yahoo-eng-team team mailing list archive

[Matt Riedemann <mriedem.os@xxxxxxxxx>]

** Also affects: nova/train
   Importance: Undecided
       Status: New

** Changed in: nova/train
       Status: New => Confirmed

** Changed in: nova/train
   Importance: Undecided => High

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1845243

Title:
  Nested 'path' query param in console URL breaks serialproxy

Status in OpenStack Compute (nova):
  In Progress
Status in OpenStack Compute (nova) rocky series:
  Confirmed
Status in OpenStack Compute (nova) stein series:
  Confirmed
Status in OpenStack Compute (nova) train series:
  Confirmed

Bug description:
  Description
  ===========

  Change I2ddf0f4d768b698e980594dd67206464a9cea37b changed all console
  URLs to have the token attached as a nested query parameter inside an
  outer "path" query parameter, e.g. "?path=?token=***".

  While this was necessary for NoVNC support, it appears to have broken
  Ironic serial consoles, which use the nova-serialproxy service, which
  apparently is not aware that it needs to parse the token in this
  manner. It uses websockify.

  To test, I enabled debug mode and added some extra logging in the
  nova-serialproxy to prove that "token" was empty in this function:
  https://github.com/openstack/nova/blob/stable/rocky/nova/objects/console_auth_token.py#L143

  Steps to reproduce
  ==================

  1. Have Ironic set up to allow web/serial consoles (https://docs.openstack.org/ironic/pike/admin/console.html). I believe this also requires having nova-serialproxy deployed.
  2. Launch an Ironic instance and attempt to access the console via Horizon.

  
  Expected result
  ===============

  The serial console loads in the web interface; "Status: Opened" is
  displayed in the bottom. Console is interactive assuming the node has
  booted properly.

  
  Actual result
  =============

  The serial console loads, but is blank; "Status: Closed" is displayed
  in the bottom. nova-serialproxy logs indicate the token was expired or
  invalid. The console never becomes interactive, but does not indicate
  there is an error in Horizon (at least on my deployment.)

  Environment
  ===========

  OpenStack Rocky release, deployed with Kolla-Ansible.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1845243/+subscriptions