NFS v3 / UDP is disabled on Centos 7 - icinga-vagrant standalone fails to start

[siklosipeter]

When trying to check out the icinga-vagrant box, I ran into a problem. The standalone version (haven't checked the others) is not starting up properly due to an NFS mount problem.

Expected Behavior

[root@localhost standalone]# vagrant up
Bringing machine 'icinga2' up with 'libvirt' provider...
==> icinga2: Checking if box 'centos/7' is up to date...
==> icinga2: A newer version of the box 'centos/7' for provider 'libvirt' is
==> icinga2: available! You currently have version '1803.01'. The latest is version
==> icinga2: '1804.02'. Run `vagrant box update` to update.
==> icinga2: Starting domain.
==> icinga2: Waiting for domain to get an IP address...
==> icinga2: Waiting for SSH to become available...
==> icinga2: Creating shared folders metadata...
==> icinga2: Forwarding ports...
==> icinga2: 443 (guest) => 8445 (host) (adapter eth0)
==> icinga2: 8003 (guest) => 8085 (host) (adapter eth0)
==> icinga2: 22 (guest) => 2085 (host) (adapter eth0)
==> icinga2: Rsyncing folder: /root/icinga-vagrant/standalone/ => /vagrant
==> icinga2: Exporting NFS shared folders...
==> icinga2: Preparing to edit /etc/exports. Administrator privileges will be required...
==> icinga2: Mounting NFS shared folders...
==> icinga2: Machine already provisioned. Run `vagrant provision` or use the `--provision`
==> icinga2: flag to force provisioning. Provisioners marked to run always will still run.
==> icinga2: Running provisioner: shell...
    icinga2: Running: inline script
    icinga2: Restarting network (via systemctl):
    icinga2: [  OK  ]
==> icinga2: Running provisioner: shell...
    icinga2: Running: /tmp/vagrant-shell******tvd.sh
[root@localhost standalone]#

Current Behavior

[root@localhost standalone]# vagrant up
Bringing machine 'icinga2' up with 'libvirt' provider...
==> icinga2: Box 'centos/7' could not be found. Attempting to find and install...
    icinga2: Box Provider: libvirt
    icinga2: Box Version: >= 0
==> icinga2: Loading metadata for box 'centos/7'
    icinga2: URL: https://vagrantcloud.com/centos/7
==> icinga2: Adding box 'centos/7' (v1804.02) for provider: libvirt
    icinga2: Downloading: https://vagrantcloud.com/centos/boxes/7/versions/1804.02/providers/libvirt.box
    icinga2: Download redirected to host: cloud.centos.org
==> icinga2: Successfully added box 'centos/7' (v1804.02) for 'libvirt'!
==> icinga2: Uploading base box image as volume into libvirt storage...
==> icinga2: Creating image (snapshot of base box volume).
==> icinga2: Creating domain with the following settings...
==> icinga2:  -- Name:              standalone_icinga2
==> icinga2:  -- Domain type:       kvm
==> icinga2:  -- Cpus:              2
==> icinga2:
==> icinga2:  -- Feature:           acpi
==> icinga2:  -- Feature:           apic
==> icinga2:  -- Feature:           pae
==> icinga2:  -- Memory:            2048M
==> icinga2:  -- Management MAC:
==> icinga2:  -- Loader:
==> icinga2:  -- Base box:          centos/7
==> icinga2:  -- Storage pool:      default
==> icinga2:  -- Image:             /var/lib/libvirt/images/standalone_icinga2.img (41G)
==> icinga2:  -- Volume Cache:      default
==> icinga2:  -- Kernel:
==> icinga2:  -- Initrd:
==> icinga2:  -- Graphics Type:     vnc
==> icinga2:  -- Graphics Port:     -1
==> icinga2:  -- Graphics IP:       127.0.0.1
==> icinga2:  -- Graphics Password: Not defined
==> icinga2:  -- Video Type:        cirrus
==> icinga2:  -- Video VRAM:        9216
==> icinga2:  -- Sound Type:
==> icinga2:  -- Keymap:            en-us
==> icinga2:  -- TPM Path:
==> icinga2:  -- INPUT:             type=mouse, bus=ps2
==> icinga2: Pruning invalid NFS exports. Administrator privileges will be required...
==> icinga2: Creating shared folders metadata...
==> icinga2: Starting domain.
==> icinga2: Waiting for domain to get an IP address...
==> icinga2: Waiting for SSH to become available...
    icinga2:
    icinga2: Vagrant insecure key detected. Vagrant will automatically replace
    icinga2: this with a newly generated keypair for better security.
    icinga2:
    icinga2: Inserting generated public key within guest...
    icinga2: Removing insecure key from the guest if it's present...
    icinga2: Key inserted! Disconnecting and reconnecting using new SSH key...
==> icinga2: Setting hostname...
==> icinga2: Forwarding ports...
==> icinga2: 443 (guest) => 8445 (host) (adapter eth0)
==> icinga2: 8003 (guest) => 8085 (host) (adapter eth0)
==> icinga2: 22 (guest) => 2085 (host) (adapter eth0)
==> icinga2: Configuring and enabling network interfaces...
    icinga2: SSH address: 192.168.121.112:22
    icinga2: SSH username: vagrant
    icinga2: SSH auth method: private key
==> icinga2: Rsyncing folder: /root/icinga-vagrant/standalone/ => /vagrant
==> icinga2: Exporting NFS shared folders...
==> icinga2: Preparing to edit /etc/exports. Administrator privileges will be required...
==> icinga2: Mounting NFS shared folders...
The following SSH command responded with a non-zero exit status.
Vagrant assumes that this means the command failed!

