Bug 2214328
| Summary: | Designate deployment fails when enabling secure RBAC | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Brent Eagles <beagles> |
| Component: | openstack-tripleo-heat-templates | Assignee: | Brent Eagles <beagles> |
| Status: | CLOSED ERRATA | QA Contact: | Lilach Avraham <lavraham> |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 17.1 (Wallaby) | CC: | bbonguar, gregraka, gthiemon, jamsmith, jelynch, lavraham, mburns, njohnston, pgrist |
| Target Milestone: | ga | Keywords: | AutomationBlocker, Triaged |
| Target Release: | 17.1 | Flags: | jelynch:
needinfo?
(beagles) jamsmith: needinfo? (beagles) jamsmith: needinfo? (gregraka) |
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | openstack-tripleo-heat-templates-14.3.1-1.20230519151015.el9ost | Doc Type: | Known Issue |
| Doc Text: |
Currently, DNS-as-a-Service (designate) is misconfigured when secure role-based access control (SRBAC) is enabled. If you configure both SRBAC and DNS-as-a-Service, the RHOSP deployment fails. Workaround: For a successful deployment, apply the following patches on the undercloud server:
* https://review.opendev.org/c/openstack/tripleo-heat-templates/+/885291
* https://review.opendev.org/c/openstack/tripleo-heat-templates/+/885599
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-08-16 01:15:43 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2124618 | ||
Edited the doc text for 17.1 beta release notes. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Release of components for Red Hat OpenStack Platform 17.1 (Wallaby)), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2023:4577 |
Overcloud deployment fails when the designate related "designate_pool_manage" container runs: 2023-06-12 10:34:39.988752 | 525400b4-3bff-826e-b8aa-00000000e590 | FATAL | Create containers managed by Podman for /var/lib/tripleo-config/container-startup-config/step_5 | controller-0 | error={"changed": false, "msg": "Failed containers: designate_pool_manage"} 2023-06-12 10:34:39.989447 | 525400b4-3bff-826e-b8aa-00000000e590 | TIMING | tripleo_container_manage : Create containers managed by Podman for /var/lib/tripleo-config/container-startup-config/step_5 | controller-0 | 1:10:39.826209 | 3.24s There are two contributing causes, both found in the tripleo heat templates: - There is syntax error of "or or" in the designate policies in enable-secure-rbac.yaml - enforce_new_defaults is not set to true for the designate policies.