fab setup_all throws SQL connection failed continuously if SSL is enabled in HA setup

Bug #1649787 reported by musharani
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Juniper Openstack
Status tracked in Trunk
R3.1
Fix Committed
Critical
Ignatious Johnson Christopher
R3.2
Fix Committed
Critical
Ignatious Johnson Christopher
Trunk
Fix Committed
Critical
Ignatious Johnson Christopher

Bug Description

while running fab setup_all throws a warning message 'SQL connection failed' continuously for ssl enabled ha setup.

setup details:
env.roledefs = {
    'all': [host1, host2, host3, host4, host5, host6],
    'cfgm': [host1, host2, host3],
    'openstack': [host1, host2, host3],
    'webui': [host3],
    'control': [host1, host2, host3],
    'compute': [host4, host5, host6],
    'collector': [host1, host2],
    'database': [host1, host2, host3],
    'build': [host_build],
}

env.hostnames = {
    'all': ['nodea35', 'nodea34', 'nodec53', 'nodec54', 'nodec55', 'nodec56']
}

env.ha = {
    'internal_vip' : '22.22.22.36',
}
ha_setup = True

ha_proxy.log:
[ALERT] 348/121102 (30898) : parsing [/etc/haproxy/haproxy.cfg:65] : 'bind *:5000' : unable to load SSL private key from PEM file '/etc/keystone/ssl/certs/keystonecertbundle.pem'.^M
[ALERT] 348/121102 (30898) : parsing [/etc/haproxy/haproxy.cfg:99] : 'bind *:35357' : unable to load SSL private key from PEM file '/etc/keystone/ssl/certs/keystonecertbundle.pem'.^M
[ALERT] 348/121102 (30898) : Error(s) found in configuration file : /etc/haproxy/haproxy.cfg^M
[ALERT] 348/121102 (30898) : Proxy 'openstack-keystone': no SSL certificate specified for bind '*:5000' at [/etc/haproxy/haproxy.cfg:65] (use 'crt').^M
[ALERT] 348/121102 (30898) : Proxy 'openstack-keystone-admin': no SSL certificate specified for bind '*:35357' at [/etc/haproxy/haproxy.cfg:99] (use 'crt').^M
[WARNING] 348/121102 (30898) : config : missing timeouts for proxy 'memcached'.^M
   | While not properly invalid, you will certainly encounter various problems^M
   | with such a configuration. To fix this, please ensure that all following^M
   | timeouts are set to a non-zero value: 'client', 'connect', 'server'.^M
[WARNING] 348/121102 (30898) : config : missing timeouts for proxy 'rabbitmq'.^M
   | While not properly invalid, you will certainly encounter various problems^M
   | with such a configuration. To fix this, please ensure that all following^M
   | timeouts are set to a non-zero value: 'client', 'connect', 'server'.^M
[WARNING] 348/121102 (30898) : config : missing timeouts for proxy 'mysql'.^M
   | While not properly invalid, you will certainly encounter various problems^M
   | with such a configuration. To fix this, please ensure that all following^M
   | timeouts are set to a non-zero value: 'client', 'connect', 'server'.^M
[ALERT] 348/121102 (30898) : Fatal errors found in configuration.^M

