Description of problem: On a deployed, working, OSP 13 non-SSL overcloud: deploying with new SSL templates to encrypt public endpoints will fail because the haproxy pacemaker bundle does not get properly updated with the docker volume to read the certificate from. Version-Release number of selected component (if applicable): RHOSP 13 How reproducible: easily, any addition of SSL endpoint encryption on an already deployed cloud will fail Steps to Reproduce: 1. deploy a classic non-SSL RHOSP 13 overcloud 2. add templates to encrypt endpoints (following official doc) and re-deploy 3. the deployment will fail simply because the haproxy-bundle PCS resource does not get properly updated with the new volume necessary to read the certificate. Actual results: deployment will fail at step 3, and looking at the pacemaker status you will see that the haproxy-bundles are down on all controllers as well as the VIPs. Expected results: the deployment should finish and enable the encryption of SSL endpoints Additional info: We know the problem is directly related to the fact the the haproxy-bundle pcs resource is not able to start, since there is no haproxy running, the deployment fail. We were able to successfully debug this and add the missing volume to the haproxy-bundle and successfully complete the deployment, this needs to be done automatically. here is the command we used to fix the haproxy bundle: pcs resource bundle update haproxy-bundle \ storage-map add id=haproxy-cert options=ro \ source-dir=/etc/pki/tls/private/overcloud_endpoint.pem \ target-dir=/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/overcloud_endpoint.pem simply adding the missing volume to the haproxy bundle allowed it to start and the deployment to continue. It looks like the addition of the etc/pki/tls/private/overcloud_endpoint.pem volume to the haproxy-bundle volumes is done properly when deploying SSL encrypted public endpoints on a new deployment but the existing haproxy-bundle resource is not updated when we do an overcloud deploy on an existing overcloud.
*** Bug 1679413 has been marked as a duplicate of this bug. ***
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:0448