Bug 1540565
| Summary: | containerized cinder pacemaker bundles are missing ssl CA certs | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Pavel Sedlák <psedlak> | ||||||||
| Component: | openstack-tripleo-heat-templates | Assignee: | Steve Baker <sbaker> | ||||||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Gurenko Alex <agurenko> | ||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | high | ||||||||||
| Version: | 12.0 (Pike) | CC: | abishop, apevec, aschultz, augol, cschwede, emacchi, jjoyce, jschluet, m.andre, mburns, rhallise, rhel-osp-director-maint, sbaker, sclewis, slinaber, tvignaud | ||||||||
| Target Milestone: | z3 | Keywords: | Automation, TestOnly, Triaged, ZStream | ||||||||
| Target Release: | 12.0 (Pike) | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | openstack-tripleo-heat-templates-7.0.3-23.el7ost | Doc Type: | If docs needed, set a value | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | |||||||||||
| : | 1543152 (view as bug list) | Environment: | |||||||||
| Last Closed: | 2018-05-17 10:35:32 UTC | Type: | Bug | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Bug Depends On: | |||||||||||
| Bug Blocks: | 1543152 | ||||||||||
| Attachments: |
|
||||||||||
|
Description
Pavel Sedlák
2018-01-31 12:12:58 UTC
Created attachment 1389115 [details]
docker-container-startup-config-step_5.json
I have a local deployment with Cinder running in containers under pacemaker, and confirm that both cinder-volume and cinder-backup containers are missing the volume mounts that provide access to the SSL certs. These mounts are present on the other cinder containers (the ones not under pacemaker control). Looking further, on the controller in /var/lib/tripleo-config/docker-container-startup-config-step_5.json, the "cinder_volume_init_bundle" and "cinder_backup_init_bundle" configurations are missing several volume mounts that are supposed to be there. The THT [1] and [2] are supposed to include the ContainersCommon volume mounts [3], but this doesn't seem to be happening. [1] https://github.com/openstack/tripleo-heat-templates/blob/master/docker/services/pacemaker/cinder-volume.yaml#L180 [2] https://github.com/openstack/tripleo-heat-templates/blob/master/docker/services/pacemaker/cinder-backup.yaml#L186 [3] https://github.com/openstack/tripleo-heat-templates/blob/master/docker/services/containers-common.yaml#L121 I'd like DFG:DF to take a look at this. It looks like your OSP build is missing this change: https://review.openstack.org/#/c/531261/ I can see in the THT rhos-13.0-patches branch this commit has not propagated through yet. Can you please reattempt when your copy of docker/services/containers-common.yaml has a docker_puppet_apply_volumes section? (In reply to Steve Baker from comment #4) > It looks like your OSP build is missing this change: > > https://review.openstack.org/#/c/531261/ > > I can see in the THT rhos-13.0-patches branch this commit has not propagated > through yet. Can you please reattempt when your copy of > docker/services/containers-common.yaml has a docker_puppet_apply_volumes > section? the version of THT in original report of bz does appear to have that included but this is only from packaging and -patches branch quick check. openstack-tripleo-heat-templates.noarch 8.0.0-0.20180122224016.el7ost Which is based on upstream 2ebc2ee3af744bc1206fc710e0dc3bf68d59d20d from 2018-01-23 and that patch merged upstream on 2018-01-11. I manually extracted containers-common.yaml and pacemaker/cinder-volume.yaml from openstack-tripleo-heat-templates.noarch 8.0.0-0.20180122224016.el7ost and they are identical to what's on upstream master. I also see the patches in my local osp-12 deployment, which is using the latest version of rhos/rhos-12.0-patches. This is the THT that resulted in the docker-container-startup-config-step_5.json attachment. OK, two more pieces of information would be useful: - please also attach docker-container-startup-config-step_1.json, I want to see if the haproxy config has the same issue - can you provide the version of the PyYAML package on your undercloud Created attachment 1389711 [details]
docker-container-startup-config-step_1.json
(undercloud) [stack@rhos-undercloud ~]$ rpm -q PyYAML
PyYAML-3.10-11.el7.x86_64
Remember that this is my own local osp-12 deployment, using THT from rhos/rhos-12.0-patches.
Created attachment 1390339 [details]
docker container info (step-config JSON and docker inspect output)
OK, I have fresh data. First, I found an error in one of my environment files
that caused the deployment to not use the latest rhos version of the
pacemaker/cinder-X.yaml files. It was still deploying the GA version, which we
know is missing the new docker_puppet_apply.sh code. So I fixed that and
redeployed.
What I'm seeing now is docker-container-startup-config-step_5.json looks good
(it shows the CA cert mounts), but the mounts are missing in the running
containers. Somehow the mounts in the config-step JSON are not present in the
containers.
I attached a full set of the /var/lib/tripleo JSON files, as well as the
docker inspect output for the cinder-volume and cinder-backup containers.
OK, these cinder containers are not managed by paunch via docker-container-startup-config-step*.json. They are managed by pacemaker, and configured by the puppet-tripleo manifest tripleo::profile::pacemaker::cinder::*_bundle. It looks like this means that the missing volume mounts need to be added to the storage_maps blocks: http://git.openstack.org/cgit/openstack/puppet-tripleo/tree/manifests/profile/pacemaker/cinder/volume_bundle.pp#n81 http://git.openstack.org/cgit/openstack/puppet-tripleo/tree/manifests/profile/pacemaker/cinder/backup_bundle.pp#n81 I'll reassign this to puppet-tripleo. It might be more appropriate for PIDONE DFG to handle the fix, but I'll ask around first. Upstream fix posted According to our records, this should be resolved by openstack-tripleo-heat-templates-7.0.9-8.el7ost. This build is available now. |