fab setup_all log:
2016-12-14 12:23:14:051921: [root@10.204.216.31] out: + sed -i -e 's|^#* *\(\(sql_\)*connection *= *mysql://heat\):.*@|\1:c0ntrail123@|' /etc/heat/heat.conf
2016-12-14 12:23:14:051994: [root@10.204.216.31] out: + echo 'Initializing the heat database, please wait...'
2016-12-14 12:23:14:055732: [root@10.204.216.31] out: Initializing the heat database, please wait...
2016-12-14 12:23:14:055879: [root@10.204.216.31] out: + '[' heat = nova ']'
2016-12-14 12:23:14:055962: [root@10.204.216.31] out: + '[' heat = cinder ']'
2016-12-14 12:23:14:056043: [root@10.204.216.31] out: + '[' heat = nova_api ']'
2016-12-14 12:23:14:056114: [root@10.204.216.31] out: + db_sync=db_sync
2016-12-14 12:23:14:056186: [root@10.204.216.31] out: + '[' 0 -eq 1 ']'
2016-12-14 12:23:14:056259: [root@10.204.216.31] out: + '[' 1 -eq 1 ']'
2016-12-14 12:23:14:056328: [root@10.204.216.31] out: + '[' heat = nova_api ']'
2016-12-14 12:23:14:056398: [root@10.204.216.31] out: + heat-manage db_sync
2016-12-14 12:23:14:056468: [root@10.204.216.31] out: 2016-12-14 12:23:17.178 7156 WARNING oslo_db.sqlalchemy.engines [-] SQL connection failed. -1 attempts left.
2016-12-14 12:23:17:192491: [root@10.204.216.31] out: 2016-12-14 12:23:25.172 7156 WARNING oslo_db.sqlalchemy.engines [-] SQL connection failed. -2 attempts left.
2016-12-14 12:23:25:203727: [root@10.204.216.31] out: 2016-12-14 12:23:38.185 7156 WARNING oslo_db.sqlalchemy.engines [-] SQL connection failed. -3 attempts left.
2016-12-14 12:23:38:221452: [root@10.204.216.31] out: 2016-12-14 12:23:45.189 7156 WARNING oslo_db.sqlalchemy.engines [-] SQL connection failed. -4 attempts left.
2016-12-14 12:23:45:194235: [root@10.204.216.31] out: 2016-12-14 12:23:56.189 7156 WARNING oslo_db.sqlalchemy.engines [-] SQL connection failed. -5 attempts left.
2016-12-14 12:23:56:208304: [root@10.204.216.31] out: 2016-12-14 12:24:02.192 7156 WARNING oslo_db.sqlalchemy.engines [-] SQL connection failed. -6 attempts left.
2016-12-14 12:24:02:216265: [root@10.204.216.31] out: 2016-12-14 12:24:12.188 7156 WARNING oslo_db.sqlalchemy.engines [-] SQL connection failed. -7 attempts left.
2016-12-14 12:24:12:193170: [root@10.204.216.31] out: 2016-12-14 12:24:20.192 7156 WARNING oslo_db.sqlalchemy.engines [-] SQL connection failed. -8 attempts left.
2016-12-14 12:24:20:203964: [root@10.204.216.31] out: 2016-12-14 12:24:34.192 7156 WARNING oslo_db.sqlalchemy.engines [-] SQL connection failed. -9 attempts left.
2016-12-14 12:24:34:221834: [root@10.204.216.31] out: 2016-12-14 12:24:41.199 7156 WARNING oslo_db.sqlalchemy.engines [-] SQL connection failed. -10 attempts left.
2016-12-14 12:24:41:231332: [root@10.204.216.31] out: 2016-12-14 12:24:52.196 7156 WARNING oslo_db.sqlalchemy.engines [-] SQL connection failed. -11 attempts left.

Jeba Paulaiyan (jebap)
tags: added: blocker
Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : [Review update] R3.2

Review in progress for https://review.opencontrail.org/27279
Submitter: Ignatious Johnson Christopher (<email address hidden>)

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : [Review update] master

Review in progress for https://review.opencontrail.org/27283
Submitter: Ignatious Johnson Christopher (<email address hidden>)

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : [Review update] R3.1

Review in progress for https://review.opencontrail.org/27284
Submitter: Ignatious Johnson Christopher (<email address hidden>)

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : A change has been merged

Reviewed: https://review.opencontrail.org/27279
Committed: http://github.org/Juniper/contrail-fabric-utils/commit/b27b0fa28fe741738932c67c0fc4f208fba90fef
Submitter: Zuul (<email address hidden>)
Branch: R3.2

commit b27b0fa28fe741738932c67c0fc4f208fba90fef
Author: Ignatious Johnson Christopher <email address hidden>
Date: Wed Dec 14 11:32:00 2016 -0800

Haproxy fails to start as the keystone certs are not created before
starting haproxy in a HA setup. Fix is to create keystone ssl
certificates before configuring haproxy and skip recreating
certs during openstack setup.

Change-Id: Ibb53ad16c0222ebd3685a03c09398a1067464664
Closes-Bug: 1649787

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote :

Reviewed: https://review.opencontrail.org/27284
Committed: http://github.org/Juniper/contrail-fabric-utils/commit/af5ce5218fc5106c9f32055595fce58e4534caf4
Submitter: Zuul (<email address hidden>)
Branch: R3.1

commit af5ce5218fc5106c9f32055595fce58e4534caf4
Author: Ignatious Johnson Christopher <email address hidden>
Date: Wed Dec 14 11:32:00 2016 -0800

Haproxy fails to start as the keystone certs are not created before
starting haproxy in a HA setup. Fix is to create keystone ssl
certificates before configuring haproxy and skip recreating
certs during openstack setup.

Change-Id: Ibb53ad16c0222ebd3685a03c09398a1067464664
Closes-Bug: 1649787

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote :

Reviewed: https://review.opencontrail.org/27283
Committed: http://github.org/Juniper/contrail-fabric-utils/commit/5c90080b9ef294187c4df0de5bc77f8b998ebb63
Submitter: Zuul (<email address hidden>)
Branch: master

commit 5c90080b9ef294187c4df0de5bc77f8b998ebb63
Author: Ignatious Johnson Christopher <email address hidden>
Date: Wed Dec 14 11:32:00 2016 -0800

Haproxy fails to start as the keystone certs are not created before
starting haproxy in a HA setup. Fix is to create keystone ssl
certificates before configuring haproxy and skip recreating
certs during openstack setup.

Change-Id: Ibb53ad16c0222ebd3685a03c09398a1067464664
Closes-Bug: 1649787

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.