When ssl setup is requested with ceph object storage the firewall on the controller node does not opens the public ssl port for consumption from the undercloud (or other node). Workaround: [heat-admin@controller-0 ~]$ sudo iptables -I INPUT 12 -p tcp -m tcp --dport 13808 -m comment --comment "122X ceph rgw ipv4 ssl" -j ACCEPT Addition info: The internal is defined without ssl. | swift | object-store | regionOne | | | | internal: http://172.17.3.35:8080/swift/v1/AUTH_ffbfeac65be8408db5492888fd7ec4b5 | | | | regionOne | | | | admin: http://172.17.3.35:8080/swift/v1/AUTH_ffbfeac65be8408db5492888fd7ec4b5 | | | | regionOne | | | | public: https://10.0.0.124:13808/swift/v1/AUTH_ffbfeac65be8408db5492888fd7ec4b5 | | | | | The internal port is exposed by: -A INPUT -p tcp -m tcp --dport 8080 -m conntrack --ctstate NEW -m comment --comment "122 ceph rgw ipv4" -j ACCEPT Probably the public rgw port should be exposed on the firewall instead of the internal. openstack-tripleo-heat-templates-14.2.1-0.20210809091810.185a41c.el8ost.noarch
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Release of components for Red Hat OpenStack Platform 17.0 (Wallaby)), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2022:6543