<div dir="ltr"><div><div><div>Hi Jesse and Lindgren,<br><br>Thank you both for the responses. think i figured out the root cause of the problem, which is SSL. But first the answers of your questions:<br>Are you deploying haproxy onto the same host as the repo container, or a different host?<br>Yes, it is on the same host.<br><br>Have you bound the VIP address manually?<br>No, through openstack-ansible playbooks.<br><br>Is the VIP address shared in some way – ie is it used for the host and haproxy?<br>Yes, it is used for the host and haproxy (keepalived is disabled).<br><br>After tcpdumping ( tcpdump -i any port 8181 -n) i found that the packets from galera conatiner are not forwarded to repo container through the VIP, and the haproxy file is full with this error message:<br>root@node01:~# tail /var/log/haproxy.log <br>Nov 17 18:02:16 localhost haproxy[30180]: <a href="http://172.16.1.94:38050">172.16.1.94:38050</a> [17/Nov/2016:18:02:16.786] repo_all-front-1/1: SSL handshake failure<br>Nov 17 18:02:16 localhost haproxy[30180]: <a href="http://172.16.1.94:38052">172.16.1.94:38052</a> [17/Nov/2016:18:02:16.791] repo_all-front-1/1: SSL handshake failure<br>Nov 17 18:02:16 localhost haproxy[30180]: <a href="http://172.16.1.94:38054">172.16.1.94:38054</a> [17/Nov/2016:18:02:16.795] repo_all-front-1/1: SSL handshake failure<br>Nov 17 18:02:16 localhost haproxy[30180]: <a href="http://172.16.1.94:38056">172.16.1.94:38056</a> [17/Nov/2016:18:02:16.800] repo_all-front-1/1: SSL handshake failure<br>Nov 17 18:02:16 localhost haproxy[30180]: <a href="http://172.16.1.94:38058">172.16.1.94:38058</a> [17/Nov/2016:18:02:16.805] repo_all-front-1/1: SSL handshake failure<br>Nov 17 18:02:16 localhost haproxy[30180]: <a href="http://172.16.1.94:38060">172.16.1.94:38060</a> [17/Nov/2016:18:02:16.809] repo_all-front-1/1: SSL handshake failure<br>Nov 17 18:02:16 localhost haproxy[30180]: <a href="http://172.16.1.94:38062">172.16.1.94:38062</a> [17/Nov/2016:18:02:16.814] repo_all-front-1/1: SSL handshake failure<br>Nov 17 18:02:16 localhost haproxy[30180]: <a href="http://172.16.1.94:38064">172.16.1.94:38064</a> [17/Nov/2016:18:02:16.819] repo_all-front-1/1: SSL handshake failure<br>Nov 17 18:02:16 localhost haproxy[30180]: <a href="http://172.16.1.94:38066">172.16.1.94:38066</a> [17/Nov/2016:18:02:16.823] repo_all-front-1/1: SSL handshake failure<br>Nov 17 18:02:16 localhost haproxy[30180]: <a href="http://172.16.1.94:38068">172.16.1.94:38068</a> [17/Nov/2016:18:02:16.828] repo_all-front-1/1: SSL handshake failure<br><br><br></div>Can you please point out how to ignore SSL check ?<br><br></div>Thank you,<br></div>Hamza<br></div><div class="gmail_extra"><br><div class="gmail_quote">On 17 November 2016 at 16:58, Jesse Pretorius <span dir="ltr"><<a href="mailto:Jesse.Pretorius@rackspace.co.uk" target="_blank">Jesse.Pretorius@rackspace.co.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="white" link="blue" vlink="purple" lang="EN-US">
<div class="m_5540327914312846759WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">With the combination of all those thing, it seems clear that there’s a problem with the internal_lb_vip_address and that the issue is specifically on the load balancer. You’re going to
have to dig into that. From here it’s a little difficult for me to try and advise.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Are you deploying haproxy onto the same host as the repo container, or a different host?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Have you bound the VIP address manually?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Is the VIP address shared in some way – ie is it used for the host and haproxy?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><u></u> <u></u></span></p>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:.5in"><b><span style="font-family:Calibri;color:black">From:
</span></b><span style="font-family:Calibri;color:black">Achi Hamza <<a href="mailto:h16mara@gmail.com" target="_blank">h16mara@gmail.com</a>><br>
<b>Date: </b>Thursday, November 17, 2016 at 3:07 PM<br>
<b>To: </b>Jesse Pretorius <<a href="mailto:Jesse.Pretorius@rackspace.co.uk" target="_blank">Jesse.Pretorius@rackspace.co.<wbr>uk</a>><br>
<b>Cc: </b>"<a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.<wbr>openstack.org</a>" <<a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.<wbr>openstack.org</a>></span></p><div><div class="h5"><br>
<b>Subject: </b>Re: [Openstack-operators] [openstack-dev] [openstack-ansible] pip issues<u></u><u></u></div></div><p></p>
</div><div><div class="h5">
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">It also works on the Public IP of the repo:
