| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2024-09-09 | |||
| 18:02:07 | noonedeadpunk | yeah, I managed to get it working with subdomain jsut out of the box | |
| 18:04:36 | noonedeadpunk | but then it's a bit tougher with let's encrypt as for wildcards I'd need dns-01 | |
| 18:15:16 | sean-k-mooney | yep thats what i use now although before i didnt use wildcards i added a dns entry for each serice | |
| 18:15:48 | sean-k-mooney | i use cloudfail as my dns provider mainly for there restapi adn the fact it supproted in a lot of things | |
| 18:16:54 | sean-k-mooney | *cloudflare | |
| 18:18:33 | noonedeadpunk | well. these are quite long-shot workarounds for smth which should be just possible to do quite simply. And I have pretty much everything working with subpaths except console... | |
| 18:20:03 | sean-k-mooney | honestly none of this is inscope of nova | |
| 18:20:38 | sean-k-mooney | noonedeadpunk: a webseocket is just a upgradded http connection | |
| 18:20:59 | sean-k-mooney | my guess is haproxy does not offcially supprto them or apply the rewite to them | |
| 18:21:08 | noonedeadpunk | yes, but it's https://opendev.org/openstack/nova/src/branch/master/nova/console/websocketproxy.py which replies with wss URL I assume? | |
| 18:22:18 | noonedeadpunk | as when I open novnc under specific path, and it fully loads (I reached this point), now I assume nova provides wss url that is not under same path at all | |
| 18:22:50 | noonedeadpunk | So I'd argue about scope here | |
| 18:22:54 | sean-k-mooney | we ues a websocket between the proxy and the html5 applciation that part of novnc | |
| 18:23:40 | noonedeadpunk | yeah, but it's created with no respect to where html5 is running I assume? | |
| 18:24:01 | noonedeadpunk | as it always thinks it runs in `/` | |
| 18:24:02 | sean-k-mooney | the websocket is created regardless yes | |
| 18:24:12 | sean-k-mooney | but we do not supprot subpaths | |
| 18:24:23 | sean-k-mooney | we only supprot runing it on a port | |
| 18:24:31 | sean-k-mooney | anythign beyond that is out so scope | |
| 18:25:25 | noonedeadpunk | so regardless of any rewrites, except trying to catch some GETs under `/` which is really weird - it won't work, yes | |
| 18:26:13 | sean-k-mooney | i belive it can be made work if you rewirte teh websocet too | |
| 18:26:25 | sean-k-mooney | https://www.haproxy.com/documentation/haproxy-configuration-tutorials/load-balancing/websocket/#configure-websockets ha porxy has some supprot for this | |
| 18:26:28 | noonedeadpunk | but then what's the whole point of devstack to be serving services under subpaths.... | |
| 18:26:54 | sean-k-mooney | to avoid using domain | |
| 18:27:15 | noonedeadpunk | yeah, but jsut use ports as used to - would be way more simple to configure... | |
| 18:27:16 | sean-k-mooney | that it we wanted to test that we can run all the rest apis over https on port 4434 | |
| 18:27:25 | sean-k-mooney | *443 | |
| 18:27:47 | sean-k-mooney | there is nothing stoping you using ports | |
| 18:28:00 | sean-k-mooney | btu we did have a lot of operator want to run everything on 443 | |
| 18:28:01 | noonedeadpunk | *all except consoles | |
| 18:28:08 | sean-k-mooney | you can run the console on 443 | |
| 18:28:25 | noonedeadpunk | (that is not tested in devstack) | |
| 18:28:34 | noonedeadpunk | https://zuul.opendev.org/t/openstack/build/092ca27659d5466aa3c19120b58b5031/log/controller/logs/etc/nova/nova-cpu_conf.txt#152-158 | |
| 18:28:38 | sean-k-mooney | sure but devstack does not test everything | |
| 18:28:57 | noonedeadpunk | I can recall some tempest tests for consoles? | |
| 18:29:26 | sean-k-mooney | there are some yes | |
| 18:29:45 | sean-k-mooney | its not that devstack could not test this | |
| 18:29:58 | sean-k-mooney | its that its not in scope to test every combination of how openstack is deployed | |
| 18:30:04 | noonedeadpunk | yeah, fair | |
| 18:30:09 | noonedeadpunk | that I agree with | |
| 18:30:48 | noonedeadpunk | I guess I just not fully in agreement that serving consoles under subpath should be out of scope of nova-novncproxy service | |
| 18:31:14 | sean-k-mooney | for our new installer we deploy novnc on a subdomain | |
| 18:31:17 | sean-k-mooney | https://logserver.rdoproject.org/57/857/e3248dbf95dfb1878d852beef4475bfb68f4e811/github-check/nova-operator-tempest-multinode/616a00d/controller/ci-framework-data/logs/openstack-k8s-operators-openstack-must-gather/namespaces/openstack/routes/nova-novncproxy-cell1-public.yaml | |
| 18:32:16 | noonedeadpunk | yeah, subdomain works really nicely.... | |
| 18:32:45 | noonedeadpunk | ok, gotcha | |
| 18:32:48 | sean-k-mooney | yep so again using subpath need a reversproxy that support both http and websockets | |
| 18:32:58 | sean-k-mooney | as in it need to be able to rewirte both properly | |
| 18:33:15 | sean-k-mooney | it might be posibel to do some other way | |
