Bug 2214328 - Designate deployment fails when enabling secure RBAC [NEEDINFO]
Summary: Designate deployment fails when enabling secure RBAC
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-tripleo-heat-templates
Version: 17.1 (Wallaby)
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: ga
: 17.1
Assignee: Brent Eagles
QA Contact: Lilach Avraham
URL:
Whiteboard:
Depends On:
Blocks: 2124618
TreeView+ depends on / blocked
 
Reported: 2023-06-12 16:17 UTC by Brent Eagles
Modified: 2023-08-17 16:11 UTC (History)
9 users (show)

Fixed In Version: openstack-tripleo-heat-templates-14.3.1-1.20230519151015.el9ost
Doc Type: Known Issue
Doc Text:
Currently, DNS-as-a-Service (designate) is misconfigured when secure role-based access control (SRBAC) is enabled. If you configure both SRBAC and DNS-as-a-Service, the RHOSP deployment fails. Workaround: For a successful deployment, apply the following patches on the undercloud server: * https://review.opendev.org/c/openstack/tripleo-heat-templates/+/885291 * https://review.opendev.org/c/openstack/tripleo-heat-templates/+/885599
Clone Of:
Environment:
Last Closed: 2023-08-16 01:15:43 UTC
Target Upstream Version:
Embargoed:
jelynch: needinfo? (beagles)
jamsmith: needinfo? (beagles)
jamsmith: needinfo? (gregraka)

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
OpenStack gerrit 885291 0 None MERGED Fix syntax error in designate policies 2023-06-21 14:51:22 UTC
OpenStack gerrit 885599 0 None MERGED Designate: conditionally force enable_new_defaults on 2023-08-14 21:40:15 UTC
Red Hat Issue Tracker OSP-25755 0 None None None 2023-06-12 18:12:59 UTC
Red Hat Product Errata RHEA-2023:4577 0 None None None 2023-08-16 01:16:19 UTC

Description Brent Eagles 2023-06-12 16:17:27 UTC 
Overcloud deployment fails when the designate related "designate_pool_manage" container runs:

2023-06-12 10:34:39.988752 | 525400b4-3bff-826e-b8aa-00000000e590 |      FATAL | Create containers managed by Podman for /var/lib/tripleo-config/container-startup-config/step_5 | controller-0 | error={"changed": false, "msg": "Failed containers: designate_pool_manage"}
2023-06-12 10:34:39.989447 | 525400b4-3bff-826e-b8aa-00000000e590 |     TIMING | tripleo_container_manage : Create containers managed by Podman for /var/lib/tripleo-config/container-startup-config/step_5 | controller-0 | 1:10:39.826209 | 3.24s


There are two contributing causes, both found in the tripleo heat templates:

- There is syntax error of "or or" in the designate policies in enable-secure-rbac.yaml
- enforce_new_defaults is not set to true for the designate policies.
Comment 6 Jenny-Anne Lynch 2023-06-14 14:11:10 UTC 
Edited the doc text for 17.1 beta release notes.
Comment 21 errata-xmlrpc 2023-08-16 01:15:43 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Release of components for Red Hat OpenStack Platform 17.1 (Wallaby)), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2023:4577
Note You need to log in before you can comment on or make changes to this bug.