Bug 1558236 - [Deployment][TLS] TLS ODL container deployments fail due to no odl user/group on host
Summary: [Deployment][TLS] TLS ODL container deployments fail due to no odl user/group...
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: puppet-tripleo
Version: 13.0 (Queens)
Hardware: Unspecified
OS: Unspecified
Target Milestone: beta
: 13.0 (Queens)
Assignee: Tim Rozet
QA Contact: Itzik Brown
Whiteboard: odl_deployment, odl_tls
Depends On:
Blocks: 1488826
TreeView+ depends on / blocked
Reported: 2018-03-19 21:05 UTC by Tim Rozet
Modified: 2018-10-18 07:24 UTC (History)
6 users (show)

Fixed In Version: puppet-tripleo-8.3.1-0.20180304033909
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2018-06-27 13:47:45 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Launchpad 1757135 0 None None None 2018-03-20 13:19:19 UTC
OpenStack gerrit 554537 0 None None None 2018-03-20 13:33:55 UTC
OpenStack gerrit 554909 0 None None None 2018-03-23 13:40:17 UTC
Red Hat Product Errata RHEA-2018:2086 0 None None None 2018-06-27 13:49:05 UTC

Description Tim Rozet 2018-03-19 21:05:04 UTC
Description of problem:
In TLS deployments a key and certificate are created for ODL on the host (as owner/group odl/odl).  These artifacts are then used to configure TLS for ODL.  In containerized deployments these files are still created on the host, and then mounted into the ODL container.  However, now that we containerize ODL, it means the RPM is no longer installed on the host, and the 'odl' linux group/user are not created.  Thus when deploying with TLS and ODL, there is a puppet error saying:

            "Error: /Stage[main]/Tripleo::Certmonger::Opendaylight/File[/etc/pki/tls/certs/odl.crt]/group: change from root to odl failed: Could not find group odl",                            
            "Error: /Stage[main]/Tripleo::Certmonger::Opendaylight/File[/etc/pki/tls/private/odl.key]/owner: change from root to odl failed: Could not find user odl",                           
            "Error: /Stage[main]/Tripleo::Certmonger::Opendaylight/File[/etc/pki/tls/private/odl.key]/group: change from root to odl failed: Could not find group odl"    

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.  Deploy ODL with internal TLS enabled and containers

Actual results:

Expected results:

Additional info:
A workaround to this issue is to virt-customize the overcloud image and install ODL on it to get the user/group created.

Comment 7 Itzik Brown 2018-04-26 09:35:57 UTC
Checked with:

Comment 9 errata-xmlrpc 2018-06-27 13:47:45 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.