Bug 2179163

The issue was that the docs assume you will have the same domain name as your realm name. 

By default in the templates if you do not have the parameter `CertmongerKerberosRealm` set it will use the parameter `CloudDomain` to set this parameter. 
Which in turn is used to set the puppet parameter `certmonger_krb_realm`. 


/usr/share/openstack-tripleo-heat-templates/deployment/certs/certmonger-user-baremetal-puppet.yaml
~~~
outputs:
  role_data:
    description: Role data for the certmonger-user service
    value:
      service_name: certmonger_user
      config_settings:
        map_merge:
          - certmonger_ca: {get_param: CertmongerCA}
          - if:
            - internal_tls_enabled
            - tripleo::certmonger::ca::crl::crl_source: {get_param: DefaultCRLURL}
              certmonger_ca_vnc: {get_param: CertmongerVncCA}
              certmonger_ca_qemu: {get_param: CertmongerQemuCA}
              certmonger_krb_realm:
                if:
                - {not: {equals: [{get_param: CertmongerKerberosRealm},'']}}
                - {get_param: CertmongerKerberosRealm}
                - yaql:
                    expression: $.data.toUpper()
                    data: {get_param: CloudDomain}
            - {}
~~~


Finally this is used to set the realm part of the `principle` parameter of the `*certificates_specs`. 

/usr/share/openstack-tripleo-heat-templates/deployment/apache/apache-baremetal-puppet.j2.yaml
~~~
              apache_certificates_specs:
                map_merge:
                  repeat:
                    template:
                      httpd-NETWORK:
                        service_certificate: '/etc/pki/tls/certs/httpd/httpd-NETWORK.crt'
                        service_key: '/etc/pki/tls/private/httpd/httpd-NETWORK.key'
                        hostname: "%{hiera('fqdn_NETWORK')}"
                        principal: "HTTP/%{hiera('fqdn_NETWORK')}@%{hiera('certmonger_krb_realm')}"
                        postsave_cmd: "pkill -USR1 httpd"
                        key_size:
                          if:
                            - key_size_override_unset
                            - {get_param: CertificateKeySize}
                            - {get_param: ApacheCertificateKeySize}
                    for_each:
                      NETWORK: {get_attr: [ApacheNetworks, value]}
            - {}
~~~


Which is what is used for creating the certmonger certificate requests.

/usr/share/openstack-puppet/modules/tripleo/manifests/profile/base/certmonger_user.pp
~~~
    $apache_certificates_specs_filtered = $apache_certificates_specs.filter | $specs, $keys | { ! empty($keys[hostname]) }
    unless empty($apache_certificates_specs_filtered) {
      include ::tripleo::certmonger::apache_dirs
      ensure_resources('tripleo::certmonger::httpd', $apache_certificates_specs_filtered)
    }
~~~
/usr/share/openstack-puppet/modules/tripleo/manifests/certmonger/httpd.pp
~~~
define tripleo::certmonger::httpd (
  $hostname,
  $service_certificate,
  $service_key,
  $certmonger_ca = hiera('certmonger_ca', 'local'),
  $dnsnames      = undef,
  $postsave_cmd  = undef,
  $principal     = undef,
  $key_size      = 2048,
) {
  include ::certmonger
  include ::apache::params

  if $dnsnames {
    $dnsnames_real = $dnsnames
  } else {
    $dnsnames_real = $hostname
  }

  certmonger_certificate { $name :
    ensure       => 'present',
    certfile     => $service_certificate,
    keyfile      => $service_key,
    hostname     => $hostname,
    dnsname      => $dnsnames_real,
    principal    => $principal,
    postsave_cmd => $postsave_cmd,
    ca           => $certmonger_ca,
    key_size     => $key_size,
    wait         => true,
    tag          => 'apache-cert',
    require      => Class['::certmonger'],
    subscribe    => File[$service_key],
  }
  file { $service_key:
    audit => [content],
  }

  Certmonger_certificate[$name] ~> Service<| title == $::apache::params::service_name |>
}
~~~