While testing Magnum I found that some environment variables and scripts were using the internal VIP inside instances. Instances don't have access to the container management network. If the clusters need access to keystone/nova/heat then they should be using the public VIP. Kubernetes clusters eventually time out and fail, my Docker Swarm cluster completed, but it still was not functioning.
In this lab 172.29.236.51 is my internal VIP.
Docker Swarm:
[fedora@sw-alnkw6gin-0-5h4igwxmbq4a-swarm-master-wzu55p6bxied ~]$ grep -A17 Traceback /var/log/cloud-init-output.log
Traceback (most recent call last):
File "/var/lib/cloud/instance/scripts/part-004", line 184, in <module>
main()
File "/var/lib/cloud/instance/scripts/part-004", line 176, in main
config = get_user_token(config)
File "/var/lib/cloud/instance/scripts/part-004", line 167, in get_user_token
r = requests.post(url, headers=headers, data=creds)
File "/usr/lib/python2.7/site-packages/requests/api.py", line 107, in post
return request('post', url, data=data, json=json, **kwargs)
File "/usr/lib/python2.7/site-packages/requests/api.py", line 53, in request
return session.request(method=method, url=url, **kwargs)
File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 468, in request
resp = self.send(prep, **send_kwargs)
File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 576, in send
r = adapter.send(request, **kwargs)
File "/usr/lib/python2.7/site-packages/requests/adapters.py", line 437, in send
raise ConnectionError(e, request=request)
requests.exceptions.ConnectionError: HTTPConnectionPool(host='172.29.236.51', port=5000): Max retries exceeded with url: /v3/auth/tokens (Caused by NewConnectionError('<requests.packages.urllib3.connection.HTTPConnection object at 0x7f958ae3de50>: Failed to establish a new connection: [Errno 110] Connection timed out',))
[fedora@sw-alnkw6gin-0-5h4igwxmbq4a-swarm-master-wzu55p6bxied ~]$ grep 172 /etc/sysconfig/heat-params
MAGNUM_URL="http://172.29.236.51:9511"
AUTH_URL="http://172.29.236.51:5000/v3"
Kubernetes:
[fedora@k8-62u4khqemw-0-6nr5p4gjgcbu-kube-master-ymzu6nhpm6zj ~]$ grep 172 /etc/sysconfig/heat-params
MAGNUM_URL="http://172.29.236.51:9511"
AUTH_URL="http://172.29.236.51:5000/v3"
[fedora@k8-62u4khqemw-0-6nr5p4gjgcbu-kube-master-ymzu6nhpm6zj ~]$ grep 172 /etc/sysconfig/kube_openstack_config
auth-url=http://172.29.236.51:5000/v2.0
I see this in the template:
[barbican_client]
endpoint_type = internalURL
[cinder_client]
region_name = {{ cinder_
endpoint_type = internalURL
[glance_client]
endpoint_type = internalURL
[heat_client]
endpoint_type = internalURL
[keystone_
auth_uri = {{ keystone_
auth_version = v3
insecure = {{ keystone_
memcached_servers = {{ memcached_servers }}
identity_uri = {{ keystone_
auth_type = {{ magnum_
auth_url = {{ keystone_
[magnum_client]
endpoint_type = internalURL
[neutron_client]
endpoint_type = internalURL
[nova_client]
endpoint_type = internalURL
Is this the problem we're talking about?
This could probably be overriden by having something defined in magnum_
But I'd be happy to see if this should be done for everyone by default.