Bug 2302191

I modified overcloud-resource-registry-puppet.j2.yaml as follows.
~~~
parameter_merge_strategies:
  ServiceNetMap: merge
  VipSubnetMap: merge
  SshServerOptions: merge
  ExtraConfig: merge
{% for role in roles %}
  {{role.name}}Parameters: merge
  {{role.name}}ExtraConfig: merge
  {{role.name}}ExtraGroupVars: merge <--- ADDED
{% endfor %}

parameter_defaults:
  NeutronMechanismDrivers: ovn
  ContainerCli: podman
  EnablePackageInstall: false
  SoftwareConfigTransport: POLL_SERVER_HEAT
  OVNIntegrationBridge: br-int
  ExtraConfig: {}

{% for role in roles %}
  # Parameters generated for {{role.name}} Role
  {{role.name}}Services: {{role.ServicesDefault|default([])}}
  {{role.name}}Parameters: {}
  {{role.name}}ExtraConfig: {}
  {{role.name}}ExtraGroupVars: {} <--- ADDED
{% endfor %}
~~~

I did the following tests.

~~~
$ cat virt/firewall.yaml 
parameter_defaults:
  ExtraFirewallRules:
    '300 accept ssh from any':
      dport: 22
      proto: tcp
    '400 accept BFD controll packet from any':
      dport: 3784
      proto: udp
    '401 accept BFD Echo packet from any':
      dport: 3785
      proto: udp
    '500 allow zabbix':
      dport: 10050
      proto: tcp
  ControllerExtraGroupVars:
    tripleo_firewall_default_rules: {'000 accept relatedestablished rules': { proto: all, state: ["RELATED", "ESTABLISHED"]},'001 accept all icmp': {ipversion: ipv4, proto: icmp}, '001 accept all ipv6-icmp': {ipversion: ipv6, proto: ipv6-icmp}, '002 accept all to lo interface': {proto: all, interface: lo}, '004 accept ipv6 dhcpv6': {ipversion: ipv6, dport: 546, proto: udp, state: NEW, destination: 'fe80::/64'}, '999 drop all': {proto: all, action: drop}}
  ComputeExtraGroupVars:
    tripleo_firewall_default_rules: {'000 accept related established rules': { proto: all, state: ["RELATED", "ESTABLISHED"]}, '001 accept all icmp': {ipversion: ipv4, proto: icmp}, '001 accept all ipv6-icmp': {ipversion: ipv6, proto: ipv6-icmp}, '002 accept all to lo interface': {proto: all, interface: lo}, '004 accept ipv6 dhcpv6': {ipversion: ipv6, dport: 546, proto: udp, state: NEW, destination: 'fe80::/64'}, '999 drop all': {proto: all, action: drop}}
~~~

~~~
 cat virt/config_heat.yaml 
parameter_defaults:
  Timezone: Asia/Tokyo
  ControllerExtraGroupVars: &chrony_action_tests
    chrony_role_action: config
  ComputeExtraGroupVars: *chrony_action_tests
~~~

~~~
openstack overcloud deploy \
--timeout 240 \
--templates /usr/share/openstack-tripleo-heat-templates \
  --environment-file /usr/share/openstack-tripleo-heat-templates/environments/services/octavia.yaml \
--stack overcloud \
--libvirt-type kvm \
--ntp-server clock.corp.redhat.com \
--deployed-server \
-e /home/stack/templates/overcloud-vip-deployed.yaml \
-e /home/stack/templates/overcloud-networks-deployed.yaml \
-e /home/stack/templates/overcloud-baremetal-deployed.yaml \
--networks-file /home/stack/virt/network/network_data_v2.yaml \
-e /home/stack/virt/config_lvm.yaml \
-e /home/stack/virt/network/network-environment_v2.yaml \
-e ~/fencing.yaml \
-e /home/stack/virt/hostnames.yml \
-e /usr/share/openstack-tripleo-heat-templates/environments/services/neutron-ovn-dvr-ha.yaml \
-e /home/stack/virt/debug.yaml \
-e /home/stack/virt/config_heat.yaml \
-e /home/stack/virt/nodes_data.yaml \
-e ~/containers-prepare-parameter.yaml \
-e /home/stack/virt/l3_fip_qos.yaml \
-e /home/stack/virt/firewall.yaml \
--log-file overcloud_deployment_0.log
~~~

Without the modification, chrony_role_action was not set to config.
Wit the modification, chrony_role_action is set to config.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: RHOSP 17.1.4 (openstack-tripleo-heat-templates) security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2024:9978