Description of problem: When TLS everywhere is enabled, haproxy configuration doesn't include the required SSL configuration for Ceph RGW backend checking. A fix is applied in the upstream code https://github.com/openstack/puppet-tripleo/commit/436bfaa158d8ff48b9e499158f6edd00df22e0a4 This bug causes Ceph RGW to be not available in the newly deployed OSP. Version-Release number of selected component (if applicable): Red Hat OpenStack 16.0 Package version : puppet-tripleo-11.4.1-0.20200402130302.b4678ba.el8ost.noarch How reproducible: Always. Steps to Reproduce: 1. Deploy OSP with TLS everywhere and ceph rgw by including the following in openstack deployment > -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml \ > -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-everywhere-endpoints-dns.yaml \ > -e /usr/share/openstack-tripleo-heat-templates/environments/services/haproxy-public-tls-certmonger.yaml \ > -e /usr/share/openstack-tripleo-heat-templates/environments/ceph-ansible/ceph-ansible.yaml \ > -e /usr/share/openstack-tripleo-heat-templates/environments/ceph-ansible/ceph-rgw.yaml \ > -e /usr/share/openstack-tripleo-heat-templates/environments/ceph-ansible/ceph-dashboard.yaml \ 2. Even after a successful deployment, Swift (ceph rgw) service will not be available. 3. Check /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg to verify backend section of "ceph_rgw". It will not have the required SSL checks for the backends. 3. On the controller nodes check the logs of ceph_rgw container, it would give "ssl handshake failed: http request" error. Actual results: Ceph RGW service is not available Expected results: Ceph RGW service should be available Additional info:
patch is in: puppet-tripleo-11.5.0-0.20200616033427.8ff1c6a.el8ost.noarch if $ceph_rgw { ::tripleo::haproxy::endpoint { 'ceph_rgw': public_virtual_ip => $public_virtual_ip, internal_ip => hiera('ceph_rgw_vip', $controller_virtual_ip), service_port => $ports[ceph_rgw_port], ip_addresses => hiera('ceph_rgw_node_ips', $controller_hosts_real), server_names => hiera('ceph_rgw_node_names', $controller_hosts_names_real), mode => 'http', public_ssl_port => $ports[ceph_rgw_ssl_port], service_network => $ceph_rgw_network, listen_options => merge($default_listen_options, { 'option' => [ 'httpchk GET /' ] }), member_options => union($haproxy_member_options, $internal_tls_member_options), } } so this will be fixed in 16.1 (fwiw the rpm is already available on the cdn as it is part of the beta).
Thanks Luca. I will pull the rpm and apply it, if not I will patch it manually. I will let you know if it works.