Hide Forgot
Description of problem: Redis replication is broken due to missing firewall rule on controller nodes. /var/log/redis/redis.log: 10987:S 04 Nov 09:20:17.778 * Connecting to MASTER overcloud-controller-0:6379 10987:S 04 Nov 09:20:17.778 * MASTER <-> SLAVE sync started 10987:S 04 Nov 09:20:17.778 # Error condition on socket for SYNC: No route to host Workaround: iptables -I INPUT -p tcp -m multiport --dports 6379 -m comment --comment "redis" -m state --state NEW -j ACCEPT on controller nodes Replication succeeds after running this. Version-Release number of selected component (if applicable): openstack-tripleo-heat-templates-5.0.0-1.2.el7ost.noarch How reproducible: 100%
hmm we already have the firewall rule in the service templates: https://github.com/openstack/tripleo-heat-templates/blob/master/puppet/services/database/redis.yaml#L38-L42 are you sure you have the right code?
I think this might have been fixed by upstream http://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=3fa2ab420c2ba354fd709857e1ceaacf36a0f1b5 Perhaps we simply need to backport this fix to newton?
backport proposed already -> https://review.openstack.org/#/c/393318/ moving to on_dev
Verified $ sudo iptables -L -n | grep 6379 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 6379,26379 /* 108 redis */ state NEW
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHEA-2016-2948.html