Description of problem: When deploying Octavia with TLS Everywhere and the OVN mechanism, the ovn_nb_connection option in Octavia still uses tcp:<VIP>:<Port> This appears to be hard-coded in puppet-tripleo. It should be ssl:<VIP>:<Port> when TLS Everywhere is enabled.
*** Bug 1812744 has been marked as a duplicate of this bug. ***
*** Bug 1803067 has been marked as a duplicate of this bug. ***
Fix is in: openstack-tripleo-heat-templates-11.3.2-0.20200414055425.89b7d51.el8ost puppet-tripleo-11.4.1-0.20200409181944.5d41a09.el8ost puppet-octavia-15.4.1-0.20200414135415.8bae62d.el8ost
Fix verified : [root@controller-1 ~]# export SBDB=$(sudo ovs-vsctl get open . external_ids:ovn-remote | sed -e 's/\"//g') [root@controller-1 ~]# export NBDB=$(sudo ovs-vsctl get open . external_ids:ovn-remote | sed -e 's/\"//g' | sed -e 's/6642/6641/g') [root@controller-1 ~]# echo $NBDB ssl:172.17.1.42:6641 [root@controller-1 ~]# echo $SBDB ssl:172.17.1.42:6642 (undercloud) [stack@undercloud-0 ~]$ rpm -qa | grep openstack-tripleo-heat-templates-11. openstack-tripleo-heat-templates-11.3.2-0.20200405044623.ec9970c.el8ost.noarch (undercloud) [stack@undercloud-0 ~]$ cat core_puddle_version RHOS_TRUNK-16.0-RHEL-8-20200417.n.1(undercloud) [stack@undercloud-0 ~]$
*** Bug 1825171 has been marked as a duplicate of this bug. ***
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:2114