Bug 1538326 – [Deployment][TLS] Using SSL URI for ovsdb_connection fails

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1538326 - [Deployment][TLS] Using SSL URI for ovsdb_connection fails

Summary:	[Deployment][TLS] Using SSL URI for ovsdb_connection fails

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat OpenStack
Classification:	Red Hat
Component:	openstack-neutron (Show other bugs)
Sub Component:
Version:	13.0 (Queens)
Hardware:	Unspecified Unspecified

Priority	high Severity high
Target Milestone:	beta
Target Release:	13.0 (Queens)
Assigned To:	Tim Rozet
QA Contact:	Itzik Brown
Docs Contact:

URL:
Whiteboard:	odl_deployment, odl_tls
Keywords:	Triaged

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2018-01-24 15:04 EST by Tim Rozet
Modified:	2018-10-18 03:25 EDT (History)
CC List:	7 users (show)

See Also:
Fixed In Version:	openstack-neutron-12.0.0-0.20180215204452.fb3f718
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:	N/A
Last Closed:	2018-06-27 09:43:23 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Flags:	trozet: needinfo-

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Launchpad	1745038	None	None	None	2018-01-24 15:04 EST
OpenStack gerrit	536983	None	master: MERGED	neutron: Fixes using SSL OVSDB connection (I19fd9dd0c72260835eb91e557a6029ec9d652179)	2018-02-19 11:33 EST
OpenStack gerrit	540127	None	master: MERGED	puppet-neutron: Adds configuration for SSL OVSDB connections (I82281eefa1aa81207ccd8ea565cffc6ca0ec48de)	2018-02-19 11:33 EST
OpenStack gerrit	540146	None	master: MERGED	puppet-tripleo: Adds missing Neutron TLS certificate/key generation (I4bbaf00f0776cab0be34d814a541fb2fd1e64326)	2018-02-19 11:33 EST
OpenStack gerrit	540164	None	master: MERGED	tripleo-heat-templates: Fixes missing SSL configuration for Neutron DHCP agent (I97352027d7f750d0820610fb9e06f82b47e7705...	2018-02-19 11:33 EST
Red Hat Product Errata	RHEA-2018:2086	None	None	None	2018-06-27 09:44 EDT

Groups: None (edit)

Description Tim Rozet 2018-01-24 15:04:55 EST

Description of problem:
When using an ssl URI for ovsdb_connection in neutron.conf, like:
ovsdb_connection=ssl:127.0.0.1:6639

The connection will fail because there is missing SSL configuration for key, cert, and ca cert that is required when creating an SSL stream connection to OVSDB. This configuration is not part of ovsdbapp and must be setup before invoking the IDL helper function that asks ovsdbapp to open the connection.

Comment 4 Itzik Brown 2018-04-26 04:58:54 EDT

Tim.
Is it about the local connection on the controllers because it's not connected.

[root@controller-1 heat-admin]# ovs-vsctl show | head -10
fdd50b4c-a491-4308-b2a0-8a1bdfc04d2d
    Manager "ssl:172.17.1.21:6640"
        is_connected: true
    Manager "ssl:172.17.1.13:6640"
        is_connected: true
    Manager "ssl:172.17.1.19:6640"
        is_connected: true
    Manager "pssl:6639:127.0.0.1"
    Bridge br-ex
        fail_mode: standalone

Comment 5 Itzik Brown 2018-05-03 04:15:20 EDT

Checked with:
openstack-neutron-12.0.2-0.20180421011358.0ec54fd.el7ost.noarch

Comment 7 errata-xmlrpc 2018-06-27 09:43:23 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:2086

Note You need to log in before you can comment on or make changes to this bug.