memcached and nova-cc relation sets up incorrect ufw rules in multi-network env

Bug #1684217 reported by Nobuto Murata
18
This bug affects 2 people
Affects Status Importance Assigned to Milestone
OpenStack Nova Cloud Controller Charm
Triaged
Low
Unassigned
memcached-charm
Won't Fix
Low
Unassigned

Bug Description

Not sure where is the upstream branch of memcached charm, but the revision in charm store relies on relation_get('private-address') to get an IP address of nova-cloud-controller unit.

That ends up with unexpected ufw rules in multi-network environment. For example, if memcached only has 192.168.0.0/24 network and nova-cc has 192.168.0.0/24 and 10.0.0.0/24 networks. An IP adddress from 10.0.0.0/24 will be chosen as unit private address and will be written, but nova-cc will access to memcached from 192.168.0.0/24. So no allowed rules in ufw will match.

It would be nice if memcached relation supported network bindings to detect the correct IP addresses for ufw rules reliably.

# ufw status verbose
Status: active
Logging: on (low)
Default: allow (incoming), allow (outgoing), deny (routed)
New profiles: skip

To Action From
-- ------ ----
11211/tcp ALLOW IN 10.0.0.XY
22 ALLOW IN Anywhere
11211/tcp DENY IN Anywhere
22 (v6) ALLOW IN Anywhere (v6)
11211/tcp (v6) DENY IN Anywhere (v6)

[hooks/memcached_hooks.py]
@hooks.hook('cache-relation-joined')
def cache_relation_joined():

    settings = {'host': unit_get('private-address'),
                'port': config('tcp-port'),
                'udp-port': config('udp-port')}

    for rid in relation_ids('cache'):
        relation_set(rid, **settings)

    addr = relation_get('private-address')
    if addr:
        log('Granting memcached access to {}'.format(addr), level='INFO')
        memcached_utils.grant_access(addr)

Revision history for this message
Alex Kavanagh (ajkavanagh) wrote :

Having compared diffs of the downloadable zip from the charm store and lp:charms/trusty/memcached, I can confirm that they are identical. This probably means that lp:charms/memcached should be brought up to date to the trusy/memcached branch too.

Revision history for this message
Ante Karamatić (ivoks) wrote :

I would assume juju 2.2 solves this by having private-address comming from default ("") space.

Revision history for this message
Dmitrii Shcherbakov (dmitriis) wrote :

Ante, see https://bugs.launchpad.net/juju/+bug/1708492

This looks like the same issue.

Revision history for this message
Dmitrii Shcherbakov (dmitriis) wrote :

With juju 2.2.3 https://bugs.launchpad.net/juju/+bug/1708492 was fixed (https://github.com/juju/juju/pull/7707).

juju version
2.2.3-xenial-amd64

juju run --application nova-cloud-controller 'for i in 0 1 2 ; do relation-get -r memcache:106 private-address memcached/$i ; done'
- Stdout: |
    10.232.6.193
    10.232.6.214
    10.232.6.225
  UnitId: nova-cloud-controller/0
- Stdout: |
    10.232.6.193
    10.232.6.214
    10.232.6.225
  UnitId: nova-cloud-controller/1
- Stdout: |
    10.232.6.193
    10.232.6.214
    10.232.6.225
  UnitId: nova-cloud-controller/2

I suggest we "won't fix" this as using a default space binding results in correct private-address values being used.

Revision history for this message
James Page (james-page) wrote :

This feels like a gap in the network space support in the charms for this specific relation; triaging both bug tasks as 'Medium' and making note that using the default space binding support in 2.2.3 allows workaround of this missing feature.

Changed in charm-nova-cloud-controller:
status: New → Invalid
status: Invalid → Triaged
importance: Undecided → Medium
Changed in memcached (Juju Charms Collection):
importance: Undecided → Medium
status: New → Triaged
James Page (james-page)
Changed in charm-nova-cloud-controller:
importance: Medium → Low
Changed in memcached (Juju Charms Collection):
importance: Medium → Low
Tom Haddon (mthaddon)
no longer affects: memcached (Juju Charms Collection)
Changed in charm-memcached:
importance: Undecided → Low
status: New → Won't Fix
status: Won't Fix → Fix Released
Changed in charm-memcached:
status: Fix Released → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.