Bug 1276118 - CFME should not use OpenStack adminURL endpoints for any services
Summary: CFME should not use OpenStack adminURL endpoints for any services
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat CloudForms Management Engine
Classification: Red Hat
Component: Providers
Version: 5.4.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: GA
: 5.5.0
Assignee: Greg Blomquist
QA Contact: Milan Falešník
URL:
Whiteboard:
: 1257629 (view as bug list)
Depends On:
Blocks: 1276353
TreeView+ depends on / blocked
 
Reported: 2015-10-28 18:53 UTC by Greg Blomquist
Modified: 2016-08-18 16:45 UTC (History)
10 users (show)

Fixed In Version: 5.5.0.11
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1276353 (view as bug list)
Environment:
Last Closed: 2015-12-08 13:41:37 UTC
Category: ---
Cloudforms Team: ---
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2551 0 normal SHIPPED_LIVE Moderate: CFME 5.5.0 bug fixes and enhancement update 2015-12-08 17:58:09 UTC

Description Greg Blomquist 2015-10-28 18:53:21 UTC
Description of problem:

If OpenStack is configured to have it's adminURL endpoints for services on a private network (or otherwise inaccessible to CFME), then CFME will fail to collect inventory.

I've been told by OSP developers that as of OSP7, external access to the adminURL endpoints is off limits and is explicitly blocked.

Steps to Reproduce:
1. Setup OSP7 with adminURL service endpoints on a private network
2. Connect CFME to the OSP7 environment
3. Attempt to gather inventory from OSP7

Actual results:

CFME fails to gather inventory.  The error in the log will reflect the type of networking problem encountered.  Usually, "No route to host".

Expected results:

CFME successfully collects inventory from OSP7.

Comment 1 Greg Blomquist 2015-10-28 19:10:12 UTC
https://github.com/ManageIQ/manageiq/pull/5169

Comment 2 CFME Bot 2015-10-28 19:55:52 UTC
New commit detected on ManageIQ/manageiq/master:
https://github.com/ManageIQ/manageiq/commit/72d6d7794f0ac06ad85058f99414cd9a27414c88

commit 72d6d7794f0ac06ad85058f99414cd9a27414c88
Author:     Greg Blomquist <gblomqui>
AuthorDate: Wed Oct 28 14:55:40 2015 -0400
Commit:     Greg Blomquist <gblomqui>
CommitDate: Wed Oct 28 14:55:40 2015 -0400

    Stop using adminURL OSP service endpoints
    
    Fog defaults to using adminURL OSP service endpoints for some services.  A blind
    grep of Fog code shows the following:
    
    > identity_v2.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > identity_v3.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v1.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v2.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > metering.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > planning.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > volume.rb:      @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    
    By explicitly setting the openstack_endpoint_type to 'publicURL', manageIQ will
    always use the publicURL for all connections to any OpenStack Service Endpoint.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1276118

 gems/pending/openstack/openstack_handle/handle.rb | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

Comment 3 Oleg Barenboim 2015-10-29 14:11:56 UTC
Please create MR on downstream 5.5

Comment 4 CFME Bot 2015-11-12 20:20:02 UTC
New commit detected on cfme/5.4.z:
https://code.engineering.redhat.com/gerrit/gitweb?p=cfme.git;a=commitdiff;h=24908430af1ca6ee6d12266b3fe27ddd42882eca

commit 24908430af1ca6ee6d12266b3fe27ddd42882eca
Author:     Greg Blomquist <gblomqui>
AuthorDate: Wed Oct 28 14:55:40 2015 -0400
Commit:     Greg Blomquist <gblomqui>
CommitDate: Tue Nov 10 16:41:16 2015 -0500

    Stop using adminURL OSP service endpoints
    
    Fog defaults to using adminURL OSP service endpoints for some services.  A blind
    grep of Fog code shows the following:
    
    > identity_v2.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > identity_v3.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v1.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v2.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > metering.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > planning.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > volume.rb:      @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    
    By explicitly setting the openstack_endpoint_type to 'publicURL', manageIQ will
    always use the publicURL for all connections to any OpenStack Service Endpoint.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1276118
    https://bugzilla.redhat.com/show_bug.cgi?id=1276353

 lib/openstack/openstack_handle/handle.rb | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

