Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1856923

Summary:	Wrong haproxy configuration for ceph_rgw when TLS everywhere is enabled.
Product:	Red Hat OpenStack	Reporter:	Mohammed Salih <mputhenp>
Component:	puppet-tripleo	Assignee:	RHOS Maint <rhos-maint>
Status:	CLOSED DUPLICATE	QA Contact:	David Rosenfeld <drosenfe>
Severity:	urgent	Docs Contact:
Priority:	high
Version:	16.0 (Train)	CC:	bperkins, fpantano, gfidente, jjoyce, jschluet, lmiccini, ltoscano, slinaber, tvignaud
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-07-16 07:37:12 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mohammed Salih 2020-07-14 17:37:57 UTC

Description of problem:
When TLS everywhere is enabled, haproxy configuration doesn't include the required SSL configuration for Ceph RGW backend checking. A fix is applied in the upstream code https://github.com/openstack/puppet-tripleo/commit/436bfaa158d8ff48b9e499158f6edd00df22e0a4
This bug causes Ceph RGW to be not available in the newly deployed OSP. 

Version-Release number of selected component (if applicable):
Red Hat OpenStack 16.0 
Package version : puppet-tripleo-11.4.1-0.20200402130302.b4678ba.el8ost.noarch


How reproducible:
Always. 

Steps to Reproduce:
1. Deploy OSP with TLS everywhere and ceph rgw by including the following in openstack deployment

>  -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml \
>  -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-everywhere-endpoints-dns.yaml \
>  -e /usr/share/openstack-tripleo-heat-templates/environments/services/haproxy-public-tls-certmonger.yaml \
>  -e /usr/share/openstack-tripleo-heat-templates/environments/ceph-ansible/ceph-ansible.yaml \
>  -e /usr/share/openstack-tripleo-heat-templates/environments/ceph-ansible/ceph-rgw.yaml \
>  -e /usr/share/openstack-tripleo-heat-templates/environments/ceph-ansible/ceph-dashboard.yaml \

2. Even after a successful deployment, Swift (ceph rgw) service will not be available.
3. Check /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg to verify backend section of "ceph_rgw". It will not have the required SSL checks for the backends.
3. On the controller nodes check the logs of ceph_rgw container, it would give "ssl handshake failed: http request" error.

Actual results:
Ceph RGW service is not available

Expected results:
Ceph RGW service should be available


Additional info:

Comment 1 Luca Miccini 2020-07-15 05:58:21 UTC

patch is in:
puppet-tripleo-11.5.0-0.20200616033427.8ff1c6a.el8ost.noarch

  if $ceph_rgw {
    ::tripleo::haproxy::endpoint { 'ceph_rgw':
      public_virtual_ip => $public_virtual_ip,
      internal_ip       => hiera('ceph_rgw_vip', $controller_virtual_ip),
      service_port      => $ports[ceph_rgw_port],
      ip_addresses      => hiera('ceph_rgw_node_ips', $controller_hosts_real),
      server_names      => hiera('ceph_rgw_node_names', $controller_hosts_names_real),
      mode              => 'http',
      public_ssl_port   => $ports[ceph_rgw_ssl_port],
      service_network   => $ceph_rgw_network,
      listen_options    => merge($default_listen_options, { 'option' => [ 'httpchk GET /' ] }),
      member_options    => union($haproxy_member_options, $internal_tls_member_options),
    }
  }

so this will be fixed in 16.1 (fwiw the rpm is already available on the cdn as it is part of the beta).

Comment 2 Mohammed Salih 2020-07-15 06:40:55 UTC

Thanks Luca. I will pull the rpm and apply it, if not I will patch it manually. I will let you know if it works.