Description of problem: Octavia Documentation should contain warning about not setting OctaviaCaCertFile, OctaviaCaKeyFile, OctaviaClientCertFile to a read-only location in the container. https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/networking_guide/sec-octavia If the following is set in the deployment environment: OctaviaCaCertFile: "/etc/pki/ca-trust/extracted/octavia/ca_02.pem" OctaviaCaKeyFile: "/etc/pki/ca-trust/extracted/octavia/cakey02.pem" OctaviaClientCertFile: "/etc/pki/ca-trust/extracted/octavia/client.pem" The octavia continers will fail to startup with the following error in the `docker logs` output: docker logs octavia_api [...] ERROR:__main__:Unexpected error: Traceback (most recent call last): File "/usr/local/bin/kolla_set_configs", line 411, in main execute_config_strategy(config) File "/usr/local/bin/kolla_set_configs", line 377, in execute_config_strategy copy_config(config) File "/usr/local/bin/kolla_set_configs", line 306, in copy_config config_file.copy() File "/usr/local/bin/kolla_set_configs", line 150, in copy self._merge_directories(source, dest) File "/usr/local/bin/kolla_set_configs", line 97, in _merge_directories os.path.join(dest, to_copy)) File "/usr/local/bin/kolla_set_configs", line 97, in _merge_directories os.path.join(dest, to_copy)) File "/usr/local/bin/kolla_set_configs", line 97, in _merge_directories os.path.join(dest, to_copy)) File "/usr/local/bin/kolla_set_configs", line 92, in _merge_directories self._set_properties(source, dest) File "/usr/local/bin/kolla_set_configs", line 117, in _set_properties self._set_properties_from_file(source, dest) File "/usr/local/bin/kolla_set_configs", line 122, in _set_properties_from_file shutil.copystat(source, dest) File "/usr/lib64/python2.7/shutil.py", line 98, in copystat os.utime(dst, (st.st_atime, st.st_mtime)) OSError: [Errno 30] Read-only file system: '/etc/pki/ca-trust/extracted'
In an abundance of caution, I verified that this is just a documentation issue and not an actual bug. I think a simple warning to the effect that the OctaviaCaCertFile, OctaviaCaKeyFile, OctaviaClientCertFile variables specify locations in the container that should not be read-only as the deployment needs to be able access them to initialize configuration when starting the container.