[nova-serialproxy] console.allowed_origins is not set

Bug #2030094 reported by Felipe Reyes
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Charm Guide
Fix Released
Undecided
Felipe Reyes
OpenStack Dashboard Charm
Fix Committed
Undecided
Felipe Reyes
2023.1
New
Undecided
Unassigned
Ussuri
New
Undecided
Unassigned
Victoria
New
Undecided
Unassigned
Wallaby
New
Undecided
Unassigned
Xena
New
Undecided
Unassigned
Yoga
New
Undecided
Unassigned
Zed
New
Undecided
Unassigned
OpenStack Nova Cloud Controller Charm
Fix Committed
High
Felipe Reyes
2023.1
Fix Committed
Undecided
Unassigned
Ussuri
Fix Committed
Undecided
Unassigned
Victoria
Fix Committed
Undecided
Unassigned
Wallaby
Fix Committed
Undecided
Unassigned
Xena
Fix Committed
Undecided
Unassigned
Yoga
Fix Committed
Undecided
Unassigned
Zed
Fix Committed
Undecided
Unassigned
OpenStack Snap
New
Undecided
Unassigned

Bug Description

[Impact]

nova.conf should include a section like this:

```
[console]
allowed_origins = <list of openstack-dashboard units>
```

This is part of a security mechanism that the nova-serialproxy daemon has to prevent cross site requests.

https://docs.openstack.org/nova/latest/configuration/config.html#console.allowed_origins

the list should contain all the possible hosts used to access Horizon, this includes at least all the virtual ip addresses and the values set in `os-*-hostname`

Revision history for this message
Felipe Reyes (freyes) wrote :

This was a finding made while analyzing a log - https://bugs.launchpad.net/charm-ironic-api/+bug/2002154/comments/29

Changed in charm-nova-cloud-controller:
status: New → Triaged
importance: Undecided → High
Felipe Reyes (freyes)
description: updated
Felipe Reyes (freyes)
Changed in charm-nova-cloud-controller:
assignee: nobody → Felipe Reyes (freyes)
status: Triaged → In Progress
Revision history for this message
Felipe Reyes (freyes) wrote :

There is a design limitation here that's making difficult to fix this issue in a straightforward manner.

The nova-cloud-controller has not juju relation with openstack-dashboard, so we can't share the dataset from openstack-dashboard units to nova-cloud-controller via relation-set.

We may need to add a new interface to both of these charms so they can exchange information directly.

Revision history for this message
Felipe Reyes (freyes) wrote :

After discussing this issue with @james-page , the agreed approach to solve this adding a new relation between openstack-dashboard and nova-cloud-controller to exchange the information needed. This will be an optional relation unless the config option enable-serial-console[0] is set to true in nova-c-c, hence units go into blocked state.

[0] https://charmhub.io/nova-cloud-controller/configure#enable-serial-console

Felipe Reyes (freyes)
Changed in charm-openstack-dashboard:
status: New → Triaged
assignee: nobody → Felipe Reyes (freyes)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-cloud-controller (master)
Changed in charm-openstack-dashboard:
status: Triaged → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-openstack-dashboard (master)
Felipe Reyes (freyes)
Changed in charm-guide:
assignee: nobody → Felipe Reyes (freyes)
status: New → Triaged
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-openstack-dashboard (master)

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/893570
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/484b7d82601bf4f493df7f564b5b74575819436d
Submitter: "Zuul (22348)"
Branch: master

commit 484b7d82601bf4f493df7f564b5b74575819436d
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:41:00 2023 -0400

    Add new interface 'dashboard'

    openstack-dashboard exposes the hostnames (and IP addresses) that can be
    used by users to load Horizon. There are 3 possible sources, they are
    juju units ingress-address, os-public-hostname and vip config options

    Closes-Bug: #2030094
    Change-Id: I5eb524c6258f72980ef43175f2bed21d7ca078be

Changed in charm-openstack-dashboard:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-cloud-controller (master)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/893569
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/816ee80cd0e83dd3b5d9e49187caf9e6d420cf1b
Submitter: "Zuul (22348)"
Branch: master

commit 816ee80cd0e83dd3b5d9e49187caf9e6d420cf1b
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:39:23 2023 -0400

    Add new interface 'dashboard'

    This new interface consumes information exposed by openstack-dashboard
    to correctly configure nova-serialproxy and allow requests coming from
    the web browser that tries to load the serial console.

