Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1846812

Summary: haproxy.pp in puppet-tripleo generates wrong haproxy.cfg for SSL-protected rgw instances
Product: Red Hat OpenStack Reporter: Shailesh Chhabdiya <schhabdi>
Component: puppet-tripleoAssignee: Francesco Pantano <fpantano>
Status: CLOSED ERRATA QA Contact: Yogev Rabl <yrabl>
Severity: high Docs Contact:
Priority: high    
Version: 16.0 (Train)CC: bperkins, fpantano, gfidente, jjoyce, jpadman, jschluet, lhh, mburns, mgarciac, michele, mputhenp, pgrist, rlobillo, slinaber, slong, spower, tvignaud
Target Milestone: rcKeywords: Triaged
Target Release: 16.1 (Train on RHEL 8.2)   
Hardware: All   
OS: All   
Whiteboard:
Fixed In Version: puppet-tripleo-11.5.0-0.20200616033427.8ff1c6a.el8ost Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-07-29 07:53:11 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1701416    

Description Shailesh Chhabdiya 2020-06-14 17:37:42 UTC 
Description of problem:
haproxy.pp assumes that Ceph rgw instances are always using plaintext and do not support SSL connectivity and hence explicitly ignore internal_tls_member_options even if EnableInternalTLS is active. In setups with SSL-protected rgw instances, this leads to a broken haproxy.cfg configuration file in which the Ceph rgw instances refuse to communicate to HAproxy, reporting an SSL handshake failure.

To the outside world, this leads to 503 errors when trying to communicate to the Ceph rgw instance, effectively making it impossible to use rgw for instance as storage for OpenShift deployments in TLS-everywhere setups.

Version-Release number of selected component (if applicable):
Red Hat OpenStack 16

Additional info:

Upstream Bug: https://bugs.launchpad.net/tripleo/+bug/1883296
Comment 8 Yogev Rabl 2020-06-26 19:12:52 UTC 
verified on puppet-tripleo-11.5.0-0.20200616033427.8ff1c6a.el8ost.noarc
Comment 12 Francesco Pantano 2020-07-16 07:37:12 UTC 
*** Bug 1856923 has been marked as a duplicate of this bug. ***
Comment 14 errata-xmlrpc 2020-07-29 07:53:11 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3148
Comment 15 John Fulton 2020-08-10 13:24:36 UTC 
*** Bug 1866036 has been marked as a duplicate of this bug. ***