1

While using ufw (Uncomplicated FireWall) and I noticed that the local juju machines were stuck in a pending state.

$ juju status
environment: local
machines:
  "0":
    agent-state: started
    agent-version: 1.20.14.1
    dns-name: localhost
    instance-id: localhost
    series: trusty
    state-server-member-status: has-vote
  "1":
    agent-state: pending
    instance-id: mbruzek-local-machine-1
    series: precise
    hardware: arch=amd64
services:
  ubuntu:
    charm: cs:precise/ubuntu-4
    exposed: false
    units:
      ubuntu/0:
        agent-state: pending
        machine: "1"

The Juju LXC documentation warns:

If you are running a firewall such as ufw, it may interfere with the correct operation of Juju using LXC containers and might need to be halted.

After disabling ufw I was able to deploy the ubuntu charm without a problem.

I want to be able to continue to use my firewall and use Juju. How do I use Juju local with a firewall?

2 Answers 2

1

After some experimentation I was able to find the minimum required ports to resolve the agent-state: pending problem.

Juju uses port 22 (ssh), juju state server uses port 17070, jujud uses port 8040. I am told this may not work with Juju set up in an HA mode because that uses different ports.

Allowing these ports in ufw:

$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
17070                      ALLOW       Anywhere
8040                       ALLOW       Anywhere
22/tcp (v6)                ALLOW       Anywhere (v6)
17070 (v6)                 ALLOW       Anywhere (v6)
8040 (v6)                  ALLOW       Anywhere (v6)

I was able to deploy with this ufw configuration. If anyone knows of other ports that should be enabled please post them here.

1

As of Juju 2.0 beta3 I needed:

To                         Action      From
--                         ------      ----
17070/tcp                  ALLOW       Anywhere                  
22/tcp                     ALLOW       Anywhere                  
8443/tcp                   ALLOW       Anywhere                  
443/tcp                    ALLOW       Anywhere                  
80/tcp                     ALLOW       Anywhere                             
17070/tcp (v6)             ALLOW       Anywhere (v6)             
22/tcp (v6)                ALLOW       Anywhere (v6)             
8443/tcp (v6)              ALLOW       Anywhere (v6)             
443/tcp (v6)               ALLOW       Anywhere (v6)             
80/tcp (v6)                ALLOW       Anywhere (v6)  

I likely didn't need 80 or 443, but had them enabled anyhow. So I left them in. It appears 8040 is now 8443 and that you only need it to allow tcp.

1
  • Thx!!! Allowing 8443 did the trick for me.
    – extraymond
    Apr 5, 2018 at 9:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .