{"id":63,"date":"2018-08-24T14:43:21","date_gmt":"2018-08-24T22:43:21","guid":{"rendered":"http:\/\/iaastalk.com\/?p=63"},"modified":"2018-08-24T14:43:21","modified_gmt":"2018-08-24T22:43:21","slug":"set-up-spice-console","status":"publish","type":"post","link":"http:\/\/iaastalk.com\/?p=63","title":{"rendered":"Set up Spice Console"},"content":{"rendered":"

Basic Flow<\/h2>\n

Obtain an URL for the web based spice console<\/p>\n

openstack console url show –spice UUID<\/p>\n

\n
\n
\n
\n\n\n\n
\n
\n
+-------+-----------------------------------------------------------------------------------------------------+<\/code><\/div>\n
| Field | Value\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |<\/code><\/div>\n
+-------+-----------------------------------------------------------------------------------------------------+<\/code><\/div>\n
| <\/code>type<\/code>\u00a0 | spice-html5\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |<\/code><\/div>\n
| url\u00a0\u00a0 | http:<\/code>\/\/<\/code>yyy.xxx.com<\/code>\/spice_auto<\/code>.html?token=9654cb37-000-000-000-fbf30f17293b |<\/code><\/div>\n
+-------+-----------------------------------------------------------------------------------------------------+<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

Stick the above url into a browser which will load spice console written in javascript, connecting back to spicehtml5proxy, which in turn forward traffics to the corresponding HV.<\/p>\n

Obtain access url and token<\/h3>\n

request path<\/strong><\/p>\n

Client\u00a0\u2192 Nova API \u2192 RPC (get_spice_console)\u2192 Cell\u00a0\u2192 RPC (get_spice_console)\u00a0\u2192 HV<\/p>\n

response path<\/strong><\/p>\n

Client \u2190(url+Token)\u00a0\u2190\u00a0 Nova API\u00a0 \u2190 Cell (Save token\u00a0\u2192 connection info\u00a0 into Console Auth Store with a TTL) \u2190\u00a0 (host, port, url+token, token )\u00a0 \u2190 HV<\/p>\n

On browser:<\/h3>\n

URL allows loading app<\/p>\n

round 1.<\/p>\n

browser \u2192 (url with token)\u00a0\u2192 vip\u00a0\u2192 spicehtml5proxy ( from default.web)<\/p>\n

browser\u00a0 \u2190 vip\u00a0\u2190 (spice web based client) \u2190 spicehtml5proxy<\/p>\n

2.<\/p>\n

browser \u2190 \u2192 (websocket based spice traffics + token) \u2190 \u2192vip\u00a0 \u2190 \u2192\u00a0 spicehtml5proxy (obtain connection info by token from Console Auth) \u2190\u00a0 (forward traffics)\u00a0 \u2192 HV<\/p>\n

*\u00a0python >=2.74 is required on controller<\/p>\n

Nova Controller setting<\/strong><\/h2>\n
\n
\n
\n
\n\n\n\n
\n
\n
[default]<\/code><\/div>\n
web = <\/code>\/usr\/share\/spice-html5<\/code> (this is default location from where all web contents get loaded.)<\/code><\/div>\n
<\/div>\n
<\/div>\n
<\/div>\n
[vnc]<\/code><\/div>\n
enabled = False<\/code><\/div>\n
<\/div>\n
[spice]<\/code><\/div>\n
agent_enabled = True (optional)<\/code><\/div>\n
enabled = True<\/code><\/div>\n
html5proxy_base_url =\u00a0 http:<\/code>\/\/os-vnc-vip-b01<\/code>.ccg23.paypalc3.com<\/code>\/spice_auto<\/code>.html (URL end user can reach from browser, VIP etc...)<\/code><\/div>\n
#server_listen\u00a0 (used by HV only)<\/code><\/div>\n
#server_proxyclient_address\u00a0 (used by HV only)<\/code><\/div>\n
<\/div>\n
html5proxy_host = controller IP proxy listen at, should be reachable from VIP<\/code><\/div>\n
<\/div>\n
html5proxy_host = port proxy listening at<\/code><\/div>\n
<\/div>\n
<\/div>\n
[console]<\/code><\/div>\n
allowed_origins=http:<\/code>\/\/os-vnc-vip-b01<\/code>.ccg23.paypalc3.com (To be save <\/code>in<\/code> case<\/code> LB modified Origin or Host)<\/code><\/div>\n
token_ttl =\u00a0 <\/code>set<\/code> up token ttl here<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

