[Docs][OSP 13] Octavia Documentation should contain warning about not setting OctaviaCaCertFile, OctaviaCaKeyFile, OctaviaClientCertFile to a read-only location in the container
Description of problem:
Octavia Documentation should contain warning about not setting OctaviaCaCertFile, OctaviaCaKeyFile, OctaviaClientCertFile to a read-only location in the container.
https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/networking_guide/sec-octavia
If the following is set in the deployment environment:
OctaviaCaCertFile: "/etc/pki/ca-trust/extracted/octavia/ca_02.pem"
OctaviaCaKeyFile: "/etc/pki/ca-trust/extracted/octavia/cakey02.pem"
OctaviaClientCertFile: "/etc/pki/ca-trust/extracted/octavia/client.pem"
The octavia continers will fail to startup with the following error in the `docker logs` output:
docker logs octavia_api
[...]
ERROR:__main__:Unexpected error:
Traceback (most recent call last):
File "/usr/local/bin/kolla_set_configs", line 411, in main
execute_config_strategy(config)
File "/usr/local/bin/kolla_set_configs", line 377, in execute_config_strategy
copy_config(config)
File "/usr/local/bin/kolla_set_configs", line 306, in copy_config
config_file.copy()
File "/usr/local/bin/kolla_set_configs", line 150, in copy
self._merge_directories(source, dest)
File "/usr/local/bin/kolla_set_configs", line 97, in _merge_directories
os.path.join(dest, to_copy))
File "/usr/local/bin/kolla_set_configs", line 97, in _merge_directories
os.path.join(dest, to_copy))
File "/usr/local/bin/kolla_set_configs", line 97, in _merge_directories
os.path.join(dest, to_copy))
File "/usr/local/bin/kolla_set_configs", line 92, in _merge_directories
self._set_properties(source, dest)
File "/usr/local/bin/kolla_set_configs", line 117, in _set_properties
self._set_properties_from_file(source, dest)
File "/usr/local/bin/kolla_set_configs", line 122, in _set_properties_from_file
shutil.copystat(source, dest)
File "/usr/lib64/python2.7/shutil.py", line 98, in copystat
os.utime(dst, (st.st_atime, st.st_mtime))
OSError: [Errno 30] Read-only file system: '/etc/pki/ca-trust/extracted'
In an abundance of caution, I verified that this is just a documentation issue and not an actual bug.
I think a simple warning to the effect that the OctaviaCaCertFile, OctaviaCaKeyFile, OctaviaClientCertFile variables specify locations in the container that should not be read-only as the deployment needs to be able access them to initialize configuration when starting the container.