Description of problem: ======================= https://bugs.launchpad.net/tripleo/+bug/1754363 While trying to deploy TLS everywhere, given that we set the neutron cert specs in the neutron-base yaml, every node tries to request a certificate for neutron. However, not all neutron services output metadata_settings that would actually create a service principal that enables the usage of that cert. Hence, when we deploy, we get the following error: "Error: /Stage[main]/Tripleo::Certmonger::Neutron/Certmonger_certificate[neutron]: Could not evaluate: Could not get certificate: Server at https://freeipa-0.redhat.local/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: Insufficient 'add' privilege to add the entry '<email address hidden>,cn=services,cn=accounts,dc=redhat,dc=local'.).", "Warning: /Stage[main]/Tripleo::Certmonger::Neutron/File[/etc/pki/tls/certs/neutron.crt]: Skipping because of failed dependencies", "Warning: /Stage[main]/Tripleo::Certmonger::Neutron/File[/etc/pki/tls/private/neutron.key]: Skipping because of failed dependencies", "Warning: /Stage[main]/Tripleo::Certmonger::Ca::Crl/File[tripleo-ca-crl]: Skipping because of failed dependencies", "Warning: /Stage[main]/Tripleo::Certmonger::Ca::Crl/Exec[tripleo-ca-crl-process-command]: Skipping because of failed dependencies", "Warning: /Stage[main]/Tripleo::Certmonger::Ca::Crl/Cron[tripleo-refresh-crl-file]: Skipping because of failed dependencies" Version-Release number of selected component (if applicable): How reproducible: ================= Always
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:2086