Description of problem: The etcd.cert used when DCN Site is deployed with ceph storage managed by etcd and TLS, is generated without SAN IP and that's why connection from cinder to etcd fails on following traceback: 2022-06-10 11:08:09.481 15 ERROR oslo_service.service [-] Error starting thread.: etcd3gw.exceptions.ConnectionFailedError 2022-06-10 11:08:09.481 15 ERROR oslo_service.service Traceback (most recent call last): 2022-06-10 11:08:09.481 15 ERROR oslo_service.service File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 699, in urlopen 2022-06-10 11:08:09.481 15 ERROR oslo_service.service httplib_response = self._make_request( 2022-06-10 11:08:09.481 15 ERROR oslo_service.service File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 382, in _make_request 2022-06-10 11:08:09.481 15 ERROR oslo_service.service self._validate_conn(conn) 2022-06-10 11:08:09.481 15 ERROR oslo_service.service File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 1010, in _validate_conn 2022-06-10 11:08:09.481 15 ERROR oslo_service.service conn.connect() 2022-06-10 11:08:09.481 15 ERROR oslo_service.service File "/usr/lib/python3.9/site-packages/urllib3/connection.py", line 464, in connect 2022-06-10 11:08:09.481 15 ERROR oslo_service.service _match_hostname(cert, self.assert_hostname or server_hostname) 2022-06-10 11:08:09.481 15 ERROR oslo_service.service File "/usr/lib/python3.9/site-packages/urllib3/connection.py", line 512, in _match_hostname 2022-06-10 11:08:09.481 15 ERROR oslo_service.service match_hostname(cert, asserted_hostname) 2022-06-10 11:08:09.481 15 ERROR oslo_service.service File "/usr/lib64/python3.9/ssl.py", line 416, in match_hostname 2022-06-10 11:08:09.481 15 ERROR oslo_service.service raise CertificateError("hostname %r " 2022-06-10 11:08:09.481 15 ERROR oslo_service.service ssl.SSLCertVerificationError: ("hostname '172.25.3.50' doesn't match either of 'dcn2-computehci2-0.internalapi.redhat.local', 'overcloud.internalapi.redhat.local'",) The inability of cinder to connect to the etcd causing that volume service on the edge DCN site is not operational. It was tested successfully with a THT patch which includes SAN IP into the etcd cert. Version-Release number of selected component (if applicable): openstack-tripleo-heat-templates-14.3.1-0.20220513220827.4edb55d.el9ost.noarch How reproducible: Always Steps to Reproduce: 1. Deploy DCN (Distributed compute nodes) topology with ceph storage on the DCN site and TLS-E Actual results: The volume service is not able to establish connection to the etcd and that's why does not work Expected results: Additional info:
I have a fix for this.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Release of components for Red Hat OpenStack Platform 17.0 (Wallaby)), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2022:6543