Bug 1823932 - [RFE] DNS entries for the overcloud and undercloud nodes should be added to freeIPA DNS
Summary: [RFE] DNS entries for the overcloud and undercloud nodes should be added to f...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-tripleo-heat-templates
Version: 16.0 (Train)
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: beta
: 16.1 (Train on RHEL 8.2)
Assignee: Grzegorz Grasza
QA Contact: Jeremy Agee
URL:
Whiteboard:
: 1534070 1608395 (view as bug list)
Depends On:
Blocks: 1825348 1848153 1859750
TreeView+ depends on / blocked
 
Reported: 2020-04-14 19:49 UTC by Ade Lee
Modified: 2020-07-29 07:52 UTC (History)
9 users (show)

Fixed In Version: openstack-tripleo-heat-templates-11.3.2-0.20200608033439.e136acb.el8ost
Doc Type: Enhancement
Doc Text:
With this enhancement, FreeIPA has DNS entries for the undercloud and overcloud nodes. DNS PTR records are necessary to generate certain types of certificates, particularly certificates for cinder active/active environments with etcd. You can disable this functionality with the `IdMModifyDNS` parameter in an environment file.
Clone Of:
: 1859750 (view as bug list)
Environment:
Last Closed: 2020-07-29 07:51:34 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
OpenStack gerrit 716982 0 None MERGED Add tripleo_ipa_dns role 2021-01-06 04:36:57 UTC
OpenStack gerrit 717295 0 None MERGED Create DNS entries in IPA for openstack services 2021-01-06 04:36:21 UTC
Red Hat Product Errata RHBA-2020:3148 0 None None None 2020-07-29 07:52:08 UTC

Description Ade Lee 2020-04-14 19:49:58 UTC 
Description of problem:

There are many cases where it is useful to have the DNS entries for the overcloud and undercloud node be addedto the IPA server when we are deploying an overcloud with TLS everywhere.

This for example, is required, to support TLS connections to etcd for cinder active/active.  In this case, the dns entry is required for certain subhosts so that the IPA server can issue a TLS cert with an IP SAN.
See https://bugzilla.redhat.com/show_bug.cgi?id=1804079

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:
Comment 9 Alex McLeod 2020-06-16 12:30:53 UTC 
If this bug requires doc text for errata release, please set the 'Doc Type' and provide draft text according to the template in the 'Doc Text' field. The documentation team will review, edit, and approve the text.

If this bug does not require doc text, please set the 'requires_doc_text' flag to '-'.
Comment 12 Nathan Kinder 2020-06-25 16:28:47 UTC 
*** Bug 1534070 has been marked as a duplicate of this bug. ***
Comment 13 Nathan Kinder 2020-06-25 16:59:19 UTC 
*** Bug 1608395 has been marked as a duplicate of this bug. ***
Comment 15 errata-xmlrpc 2020-07-29 07:51:34 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3148
Note You need to log in before you can comment on or make changes to this bug.