Bug 1562394
| Summary: | OSP13 Deployment with TLS everywhere fails - Could not evaluate: The certificate * wasn't found in the list. | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Artem Hrechanychenko <ahrechan> | ||||||
| Component: | instack-undercloud | Assignee: | Juan Antonio Osorio <josorior> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Artem Hrechanychenko <ahrechan> | ||||||
| Severity: | urgent | Docs Contact: | |||||||
| Priority: | urgent | ||||||||
| Version: | 13.0 (Queens) | CC: | ahrechan, alee, hrybacki, itbrown, josorior, jschluet, kbasil, knylande, mburns, nkinder, nyechiel, pkesavar, rhel-osp-director-maint, rmascena, vitorepoma | ||||||
| Target Milestone: | beta | Keywords: | Triaged | ||||||
| Target Release: | 13.0 (Queens) | ||||||||
| Hardware: | x86_64 | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | instack-undercloud-8.4.1-3.el7ost, python-novajoin-1.0.18-2.el7ost | Doc Type: | If docs needed, set a value | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | |||||||||
| : | 1573583 (view as bug list) | Environment: | |||||||
| Last Closed: | 2018-06-27 13:49:35 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | |||||||||
| Bug Blocks: | 1488826, 1573583 | ||||||||
| Attachments: |
|
||||||||
|
Description
Artem Hrechanychenko
2018-03-30 14:11:44 UTC
I have the same problem - It affects also the OpenDaylight SSL/TLS feature This usually indicates the overcloud failed to enroll with freeipa or your CA (that's why it cannot get a certificate). Can you please ensure your undercloud is enrolled, and if so, then attach the /var/log/messages and /var/log/cloud-init logs. We need to see why the overcloud was unable to join if that is indeed the issue. Created attachment 1421400 [details]
ipa logs and /var/log/messages
Could you provide an environment where this issue is presented so I can check it out? Itzik hit the same problem. The problem is the overcloud does not join IPA. The solution was to increase the timeouts for the vendor data settings. In nova.conf: vendordata_dynamic_connect_timeout = 30 vendordata_dynamic_read_timeout = 30 Then restart the openstack-nova-api, novajoin-notify, and novajoin-server processes. Let me know if that fixes it. @trozet, vendordata_dynamic_connect_timeout = 30 vendordata_dynamic_read_timeout = 30 in /etc/nova/nova.conf on undercloud node and reboot freeipa and UC node works as a w/a for me @Nir -- we have eyes on this. Resetting NEEDINFO from comment#6 -- Artem are you able to provide Ozz with an env. for debugging? env details were send via email Downstream patches have merged, builds created and noted in `fixed-in`. Moving but to MODIFIED. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:2086 |