Bug 1513502

Summary: TLS everywhere fails with keystone admin API in the external network
Product: Red Hat OpenStack Reporter: Juan Antonio Osorio <josorior>
Component: openstack-tripleo-heat-templatesAssignee: Juan Antonio Osorio <josorior>
Status: CLOSED ERRATA QA Contact: Pavan <pkesavar>
Severity: high Docs Contact:
Priority: high    
Version: 12.0 (Pike)CC: alee, dbecker, emacchi, hrybacki, jamsmith, josorior, mburns, morazi, pkesavar, rhel-osp-director-maint, slinaber
Target Milestone: z3Keywords: Triaged, ZStream
Target Release: 12.0 (Pike)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openstack-tripleo-heat-templates-7.0.12-1.el7ost Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-08-20 12:58:30 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1608450    
Bug Blocks:    

Description Juan Antonio Osorio 2017-11-15 14:27:31 UTC
It's a common scenario that deployers change the keystone admin API from the ctlplane to the external network. They tend to do so by setting the appropriate value in the ServiceNetMap. With an environment that looks as follows:

parameter_defaults:
  ServiceNetMap:
    KeystoneAdminApiNetwork: external

When trying to do so, we get the following error:

overcloud.AllNodesDeploySteps.ControllerDeployment_Step1.0:
  resource_type: OS::Heat::StructuredDeployment
  physical_resource_id: 8a1a8376-07ba-43f8-8dba-8016176fd212
  status: CREATE_FAILED
  status_reason: |
    Error: resources[0]: Deployment to server failed: deploy_status_code : Deployment exited with non-zero status code: 2
  deploy_stdout: |

    PLAY [localhost] ***************************************************************

    TASK [Gathering Facts] *********************************************************
    ok: [localhost]

    TASK [Set host puppet debugging fact string] ***********************************
    ok: [localhost]

    TASK [Write the config_step hieradata] *****************************************
    changed: [localhost]

    TASK [Run puppet host configuration for step 1] ********************************
    ok: [localhost]

    TASK [debug] *******************************************************************
    fatal: [localhost]: FAILED! => {
        "(outputs.stderr|default('')).split('\n')|union(outputs.stdout_lines|default([]))": [
            "exception: connect failed",
            "erlexec: HOME must be set",
            "Warning: Facter: Fact resolution fact='systemd_internal_services', resolution='<anonymous>' resolved to an invalid value: Expected disabled to be one of [Integer, Float, TrueClass, FalseClass, NilCl
ass, String, Array, Hash], but was Symbol",
            "Warning: Undefined variable 'deploy_config_name'; ",
            " (file & line not available)",
            "Warning: ModuleLoader: module 'haproxy' has unresolved dependencies - it will only see those that are resolved. Use 'puppet module list --tree' to see information about modules",
            "Warning: ModuleLoader: module 'mysql' has unresolved dependencies - it will only see those that are resolved. Use 'puppet module list --tree' to see information about modules",
            "Error: Evaluation Error: Operator '[]' is not applicable to an Undef Value. at /etc/puppet/modules/tripleo/manifests/profile/base/keystone.pp:187:27 on node overcloud-controller-0.walrusdomain",
             ...

Comment 9 James Smith 2018-07-12 18:03:43 UTC
If this bug requires doc text for errata release, please set the 'Doc Type' and provide draft text according to the template in the 'Doc Text' field.

The documentation team will review, edit, and approve the text.

If this bug does not require doc text, please set the 'requires_doc_text' flag to -.
Thank you!

Comment 15 errata-xmlrpc 2018-08-20 12:58:30 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:2331