Hi Igor,<div><br></div><div>I'd first access the VM via VNC and make sure it has booted and is getting an IP address via DHCP. The easiest way to do this is using the VNC consoles exposed via Horizon, but you can also use a tool like vncviewer directly from the command line. </div>
<div><br></div><div>If you think it may be an issue with security groups, running nova with the following flag will disable security groups so you can see if that is what is blocking the traffic: firewall_driver=nova.virt.firewall.NoopFirewallDriver . Of course, you'll need to restart nova-compute. With devstack, you can set this in your localrc: LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver . </div>
<div><br></div><div>Dan</div><div><br></div><div><br><div class="gmail_quote">On Sat, May 26, 2012 at 11:31 AM, Igor Laskovy <span dir="ltr"><<a href="mailto:igor.laskovy@gmail.com" target="_blank">igor.laskovy@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Thank you Dan, Chris, Dean and Soheil for help. I very appreciated your help!<br>
<br>
Yes, I using Precise for this lab and after I have added /dev/net/tun<br>
to the cgroup_device_acl list I have ACTIVE state for my running<br>
instances. BTW, the doc<br>
<a href="http://openvswitch.org/openstack/documentation/" target="_blank">http://openvswitch.org/openstack/documentation/</a> already have this<br>
clarification, thanks))<br>
<br>
Well, although that the instances are running, I can't ping or ssh to them.<br>
I already doing this:<br>
$ nova secgroup-add-rule default icmp -1 -1 <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br>
$ nova secgroup-add-rule default tcp 22 22 <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br>
but didn't help!<br>
<div class="HOEnZb"><div class="h5"><br>
On Fri, May 25, 2012 at 12:40 AM, Dan Wendlandt <<a href="mailto:dan@nicira.com">dan@nicira.com</a>> wrote:<br>
> Hi Igor,<br>
><br>
> Are you running this on Precise? If so, Precise is a bit pickier than<br>
> previous versions about requiring a setting in /etc/libvirt/qemu.conf<br>
><br>
> You need to add /dev/net/tun to the cgroup_device_acl list in that file, and<br>
> restart libvirt.<br>
><br>
> This is actually handled automatically by a branch I've pushed for review in<br>
> devstack: <a href="https://review.openstack.org/#/c/7001/" target="_blank">https://review.openstack.org/#/c/7001/</a><br>
><br>
> It has lots of positive reviews, but still needs one more core review and<br>
> I've been waiting a while. If you're a devstack core, please give me a<br>
> hand! :)<br>
><br>
> Dan<br>
><br>
> p.s. the root cause of needing to tweak /etc/libvirt/qemu.conf is that<br>
> we're using libvirt <interface type=ethernet> elements to work with<br>
> openvswitch. Starting in libvirt 0.9.11 (not available in precise),<br>
> openvswitch is integrated directly with libvirt, meaning that using<br>
> type=ethernet (and the workaround) is no longer necessary.<br>
><br>
><br>
> On Thu, May 24, 2012 at 1:05 PM, Igor Laskovy <<a href="mailto:igor.laskovy@gmail.com">igor.laskovy@gmail.com</a>><br>
> wrote:<br>
>><br>
>> Hello all from sunny Kiev))<br>
>><br>
>> I have built nova+quantum+openvswitch without nova-volume lab on two<br>
>> nodes - one controller with everything on it except nova-compute and<br>
>> second dedicated compute node with nova-compute:<br>
>><br>
>> During creating VM I have error which I still can't fix:<br>
>> $ nova boot --image precise --flavor m1.tiny my-precise-vm3<br>
>> $ nova list<br>
>><br>
>> +--------------------------------------+----------------+--------+----------+<br>
>> | ID | Name | Status |<br>
>> Networks |<br>
>><br>