    Change-Id: I2d82abffb9649f16a792f180806cea36cc5e25df
    Closes-Bug: #2030094

Changed in charm-nova-cloud-controller:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-cloud-controller (stable/2023.1)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-cloud-controller (stable/zed)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-cloud-controller (stable/yoga)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-cloud-controller (stable/xena)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-cloud-controller (stable/wallaby)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-cloud-controller (stable/victoria)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-cloud-controller (stable/ussuri)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-openstack-dashboard (stable/2023.1)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-openstack-dashboard (stable/zed)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-openstack-dashboard (stable/yoga)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-openstack-dashboard (stable/xena)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-openstack-dashboard (stable/wallaby)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-openstack-dashboard (stable/victoria)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-openstack-dashboard (stable/ussuri)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-openstack-dashboard (stable/wallaby)

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/896674
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/a6584a06d9d0f1ae34e2168adcd14f7f1f3d8fd8
Submitter: "Zuul (22348)"
Branch: stable/wallaby

commit a6584a06d9d0f1ae34e2168adcd14f7f1f3d8fd8
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:41:00 2023 -0400

    Add new interface 'dashboard'

    openstack-dashboard exposes the hostnames (and IP addresses) that can be
    used by users to load Horizon. There are 3 possible sources, they are
    juju units ingress-address, os-public-hostname and vip config options

    Closes-Bug: #2030094
    Change-Id: I5eb524c6258f72980ef43175f2bed21d7ca078be
    (cherry picked from commit 484b7d82601bf4f493df7f564b5b74575819436d)
    (cherry picked from commit 83ffa9eb3a2418897bf2707d14efce725d775090)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-cloud-controller (stable/ussuri)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/896669
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/b9f444372671bb86b5c1482c83e7ba8d5df13e59
Submitter: "Zuul (22348)"
Branch: stable/ussuri

commit b9f444372671bb86b5c1482c83e7ba8d5df13e59
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:39:23 2023 -0400

    Add new interface 'dashboard'

    This new interface consumes information exposed by openstack-dashboard
    to correctly configure nova-serialproxy and allow requests coming from
    the web browser that tries to load the serial console.

    Change-Id: I2d82abffb9649f16a792f180806cea36cc5e25df
    Closes-Bug: #2030094
    (cherry picked from commit 816ee80cd0e83dd3b5d9e49187caf9e6d420cf1b)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-cloud-controller (stable/victoria)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/896668
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/95e783b19809c520ad2522facbbb1e1328a4fc67
Submitter: "Zuul (22348)"
Branch: stable/victoria

commit 95e783b19809c520ad2522facbbb1e1328a4fc67
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:39:23 2023 -0400

    Add new interface 'dashboard'

    This new interface consumes information exposed by openstack-dashboard
    to correctly configure nova-serialproxy and allow requests coming from
    the web browser that tries to load the serial console.

    Change-Id: I2d82abffb9649f16a792f180806cea36cc5e25df
    Closes-Bug: #2030094
    (cherry picked from commit 816ee80cd0e83dd3b5d9e49187caf9e6d420cf1b)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-cloud-controller (stable/wallaby)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/896667
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/69070bcc72912c5840e1ed5633bf4c058710785b
Submitter: "Zuul (22348)"
Branch: stable/wallaby

commit 69070bcc72912c5840e1ed5633bf4c058710785b
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:39:23 2023 -0400

    Add new interface 'dashboard'

    This new interface consumes information exposed by openstack-dashboard
    to correctly configure nova-serialproxy and allow requests coming from
    the web browser that tries to load the serial console.

