DescriptionPrasanth Anbalagan
2018-03-12 16:48:31 UTC
Description of problem:
=======================
https://bugs.launchpad.net/tripleo/+bug/1754363
While trying to deploy TLS everywhere, given that we set the neutron cert specs in the neutron-base yaml, every node tries to request a certificate for neutron. However, not all neutron services output metadata_settings that would actually create a service principal that enables the usage of that cert. Hence, when we deploy, we get the following error:
"Error: /Stage[main]/Tripleo::Certmonger::Neutron/Certmonger_certificate[neutron]: Could not evaluate: Could not get certificate: Server at https://freeipa-0.redhat.local/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: Insufficient 'add' privilege to add the entry '<email address hidden>,cn=services,cn=accounts,dc=redhat,dc=local'.).",
"Warning: /Stage[main]/Tripleo::Certmonger::Neutron/File[/etc/pki/tls/certs/neutron.crt]: Skipping because of failed dependencies",
"Warning: /Stage[main]/Tripleo::Certmonger::Neutron/File[/etc/pki/tls/private/neutron.key]: Skipping because of failed dependencies",
"Warning: /Stage[main]/Tripleo::Certmonger::Ca::Crl/File[tripleo-ca-crl]: Skipping because of failed dependencies",
"Warning: /Stage[main]/Tripleo::Certmonger::Ca::Crl/Exec[tripleo-ca-crl-process-command]: Skipping because of failed dependencies",
"Warning: /Stage[main]/Tripleo::Certmonger::Ca::Crl/Cron[tripleo-refresh-crl-file]: Skipping because of failed dependencies"
Version-Release number of selected component (if applicable):
How reproducible:
=================
Always
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHEA-2018:2086