Bug 1571840 – Attempting to use iptables with ipv6 address/prefix

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1571840 - Attempting to use iptables with ipv6 address/prefix

Summary:	Attempting to use iptables with ipv6 address/prefix

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat OpenStack
Classification:	Red Hat
Component:	puppet-tripleo (Show other bugs)
Sub Component:
Version:	10.0 (Newton)
Hardware:	Unspecified Unspecified

Priority	high Severity high
Target Milestone:	z8
Target Release:	10.0 (Newton)
Assigned To:	Emilien Macchi
QA Contact:	Filip Hubík
Docs Contact:

URL:
Whiteboard:
Keywords:	Automation, AutomationBlocker, Triaged, ZStream

Duplicates:	1569972 (view as bug list)
Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2018-04-25 09:52 EDT by Attila Fazekas
Modified:	2018-08-03 14:36 EDT (History)
CC List:	9 users (show)

See Also:
Fixed In Version:	puppet-tripleo-5.6.8-2.el7ost
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2018-05-17 11:42:06 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
OpenStack gerrit	564250	None	None	None	2018-04-25 11:21 EDT
Red Hat Product Errata	RHSA-2018:1593	None	None	None	2018-05-17 11:42 EDT

Groups: None (edit)

Description Attila Fazekas 2018-04-25 09:52:16 EDT

Description of problem:

In the ipv6 setups tripleo tries to use iptables for ipv6 rules,
but for ipv6 rules we need to use ip6tables. (snmp/161)


Version-Release number of selected component (if applicable):
openstack-tripleo-heat-templates.noarch
                                 5.3.10-1.el7ost  
openstack-tripleo-puppet-elements.noarch
                                 5.3.3-2.el7ost 

puppet-tripleo.noarch            5.6.8-1.el7ost 


Failure:

 Error: /Stage[main]/Tripleo::Firewall/Tripleo::Firewall::Service_rules[snmp]/Tripleo::Firewall::Rule[124 snmp]/Firewall[124 snmp]/ensure: change from absent to present failed: Execution of '/usr/sbin/iptables -I INPUT 7 -t filter -s fd00:fd00:fd00:2000::/64 -p udp -m multiport --dports 161 -m comment --comment 124 snmp -m state --state NEW -j ACCEPT' returned 2: iptables v1.4.21: invalid mask `64' specified

Comment 4 Filip Hubík 2018-04-26 08:32:25 EDT

Successfully workarounded this problem using file /usr/share/openstack-puppet/modules/tripleo/manifests/firewall/rule.pp patched to f6d398a7da in overcloud-full.qcow2 as per https://review.openstack.org/#/c/564250, reuploaded to glance and redeployed OC, ipv6-enabled deployment is able to pass now without "invalid mask `64' specified" issue.

Comment 6 Alex Schultz 2018-04-27 10:53:03 EDT

*** Bug 1569972 has been marked as a duplicate of this bug. ***

Comment 10 Filip Hubík 2018-04-30 06:21:01 EDT

Verified by CI, since package puppet-tripleo-5.6.8-2.el7ost is present on controllers and compute nodes and OC deployment passes without error (puddle 2018-04-27.2).

Comment 14 errata-xmlrpc 2018-05-17 11:42:06 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:1593

Note You need to log in before you can comment on or make changes to this bug.