    Change-Id: I2d82abffb9649f16a792f180806cea36cc5e25df
    Closes-Bug: #2030094
    (cherry picked from commit 816ee80cd0e83dd3b5d9e49187caf9e6d420cf1b)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-cloud-controller (stable/xena)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/896666
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/bd6d482f6f0fa298e8e1cf0dd04e8c0f793191fe
Submitter: "Zuul (22348)"
Branch: stable/xena

commit bd6d482f6f0fa298e8e1cf0dd04e8c0f793191fe
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:39:23 2023 -0400

    Add new interface 'dashboard'

    This new interface consumes information exposed by openstack-dashboard
    to correctly configure nova-serialproxy and allow requests coming from
    the web browser that tries to load the serial console.

    Change-Id: I2d82abffb9649f16a792f180806cea36cc5e25df
    Closes-Bug: #2030094
    (cherry picked from commit 816ee80cd0e83dd3b5d9e49187caf9e6d420cf1b)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-cloud-controller (stable/yoga)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/896665
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/e9dbe36914caf48a11fe3b4fe7c3db9b0f183c63
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit e9dbe36914caf48a11fe3b4fe7c3db9b0f183c63
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:39:23 2023 -0400

    Add new interface 'dashboard'

    This new interface consumes information exposed by openstack-dashboard
    to correctly configure nova-serialproxy and allow requests coming from
    the web browser that tries to load the serial console.

    Change-Id: I2d82abffb9649f16a792f180806cea36cc5e25df
    Closes-Bug: #2030094
    (cherry picked from commit 816ee80cd0e83dd3b5d9e49187caf9e6d420cf1b)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-cloud-controller (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/896664
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/a80d717fdc808408d430a1152187c9eda0b165e8
Submitter: "Zuul (22348)"
Branch: stable/zed

commit a80d717fdc808408d430a1152187c9eda0b165e8
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:39:23 2023 -0400

    Add new interface 'dashboard'

    This new interface consumes information exposed by openstack-dashboard
    to correctly configure nova-serialproxy and allow requests coming from
    the web browser that tries to load the serial console.

    Change-Id: I2d82abffb9649f16a792f180806cea36cc5e25df
    Closes-Bug: #2030094
    (cherry picked from commit 816ee80cd0e83dd3b5d9e49187caf9e6d420cf1b)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-cloud-controller (stable/2023.1)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/896663
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/bf1a0efab492c62ce3b7804f1fef88f50b7b74f7
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit bf1a0efab492c62ce3b7804f1fef88f50b7b74f7
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:39:23 2023 -0400

    Add new interface 'dashboard'

    This new interface consumes information exposed by openstack-dashboard
    to correctly configure nova-serialproxy and allow requests coming from
    the web browser that tries to load the serial console.

    Change-Id: I2d82abffb9649f16a792f180806cea36cc5e25df
    Closes-Bug: #2030094
    (cherry picked from commit 816ee80cd0e83dd3b5d9e49187caf9e6d420cf1b)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-openstack-dashboard (stable/ussuri)

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/896676
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/3d2d3ea0b6372c29aedce320a649ad2ca712b4c0
Submitter: "Zuul (22348)"
Branch: stable/ussuri

commit 3d2d3ea0b6372c29aedce320a649ad2ca712b4c0
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:41:00 2023 -0400

    Add new interface 'dashboard'

    openstack-dashboard exposes the hostnames (and IP addresses) that can be
    used by users to load Horizon. There are 3 possible sources, they are
    juju units ingress-address, os-public-hostname and vip config options

    Closes-Bug: #2030094
    Change-Id: I5eb524c6258f72980ef43175f2bed21d7ca078be
    (cherry picked from commit 484b7d82601bf4f493df7f564b5b74575819436d)
    (cherry picked from commit 83ffa9eb3a2418897bf2707d14efce725d775090)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-openstack-dashboard (stable/victoria)

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/896675
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/d71c4ea6d661dd6e57b401407539c960d4ca4b2c
Submitter: "Zuul (22348)"
Branch: stable/victoria

commit d71c4ea6d661dd6e57b401407539c960d4ca4b2c
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:41:00 2023 -0400

