Merge lp://qastaging/~markmc/nova/metadata-accept-rule into lp://qastaging/~hudson-openstack/nova/trunk
| Status: | Work in progress |
|---|---|
| Proposed branch: | lp://qastaging/~markmc/nova/metadata-accept-rule |
| Merge into: | lp://qastaging/~hudson-openstack/nova/trunk |
| Diff against target: |
157 lines (+84/-2) 5 files modified
nova/api/manager.py (+42/-0) nova/flags.py (+3/-0) nova/network/linux_net.py (+11/-0) nova/network/manager.py (+0/-2) nova/service.py (+28/-0) |
| To merge this branch: | bzr merge lp://qastaging/~markmc/nova/metadata-accept-rule |
| Related bugs: |
| Reviewer | Review Type | Date Requested | Status |
|---|---|---|---|
| Vish Ishaya (community) | Needs Fixing | ||
|
Review via email:
|
|||
Commit message
Add INPUT chain rule for EC2 metadata requests (lp:856385)
On Fedora, the default policy for the INPUT chain in the filter table
is DROP. This means that EC2 metadata requests from guests get dropped.
We have nova-api add this rule to let it through:
$> sudo iptables -t filter -A nova-api-INPUT \
-s 0.0.0.0/0 -d $ec2_dmz_host \
-m tcp -p tcp --dport $ec2_port -j ACCEPT
| Mark McLoughlin (markmc) wrote | # |
| Mark McLoughlin (markmc) wrote | # |
| Thierry Carrez (ttx) wrote | # |
| Mark McLoughlin (markmc) wrote | # |
| Mark McLoughlin (markmc) wrote | # |
Unmerged revisions
- 1530. By Mark McLoughlin
-
Fix pep8 issue
- 1529. By Mark McLoughlin
-
Allow EC2 manager host param be set to default FLAGS.host
- 1528. By Mark McLoughlin
-
Have nova-api add the INPUT rule for EC2 metadata
It makes no sense to have nova-network add an iptables rule for the EC2
metadata service, since they may not actually be on the same host.Instead, nova-api should add it directly. In order to do that, we add a
manager class for API services and allow the EC2 manager use the network
driver to add the rule. - 1527. By Mark McLoughlin
-
Add INPUT chain rule for EC2 metadata requests
On Fedora, the default policy for the INPUT chain in the filter table
is DROP. This means that EC2 metadata requests from guests get dropped.Add this rule to let it through:
$> sudo iptables -t filter -A nova-network-INPUT \
-s 0.0.0.0/0 -d $ec2_dmz_host \
-m tcp -p tcp --dport $ec2_port -j ACCEPTHowever, this only works if nova-network and nova-api are on the same
host.
again, reasonable. Perhaps one bug for all of these.