| 18:33:16 | noonedeadpunk | the problem here of reverseproxy, that then you can't serve anything on root | |
| 18:33:36 | noonedeadpunk | so if you want to have smth like skyline/horizon on root - you can't do that jsut because of vnc console | |
| 18:33:53 | sean-k-mooney | right but normally you sever that on /dashboard | |
| 18:33:59 | sean-k-mooney | and have a redirect for root to it | |
| 18:34:39 | noonedeadpunk | but then redirecting is also fishy a bit, as you need to account for wss | |
| 18:34:48 | sean-k-mooney | you shoudl be able to have the proxy on /vnc by the way and use / for horizon aslong as there isnt a collition | |
| 18:34:53 | noonedeadpunk | which is just /?token= | |
| 18:35:09 | noonedeadpunk | but probably possible to come up with some regex | |
| 18:35:47 | sean-k-mooney | you shoudl be able to have the websoceket be wss://<domain>/novnc?token=... | |
| 18:36:54 | noonedeadpunk | so I just got `https://domain.com/console/vnc_lite.html` loading but still wss was just wss:// |
|
| 18:37:17 | noonedeadpunk | so it ended up with "something went wrong" | |
| 18:37:35 | sean-k-mooney | right but the websocket is not beeing writhe properly | |
| 18:38:07 | sean-k-mooney | you said the url looked correct form nova right | |
| 18:38:23 | sean-k-mooney | do you have an exmaple of the consol url returned | |
| 18:38:29 | noonedeadpunk | yes, but what does return wss URL? | |
| 18:39:02 | sean-k-mooney | at least for the serial console oepnstack server console show returns it | |
| 18:39:22 | noonedeadpunk | openstack console url show returns `https://domain.com/console/vnc_lite.html?path=%3Ftoken%3D76a1303f-c40c-4169-912d-19c05432dbc5` is what is returned | |
| 18:39:25 | sean-k-mooney | but i think we get https back by defualt for novnc | |
| 18:39:30 | noonedeadpunk | it loads, vnc console renders | |
| 18:40:00 | sean-k-mooney | so with devstack the dash board load at "http://192.168.16.127/dashboard/auth/login/?next=/dashboard/" | |
| 18:40:10 | noonedeadpunk | but then html5 tries to connect to wss on `wss://domain.com/?token=76a1303f-c40c-4169-912d-19c05432dbc5` | |
| 18:41:05 | noonedeadpunk | ok, I gues I'm jsut confused where this wss path is coming from | |
| 18:41:14 | noonedeadpunk | as indeed it's probably not from nova at all | |
| 18:41:30 | sean-k-mooney | its part of the html content provided to the javascript app | |
| 18:43:16 | sean-k-mooney | so in my case it returns http://192.168.16.127:6080/vnc_lite.html?path=%3Ftoken%3Dd8a68169-dbd6-4333-8b4a-f57bc3beb53c by edfault | |
| 18:43:44 | sean-k-mooney | if i open that direclty that is what nova is serving and what ironic is embding in an iframe | |
| 18:43:55 | noonedeadpunk | yup, true, and that's working as well (if clients don't have 6080 firewalled) | |
| 18:44:10 | noonedeadpunk | byt heir isp | |
| 18:44:26 | noonedeadpunk | ok, I'll try to do some rewrites indeed. | |
| 18:44:53 | noonedeadpunk | and look one more time what does construct wss uri | |
| 18:45:15 | sean-k-mooney | tehre are two path to how htis works. we use websoxkify to wrap th raw tcp connectoin to the vnc console create by qemu | |
| 18:45:41 | sean-k-mooney | and we use novnc ot provide the webpage that conenct to that and provde the vnc clinet | |
| 18:45:49 | noonedeadpunk | as htmlk5 console does have `const path = readQueryVariable('path', 'websockify');` | |
| 18:46:36 | noonedeadpunk | and it does `url += '/' + path;` - that's why I kind of complained that smth not passing html5 all details for it to perform | |
| 18:47:27 | sean-k-mooney | ok but that novnc that doing that | |
| 18:47:32 | sean-k-mooney | not nova | |
| 18:47:55 | sean-k-mooney | there might eb some header you can set like x_forwared_for or similar | |
| 18:48:35 | sean-k-mooney | in my case the path query arge is empty | |
| 18:48:45 | noonedeadpunk | I think it's just because path being used to pass token | |
| 18:48:49 | sean-k-mooney | well technialy path=%3F | |
| 18:48:58 | noonedeadpunk | ah | |
| 18:49:00 | noonedeadpunk | true | |
| 18:49:20 | noonedeadpunk | but it's what nova replies then | |
| 18:49:54 | sean-k-mooney | you may be able to add it to novncproxy_base_url | |
| 18:50:31 | sean-k-mooney | so instead of http://127.0.0.1:6080/vnc_auto.html | |
| 18:50:59 | sean-k-mooney | http://domain/subpath/vnc_auto.html?path=/subpath | |
| 18:51:55 | sean-k-mooney | can you try setting that in your broser and see if setting path=/subpath is enouch | |
| 18:51:58 | noonedeadpunk | hm, I somehow don't think that will work? | |
| 18:52:09 | noonedeadpunk | yeah, I'm trying now | |
| 18:52:24 | noonedeadpunk | in terms won't work - regarding defining novncproxy_base_url that way | |
| 18:52:28 | sean-k-mooney | well its being used by vnc_lite.html | |
| 18:52:32 | sean-k-mooney | whic is part of novnc | |