Description of problem: With Openshift installation fips_enable: true on Openstack. Metering installation via CLI failed with the following error. TASK [meteringconfig : include_tasks] ****************************************** task path: /opt/ansible/roles/meteringconfig/tasks/main.yml:4 Wednesday 11 December 2019 07:17:47 +0000 (0:00:03.671) 0:00:03.801 **** included: /opt/ansible/roles/meteringconfig/tasks/update_meteringconfig_status.yml for localhost TASK [meteringconfig : Update the MeteringConfig status] *********************** task path: /opt/ansible/roles/meteringconfig/tasks/update_meteringconfig_status.yml:3 Wednesday 11 December 2019 07:17:47 +0000 (0:00:00.057) 0:00:03.859 **** An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips fatal: [localhost]: FAILED! => {"changed": false, "module_stderr": "Traceback (most recent call last):\n File \"/tmp/.ansible-/tmp/ansible-tmp-1576048667.6-158297275239258/AnsiballZ_k8s_status.py\", line 114, in <module>\n _ansiballz_main()\n File \"/tmp/.ansible-/tmp/ansible-tmp-1576048667.6-158297275239258/AnsiballZ_k8s_status.py\", line 106, in _ansiballz_main\n invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n File \"/tmp/.ansible-/tmp/ansible-tmp-1576048667.6-158297275239258/AnsiballZ_k8s_status.py\", line 49, in invoke_module\n imp.load_module('__main__', mod, module, MOD_DESC)\n File \"/tmp/ansible_k8s_status_payload_oVsAXP/__main__.py\", line 381, in <module>\n File \"/tmp/ansible_k8s_status_payload_oVsAXP/__main__.py\", line 248, in main\n File \"/tmp/ansible_k8s_status_payload_oVsAXP/__main__.py\", line 275, in execute_module\n File \"/tmp/ansible_k8s_status_payload_oVsAXP/ansible_k8s_status_payload.zip/ansible/module_utils/k8s/common.py\", line 184, in get_api_client\n File \"/usr/lib/python2.7/site-packages/openshift/dynamic/client.py\", line 71, in __init__\n self.__discoverer = discoverer(self, cache_file)\n File \"/usr/lib/python2.7/site-packages/openshift/dynamic/discovery.py\", line 226, in __init__\n Discoverer.__init__(self, client, cache_file)\n File \"/usr/lib/python2.7/site-packages/openshift/dynamic/discovery.py\", line 29, in __init__\n default_cachefile_name = 'osrcp-{0}.json'.format(hashlib.md5(self.__get_default_cache_id()).hexdigest())\nValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1} PLAY RECAP ********************************************************************* localhost : ok=2 changed=0 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0 Version-Release number of selected component (if applicable): 4.3 How reproducible: always Steps to Reproduce: 1. install openshift on Openstack with FIPS enabled 2. run ./hack/openshift-install.sh 3. Actual results: Expected results: Additional info:
it looks like the problem is fixed upstream in the openshift-restclient-python module https://github.com/openshift/openshift-restclient-python/commit/4865d274ee705c95b78723382edad0e9e4ae786a
The Dockerfile.metering-ansible-operator uses the most up-to-date openshift python client (and contains the fix). The problem is with the Dockerfile.metering-ansible-operator.rhel, which uses the python2-openshift yum package and that rpm does not contain the upstream fix noted by Peter.
The library was fixed by https://bugzilla.redhat.com/show_bug.cgi?id=1779101 python2-openshift 0.8.11 has the fix for this.
This is related to Bug https://bugzilla.redhat.com/show_bug.cgi?id=1779101 should be retested.
the new python2-openshift client worked for part of the ansible, but failed further down the installation. Will open an new bug to track.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0062