DescriptionAugust Simonelli
2017-03-24 00:45:21 UTC
Description of problem:
When deploying OpenStack with Ceph by using OSP director all the OverCloud nodes have the same software footprint. This causes a few issues:
1. OSP Subscriptions need to be applied to all nodes, including the Ceph OSDs, to ensure packages can be updated for security reasons. Due to the setup of the current images Satellite 6 will automatically allocate OSP subs to Ceph OSDs based on the OSP pems on the image. This is a "waste" of a subscription as those OSDs are managed by Ceph subs already.
2. The OSP software isn't needed on the OSD and makes it harder to managed and less lean.
Version-Release number of selected component (if applicable):
rhosp-director-images-ipa-10.0-20161212.1.el7ost.noarch
rhosp-director-images-10.0-20161212.1.el7ost.noarch
How reproducible:
Deploy Ceph OSDs with director.
Steps to Reproduce:
1. load the supported overcloud images into glance
2. include templates for ceph OSDs
3. deploy with a ceph-storage-scale setting greater than 0
Actual results:
Deployment uses the same overcloud image for all roles so Ceph OSD's have OSP software and pems. These pems force Satellite 6 to allocate OSP subs to the hosts. They also need the subs for security reasons as the software on those hosts could be exploited if not patched, even if it is not being used.
Expected results:
Ceph OSD deployed by OSP director should only require Ceph subs and ceph packages and not contain any OSP packages.
Additional info:
BZ to report the issue: https://bugzilla.redhat.com/show_bug.cgi?id=1417754
RFE for a similar issue: https://bugzilla.redhat.com/show_bug.cgi?id=1408571 (this issue is to be able to bind roles to specific subs. This would be helpful and is needed. But does not solve my RFE's issue. Even if we can bind roles to subs, if the overcloud image has OSP software it *needs* an OSP sub. I'd like to have a clean Ceph image AND have the ability to bind unique subs.
Also see this BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1430545
It allows for assigning subs to targeted roles, but that still creates issues around how to support the software when using a single overcloud image and will, i believe, create a security risk on the ceph nodes.
Comment 10August Simonelli
2017-03-29 01:22:28 UTC
Conversely (and implied but not explicitly stated) Ceph packages should be removed from the OSP image to avoid the opposite problem (osp nodes requiring Ceph subs).