Bug 1899761

Summary:	Barbican at edge: Director does not configure barbican parameters in glance-api.conf for Edge site
Product:	Red Hat OpenStack	Reporter:	Marian Krcmarik <mkrcmari>
Component:	openstack-tripleo-heat-templates	Assignee:	Alan Bishop <abishop>
Status:	CLOSED ERRATA	QA Contact:	Marian Krcmarik <mkrcmari>
Severity:	high	Docs Contact:
Priority:	medium
Version:	16.1 (Train)	CC:	abishop, bdobreli, dpeacock, gfidente, igallagh, mabrams, mburns
Target Milestone:	z4	Keywords:	Triaged, ZStream
Target Release:	16.1 (Train on RHEL 8.2)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openstack-tripleo-heat-templates-11.3.2-1.20201114031847.el8ost	Doc Type:	Bug Fix
Doc Text:	Before this update, when deployed at an edge site the Image (glance) service was not configured to access the Key Manager (barbican) service running on the central site's control plane. This resulted in the Image services running on edge sites being unable to access encryption keys stored in the Key Manager service. With this update, Image services running on edge sites are now configured to access the encryption keys stored in the Key Manager service.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-03-17 15:35:42 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Marian Krcmarik 2020-11-19 23:07:12 UTC

Description of problem:
The glance-api.conf is not configured correctly with all needed barbican parameters at an Edge site. The tht which is included in overcloud deloy command:
/usr/share/openstack-tripleo-heat-templates/environments/services/barbican-edge.yaml
The glance-api.conf misses some items such as:
[key_manager]
backend=barbican
[barbican]
barbican_endpoint=https://overcloud.internalapi.redhat.local:9311
auth_endpoint=https://overcloud.internalapi.redhat.local:5000

The solution seems to be in fixing barbican-client-puppet.yaml as following:
5c55
<         glance_api: &glance_barbican_config
---
>         glance_api:
61d60
<         glance_api_edge: *glance_barbican_config

Version-Release number of selected component (if applicable):
openstack-tripleo-heat-templates-11.3.2-1.20200914170172.el8ost.noarch

How reproducible:
always

Steps to Reproduce:
1. Deploy barbican at an edge site (especially by including barbican-edge.yaml)
at an edge site with ceph storage and glance multistore (with enabled glance image signature verification)
2. Check glance-api.conf at edge site

Actual results:
barbican not configured

Expected results:
barbican configured (with its endpoints)

Additional info:

Comment 19 errata-xmlrpc 2021-03-17 15:35:42 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat OpenStack Platform 16.1.4 director bug fix advisory), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:0817