COA Troubleshooting & Problem Resolution 5

Question 1

An instance is in 'ACTIVE' state but the user reports it is unreachable over SSH. The security group allows port 22. What should you check next?

Accepted Answer

Check iptables/nftables rules on the compute node for the instance's tap interface

Answer

When security groups look correct, the next step is verifying that iptables rules on the compute node's tap interface correctly implement those security group rules.

Question 2

A newly deployed Heat stack fails because a Neutron router cannot be attached to an external network. The error is 'External network not found'. What should you verify?

Accepted Answer

The external network has 'router:external' set to True by an admin

Answer

Only networks with the 'router:external' attribute set to True (by an admin) can be used as external gateways for routers.

Question 3

During a rolling upgrade, some Nova API calls return HTTP 400 with 'microversion not supported'. What causes this and how is it fixed?

Accepted Answer

The client is requesting a microversion higher than what the older Nova API node supports during the mixed-version window

Answer

During a rolling upgrade, old and new Nova API nodes coexist; clients requesting microversions only available in the new version will get 400 from the old node.

Question 4

The 'openstack token issue' command fails with 'Connection refused' even though Keystone is running. What is the most likely cause?

Accepted Answer

The OS_AUTH_URL environment variable points to an incorrect endpoint or port

Answer

'Connection refused' (not 401 Unauthorized) means the client cannot reach the endpoint at all, pointing to an incorrect URL or firewall blocking the port.

Question 5

A Barbican secret cannot be retrieved by a Nova instance via the metadata API. The instance uses a config-drive. What is the most likely misconfiguration?

Accepted Answer

The instance's Barbican consumer ACL does not include the Nova service user

Answer

Barbican secrets require explicit ACL entries granting read access to the requesting service user; Nova needs to be in the secret's consumer ACL to retrieve it on behalf of an instance.

(COA) Certified OpenStack Administrator Exam Practice Test

(COA) Certified OpenStack Administrator Exam Practice Test

COA Troubleshooting & Problem Resolution 5