From 154ecfe25a09fe08b3a11642b4469d6015c0b836 Mon Sep 17 00:00:00 2001
From: Andrew Bonney <andrew.bonney@bbc.co.uk>
Date: Wed, 16 Dec 2020 14:59:26 +0000
Subject: [PATCH] Prevent zun-wsproxy binding to all IP addresses

This issue is preventing metal upgrade jobs for
victoria->master from deploying haproxy correctly following the
merge of https://review.opendev.org/769142/.

This is intended to be a minimal patch to fix the binding
so that it can be backported in order to fix the upgrades.

Change-Id: I1c3dcbc21bee1bf6c66c9c2f77c4ff832db49f19
---
 defaults/main.yml     | 6 ++++++
 templates/zun.conf.j2 | 6 ++++--
 zuul.d/project.yaml   | 8 ++++++++
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/defaults/main.yml b/defaults/main.yml
index 39401ac..eeba31e 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -182,6 +182,12 @@ zun_kuryr_service_username: kuryr
 ## Keystone authentication middleware
 zun_keystone_auth_plugin: password
 
+## Zun WebSocket Proxy
+zun_wsproxy_proto: "{{ (openstack_service_publicuri_proto | default('http') == 'https') | ternary('wss', 'ws') }}"
+zun_wsproxy_port: 6784
+zun_wsproxy_host: "{{ openstack_service_bind_address | default('0.0.0.0') }}"
+zun_wsproxy_base_uri: "{{ zun_wsproxy_proto }}://{{ external_lb_vip_address }}:{{ zun_wsproxy_port }}"
+
 ## Zun v1
 zun_service_name: zun
 zun_service_type: container
diff --git a/templates/zun.conf.j2 b/templates/zun.conf.j2
index d44ac44..4520ad0 100644
--- a/templates/zun.conf.j2
+++ b/templates/zun.conf.j2
@@ -124,8 +124,10 @@ host_shared_with_nova = {{ inventory_hostname in groups['nova_compute'] }}
 
 
 [websocket_proxy]
-wsproxy_host = 0.0.0.0
-wsproxy_port = 6784
+base_url = {{ zun_wsproxy_base_uri }}
+wsproxy_host = {{ zun_wsproxy_host }}
+wsproxy_port = {{ zun_wsproxy_port }}
+
 
 [zun_client]
 endpoint_type = {{ zun_service_endpoint_type }}
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
index 54bf194..b1e425a 100644
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@@ -20,3 +20,11 @@
       - openstack-ansible-deploy-aio_metal-jobs
       - publish-openstack-docs-pti
       - release-notes-jobs-python3
+    check:
+      jobs:
+        - openstack-ansible-upgrade-aio_metal-ubuntu-focal:
+            voting: false
+    gate:
+      jobs:
+        - openstack-ansible-upgrade-aio_metal-ubuntu-focal:
+            voting: false