Comment 5 CFME Bot 2015-11-12 20:20:52 UTC
New commit detected on cfme/5.4.z:
https://code.engineering.redhat.com/gerrit/gitweb?p=cfme.git;a=commitdiff;h=f1cf151a52faf1301d3f11fd117ae362d9eadfbe

commit f1cf151a52faf1301d3f11fd117ae362d9eadfbe
Merge: acee802 2490843
Author:     Jason Frey <jfrey>
AuthorDate: Wed Nov 11 16:18:07 2015 -0500
Commit:     Jason Frey <jfrey>
CommitDate: Wed Nov 11 16:18:07 2015 -0500

    Merge branch 'bz1276353-os-use-public-endpoints' into '5.4.z'
    
    Stop using adminURL OSP service endpoints
    
    Fog defaults to using adminURL OSP service endpoints for some services.  A blind
    grep of Fog code shows the following:
    
    > identity_v2.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > identity_v3.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v1.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v2.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > metering.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > planning.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > volume.rb:      @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    
    By explicitly setting the openstack_endpoint_type to 'publicURL', manageIQ will
    always use the publicURL for all connections to any OpenStack Service Endpoint.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1276118
    https://bugzilla.redhat.com/show_bug.cgi?id=1276353
    
    Upstream: https://github.com/ManageIQ/manageiq/pull/5169
    
    See merge request !397

 lib/openstack/openstack_handle/handle.rb | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

Comment 6 CFME Bot 2015-11-12 20:30:45 UTC
New commit detected on cfme/5.5.z:
https://code.engineering.redhat.com/gerrit/gitweb?p=cfme.git;a=commitdiff;h=15c079ef6f251fcd9c051e8bf97d1050ac62813c

commit 15c079ef6f251fcd9c051e8bf97d1050ac62813c
Author:     Greg Blomquist <gblomqui>
AuthorDate: Wed Oct 28 14:55:40 2015 -0400
Commit:     Greg Blomquist <gblomqui>
CommitDate: Mon Nov 9 16:38:23 2015 -0500

    Stop using adminURL OSP service endpoints
    
    Fog defaults to using adminURL OSP service endpoints for some services.  A blind
    grep of Fog code shows the following:
    
    > identity_v2.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > identity_v3.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v1.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v2.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > metering.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > planning.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > volume.rb:      @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    
    By explicitly setting the openstack_endpoint_type to 'publicURL', manageIQ will
    always use the publicURL for all connections to any OpenStack Service Endpoint.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1276118

 gems/pending/openstack/openstack_handle/handle.rb | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

Comment 7 CFME Bot 2015-11-12 20:33:04 UTC
New commit detected on cfme/5.5.z:
https://code.engineering.redhat.com/gerrit/gitweb?p=cfme.git;a=commitdiff;h=47d06d59bfe8e5d65c03775f16268af488546823

commit 47d06d59bfe8e5d65c03775f16268af488546823
Merge: 70e08e4 15c079e
Author:     Jason Frey <jfrey>
AuthorDate: Wed Nov 11 16:17:09 2015 -0500
Commit:     Jason Frey <jfrey>
CommitDate: Wed Nov 11 16:17:09 2015 -0500

    Merge branch 'bz1276118-os-use-public-endpoints' into '5.5.z'
    
    Stop using adminURL OSP service endpoints
    
    Fog defaults to using adminURL OSP service endpoints for some services.  A blind
    grep of Fog code shows the following:
    
    > identity_v2.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > identity_v3.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v1.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v2.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > metering.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > planning.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > volume.rb:      @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    
    By explicitly setting the openstack_endpoint_type to 'publicURL', manageIQ will
    always use the publicURL for all connections to any OpenStack Service Endpoint.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1276118
    
    Upstream: https://github.com/ManageIQ/manageiq/pull/5169
    
    See merge request !390

 gems/pending/openstack/openstack_handle/handle.rb | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

Comment 8 Milan Falešník 2015-11-19 12:24:42 UTC
Verified in 5.5.0.11

Comment 10 errata-xmlrpc 2015-12-08 13:41:37 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2015:2551

Comment 11 Greg Blomquist 2016-02-05 17:59:28 UTC
*** Bug 1257629 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.