Bug 1778719

Description of problem:

The following patch:

~~~~
Per-Role krb-service-principal for CompactServices

Filter krb-service-principals for the CompactServices
based on the networks associated with the role.

Filtering for the IndividualServices was added in previous
fix https://review.openstack.org/646005, which did'nt
fully fix the bug.

Closes-Bug: #1821377
Change-Id: Id54477ca5581e1f5fe8a09c3bc60a238d114dbb2
(cherry picked from commit 578bcb2ffa)

tags/10.6.1
~~~~

LINK: https://opendev.org/openstack/tripleo-heat-templates/commit/223ddba9137a3c9129fc33593db086518bf75a78?lang=en-US


Contains additional filtering (as means to workaround nova metadata fields size limit: each field cannot exceed 256 bytes). 

However, the filtering might be a little too aggressive: 

l63: {%- for network in networks if network.vip|default(false) and network.name in role.networks %} 
                                    ^^^^^^^^^^^^^^^^^^^^^^^^^^

$ cat network_data.yaml
 
#CTL-MANAGEMENT
- name: MgmtCtl
  name_lower: mgmtctl
  vip: false                 <<<<<<<<<<<<<<<<<
  ip_subnet: xxx.xxx.xxx.0/xx
  allocation_pools: [{'start': 'xxx.xxx.xxx.xxx', 'end': 'xxx.xxx.xxx.xxx'}]
  vlan: xxxxxxxx
 
< snip > 


os-collect-config logs:

Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: "Warning: Could not get certificate: Execution of '/usr/bin/getcert request -I contrail -f /etc/contrail/ssl/certs/server.pem -c IPA -N CN=ctl1.xxxxxxxxxxxxxxxx -K contrail/ctl1.xxxxxxxxxxxxxxxx -D ctl1.ctlplane.xxxxxxxxxxxxxxxx -D ctl1.mgmtctl.xxxxxxxxxxxxxxxx -D < snip > -D  -D  -D  -D  -D  -C sudo docker ps -q --filter=name=\"contrail*\" | xargs -i sudo docker restart {} -w -k /etc/contrail/ssl/private/server-privkey.pem' returned 3: New signing request \"contrail\" added.",
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: "Error: /Stage[main]/Tripleo::Certmonger::Contrail/Certmonger_certificate[contrail]: Could not evaluate: Could not get certificate: Server at https://idm.xxxxxxxxxxxxxxxx/ipa/xml failed request, will retry: 4001 (RPC failed at server.  The service principal for subject alt name ctl1.mgmtctl.xxxxxxxxxxxxxxxx in certificate request does not exist).",
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: "Warning: Could not get certificate: Execution of '/usr/bin/getcert request -I httpd-mgmtctl -f /etc/pki/tls/certs/httpd/httpd-mgmtctl.crt -c IPA -N CN=ctl1.mgmtctl.xxxxxxxxxxxxxxxx -K HTTP/ctl1.mgmtctl.xxxxxxxxxxxxxxxx -D ctl1.mgmtctlxxxxxxxxxxxxxxxxx -C pkill -USR1 httpd -w -k /etc/pki/tls/private/httpd/httpd-mgmtctl.key' returned 3: New signing request \"httpd-mgmtctl\" added.",
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: "Error: /Stage[main]/Tripleo::Profile::Base::Certmonger_user/Tripleo::Certmonger::Httpd[httpd-mgmtctl]/Certmonger_certificate[httpd-mgmtctl]: Could not evaluate: Could not get certificate: Server at https://idm.xxxxxxxxxxxxxxxx/ipa/xml failed request, will retry: 4001 (RPC failed at server.  The host 'ctl1.mgmtctl.xxxxxxxxxxxxxxxx' does not exist to add a service to.).",
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: "Warning: /Stage[main]/Tripleo::Certmonger::Ca::Crl/Exec[tripleo-ca-crl]: Skipping because of failed dependencies",
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: "Warning: /Stage[main]/Tripleo::Certmonger::Ca::Crl/File[tripleo-ca-crl-file]: Skipping because of failed dependencies",
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: "Warning: /Stage[main]/Tripleo::Certmonger::Ca::Crl/Exec[tripleo-ca-crl-process-command]: Skipping because of failed dependencies",
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: "Warning: /Stage[main]/Tripleo::Certmonger::Ca::Crl/Cron[tripleo-refresh-crl-file]: Skipping because of failed dependencies"
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: ]
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: }
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: to retry, use: --limit @/var/lib/heat-config/heat-config-ansible/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx_playbook.retry
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: PLAY RECAP *********************************************************************
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: localhost                  : ok=26   changed=13   unreachable=0    failed=1
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: [2019-11-22 12:03:22,217] (heat-config) [ERROR] Error running /var/lib/heat-config/heat-config-ansible/_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxplaybook.yaml. [2]
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: [2019-11-22 12:03:22,223] (heat-config) [INFO] Completed /usr/libexec/heat-config/hooks/ansible
Nov 22 12:03:22 ctl1.xxxxxxxxxxxxxxxx os-collect-config[11623]: [2019-11-22 12:03:22,224] (heat-config) [DEBUG] Running heat-config-notify /var/lib/heat-config/deployed/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.json < /var/lib/heat-config/deployed/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.notify.json

                                                                                                                                                                                                                                                                                                                                                                  

Version-Release number of selected component (if applicable):
RHOSP-13z9

How reproducible:
Every time.