Bug 1553520
| Summary: | Cannot create listener with TLS termination | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Carlos Goncalves <cgoncalves> |
| Component: | openstack-octavia | Assignee: | Carlos Goncalves <cgoncalves> |
| Status: | CLOSED ERRATA | QA Contact: | Alexander Stafeyev <astafeye> |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 13.0 (Queens) | CC: | amuller, bcafarel, ihrachys, jschluet, lpeer, majopela, nmanos, nyechiel, rhbz, samccann |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 13.0 (Queens) | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | openstack-octavia-2.0.1-0.20180327200337.e06b95f.el7ost | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-06-27 13:35:18 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1553517, 1553521, 1554336, 1554409, 1556933, 1576436 | ||
| Bug Blocks: | 1433523 | ||
|
Description
Carlos Goncalves
2018-03-09 01:29:07 UTC
To clarify, the root cause of this bug is two-fold: 1) Wrong minimum python2-cryptography set in octavia.spec (set to >= 1.7.2 [1]) while upstream it's set correctly [2]. 2) Minimum required version of python-pyOpenSSL was not reflected in octavia/requirements.txt. A bump of minimum version should had been proposed to requirements/global-requirements.txt by octavia folks but that slipped. So, to fix this bug we need: - python-cryptography >= 1.9 - python-pyOpenSSL >= 17.1.0 [1] https://github.com/rdo-packages/octavia-distgit/blob/queens-rdo/openstack-octavia.spec#L115-L116 [2] https://github.com/openstack/octavia/blob/stable/queens/requirements.txt#L47 On puddle 2018-03-20.2 - There's no "python-cryptography" nor "python2-cryptography" packages at all, only "cryptography" version 1.7.2. ---- (overcloud) [stack@undercloud-0 ~]$ cat /etc/yum.repos.d/latest-installed 13 -p 2018-03-20.2 (overcloud) [stack@undercloud-0 ~]$ pip list | egrep *cryptography cryptography 1.7.2 (overcloud) [stack@undercloud-0 ~]$ pip list | egrep *OpenSSL* pyOpenSSL 17.3.0 ---- Use yum, not pip: rpm -qa | grep *cryptography* (In reply to Carlos Goncalves from comment #4) > Use yum, not pip: rpm -qa | grep *cryptography* Nothing either. (overcloud) [stack@undercloud-0 ~]$ rpm -qa | grep *cryptography* (overcloud) [stack@undercloud-0 ~]$ You're running it on the undercloud, sorry I missed that from before. You have to run it in the octavia-worker docker container which runs on the controller nodes. Indeed, for example I got: [heat-admin@controller-0 ~]$ sudo docker exec -ti octavia_worker bash ()[octavia@controller-0 /]$ rpm -qi python2-cryptography Name : python2-cryptography Version : 2.1.4 Release : 1.el7ost [...] (latest puddle) Right, but octavia's .spec file is not yet enforcing latest minimum required dependency versions. It's pending import from RDO. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:2086 |