nova/libvirt: switch vnc server binding
On compute nodes, instead of binding vnc server on 0.0.0.0, use the IP address provided by libvirt's t-h-t profile (hiera). Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com> Depends-On: Ie377c09734e9f6170daa519aed69c53fc67c366b Change-Id: If6b116b238a52144aad5e76c9edc7df6aa15313c Closes-Bug: #1660099
This commit is contained in:
parent
2b11f29824
commit
6556123395
@ -40,24 +40,13 @@ class tripleo::profile::base::nova::compute::libvirt (
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
# TODO(emilien): Some work needs to be done in puppet-nova to separate nova-compute config
|
|
||||||
# when running libvirt and libvirt itself, so we allow micro-services deployments.
|
|
||||||
if str2bool(hiera('nova::use_ipv6', false)) {
|
|
||||||
$vncserver_listen = '::0'
|
|
||||||
} else {
|
|
||||||
$vncserver_listen = '0.0.0.0'
|
|
||||||
}
|
|
||||||
|
|
||||||
if $rbd_ephemeral_storage {
|
if $rbd_ephemeral_storage {
|
||||||
class { '::nova::compute::libvirt':
|
class { '::nova::compute::libvirt':
|
||||||
libvirt_disk_cachemodes => ['network=writeback'],
|
libvirt_disk_cachemodes => ['network=writeback'],
|
||||||
libvirt_hw_disk_discard => 'unmap',
|
libvirt_hw_disk_discard => 'unmap',
|
||||||
vncserver_listen => $vncserver_listen,
|
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
class { '::nova::compute::libvirt' :
|
include ::nova::compute::libvirt
|
||||||
vncserver_listen => $vncserver_listen,
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
include ::nova::compute::libvirt::qemu
|
include ::nova::compute::libvirt::qemu
|
||||||
|
@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
features:
|
||||||
|
- Configure VNC server to be binded on internal network interface on compute nodes.
|
||||||
|
This value comes from tripleo-heat-templates and is configured by default to use
|
||||||
|
an IP address from the internal API network.
|
||||||
|
We use the ServiceNetMap in tripleo-heat-templates to compute the IP address, and we won't
|
||||||
|
configure 0.0.0.0 anymore as it used to open the binding to any network, which is unsecure.
|
Loading…
Reference in New Issue
Block a user