Bug 1165606

PR is open upstream, I'll merge this into enterprise after it's merged upstream.
https://github.com/openshift/origin-server/pull/5969

The patches for this bug have been merged and built for enterprise-server.

This required a fix to both the routing plugin and routing daemon. The next puddle build will contiain the packages as noted in Fixed In Version.

Since the documentation for this hasn't yet been updated, I want to make sure I have more notes around for QE for testing SSL connections for the routing plugin and routing daemon.

For SSL testing the routing pluging and routing daemon configuration need to be able handle an SSL configuration per activemq host. The routing plugin is able to set the MCOLLECTIVE_CONFIG="/opt/rh/ruby193/root/etc/mcollective/client.cfg" setting in openshift-origin-routing-activemq.conf to pick up the client.cfg settings on the OpenShift broker. It's important to know that the username and password are still picked up from the openshift-origin-routing-activemq.conf and not from the client.cfg. The reason for this is the client.cfg doesn't have credentials for the routing topic.

The routing daemon is typically not installed on the OpenShift broker, so if you want to configure SSL, you'll need to uncomment the new plugin.activemq* settings routing-daemon.conf. They are bssically a duplication of what is carried in the mcollective client.cfg - again, other than the username and password.

Verified this bug with rubygem-openshift-origin-routing-activemq-0.7.1.2-1.el6op.noarch and rubygem-openshift-origin-routing-daemon-0.20.2.1-1.el6op.noarch, PASS.

# cat /etc/openshift/plugins.d/openshift-origin-routing-activemq.conf
ACTIVEMQ_TOPIC='/topic/routinginfo'
ACTIVEMQ_PORT='61613'
ACTIVEMQ_HOST='activemq.ose21-20141112.example.com'
ACTIVEMQ_USERNAME='routinginfo'
ACTIVEMQ_PASSWORD='routinginfopasswd'
MCOLLECTIVE_CONFIG="/opt/rh/ruby193/root/etc/mcollective/client.cfg"

# cat /opt/rh/ruby193/root/etc/mcollective/client.cfg
main_collective = mcollective
collectives = mcollective
libdir = /opt/rh/ruby193/root/usr/libexec/mcollective
logger_type = console
loglevel = warn
direct_addressing = 0

# Plugins
securityprovider=psk
plugin.psk = asimplething

connector = activemq
plugin.activemq.pool.size = 1
plugin.activemq.pool.1.host = activemq.ose21-20141112.example.com
plugin.activemq.pool.1.port = 61613
plugin.activemq.pool.1.user = mcollective
plugin.activemq.pool.1.password = marionette
plugin.activemq.pool.1.ssl = true
plugin.activemq.pool.1.ssl.ca = /etc/ssl/server.crt
plugin.activemq.pool.1.ssl.key = /etc/ssl/server.key
plugin.activemq.pool.1.ssl.cert = /etc/ssl/server.crt
# For further options on heartbeats and timeouts, refer to
# https://docs.puppetlabs.com/mcollective/reference/plugins/connector_activemq.html
plugin.activemq.heartbeat_interval = 30
plugin.activemq.max_hbread_fails = 2
plugin.activemq.max_hbrlck_fails = 2
# Broker will retry ActiveMQ connection, then report error
plugin.activemq.initial_reconnect_delay = 0.1
plugin.activemq.max_reconnect_attempts = 6

# Facts
factsource = yaml
plugin.yaml = /opt/rh/ruby193/root/etc/mcollective/facts.yaml


# cat /etc/openshift/routing-daemon.conf
<--snip-->
ACTIVEMQ_HOST=activmq.example.com
ACTIVEMQ_USER=routinginfo
ACTIVEMQ_PASSWORD=routinginfopasswd
ACTIVEMQ_PORT=61613
ACTIVEMQ_DESTINATION=/topic/routinginfo
<--snip-->
# Enabling the plugin.activemq settings will override the ACTIVEMQ_HOST and ACTIVEMQ_PORT
# settings. Use the plugin settings if you need to verified SSL settings.
plugin.activemq.pool.size = 1
plugin.activemq.pool.1.host = 10.66.79.123
plugin.activemq.pool.1.port = 61613
plugin.activemq.pool.1.ssl = true
plugin.activemq.pool.1.ssl.ca = /etc/keys/server.crt
plugin.activemq.pool.1.ssl.key = /etc/keys/server.key
plugin.activemq.pool.1.ssl.cert = /etc/keys/server.crt


After scalable app is created successfully, nginx config file is also created successfully, app could be accessed successfully via nginx.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2014-1979.html