[vbox] Enable Internet for slave nodes
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Fuel for OpenStack |
Fix Committed
|
Critical
|
Miroslav Anashkin | ||
6.0.x |
Won't Fix
|
Undecided
|
Serhii Ovsianikov |
Bug Description
As now we have Ubuntu being installed from external repos, we need to improve UX for VirtualBox installations. If you try to use current version of scripts, your installation will fail, if you use default repos with Ubuntu packages. The reason for the failure is that slave nodes will lose network connectivity during deployment.
High level networking process is the following:
- Node loaded with bootstrap. DNS, default gateway point to Fuel Master node, and since Fuel Master has masquerading enabled, bootstrap has full access to Internet via Fuel Master
- Once slave is rebooted for OS provisioning, we still have access through Fuel master.
- When deployment is started, l23network puppet module configures all the interfaces, including routing table. As OpenStack requires default route to public network, it's being configured as so via corresponding interface.
- Once it's done using virtualbox scripts, default gateway for the slave node becomes 172.16.0.1. You can access this IP, but your traffic won't go over it.
In order to fix this, and allow traffic to go, you would need to do the following:
--- in Linux ---
sudo iptables -t nat -A POSTROUTING -s 172.16.1.0/24 \! -d 172.16.1.0/24 -j MASQUERADE
sudo echo 1 > /proc/sys/
--- in MacOS ---
Assuming that en0 is the external interface:
sudo /usr/sbin/natd -interface en0
sudo /sbin/ipfw -f flush
sudo /sbin/ipfw add divert natd all from any to any via en0
sudo /sbin/ipfw add pass all from any to any
sudo sysctl -w net.inet.
In order to achieve better UX these steps have to be automated in VirtualBox scripts. Instructions for MacOS has to be modified in such a way that:
a) external interface identified automatically
b) configuration does not harm already existing configuration (i.e. we should avoid ipfw -f flush).
c) We have to let the user know, what we are doing with sudo, and why it is required.
Changed in fuel: | |
status: | New → Confirmed |
tags: | added: feature-separate-repos |
Changed in fuel: | |
assignee: | Fabrizio Soppelsa (fsoppelsa) → Serhiy Ovsianikov (sovsianikov) |
tags: |
added: feature-remote-repos removed: feature-separate-repos |
Changed in fuel: | |
assignee: | Serhiy Ovsianikov (sovsianikov) → Miroslav Anashkin (manashkin) |
Unfortunately, both natd and ipfw are deprecated in the latest Mac OS X (Yosemite)
ipfw: https:/ /developer. apple.com/ library/ mac/documentati on/Darwin/ Reference/ ManPages/ man8/ipfw. 8.html /support. apple.com/ en-us/HT202553
natd: https:/
So for Mac OS X, we are going to have instructions using Internet Connection Sharing - probably.