Description of problem: When we deploy overcloud by director, we see that pcsd is listening on all available networks, which means that we can access to pcsd from external network connected to controller nodes. ~~~ [heat-admin@controller-0 ~]$ sudo ps aux | grep pcsd | grep -v grep root 280462 0.0 0.1 986088 58020 ? Ssl Dec09 2:44 /usr/bin/ruby /usr/lib/pcsd/pcsd [heat-admin@controller-0 ~]$ sudo netstat -anp | grep ruby tcp 0 0 :::2224 0.0.0.0:* LISTEN 280462/ruby ~~~ However, we expect that only operators can use pcsd to manage cluster services, so it would be better to make pcsd listen on a specific internal network instead of all networks How reproducible: Always Steps to Reproduce: 1. Deploy overcloud 2. See which networks pcsd listening on Actual results: pcsd is listening on all networks Expected results: pcsd is listening on a specific network Additional info:
fixed by https://github.com/openstack/puppet-pacemaker/commit/6138c5b9f35b1bddc1ee17c08372b7bde85c264d
backpedaling as we need THT support for this to be on POST.
To fix the bug reported, we need the following 3 patches. https://review.opendev.org/#/q/topic:bug/1856626+(status:open+OR+status:merged) I'll backport all of them to stable branches once all patches land in master. puppet-pacemaker : https://review.opendev.org/#/c/697942/ puppet-tripleo : https://review.opendev.org/#/c/697943/ tripleo-heat-templates: https://review.opendev.org/#/c/699318/
neither the change in puppet-pacemaker nor the tht change was backported. the change in puppet-tripleo is included eg. in puppet-tripleo-11.4.1-0.20200118215809.6f9bf6c.el8ost.noarch
switching version to 16.0, will clone for 13.0 eventually.
Thanks Michele. I will add it the correct version of puppet-pacemaker in next compose.
*** Bug 1803362 has been marked as a duplicate of this bug. ***
Verified , (overcloud) [stack@undercloud-0 ~]$ ./rpm_compare puppet-tripleo-11.4.1-0.20200204230745.801f789.el8ost puppet-pacemaker-0.8.1-0.20200203145608.83d23b3.el8ost openstack-tripleo-heat-templates-11.3.2-0.20200204230640.7a0659c.el8ost package tested: puppet-tripleo-11.4.1-0.20200204230745.801f789.el8ost package installed : puppet-tripleo-11.4.1-0.20200205150840.71ff36d.el8ost.noarch [stack@undercloud-0 ~]$ ansible controller -b -mshell -a 'ss -atpln|grep pcsd' [WARNING]: Found both group and host with same name: undercloud controller-0 | CHANGED | rc=0 >> LISTEN 0 128 172.17.1.94:2224 0.0.0.0:* users:(("pcsd",pid=4206,fd=6)) controller-2 | CHANGED | rc=0 >> LISTEN 0 128 172.17.1.44:2224 0.0.0.0:* users:(("pcsd",pid=4181,fd=6)) controller-1 | CHANGED | rc=0 >> LISTEN 0 128 172.17.1.59:2224 0.0.0.0:* users:(("pcsd",pid=4173,fd=6))
If this bug requires doc text for errata release, please set the 'Doc Type' and provide draft text according to the template in the 'Doc Text' field. The documentation team will review, edit, and approve the text. If this bug does not require doc text, please set the 'requires_doc_text' flag to '-'.
*** Bug 1804721 has been marked as a duplicate of this bug. ***
*** Bug 1805604 has been marked as a duplicate of this bug. ***
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0655