mount -o vers=3,udp 192.168.121.1:/root/icinga-vagrant/.puppet/hieradata /hieradata

Stdout from the command:



Stderr from the command:

mount.nfs: No route to host

[root@localhost standalone]#

Possible Solution

Forcing the NFS to use TCP prococol:

--- Vagrantfile.dist    2018-05-22 14:43:52.639149106 +0200
+++ Vagrantfile 2018-05-22 14:26:08.599194924 +0200
@@ -42,7 +42,7 @@

       if options[:synced_folders]
         options[:synced_folders].each_pair do |source, target|
-          node_config.vm.synced_folder source, target
+          node_config.vm.synced_folder source, target, nfs_udp: false
         end
       end

@@ -102,7 +102,7 @@
       node_config.vm.provision :shell, :path => "../.puppet/scripts/shell_provisioner_pre.sh"

       # sync generic hiera data
-      node_config.vm.synced_folder "../.puppet/hieradata", "/hieradata"
+      node_config.vm.synced_folder "../.puppet/hieradata", "/hieradata", nfs_udp: false

       # provisioner: install box using puppet manifest
       node_config.vm.provision :puppet do |puppet|

Steps to Reproduce (for bugs)

1. Install Centos 7 base system (as of 2018.05.18)
2. git clone https://github.com/Icinga/icinga-vagrant
3. cd icinga-vagrant/standalone
4. vagrant up

Context

I tried to check out a fully installed and configured Icinga2 install to see how it could be used.

Your Environment

• Vagrant version (vagrant -v): Vagrant 2.1.1
• Box name: icinga-vagrant
• Release version: git head as of 2018.05.18
• Operating system: CentOS Linux release 7.5.1804 (Core)
• Provider (VirtualBox, Parallels, libvirt): libvirt

Solution

~~ See Possible Solution

[siklosipeter]

Even after this change, one should execute the following commands to allow connections through:

# firewall-cmd --permanent --add-service=nfs3
success
# firewall-cmd --reload
success
#

This is after the nfs, mountd,rpc-bind services are already enabled.

[dnsmichi]

Interesting, thanks for the report. I'll need to reproduce this on my Fedora box at home.

https://developer.fedoraproject.org/tools/vagrant/vagrant-nfs.html

[dnsmichi]

Please test the linked PR :)