[Starlingx-discuss] oam address

Qi, Mingyuan mingyuan.qi at intel.com
Thu Mar 12 08:17:43 UTC 2020


Hi Dejan,

In simplex mode, mgmt network is assigned to loopback(lo), you can check with " system addrpool-list" and "ip a".
The dns resolve is ok, You will need to add the new oam ip as a new SAN to /etc/docker/certs.d/registry.local:9001/registry-cert.crt

Hi Tee,

I saw a potential issue in registry service config file, /etc/docker-distribution/registry/config.yaml
auth:
  token: 
    realm: "xxx/token"
It is set to https://{oam ip}/token, not {mgmt ip}, is it expected?

Mingyuan

-----Original Message-----
From: Dejan Muhamedagic <dejan.muhamedagic at tttech-industrial.com> 
Sent: Tuesday, March 10, 2020 16:50
To: starlingx-discuss at lists.starlingx.io
Subject: Re: [Starlingx-discuss] oam address

Hi,

There's no mgmt, I guess because this is a simplex all-in-one installation. Here's the output from nslookup:

controller-0:~$ nslookup mgmt
Server:192.168.204.1
Address:192.168.204.1#53

** server can't find mgmt: NXDOMAIN

controller-0:~$ grep mgmt /etc/hosts
controller-0:~$ nslookup registry.local
Server:192.168.204.1
Address:192.168.204.1#53

registry.localcanonical name = controller.
Name:controller
Address: 192.168.204.1

The internal server error suggests that the registry itself gets offended by the new IP address.

Thanks,

Dejan

On Tue, 2020-03-10 at 02:35 +0000, Qi, Mingyuan wrote:
> Dejan,
>
> This issue is caused by new oam ip missing in registry/registry token 
> server certificate SAN.
> But...normally the registry.local is resolved to mgmt ip which will 
> not trigger this issue. From the log, it seems registry.local was 
> resolved to oam ip.
> Better to check /etc/hosts and "nslookup registry.local" output.
>
> Mingyuan
>
> -----Original Message-----
> From: Dejan Muhamedagic <dejan.muhamedagic at tttech-industrial.com>
> Sent: Monday, March 9, 2020 23:06
> To: starlingx-discuss at lists.starlingx.io
> Subject: Re: [Starlingx-discuss] oam address
>
> Hi,
>
> Changing the OAM IP address did work, sort of, but there is a problem 
> with some certificate which apparently needs to be recreated.
> Applications cannot be applied anymore:
>
> > platform-integ-apps | 1.0-8                       | platform-
> integration-manifest | manifest.yaml      | apply-failed | Deployment
> of application platform-integ-apps (1.0-8) failed: failed to download
> one or more image(s).                 |
>
> The error message I found in sysinv.log:
>
> sysinv 2020-03-09 14:57:45.903 83083 ERROR sysinv.conductor.kube_app 
> [-] Image registry.local:9001/docker.io/starlingx/ceph-config-
> helper:v1.15.0 dow
> nload failed from local registry: 500 Server Error: Internal Server 
> Error ("Get 
> https://registry.local:9001/v2/docker.io/starlingx/ceph-config-helper/
> manifests/
> v1.15.0: Get
> https://10.107.8.255:9002/token/?account=admin&scope=repository%3Ad
> ocker.io%2Fstarlingx%2Fceph-config-
> helper%3Apull&service=192.168.204.1%3A9001: x
> 509: certificate is valid for 192.168.204.1, 10.107.10.21, not
> 10.107.8.255"): A
> PIError: 500 Server Error: Internal Server Error ("Get
> https://registry.local:90
> 01/v2/docker.io/starlingx/ceph-config-helper/manifests/v1.15.0: Get
> https://10.1
> 07.8.255:9002/token/?account=admin&scope=repository%3Adocker.io%2Fsta
> rl
> ingx%2Fce
> ph-config-helper%3Apull&service=192.168.204.1%3A9001: x509:
> certificate is valid  for 192.168.204.1, 10.107.10.21, not
> 10.107.8.255")
>
> (Sorry about the formatting!)
>
> The OAM IP address changed from 10.107.10.21/22 to 10.107.8.255/22.
>
> Is it possible to fix this?
>
> Best regards,
>
> Dejan
>
>
> On Mon, 2020-02-24 at 15:05 +0000, Winnicki, Chris wrote:
> > Hi Dejan
> >
> > It's absolutely possible to change the OAM IP address after the 
> > installation is completed.
> > * One thing to watch out for is make sure that:
> > 1) oam_gateway_ip is updated if you're changing networks
> > 2) That your machine (which you're using to access the StarlinX
> > system)  can route to the new network (in case the networks were
> > changed)
> >
> >
> > Regards,
> >
> > Chris Winnicki
> > chris.winnicki at windriver.com
> > 613-963-1329
> > ________________________________________
> > From: Dejan Muhamedagic [dejan.muhamedagic at tttech-industrial.com]
> > Sent: Monday, February 24, 2020 9:48 AM
> > To: starlingx-discuss at lists.starlingx.io
> > Subject: [Starlingx-discuss] oam address
> >
> > Hi,
> >
> > Is it possible to change the OAM IP address after the installation?
> > There is a "system oam-modify", but the installation guide warns:
> >
> > "Some Ansible bootstrap parameters cannot be changed or are very 
> > difficult to change after installation is complete."
> >
> > The reason I'm asking is that this installation may have to run in 
> > different environments and possibly in different networks.
> >
> > Thanks,
> >
> > Dejan
> >
> > CONFIDENTIALITY: The contents of this e-mail are confidential and 
> > intended only for the above addressee(s). If you are not the 
> > intended recipient, or the person responsible for delivering it to 
> > the intended recipient, copying or delivering it to anyone else or 
> > using it in any unauthorized manner is prohibited and may be 
> > unlawful. If you receive this e-mail by mistake, please notify the 
> > sender and the systems administrator at straymail at tttech.com 
> > immediately.
> > _______________________________________________
> > Starlingx-discuss mailing list
> > Starlingx-discuss at lists.starlingx.io
> > http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
> CONFIDENTIALITY: The contents of this e-mail are confidential and 
> intended only for the above addressee(s). If you are not the intended 
> recipient, or the person responsible for delivering it to the intended 
> recipient, copying or delivering it to anyone else or using it in any 
> unauthorized manner is prohibited and may be unlawful. If you receive 
> this e-mail by mistake, please notify the sender and the systems 
> administrator at straymail at tttech.com immediately.
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
CONFIDENTIALITY: The contents of this e-mail are confidential and intended only for the above addressee(s). If you are not the intended recipient, or the person responsible for delivering it to the intended recipient, copying or delivering it to anyone else or using it in any unauthorized manner is prohibited and may be unlawful. If you receive this e-mail by mistake, please notify the sender and the systems administrator at straymail at tttech.com immediately.
_______________________________________________
Starlingx-discuss mailing list
Starlingx-discuss at lists.starlingx.io
http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss


More information about the Starlingx-discuss mailing list