Ask Your Question
0

juno neutron nova metadata network configuration issue (request failed)

asked 2015-03-08 16:45:54 -0500

hckeyguy33 gravatar image

updated 2015-03-09 20:08:17 -0500

I've read a ton about this metadata service issue on multinode environments and nothing seems to quite hit the nail into the coffin.

I have a true multinode configuration (separated controller, network, compute, and storage nodes).

I've read in the admin guide the following.
For instances to reach the metadata service, the nova-network service must configure iptables to NAT port 80 of the 169.254.169.254 address to the IP address specified in metadata_host (this defaults to $my_ip, which is the IP address of the nova-network service) and port specified in metadata_port (which defaults to 8775) in /etc/nova/nova.conf.

However I'm not using nova-network I'm using neutron.

The install guide does not seem to cover this either, outside of just point the metadata server to the controller's IP in the nova and neutron configs.

However when I boot up a cirros image, it still reaches out to 169.254.169.254 which seems to be a magic number over an actual configuration item.

Do I still need the NAT? If yes, please show the correct command per the juno neutron and juno setup. I've found one I think for nova-network through a bunch of posts. If no, I'm kind of at a loss in direction at this point.

I've also tried this instruction per the same admin guide (even though again I'm not using nova-netowork) The default Compute service settings assume that nova-network and nova-api are running on the same host. If this is not the case, in the /etc/nova/nova.conf file on the host running nova-network, set the metadata_host configuration option to the IP address of the host where nova-api is running.

The actual error as follows. *As shown I get a private IP. I can also ping my external net. I can however on the controller hit http://controller:8775 and get the listing of dates. However when I try to do anything more than that with the instance id from the dashboard, I keep getting malformed request.

 Sending discover...
 Sending select for 192.168.1.22...
 Lease of 192.168.1.22 obtained, lease time 86400
 cirros-ds 'net' up at 1.01
 checking http://169.254.169.254/2009-04-04/instance-id
 failed 1/20: up 1.01. request failed

Here is the ip netns iptables

ip netns exec qrouter-3e7bfe72-d4d7-4f7d-a3ea-4d22615cc19a iptables -S -t nat

-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N neutron-l3-agent-OUTPUT
-N neutron-l3-agent-POSTROUTING
-N neutron-l3-agent-PREROUTING
-N neutron-l3-agent-float-snat
-N neutron-l3-agent-snat
-N neutron-postrouting-bottom
-A PREROUTING -j neutron-l3-agent-PREROUTING
-A OUTPUT -j neutron-l3-agent-OUTPUT
-A POSTROUTING -j neutron-l3-agent-POSTROUTING
-A POSTROUTING -j neutron-postrouting-bottom
-A neutron-l3-agent-OUTPUT -d 202.0.113.105/32 -j DNAT --to-destination 192.168.1.22
-A neutron-l3-agent-OUTPUT -d 202.0.113.106/32 -j DNAT --to-destination 192.168.1.23
-A neutron-l3-agent-OUTPUT -d 202.0.113.104/32 -j DNAT --to-destination 192.168.1.6
-A neutron-l3-agent-OUTPUT -d 202.0.113.102/32 -j DNAT --to-destination 192.168.1.2
-A ...
(more)
edit retag flag offensive close merge delete

Comments

The last message is normal. Please run from within CirrOS VM

curl http://169.254.169.254/latest/meta-data/
curl http://169.254.169.254/latest/meta-data/instance-id
dbaxps gravatar imagedbaxps ( 2015-03-09 01:26:45 -0500 )edit

1 answer

Sort by ยป oldest newest most voted
0

answered 2015-03-08 23:59:46 -0500

dbaxps gravatar image

Use as comment. Please, obtain analog of this report on your network node

ubuntu@ubuntu-system:~/devstack$ sudo ip netns exec qrouter-ad60fdb9-db42-4e8f-b533-b9527124ca30  iptables -S -t nat
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N neutron-l3-agent-OUTPUT
-N neutron-l3-agent-POSTROUTING
-N neutron-l3-agent-PREROUTING
-N neutron-l3-agent-float-snat
-N neutron-l3-agent-snat
-N neutron-postrouting-bottom
-A PREROUTING -j neutron-l3-agent-PREROUTING
-A OUTPUT -j neutron-l3-agent-OUTPUT
-A POSTROUTING -j neutron-l3-agent-POSTROUTING
-A POSTROUTING -j neutron-postrouting-bottom
-A neutron-l3-agent-OUTPUT -d 192.168.10.153/32 -j DNAT --to-destination 10.254.1.5
-A neutron-l3-agent-OUTPUT -d 192.168.10.154/32 -j DNAT --to-destination 10.254.1.6
-A neutron-l3-agent-OUTPUT -d 192.168.10.156/32 -j DNAT --to-destination 10.254.1.8
-A neutron-l3-agent-OUTPUT -d 192.168.10.155/32 -j DNAT --to-destination 10.254.1.7
-A neutron-l3-agent-POSTROUTING ! -i qg-fbff8595-eb ! -o qg-fbff8595-eb -m conntrack ! --ctstate DNAT -j ACCEPT
-A neutron-l3-agent-PREROUTING -d 192.168.10.153/32 -j DNAT --to-destination 10.254.1.5
-A neutron-l3-agent-PREROUTING -d 192.168.10.154/32 -j DNAT --to-destination 10.254.1.6
-A neutron-l3-agent-PREROUTING -d 192.168.10.156/32 -j DNAT --to-destination 10.254.1.8
-A neutron-l3-agent-PREROUTING -d 192.168.10.155/32 -j DNAT --to-destination 10.254.1.7
-A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9697
-A neutron-l3-agent-float-snat -s 10.254.1.5/32 -j SNAT --to-source 192.168.10.153
-A neutron-l3-agent-float-snat -s 10.254.1.6/32 -j SNAT --to-source 192.168.10.154
-A neutron-l3-agent-float-snat -s 10.254.1.8/32 -j SNAT --to-source 192.168.10.156
-A neutron-l3-agent-float-snat -s 10.254.1.7/32 -j SNAT --to-source 192.168.10.155
-A neutron-l3-agent-snat -j neutron-l3-agent-float-snat
-A neutron-l3-agent-snat -o qg-fbff8595-eb -j SNAT --to-source 192.168.10.150
-A neutron-postrouting-bottom -m comment --comment "Perform source NAT on outgoing traffic." -j neutron-l3-agent-snat
edit flag offensive delete link more

Comments

Is your 192 address space your external network? and the 10 net is your private net?

Everything else looks correct to mine, I show the floating IP's getting DNAT/SNAT's. I also have the 169 line.

I'll post above in my original post

hckeyguy33 gravatar imagehckeyguy33 ( 2015-03-09 19:41:18 -0500 )edit

Yes, it is correct

dbaxps gravatar imagedbaxps ( 2015-03-10 00:32:59 -0500 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Get to know Ask OpenStack

Resources for moderators

Question Tools

1 follower

Stats

Asked: 2015-03-08 16:45:54 -0500

Seen: 1,123 times

Last updated: Mar 09 '15