>> +--------------------------------------+----------------+--------+----------+<br>
>> | 5a72aa9f-5743-486a-9496-130d367bc665 | my-precise-vm3 | ERROR |<br>
>> |<br>
>><br>
>> +--------------------------------------+----------------+--------+----------+<br>
>><br>
>> # cat /var/log/libvirt/qemu/instance-00000012.log<br>
>> 2012-05-24 19:51:47.994+0000: starting up<br>
>> LC_ALL=C PATH=/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/sbin:/bin<br>
>> QEMU_AUDIO_DRV=none /usr/bin/kvm -S -M pc-1.0 -enable-kvm -m 512 -smp<br>
>> 1,sockets=1,cores=1,threads=1 -name instance-00000012 -uuid<br>
>> 5a72aa9f-5743-486a-9496-130d367bc665 -nodefconfig -nodefaults -chardev<br>
>><br>
>> socket,id=charmonitor,path=/var/lib/libvirt/qemu/instance-00000012.monitor,server,nowait<br>
>> -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc<br>
>> -no-shutdown -drive<br>
>><br>
>> file=/var/lib/nova/instances/instance-00000012/disk,if=none,id=drive-virtio-disk0,format=qcow2,cache=none<br>
>> -device<br>
>> virtio-blk-pci,bus=pci.0,addr=0x5,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1<br>
>> -netdev tap,ifname=tap24b9f3da-8b,script=,id=hostnet0 -device<br>
>> rtl8139,netdev=hostnet0,id=net0,mac=fa:16:3e:49:f1:a9,bus=pci.0,addr=0x3<br>
>> -netdev tap,ifname=tapcdd6bc93-86,script=,id=hostnet1 -device<br>
>> rtl8139,netdev=hostnet1,id=net1,mac=fa:16:3e:68:94:b4,bus=pci.0,addr=0x4<br>
>> -chardev<br>
>> file,id=charserial0,path=/var/lib/nova/instances/instance-00000012/console.log<br>
>> -device isa-serial,chardev=charserial0,id=serial0 -chardev<br>
>> pty,id=charserial1 -device isa-serial,chardev=charserial1,id=serial1<br>
>> -usb -device usb-tablet,id=input0 -vnc <a href="http://192.168.1.71:0" target="_blank">192.168.1.71:0</a> -k en-us -vga<br>
>> cirrus -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x6<br>
>> Domain id=4 is tainted: shell-scripts<br>
>> char device redirected to /dev/pts/2<br>
>> kvm: -netdev tap,ifname=tap24b9f3da-8b,script=,id=hostnet0: could not<br>
>> open /dev/net/tun: Operation not permitted<br>
>> kvm: -netdev tap,ifname=tap24b9f3da-8b,script=,id=hostnet0: Device<br>
>> 'tap' could not be initialized<br>
>> 2012-05-24 19:51:48.175+0000: shutting down<br>
>><br>
>> /var/lib/nova/instances/instance-00000012# virsh create libvirt.xml<br>
>> error: Failed to create domain from libvirt.xml<br>
>> error: internal error Process exited while reading console log output:<br>
>> char device redirected to /dev/pts/2<br>
>> kvm: -netdev tap,ifname=tap24b9f3da-8b,script=,id=hostnet0: could not<br>
>> open /dev/net/tun: Operation not permitted<br>
>> kvm: -netdev tap,ifname=tap24b9f3da-8b,script=,id=hostnet0: Device<br>
>> 'tap' could not be initialized<br>
>><br>
>> Waiting any advises!<br>
>><br>
>> --<br>
>> Igor Laskovy<br>
>> Kiev, Ukraine<br>
>><br>
>> _______________________________________________<br>
>> Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
>> Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
>> Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
>> More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
><br>
><br>
><br>
><br>
> --<br>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>
> Dan Wendlandt<br>
> Nicira, Inc: <a href="http://www.nicira.com" target="_blank">www.nicira.com</a><br>
> twitter: danwendlandt<br>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>
><br>
<br>
<br>
<br>
--<br>
Igor Laskovy<br>
Kiev, Ukraine<br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>Dan Wendlandt <div>Nicira, Inc: <a href="http://www.nicira.com" target="_blank">www.nicira.com</a><br><div>twitter: danwendlandt<br>
~~~~~~~~~~~~~~~~~~~~~~~~~~~<br></div></div><br>
</div>