Description of problem: tripleo templates have hard-coded vncserver_listen value this behavior causes vnc to listen on all ports on compute servers, including the routable ip, allowing connections from anybody. We would like to set this like: vncserver_proxyclient_address to the internapi network /usr/share/openstack-tripleo-heat-templates/puppet/manifests/overcloud_compute.pp if str2bool(hiera('nova::use_ipv6', false)) { $vncserver_listen = '::0' } else { $vncserver_listen = '0.0.0.0' } class { '::nova::compute::libvirt' : vncserver_listen => $vncserver_listen, } It's not possible to override this value with yaml parameters Version-Release number of selected component (if applicable): How reproducible: Alaways Steps to Reproduce: 1. Install openstack-tripleo-heat-templates 2. Look at the code 3. Actual results: Cannot override Expected results: Would like to override Additional info:
David, this is not a bug but a feature. If you want Live Migration to work, the vncserver_listen must be 0.0.0.0. Otherwise, your VM console won't be available anymore when you migrate your VM to another compute. You can find some documentation here that confirms what I just wrote: http://docs.openstack.org/admin-guide/compute-remote-console-access.html I'm closing the bug.
Emilien, We've tested this with the customer and manually changing the VNC listening adress to the IP of the compute node does't seem to affect anything. Are we sure this is not outdated?
Indeed, it's a bug. Apologize.
As there was no puppet-nova for mitaka, moving to opm
Needs puppet-tripleo backport, puppet-nova done
No profiles in puppet-tripleo in < netwon, those changes will be made in the related tht BZ #1431673
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:1501
The bug for which this was filed, openstack-puppet-modules-8.1.13-1.el7ost, was shipped. Please clone it if an additional fix is needed for openstack-tripleo-heat-templates.