If the Undercloud is configured with SSL and the OSP 9 overcloud-full image is used to deploy the following error appears during the os-collect-config run on a controller:


 (heat-config) [DEBUG] Running /var/lib/heat-config/hooks/puppet < /var/lib/heat-config/deployed/f748838f-7a68-49d9-a896-6fda40ecb5d6.json
 (heat-config) [INFO] {"deploy_stdout": "", "deploy_stderr": "\u001b[1;31mError: Could not find class ::tripleo::trusted_cas for overcloud-controller-0.localdomain on node overcloud-controller-0.localdo
 (heat-config) [DEBUG] [2016-11-15 15:25:19,382] (heat-config) [DEBUG] Running FACTER_heat_outputs_path="/var/run/heat-config/heat-config-puppet/f748838f-7a68-49d9-a896-6fda40ecb5d6"  FACTER_fqdn="overc
 (heat-config) [INFO] Return code 1
 (heat-config) [INFO] Error: Could not find class ::tripleo::trusted_cas for overcloud-controller-0.localdomain on node overcloud-controller-0.localdomain
ss ::tripleo::trusted_cas for overcloud-controller-0.localdomain on node overcloud-controller-0.localdomain
 (heat-config) [ERROR] Error running /var/lib/heat-config/heat-config-puppet/f748838f-7a68-49d9-a896-6fda40ecb5d6.pp. [1]

Looking at the file it uses "include ::tripleo::trusted_cas":

# Copyright 2015 Red Hat, Inc.
# All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.

if hiera('step') >= 4 {
  hiera_include('controller_classes', [])
}

$package_manifest_name = join(['/var/lib/tripleo/installed-packages/overcloud_controller_pacemaker', hiera('step')])
package_manifest{$package_manifest_name: ensure => present}
include ::tripleo::trusted_cas

[...]

No workaround at this point but could be a similar fix to the one in https://bugs.launchpad.net/tripleo/+bug/1626452