Cluster with detach-keystone failed to deploy - probably ssl issue

[Vladimir Khlyunev]

ISO - #88 Liberty

Found by CI:
https://product-ci.infra.mirantis.net/view/8.0_swarm/job/8.0.system_test.ubuntu.plugins.thread_keystone_separate_services/27/testReport/%28root%29/separate_keystone_service/separate_keystone_service/
Snapshot:
https://product-ci.infra.mirantis.net/view/8.0_swarm/job/8.0.system_test.ubuntu.plugins.thread_keystone_separate_services/27/artifact/logs/fail_error_separate_keystone_service-fuel-snapshot-2015-10-29_06-24-19.tar.xz

Steps:
            0. Build & install detach-database and detach-keystone plugins
            1. Create cluster
            2. Add 3 nodes with controller role
            3. Add 3 nodes with database+keystone role
            4. Add 1 compute and cinder
            5. Verify networks
            6. Deploy the cluster <- failed here

Usual uninformative error message:
Task 'deploy' has incorrect status. error != ready, 'Deployment has failed. Check these nodes:
'slave-06_standalone-database_standalone-keystone', 'slave-05_standalone-database_standalone-keystone''

May be useful:
node-3 (db+keystone) /var/log/puppet.log:
2015-10-29 05:51:07 +0000 /Stage[main]/Keystone::Roles::Admin/Keystone_user[separatekeystone] (err): Could not evaluate: Execution of /usr/bin/openstack token issue --format value' returned 1: ERROR: openstack SSL exception connecting to https://10.109.21.3:5000/v3/auth/tokens: [Errno1] _ssl.c:510: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/240195

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/240195
Committed: https://git.openstack.org/cgit/openstack/fuel-plugin-detach-keystone/commit/?id=2557bb01ac6c661d6924e9a570cb676d689fcf62
Submitter: Jenkins
Branch: master

commit 2557bb01ac6c661d6924e9a570cb676d689fcf62
Author: Matthew Mosesohn <email address hidden>
Date: Thu Oct 29 13:59:45 2015 +0300

    Add ssl tasks to keystone role and fix ordering

    Added ssl-keys-saving and ssl-add-trust-chain tasks to keystone
    role so that it can contact public endpoint on public VIP
    (after controller deployment) and validate the SSL cert.

    Non-primary standalone keystone role should run before all other
    default roles as well.

    Closes-Bug: #1511319
    Change-Id: I3eaee62ce8399ee9e053f03a419e0cf99559c80a

[Anastasia Palkina (apalkina)]

Verified on ISO #229

VERSION:
  feature_groups:
    - mirantis
  production: "docker"
  release: "8.0"
  openstack_version: "2015.1.0-8.0"
  api: "1.0"
  build_number: "229"
  build_id: "229"
  fuel-nailgun_sha: "28025f978a6c5d23e7441ad3ec8c2b9f123d9d15"
  python-fuelclient_sha: "b77559b309a62650658424a43051cfeaba518748"
  fuel-agent_sha: "1672c18c8193e1b93d5687d8b720cf4f1ea07048"
  fuel-nailgun-agent_sha: "a33a58d378c117c0f509b0e7badc6f0910364154"
  astute_sha: "b60624ee2c5f1d6d805619b6c27965a973508da1"
  fuel-library_sha: "b9f8c28f0e8f7d725ed4211df418fc54a1abd728"
  fuel-ostf_sha: "fc6648be21f26fac4f66ef18ba36f521960d554b"
  fuel-createmirror_sha: "1f3b4ae09d01591e59449448955dd4254b38ce23"
  fuelmenu_sha: "4064b7723773ab89cdfcbf6cf4682215a7757104"
  shotgun_sha: "25a0cc461a9fa4f7684f04cef0ff4ad9aa99a64d"
  network-checker_sha: "0b1b94a9685c6471d6911dff7ecac10b7bd2625f"
  fuel-upgrade_sha: "1e894e26d4e1423a9b0d66abd6a79505f4175ff6"
  fuelmain_sha: "2eca6adc33f02e02cd812e1d4be7c70e05fd07db"