<u></u><u></u></p>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">root@maas:/opt/openstack-<wbr>ansible/playbooks# ansible hosts -m shell -a "curl http://<b>172.16.1.222</b>:8181/os-<wbr>releases/"<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">Variable files: "-e @/etc/openstack_deploy/user_<wbr>secrets.yml -e @/etc/openstack_deploy/user_<wbr>variables.yml "<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">node01 | SUCCESS | rc=0 >><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><html><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><head><title>Index of /os-releases/</title></head><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><body bgcolor="white"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><h1>Index of /os-releases/</h1><hr><pre><a href="../">../</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><a href="14.0.1/">14.0.1/</a> 16-Nov-2016 14:47 -<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"></pre><hr></body><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"></html> % Total % Received % Xferd Average Speed Time Time Time Current<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"> Dload Upload Total Spent Left Speed<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">100 287 0 287 0 0 381k 0 --:--:-- --:--:-- --:--:-- 280k<u></u><u></u></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">do you have an explanation to this Jesse ?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">Thank you<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
<div>
<p class="MsoNormal" style="margin-left:.5in">On 17 November 2016 at 15:53, Achi Hamza <<a href="mailto:h16mara@gmail.com" target="_blank">h16mara@gmail.com</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal" style="margin-left:.5in">It also works on the internal interface of the containers, i can fetch from the repo container to the host on the internal IP of the container:
<u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><b>root@maas:/opt/openstack-<wbr>ansible/playbooks# ansible hosts -m shell -a "curl
<a href="http://10.0.3.92:8181/os-releases/" target="_blank">http://10.0.3.92:8181/os-<wbr>releases/</a>"</b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">Variable files: "-e @/etc/openstack_deploy/user_<wbr>secrets.yml -e @/etc/openstack_deploy/user_<wbr>variables.yml "<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">node01 | SUCCESS | rc=0 >><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><html><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><head><title>Index of /os-releases/</title></head><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><body bgcolor="white"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><h1>Index of /os-releases/</h1><hr><pre><a href="../">../</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><a href="14.0.1/">14.0.1/</a> 16-Nov-2016 14:47 -<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"></pre><hr></body><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"></html> % Total % Received % Xferd Average Speed Time Time Time Current<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"> Dload Upload Total Spent Left Speed<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">100 287 0 287 0 0 405k 0 --:--:-- --:--:-- --:--:-- 280k<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
<div>
<p class="MsoNormal" style="margin-left:.5in">On 17 November 2016 at 15:26, Achi Hamza <<a href="mailto:h16mara@gmail.com" target="_blank">h16mara@gmail.com</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal" style="margin-left:.5in">It works on the repo itself: <u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><b>root@maas:/opt/openstack-<wbr>ansible/playbooks# ansible repo_all -m shell -a "curl
<a href="http://localhost:8181/os-releases/" target="_blank">http://localhost:8181/os-<wbr>releases/</a>"</b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">Variable files: "-e @/etc/openstack_deploy/user_<wbr>secrets.yml -e @/etc/openstack_deploy/user_<wbr>variables.yml "<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">node01_repo_container-82b4e1f6 | SUCCESS | rc=0 >><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><html><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><head><title>Index of /os-releases/</title></head><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><body bgcolor="white"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><h1>Index of /os-releases/</h1><hr><pre><a href="../">../</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><a href="14.0.1/">14.0.1/</a> 16-Nov-2016 14:47 -<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"></pre><hr></body><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"></html> % Total % Received % Xferd Average Speed Time Time Time Current<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"> Dload Upload Total Spent Left Speed<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">100 287 0 287 0 0 59878 0 --:--:-- --:--:-- --:--:-- 71750<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">On 17 November 2016 at 15:22, Jesse Pretorius <<a href="mailto:Jesse.Pretorius@rackspace.co.uk" target="_blank">Jesse.Pretorius@rackspace.co.<wbr>uk</a>> wrote:<u></u><u></u></p>
