Bug 1341261
| Summary: | vncserver_listen makes live migration fail | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Ondrej <ochalups> |
| Component: | openstack-puppet-modules | Assignee: | Sven Anderson <svanders> |
| Status: | CLOSED ERRATA | QA Contact: | awaugama |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.0 (Kilo) | CC: | awaugama, berrange, dasmith, dbecker, ealcaniz, eglynn, jguiditt, jjoyce, jschluet, kchamart, lyarwood, mburns, mlopes, morazi, pablo.iranzo, paldeala, rhel-osp-director-maint, sbauza, sferdjao, sgordon, srevivo, svanders, tvvcox, vromanso |
| Target Milestone: | async | Keywords: | Triaged, ZStream |
| Target Release: | 7.0 (Kilo) | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | openstack-puppet-modules-2015.1.8-54.el7ost | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-06-20 12:25:31 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1339488 | ||
That puppet check for vnc listen address is really total nonsense. It is perfectly valid to use an interface specific address for VNC when you have multiple NICs in the host machine. The only addresses it could potentilly make sense to reject are loopback addrs (127.0.0.1 / ::1), but even that is potentially incorrect, if someone is tunnelling access to the VNC server over say stunnel/ssh. IMHO the puppet check should just be killed This has apparently been fixed in stable/newton and stable/mitaka, and thus will be in the next rebase for RHOSP 10 and 9 respectively but will require an explicit backport to 8 as there is no stable/liberty anymore. From a timing point of view we should wait for the rebases for 10 and 9 to occur, and time the backport for 8 to be done as or after those rebases go out. This is to avoid fixing the issue in 8 first and then having it appear as a surprise regression when a customer upgrades to 9 or 10. (In reply to Stephen Gordon from comment #6) > This has apparently been fixed in stable/newton and stable/mitaka, and thus > will be in the next rebase for RHOSP 10 and 9 respectively but will require > an explicit backport to 8 as there is no stable/liberty anymore. > > From a timing point of view we should wait for the rebases for 10 and 9 to > occur, and time the backport for 8 to be done as or after those rebases go > out. This is to avoid fixing the issue in 8 first and then having it appear > as a surprise regression when a customer upgrades to 9 or 10. Sven also mentioned the possibility of backporting to 7 for limited additional effort in this case. As a pre-emptive measure I am comfortable with this, but the same time considerations as above apply (that is, we should work backwards fixing in 10->9->8->7). Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:1538 |
Description of problem: Hello, when changing the default interface for vnc console with configuring /etc/nova/nova.conf "vncserver_listen", this on the other hand makes live migration fail. ###nova.conf sets this value via #vncserver_listen=127.0.0.1: parameter_defaults: NovaComputeExtraConfig: nova::compute::libvirt::vncserver_listen: <address> #### However this will break live migration: /etc/puppet/modules/nova/manifests/compute/libvirt.pp if $migration_support { if $vncserver_listen != '0.0.0.0' and $vncserver_listen != '::0' { fail('For migration support to work, you MUST set vncserver_listen to \'0.0.0.0\' or \'::0\'') } else { include ::nova::migration::libvirt } } } Is this check really necessary? If yes, how else can the hardening be done? Version-Release number of selected component (if applicable): Red Hat Director 7.3.1. How reproducible: always Steps to Reproduce: 1. 2. 3. Actual results: live migration fails Expected results: vnc console configured and live migration succeeds Additional info: