Description of problem:
Update OSP from 16.1 to 16.2 with tls-everywhere failed at the controller update stage with an error: 
2021-08-09 13:46:10,853 p=2293 u=mistral n=ansible | 2021-08-09 13:46:10.836845 | 525400d6-5742-2703-c9be-000000001993 |      FATAL | Wait for puppet host configuration to finish | central-controller0-0 | error={"ansible_job_id": "401732811894.31088", "attempts": 36, "changed": true, "cmd": "set -o pipefail; puppet apply --debug --verbose --modulepath=/etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules --detailed-exitcodes --summarize --color=false   /var/lib/tripleo-config/puppet_step_config.pp 2>&1 | logger -s -t puppet-user", "delta": "0:01:54.410882", "end": "2021-08-09 13:46:08.347463", "failed_when_result": true, "finished": 1, "msg": "non-zero return code", "rc": 6

Applying puppet manifest on controller node gives an error: 

Error: 'test -f /etc/pki/CA/certs/vnc.crt' returned 1 instead of one of [0]                                                                                                                                       Error: /Stage[main]/Tripleo::Profile::Base::Certmonger_user/Tripleo::Certmonger::Libvirt_vnc[libvirt-vnc-client-cert]/Exec[/etc/pki/CA/certs/vnc.crt]/returns: change from 'notrun' to ['0'] failed: 'test -f /etc/pki/CA/certs/vnc.crt' returned 1 instead of one of [0]  

Version-Release number of selected component (if applicable):
Update from version RHOS-16.1-RHEL-8-20210727.n.1 to RHOS-16.2-RHEL-8-20210804.n.0

How reproducible:
1. Install OSP 16.1 with tls-everywhere 
2. Update undercloud to 16.2
3. Update overcloud to 16.2

Actual results:
Overcloud update failed

Expected results:
Successful update to 16.2