yahoo-eng-team team mailing list archive

Thread
Date
[Bug 1405146] Re: cannot create instance if security groups are disabled

To: yahoo-eng-team@xxxxxxxxxxxxxxxxxxx
From: Numan Siddique <numan.siddique@xxxxxxxxxxxx>
Date: Thu, 29 Jan 2015 11:31:42 -0000
Reply-to: Bug 1405146 <1405146@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx
** Changed in: nova
       Status: New => Invalid

** Changed in: nova
     Assignee: Numan Siddique (numansiddique) => (unassigned)

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1405146

Title:
  cannot create instance if security groups are disabled

Status in OpenStack Compute (Nova):
  Invalid

Bug description:
  2014.2.1 deployed by packstack on CentOS 7.

  I completely disabled security groups in both neutron (ml2 plugin) and
  nova:

  * /etc/neutron/plugin.ini
  enable_security_group = False

  * /etc/neutron/plugins/linuxbridge/linuxbridge_conf.ini
  firewall_driver=neutron.agent.firewall.NoopFirewallDriver

  * /etc/nova/nova.conf
  security_group_api=neutron
  firewall_driver=nova.virt.firewall.NoopFirewallDriver

  [root@juno1 ~(keystone_admin)]# nova boot --flavor m1.small --image
  fedora-21 --nic net-id="5d37cd0b-7ad4-439e-a0f9-a4a430ff696b" fedora-
  test

  From the nova-compute log instance creation fails with:

  2014-12-23 14:21:26.747 13009 ERROR nova.compute.manager [-] [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9] Instance failed to spawn
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9] Traceback (most recent call last):
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/nova/compute/manager.py", line 2243, in _build_resources
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     yield resources
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/nova/compute/manager.py", line 2113, in _build_and_run_ins
  tance
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     block_device_info=block_device_info)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/nova/virt/libvirt/driver.py", line 2615, in spawn
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     admin_pass=admin_password)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/nova/virt/libvirt/driver.py", line 3096, in _create_image
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     instance, network_info, admin_pass, files, suffix)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/nova/virt/libvirt/driver.py", line 2893, in _inject_data
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     network_info, libvirt_virt_type=CONF.libvirt.virt_type)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/nova/virt/netutils.py", line 87, in get_injected_network_t
  emplate
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     if not (network_info and template):
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/nova/network/model.py", line 463, in __len__
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     return self._sync_wrapper(fn, *args, **kwargs)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/nova/network/model.py", line 450, in _sync_wrapper
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     self.wait()
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/nova/network/model.py", line 482, in wait
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     self[:] = self._gt.wait()
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/eventlet/greenthread.py", line 173, in wait
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     return self._exit_event.wait()
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/eventlet/event.py", line 125, in wait
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     current.throw(*self._exc)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/eventlet/greenthread.py", line 212, in main
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     result = function(*args, **kwargs)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/nova/compute/manager.py", line 1643, in _allocate_network_
  async
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     dhcp_options=dhcp_options)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/nova/network/neutronv2/api.py", line 346, in allocate_for_
  instance
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     **search_opts).get('security_groups')
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 98, in with_params
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     ret = self.function(instance, *args, **kwargs)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 480, in list_security_
  groups
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     retrieve_all, **_params)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 1334, in list
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     for r in self._pagination(collection, path, **params):
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 1347, in _pagination
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     res = self.get(path, params=params)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 1320, in get
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     headers=headers, params=params)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 1297, in retry_request
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     headers=headers, params=params)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 1251, in do_request
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     self._handle_fault_response(status_code, replybody)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 1216, in _handle_fault_response
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     exception_handler_v20(status_code, des_error_body)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 79, in exception_handler_v20
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9]     message=message)
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9] NeutronClientException: 404 Not Found
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9] 
  2014-12-23 14:21:26.747 13009 TRACE nova.compute.manager [instance: 11d26eca-049c-415c-b74b-70a6e0ffb6c9] The resource could not be found.

  In nova-conductor log:

  2014-12-23 14:20:43.443 4099 ERROR nova.scheduler.utils [req-9448159c-
  0f04-4bb9-b31f-c1f0e856e84c None] [instance: 11d26eca-049c-415c-b74b-
  70a6e0ffb6c9] Error from last host: juno5 (node juno5): [u'Traceback
  (most recent call last):\n', u'  File "/usr/lib/python2.7/site-
  packages/nova/compute/manager.py", line 2030, in
  _do_build_and_run_instance\n    filter_properties)\n', u'  File
  "/usr/lib/python2.7/site-packages/nova/compute/manager.py", line 2161,
  in _build_and_run_instance\n    instance_uuid=instance.uuid,
  reason=six.text_type(e))\n', u'RescheduledException: Build of instance
  11d26eca-049c-415c-b74b-70a6e0ffb6c9 was re-scheduled: 404 Not
  Found\n\nThe resource could not be found.\n\n   \n']

  However, the instance status is stuck on BUILD:

  [root@juno1 ~(keystone_admin)]# nova show 11d26eca-049c-415c-b74b-70a6e0ffb6c9
  +--------------------------------------+----------------------------------------------------------+
  | Property                             | Value                                                    |
  +--------------------------------------+----------------------------------------------------------+
  | OS-DCF:diskConfig                    | MANUAL                                                   |
  | OS-EXT-AZ:availability_zone          | nova                                                     |
  | OS-EXT-SRV-ATTR:host                 | juno5                                                    |
  | OS-EXT-SRV-ATTR:hypervisor_hostname  | juno5                                                    |
  | OS-EXT-SRV-ATTR:instance_name        | instance-00000005                                        |
  | OS-EXT-STS:power_state               | 0                                                        |
  | OS-EXT-STS:task_state                | -                                                        |
  | OS-EXT-STS:vm_state                  | building                                                 |
  | OS-SRV-USG:launched_at               | -                                                        |
  | OS-SRV-USG:terminated_at             | -                                                        |
  | accessIPv4                           |                                                          |
  | accessIPv6                           |                                                          |
  | config_drive                         |                                                          |
  | created                              | 2014-12-23T11:20:37Z                                     |
  | flavor                               | m1.small (2)                                             |
  | hostId                               | f307dffec204bf174af86c470edc4ffc6ddf47f2945d103b9694cdbf |
  | id                                   | 11d26eca-049c-415c-b74b-70a6e0ffb6c9                     |
  | image                                | fedora-21 (ddeebb26-ee9d-4f98-adf3-241c5e7e8be2)         |
  | key_name                             | -                                                        |
  | metadata                             | {}                                                       |
  | name                                 | fedora-test                                              |
  | os-extended-volumes:volumes_attached | []                                                       |
  | progress                             | 0                                                        |
  | status                               | BUILD                                                    |
  | tenant_id                            | 05732ceabcaf440593b7f7e8c695f829                         |
  | updated                              | 2014-12-23T11:20:43Z                                     |
  | user_id                              | c8ffb935e7f3495593ee73a1f1d3f17f                         |
  +--------------------------------------+----------------------------------------------------------+

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1405146/+subscriptions
References

[Bug 1405146] [NEW] cannot create instance if security groups are disabled
From: Pavel Gluschak, 2014-12-23