Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1514244

Summary: puppet-tripleo-5.6.4-2 breaks keystone SSL config on external net for existing deployments
Product: Red Hat OpenStack Reporter: Matt Flusche <mflusche>
Component: puppet-tripleoAssignee: RHOS Maint <rhos-maint>
Status: CLOSED NOTABUG QA Contact: nlevinki <nlevinki>
Severity: medium Docs Contact:
Priority: medium    
Version: 10.0 (Newton)CC: alee, aschultz, jjoyce, jschluet, slinaber, tvignaud
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-12-08 17:30:36 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Matt Flusche 2017-11-16 22:12:31 UTC 
Description of problem:
This change: https://review.openstack.org/#/c/510738/ included in puppet-tripleo-5.6.4-2  breaks existing deployments using tcp/13357 for the keystone admin endpoint on the public/external network.

Ref: https://access.redhat.com/solutions/2943481


Version-Release number of selected component (if applicable):
puppet-tripleo-5.6.4-2.el7ost.noarch
Comment 2 Matt Flusche 2017-11-17 16:34:56 UTC 
It makes sense from a security standpoint to eliminate the non-ssl endpoint; just the behavior will not be expected for existing deployments.

It looks like the following additional config can be used to preserve the tcp/13357 haproxy listener (add to a tripleo deployment environment file):

parameter_defaults:
  controllerExtraConfig:
    tripleo::haproxy::keystone_admin_api_port: 13357

Or to switch to the new 35357 SSL listener the following can be changed in the custom tls-endpoints-public-ip.yaml or tls-endpoints-public-dns.yaml files:

KeystoneAdmin: {protocol: 'https', port: '35357', host: 'IP_ADDRESS'}

or if using DNS name:

KeystoneAdmin: {protocol: 'https', port: '35357', host: 'CLOUDNAME'}
Comment 3 Ade Lee 2017-12-08 17:30:36 UTC 
Not clear that this is a bug.  Please reopen if I'm missing something here.