Bug 1661621
| Summary: | When using novajoin and IPA with an external CA chain, haproxy is not configured with the proper intermediate cert chain | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Brian J. Atkisson <batkisso> |
| Component: | openstack-tripleo-heat-templates | Assignee: | Emilien Macchi <emacchi> |
| Status: | CLOSED DUPLICATE | QA Contact: | Gurenko Alex <agurenko> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 13.0 (Queens) | CC: | bperkins, dhill, hrybacki, mburns, nkinder |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-04-05 16:04:11 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1595876 | ||
| Bug Blocks: | |||
|
Description
Brian J. Atkisson
2018-12-21 18:49:58 UTC
This is likely a bug. We use certmonger's "post-save" command to update the certs/keys for HAProxy. You can see the details of this post save command on your controllers like this: ---------------------------------------------------------------------- [heat-admin@overcloud-controller-0 ~]$ sudo getcert list -i haproxy-external-cert Number of certificates and requests being tracked: 17. Request ID 'haproxy-external-cert': status: MONITORING stuck: no key pair storage: type=FILE,location='/etc/pki/tls/private/haproxy/overcloud-haproxy-external.key' certificate: type=FILE,location='/etc/pki/tls/certs/haproxy/overcloud-haproxy-external.crt' CA: IPA issuer: CN=Certificate Authority,O=OOO.TEST subject: CN=overcloud.ooo.test,O=OOO.TEST expires: 2020-12-15 01:19:52 UTC dns: overcloud.ooo.test principal name: haproxy/overcloud.ooo.test key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: "cat /etc/pki/tls/certs/haproxy/overcloud-haproxy-external.crt /etc/pki/tls/private/haproxy/overcloud-haproxy-external.key > /etc/pki/tls/private/overcloud_endpoint.pem && if systemctl -q is-active haproxy; then systemctl reload haproxy; else true; fi" track: yes auto-renew: yes ---------------------------------------------------------------------- The post-save command used for HAProxy appears to be configurable at the puppet-tripleo level: ---------------------------------------------------------------------- https://github.com/openstack/puppet-tripleo/blob/392d629d9f83bd2b2445d0e473dde4dde3510294/manifests/certmonger/haproxy.pp#L47-L49 https://github.com/openstack/puppet-tripleo/blob/392d629d9f83bd2b2445d0e473dde4dde3510294/manifests/profile/base/certmonger_user.pp#L55-L58 ---------------------------------------------------------------------- I don't see anywhere we can specify this via tripleo-heat-templates though, which is what you would need to be able to pass a custom command in. I believe we need to add some flexibility here so you can have other certificates injected into the HAProxy bundle. This would be needed for cases where some outside CA is used for the external certs. The other thing we should do here is to change the default behavior when "TLS everywhere" is used and IPA is used for the external certs. In this case, we should just automatically add /etc/ipa/ca.crt in the post-save command instead of requiring the user to override it. The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days |