Bug 1486363
| Summary: | OSP11 -> OSP12 upgrade and during OSP12+SSL deployment: haproxy_init_bundle container fails to start on SSL enabled overcloud because it cannot access certificates | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Marius Cornea <mcornea> |
| Component: | openstack-tripleo-heat-templates | Assignee: | Angus Thomas <athomas> |
| Status: | CLOSED ERRATA | QA Contact: | Prasanth Anbalagan <panbalag> |
| Severity: | urgent | Docs Contact: | |
| Priority: | high | ||
| Version: | 12.0 (Pike) | CC: | afazekas, agurenko, ahrechan, bperkins, chjones, dbecker, dyasny, jcoufal, jfrancoa, josorior, jschluet, mandreou, m.andre, mburns, morazi, nkinder, ohochman, panbalag, rhel-osp-director-maint, sasha |
| Target Milestone: | beta | Keywords: | AutomationBlocker, Triaged |
| Target Release: | 12.0 (Pike) | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | openstack-tripleo-heat-templates-7.0.0-0.20170913050524.0rc2.el7ost | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-12-13 21:58:11 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Marius Cornea
2017-08-29 14:58:34 UTC
For some reason, it seems the volume /etc/pki/tls/private/overcloud_endpoint.pem is not being binded to the container. However, the binding is implemented in https://github.com/openstack/tripleo-heat-templates/blob/53db241cfbfc1b6a237b7f33486a051aa6934579/docker/services/haproxy.yaml#L118-L120. I will try to reproduce the bug in my local environment to be able to get more information about the failure. Reproduce the issue during clean deployment of osp12 I suspect a misconfiguration. In the broken deployment: [heat-admin@overcloud-controller-0 ~]$ sudo hiera -c /etc/puppet/hiera.yaml "tripleo::haproxy::service_certificate" /etc/pki/tls/private/overcloud_endpoint.pem While in my local successful deployment: [heat-admin@overcloud-controller-0 ~]$ sudo hiera -c /etc/puppet/hiera.yaml "tripleo::haproxy::service_certificate" /etc/pki/tls/certs/haproxy/overcloud-haproxy-external.pem (In reply to Martin André from comment #4) > I suspect a misconfiguration. In the broken deployment: > > [heat-admin@overcloud-controller-0 ~]$ sudo hiera -c /etc/puppet/hiera.yaml > "tripleo::haproxy::service_certificate" > /etc/pki/tls/private/overcloud_endpoint.pem > > While in my local successful deployment: > > [heat-admin@overcloud-controller-0 ~]$ sudo hiera -c /etc/puppet/hiera.yaml > "tripleo::haproxy::service_certificate" > /etc/pki/tls/certs/haproxy/overcloud-haproxy-external.pem Here's my deployment command: openstack overcloud deploy --templates \ --libvirt-type kvm \ -e /usr/share/openstack-tripleo-heat-templates/environments/docker.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/docker-ha.yaml \ -e /home/stack/templates/nodes_data.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/ceph-ansible/ceph-ansible.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/network-isolation.yaml \ -e /home/stack/virt/network/network-environment.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-tls.yaml \ -e /home/stack/virt/public_vip.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-endpoints-public-ip.yaml \ -e /home/stack/inject-trust-anchor-hiera.yaml \ -e /home/stack/rhos12.yaml In the included /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-tls.yaml By default we have: DeployedSSLCertificatePath: /etc/pki/tls/private/overcloud_endpoint.pem Yet that file doesn't exist on OC nodes. Removing the Triaged keywork(from upgrades) since it has been reassigned to containers DFG. *** Bug 1488355 has been marked as a duplicate of this bug. *** *** Bug 1488352 has been marked as a duplicate of this bug. *** Confirmed that the gerrit patch works. For successful deployment also note this bug: https://bugzilla.redhat.com/show_bug.cgi?id=1488552 The backport is on its way to stable/pike. https://review.openstack.org/#/c/501127/ *** Bug 1488601 has been marked as a duplicate of this bug. *** Is there a build available with the fix? (In reply to Prasanth Anbalagan from comment #12) > Is there a build available with the fix? I checked the srpm of the latest build, and it contains the fix for this issue. The package fixed package is: openstack-tripleo-heat-templates-7.0.0-0.20170913050524.0rc2.el7ost Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:3462 |