Need the ability to set a URL for the endpoint catalog

Bug #1716050 reported by Major Hayden
20
This bug affects 4 people
Affects Status Importance Assigned to Milestone
openstack-ansible
Confirmed
Wishlist
Victor Palma

Bug Description

Consider an environment set up like this:

* End users want to access APIs and Horizon via a FQDN (cloud.example.com)
* The cloud.example.com address points to a public address (example 1.2.3.4)
* OSA environment is behind a firewall with NAT using a private address VIP (192.168.0.10)
* Firewall NATs all traffic from 1.2.3.4 -> 192.168.0.10.

The end users can connect to the APIs without an issue, but the OpenStack endpoint catalog returns all of the endpoints with '192.168.0.10' in them. This causes OpenStack client requests to fail since the end users are noton the 192.168.0.10/24 network.

End users really want to be able to talk to the OpenStack APIs using the cloud.example.com address, which points to a public IP (1.2.3.4) and NATs back to a private IP (192.168.0.10). They expect the endpont catalog to have 'cloud.example.com' for all of the endpoints.

At the moment, we have external_lb_vip_address, which sets the catalog public URL and the IP address that haproxy binds to. However, a FQDN can't be used for that variable. Also, it's not possible to use a public IP for the catalog and a private (NAT) IP for haproxy to listen on.

We should be able to configure the address that haproxy listens on (external_lb_vip_address) as well as a catalog endpoint address (possibly endpoint_catalog address?) This would allow deployers to have more flexibility into what end users will see when connecting to the APIs.

Changed in openstack-ansible:
assignee: nobody → Victor Palma (victor-palma)
importance: Undecided → Wishlist
status: New → Confirmed
Revision history for this message
Gilles Mocellin (gilles-mocellin) wrote :

My current workaround : put the external FQDN in /etc/hosts pointing to the internal IP where haproxy should bind.

Revision history for this message
Thiago Martins (martinx) wrote :

I'm a bit surprised that this isn't an option!

Any plans to implement it?

Revision history for this message
Thiago Martins (martinx) wrote :

My OSA deployment has a proper DNS working but, I can't see a way to tweak /etc/openstack_deploy/* files to set the FQDN (osa-1.cloud.mydomain.com) for all "openstack endpoint"s.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.