yahoo-eng-team team mailing list archive

[OpenStack Infra <1845243@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://review.opendev.org/685194
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=54125a75fb056dbea115408610f90e7d6eee5139
Submitter: Zuul
Branch:    master

commit 54125a75fb056dbea115408610f90e7d6eee5139
Author: melanie witt <melwittt@xxxxxxxxx>
Date:   Fri Sep 27 02:10:22 2019 +0000

    Reduce scope of 'path' query parameter to noVNC consoles
    
    This is a partial revert of commit
    9606c80402f6db20d62b689c58aa8f024183628a which added the 'path' query
    parameter to work with noVNC v1.1.0. This broke all other console types
    using websockify server (serial, spice) because the websockify server
    itself doesn't know how to handle the 'path' query parameter. It is the
    noVNC vnc_lite.html file which parses the 'path' variable and uses it
    as the url to the websockify server. So, all other console types should
    *not* be generating a console access url with a 'path' query parameter,
    only noVNC.
    
    Closes-Bug: #1845243
    
    TODO(melwitt): Figure out how to test serial and/or spice console in
    the gate
    
    Change-Id: I9521f21a685edc44121d75bdf534c201fa87c2d7


** Changed in: nova
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1845243

Title:
  Nested 'path' query param in console URL breaks serialproxy

Status in OpenStack Compute (nova):
  Fix Released
Status in OpenStack Compute (nova) rocky series:
  In Progress
Status in OpenStack Compute (nova) stein series:
  In Progress
Status in OpenStack Compute (nova) train series:
  In Progress

Bug description:
  Description
  ===========

  Change I2ddf0f4d768b698e980594dd67206464a9cea37b changed all console
  URLs to have the token attached as a nested query parameter inside an
  outer "path" query parameter, e.g. "?path=?token=***".

  While this was necessary for NoVNC support, it appears to have broken
  Ironic serial consoles, which use the nova-serialproxy service, which
  apparently is not aware that it needs to parse the token in this
  manner. It uses websockify.

  To test, I enabled debug mode and added some extra logging in the
  nova-serialproxy to prove that "token" was empty in this function:
  https://github.com/openstack/nova/blob/stable/rocky/nova/objects/console_auth_token.py#L143

  Steps to reproduce
  ==================

  1. Have Ironic set up to allow web/serial consoles (https://docs.openstack.org/ironic/pike/admin/console.html). I believe this also requires having nova-serialproxy deployed.
  2. Launch an Ironic instance and attempt to access the console via Horizon.

  
  Expected result
  ===============

  The serial console loads in the web interface; "Status: Opened" is
  displayed in the bottom. Console is interactive assuming the node has
  booted properly.

  
  Actual result
  =============

  The serial console loads, but is blank; "Status: Closed" is displayed
  in the bottom. nova-serialproxy logs indicate the token was expired or
  invalid. The console never becomes interactive, but does not indicate
  there is an error in Horizon (at least on my deployment.)

  Environment
  ===========

  OpenStack Rocky release, deployed with Kolla-Ansible.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1845243/+subscriptions