Hypervisor setting<\/strong><\/h2>\n

HV will return connection details like where to connect back from proxy including host and port.<\/p>\n

Token is also generated on HV, and cell manager add it into console Auth later, so is full access url with token, so html5proxy_base_url is required on every HV as well.<\/p>\n

\n
\n
\n
\n\n\n\n
\n
\n
[vnc]<\/code><\/div>\n
enabled = False<\/code><\/div>\n
[spice]<\/code><\/div>\n
agent_enabled = True (optional)<\/code><\/div>\n
enabled = True<\/code><\/div>\n
server_listen = IP reachable form controller<\/code><\/div>\n
<\/div>\n
server_proxyclient_address\u00a0 =\u00a0 <\/code>hostname<\/code> or IP reachable form controller<\/code><\/div>\n
server_listen & server_proxyclient_address needs to be identical<\/code><\/div>\n
html5proxy_base_url = (URL end user can reach from browser, VIP etc...)<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

Console-auth & token store backend
\n<\/strong><\/h2>\n

By default Console-auth save everything in local dictionary. So each spicehtml5proxy or cell manager ( when authorize a new token) may talk to different console-auth which maintains it’s own independent token cache.<\/p>\n

Fortunately token store is implemented with oslo_cache library\u00a0 with caching back-end configurable.<\/p>\n

In production a memcachd should be used so that console-auth can scale.<\/p>\n

\n
\n
\n
\n\n\n\n
\n
\n
[cache]<\/code><\/div>\n
enabled = True<\/code><\/div>\n
memcache_servers = .....<\/code><\/div>\n
[consoleauth]<\/code><\/div>\n
token_ttl =\u00a0 <\/code>set<\/code> up token ttl here<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

more details regarding\u00a0 oslo cache configuration<\/p>\n

https:\/\/docs.openstack.org\/oslo.cache\/latest\/configuration\/index.html<\/a><\/p>\n

3 VIP\/LB<\/h2>\n

Last, but not the least, Vip\/LB has to\u00a0 support either websocket, if doing L7, or just plain TCP,\u00a0 since spice traffics requires upgrading http to websocket.<\/p>\n","protected":false},"excerpt":{"rendered":"

Basic Flow Obtain an URL for the web based spice console openstack console url show –spice UUID +——-+—————————————————————————————————–+ | Field | Value\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 | +——-+—————————————————————————————————–+ | type\u00a0 | spice-html5\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 | | url\u00a0\u00a0 | http:\/\/yyy.xxx.com\/spice_auto.html?token=9654cb37-000-000-000-fbf30f17293b | +——-+—————————————————————————————————–+ Stick the above url into a browser which will load spice console written in javascript, connecting back to spicehtml5proxy, which […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3],"tags":[],"_links":{"self":[{"href":"http:\/\/iaastalk.com\/index.php?rest_route=\/wp\/v2\/posts\/63"}],"collection":[{"href":"http:\/\/iaastalk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/iaastalk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/iaastalk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/iaastalk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=63"}],"version-history":[{"count":1,"href":"http:\/\/iaastalk.com\/index.php?rest_route=\/wp\/v2\/posts\/63\/revisions"}],"predecessor-version":[{"id":64,"href":"http:\/\/iaastalk.com\/index.php?rest_route=\/wp\/v2\/posts\/63\/revisions\/64"}],"wp:attachment":[{"href":"http:\/\/iaastalk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=63"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/iaastalk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=63"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/iaastalk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=63"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}