Bug 1661635

Summary:	Enable TLS-Everywhere when IdM is not on the ctlplane network
Product:	Red Hat OpenStack	Reporter:	Mark Jones <marjones>
Component:	openstack-tripleo-heat-templates	Assignee:	Emilien Macchi <emacchi>
Status:	CLOSED ERRATA	QA Contact:	Pavan <pkesavar>
Severity:	high	Docs Contact:
Priority:	high
Version:	15.0 (Stein)	CC:	alee, hrybacki, jagee, kbasil, marjones, mburns, rcritten, rmascena
Target Milestone:	rc	Keywords:	Triaged
Target Release:	15.0 (Stein)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openstack-tripleo-heat-templates-10.5.1-0.20190606110437.b9992d9.el8ost	Doc Type:	Bug Fix
Doc Text:	Previously, when using TLS Everywhere, your controller node was required to access IdM through the `ctlplane` network. As a result, if traffic was routed through a different network, then the overcloud deployment process would fail due to `getcert` errors. To address this, IdM enrolment has been moved into a composable service that runs within `host_prep_tasks`; this runs at the start of the deployment phase. Note that the script will simply exit if the instance has already been enrolled in IdM.	Story Points:	---
Clone Of:
Clones:	1677001 (view as bug list)		Environment:
Last Closed:	2019-09-21 11:19:41 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1655185, 1677001

Description Mark Jones 2018-12-21 20:16:03 UTC

Description of problem:

Failures occur during an OSP13 deployment that has TLS Everywhere enabled where access to the IDM server is _not_ via the ctlplane network. 

For example, if access to the IDM server is routed through one of the other controller networks besides ctlplane, then an overcloud node that is being deployed will not be enrolled with IDM and the deployment process will subsequently fail with getcert requests returning errors.

Version-Release number of selected component (if applicable):
OSP13

How reproducible:
Consistently

Steps to Reproduce:
1. Design a configuration where the IDM server is accessible via a network other than ctlplane

2. Deploy an OSP13 configuration with TLS Everywhere enabled

Actual results:
Deployment fails

Expected results:
Deployment succeeds

Additional info:

Comment 10 Harry Rybacki 2019-02-28 16:29:12 UTC

Up and downstream changes have merged. Moving bug to POST.

Comment 13 Martin Lopes 2019-06-11 09:49:58 UTC

Raised BZ#1719194 for docs requirements.

Comment 17 errata-xmlrpc 2019-09-21 11:19:41 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2019:2811