</div>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">
<span style="font-size:11.0pt;font-family:Calibri"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in">
<span style="font-size:11.0pt;font-family:Calibri"> </span><u></u><u></u></p>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:1.0in">
<b><span style="font-family:Calibri;color:black">From: </span></b><span style="font-family:Calibri;color:black">Achi Hamza <<a href="mailto:h16mara@gmail.com" target="_blank">h16mara@gmail.com</a>><br>
<b>Date: </b>Thursday, November 17, 2016 at 1:57 PM<br>
<b>To: </b>Jesse Pretorius <<a href="mailto:Jesse.Pretorius@rackspace.co.uk" target="_blank">Jesse.Pretorius@rackspace.co.<wbr>uk</a>>, "<a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.<wbr>openstack.org</a>" <<a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.<wbr>openstack.org</a>><br>
<b>Subject: </b>Re: [Openstack-operators] [openstack-dev] [openstack-ansible] pip issues</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">
Thank you Jesse, but these iptables rules are just applied on the deployment node not the host nodes. do i have to omit these rules even on the deployment node ?
<u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-left:1.0in">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">
Thank you<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">
<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in">
Ah, then that’s a red herring. As long as your hosts can reach the internet through it, then you’re good on that front.<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in">
<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in">
Let’s go back to verifying access to the repo – try checking access from the repo server to itself:<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in">
<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in">
ansible repo_all -m uri -a "url=<a href="http://localhost:8181/os-releases/" target="_blank">http://localhost:8181/os-<wbr>releases/</a>"<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in">
<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in">
or<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in">
<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in">
ansible repo_all –m shell –a "curl <a href="http://localhost:8181/os-releases/" target="_blank">
http://localhost:8181/os-<wbr>releases/</a>"<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in">
<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:.5in"> <u></u><u></u></p>
<div class="MsoNormal" style="margin-left:.5in;text-align:center" align="center">
<hr width="100%" size="2" align="center">
</div>
<p class="MsoNormal" style="margin-left:.5in">Rackspace Limited is a company registered in England & Wales (company registered number 03897010) whose registered office is at 5 Millington Road, Hyde Park Hayes, Middlesex UB3 4AZ. Rackspace Limited privacy policy
can be viewed at <a href="http://www.rackspace.co.uk/legal/privacy-policy" target="_blank">
www.rackspace.co.uk/legal/<wbr>privacy-policy</a> - This e-mail message may contain confidential or privileged information intended for the recipient. Any dissemination, distribution or copying of the enclosed material is prohibited. If you receive this transmission
in error, please notify us immediately by e-mail at <a href="mailto:abuse@rackspace.com" target="_blank">
abuse@rackspace.com</a> and delete the original message. Your cooperation is appreciated.
<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
</div>
<p class="MsoNormal" style="margin-right:0in;margin-bottom:12.0pt;margin-left:.5in">
______________________________<wbr>_________________<br>
OpenStack-operators mailing list<br>
<a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.<wbr>openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" target="_blank">http://lists.openstack.org/<wbr>cgi-bin/mailman/listinfo/<wbr>openstack-operators</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
</blockquote>
</div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
</div></div></div>
</div>
</blockquote></div><br></div>