Bug 1513502 - TLS everywhere fails with keystone admin API in the external network
Summary: TLS everywhere fails with keystone admin API in the external network
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-tripleo-heat-templates
Version: 12.0 (Pike)
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: z3
: 12.0 (Pike)
Assignee: Juan Antonio Osorio
QA Contact: Pavan
URL:
Whiteboard:
Depends On: 1608450
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-11-15 14:27 UTC by Juan Antonio Osorio
Modified: 2018-08-20 12:59 UTC (History)
11 users (show)

Fixed In Version: openstack-tripleo-heat-templates-7.0.12-1.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-08-20 12:58:30 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2331 None None None 2018-08-20 12:59:12 UTC
OpenStack gerrit 520081 None None None 2017-11-15 14:28:25 UTC
Launchpad 1732443 None None None 2017-11-15 14:27:30 UTC

Description Juan Antonio Osorio 2017-11-15 14:27:31 UTC
It's a common scenario that deployers change the keystone admin API from the ctlplane to the external network. They tend to do so by setting the appropriate value in the ServiceNetMap. With an environment that looks as follows:

parameter_defaults:
  ServiceNetMap:
    KeystoneAdminApiNetwork: external

When trying to do so, we get the following error:

overcloud.AllNodesDeploySteps.ControllerDeployment_Step1.0:
  resource_type: OS::Heat::StructuredDeployment
  physical_resource_id: 8a1a8376-07ba-43f8-8dba-8016176fd212
  status: CREATE_FAILED
  status_reason: |
    Error: resources[0]: Deployment to server failed: deploy_status_code : Deployment exited with non-zero status code: 2
  deploy_stdout: |

    PLAY [localhost] ***************************************************************

    TASK [Gathering Facts] *********************************************************
    ok: [localhost]

    TASK [Set host puppet debugging fact string] ***********************************
    ok: [localhost]

    TASK [Write the config_step hieradata] *****************************************
    changed: [localhost]

    TASK [Run puppet host configuration for step 1] ********************************
    ok: [localhost]

    TASK [debug] *******************************************************************
    fatal: [localhost]: FAILED! => {
        "(outputs.stderr|default('')).split('\n')|union(outputs.stdout_lines|default([]))": [
            "exception: connect failed",
            "erlexec: HOME must be set",
            "Warning: Facter: Fact resolution fact='systemd_internal_services', resolution='<anonymous>' resolved to an invalid value: Expected disabled to be one of [Integer, Float, TrueClass, FalseClass, NilCl
ass, String, Array, Hash], but was Symbol",
            "Warning: Undefined variable 'deploy_config_name'; ",
            " (file & line not available)",
            "Warning: ModuleLoader: module 'haproxy' has unresolved dependencies - it will only see those that are resolved. Use 'puppet module list --tree' to see information about modules",
            "Warning: ModuleLoader: module 'mysql' has unresolved dependencies - it will only see those that are resolved. Use 'puppet module list --tree' to see information about modules",
            "Error: Evaluation Error: Operator '[]' is not applicable to an Undef Value. at /etc/puppet/modules/tripleo/manifests/profile/base/keystone.pp:187:27 on node overcloud-controller-0.walrusdomain",
             ...

Comment 9 James Smith 2018-07-12 18:03:43 UTC
If this bug requires doc text for errata release, please set the 'Doc Type' and provide draft text according to the template in the 'Doc Text' field.

The documentation team will review, edit, and approve the text.

If this bug does not require doc text, please set the 'requires_doc_text' flag to -.
Thank you!

Comment 15 errata-xmlrpc 2018-08-20 12:58:30 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:2331


Note You need to log in before you can comment on or make changes to this bug.