    Add new interface 'dashboard'

    openstack-dashboard exposes the hostnames (and IP addresses) that can be
    used by users to load Horizon. There are 3 possible sources, they are
    juju units ingress-address, os-public-hostname and vip config options

    Closes-Bug: #2030094
    Change-Id: I5eb524c6258f72980ef43175f2bed21d7ca078be
    (cherry picked from commit 484b7d82601bf4f493df7f564b5b74575819436d)
    (cherry picked from commit 83ffa9eb3a2418897bf2707d14efce725d775090)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-openstack-dashboard (stable/xena)

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/896673
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/83ffa9eb3a2418897bf2707d14efce725d775090
Submitter: "Zuul (22348)"
Branch: stable/xena

commit 83ffa9eb3a2418897bf2707d14efce725d775090
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:41:00 2023 -0400

    Add new interface 'dashboard'

    openstack-dashboard exposes the hostnames (and IP addresses) that can be
    used by users to load Horizon. There are 3 possible sources, they are
    juju units ingress-address, os-public-hostname and vip config options

    Closes-Bug: #2030094
    Change-Id: I5eb524c6258f72980ef43175f2bed21d7ca078be
    (cherry picked from commit 484b7d82601bf4f493df7f564b5b74575819436d)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-openstack-dashboard (stable/yoga)

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/896672
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/8ad7aeba9e72e87ec38819136efe4e9ec820a4c5
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit 8ad7aeba9e72e87ec38819136efe4e9ec820a4c5
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:41:00 2023 -0400

    Add new interface 'dashboard'

    openstack-dashboard exposes the hostnames (and IP addresses) that can be
    used by users to load Horizon. There are 3 possible sources, they are
    juju units ingress-address, os-public-hostname and vip config options

    Closes-Bug: #2030094
    Change-Id: I5eb524c6258f72980ef43175f2bed21d7ca078be
    (cherry picked from commit 484b7d82601bf4f493df7f564b5b74575819436d)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-openstack-dashboard (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/896671
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/eab473e0d9409cf6897e486ba6f53e701ff83c9c
Submitter: "Zuul (22348)"
Branch: stable/zed

commit eab473e0d9409cf6897e486ba6f53e701ff83c9c
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:41:00 2023 -0400

    Add new interface 'dashboard'

    openstack-dashboard exposes the hostnames (and IP addresses) that can be
    used by users to load Horizon. There are 3 possible sources, they are
    juju units ingress-address, os-public-hostname and vip config options

    Closes-Bug: #2030094
    Change-Id: I5eb524c6258f72980ef43175f2bed21d7ca078be
    (cherry picked from commit 484b7d82601bf4f493df7f564b5b74575819436d)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-openstack-dashboard (stable/2023.1)

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/896670
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/f3f61cb24da2240878abcf7845665fa8eede0f65
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit f3f61cb24da2240878abcf7845665fa8eede0f65
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 1 17:41:00 2023 -0400

    Add new interface 'dashboard'

    openstack-dashboard exposes the hostnames (and IP addresses) that can be
    used by users to load Horizon. There are 3 possible sources, they are
    juju units ingress-address, os-public-hostname and vip config options

    Closes-Bug: #2030094
    Change-Id: I5eb524c6258f72980ef43175f2bed21d7ca078be
    (cherry picked from commit 484b7d82601bf4f493df7f564b5b74575819436d)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-guide (master)
Changed in charm-guide:
status: Triaged → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-guide (master)

Reviewed: https://review.opendev.org/c/openstack/charm-guide/+/896964
Committed: https://opendev.org/openstack/charm-guide/commit/118a222af47176a8cf719d82fddf4fa68899888c
Submitter: "Zuul (22348)"
Branch: master

commit 118a222af47176a8cf719d82fddf4fa68899888c
Author: Felipe Reyes <email address hidden>
Date: Fri Sep 29 18:14:10 2023 -0300

    nova-cloud-controller charm: new relation to openstack-dashboard

    Closes-Bug: #2030094
    Change-Id: I2c2a7cbf9b47063cbc4e6b9916288db2c667c138

Changed in charm-guide:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.