Bug 1134016

Summary:	OpenStack Foreman Installer should support enabling SSL for all the OpenStack components
Product:	Red Hat OpenStack	Reporter:	Ramon Acedo <racedoro>
Component:	rhel-osp-installer	Assignee:	Mike Burns <mburns>
Status:	CLOSED DUPLICATE	QA Contact:	Omri Hochman <ohochman>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	5.0 (RHEL 7)	CC:	aberezin, mburns, rhos-maint, yeylon
Target Milestone:	---
Target Release:	Installer
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-09-08 16:11:09 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ramon Acedo 2014-08-26 15:53:34 UTC

Enabling SSL on all the components is a requirement in many deployments. RabbitMQ, MariaDB and the API endpoints should support SSL out of the box.

Currently I've tried in two different ways:

Option 1: During deployment

Modifying the Host Group for the Controller with Ssl="true" and setting Ssl true in "Advanced Configuration" at Neutron (Controller) and Neutron compute

err Puppet Could not start Service[httpd]: Execution of '/usr/bin/systemctl start httpd' returned 1: Job for httpd.service failed. See 'systemctl status httpd.service' and 'journalctl -xn' for details. Wrapped exception: Execution of '/usr/bin/systemctl start httpd' returned 1: Job for httpd.service failed. See 'systemctl status httpd.service' and 'journalctl -xn' for details.
err /Stage[main]/Apache::Service/Service[httpd]/ensure change from stopped to running failed: Could not start Service[httpd]: Execution of '/usr/bin/systemctl start httpd' returned 1: Job for httpd.service failed. See 'systemctl status httpd.service' and 'journalctl -xn' for details.
err Puppet Could not start Service[neutron-server]: Execution of '/usr/bin/systemctl start neutron-server' returned 1: Job for neutron-server.service failed. See 'systemctl status neutron-server.service' and 'journalctl -xn' for details. Wrapped exception: Execution of '/usr/bin/systemctl start neutron-server' returned 1: Job for neutron-server.service failed. See 'systemctl status neutron-server.service' and 'journalctl -xn' for details.
err /Stage[main]/Neutron::Server/Service[neutron-server]/ensure change from stopped to running failed: Could not start Service[neutron-server]: Execution of '/usr/bin/systemctl start neutron-server' returned 1: Job for neutron-server.service failed. See 'systemctl status neutron-server.service' and 'journalctl -xn' for details.

Option 2: After deployment.

I just get this:

err /Stage[main]/Neutron::Server/Service[neutron-server] Could not restart Service[neutron-server]: Execution of '/usr/bin/systemctl restart neutron-server' returned 1: Job for neutron-server.service failed. See 'systemctl status neutron-server.service' and 'journalctl -xn' for details. Wrapped exception: Execution of '/usr/bin/systemctl restart neutron-server' returned 1: Job for neutron-server.service failed. See 'systemctl status neutron-server.service' and 'journalctl -xn' for details.
err /Stage[main]/Neutron::Server/Service[neutron-server] Failed to call refresh: Could not restart Service[neutron-server]: Execution of '/usr/bin/systemctl restart neutron-server' returned 1: Job for neutron-server.service failed. See 'systemctl status neutron-server.service' and 'journalctl -xn' for details.
err /Stage[main]/Apache::Service/Service[httpd] Could not restart Service[httpd]: Execution of '/usr/bin/systemctl restart httpd' returned 1: Job for httpd.service failed. See 'systemctl status httpd.service' and 'journalctl -xn' for details. Wrapped exception: Execution of '/usr/bin/systemctl restart httpd' returned 1: Job for httpd.service failed. See 'systemctl status httpd.service' and 'journalctl -xn' for details.
err /Stage[main]/Apache::Service/Service[httpd] Failed to call refresh: Could not restart Service[httpd]: Execution of '/usr/bin/systemctl restart httpd' returned 1: Job for httpd.service failed. See 'systemctl status httpd.service' and 'journalctl -xn' for details.

Versions:

openstack-foreman-installer-2.0.21-1.el6ost.noarch
rhel-osp-installer-0.1.10-2.el6ost.noarch
openstack-puppet-modules-2014.1-20.2.el6ost.noarch

Comment 3 Mike Burns 2014-08-27 14:31:35 UTC

Arthur, 

Can you set priority for this?
Is this something we want configurable?

Comment 4 Arthur Berezin 2014-09-02 07:19:10 UTC

(In reply to Mike Burns from comment #3)
> Arthur, 
> 
> Can you set priority for this?
> Is this something we want configurable?

We do want it configurable in services' wizard, I'm tracking this request in Trello so we should plan this in one of the upcomming sprints.

Until we add this to services' Wizard we should document how to enable/configure SSL via Advanced options.

Comment 5 Mike Burns 2014-09-08 16:11:09 UTC


*** This bug has been marked as a duplicate of bug 998623 ***