Barbican.conf - external_fqdn should be used for host_href

[Nenad Radojevic]

The barbican service should use the external fqdn as value for the host_href parameter. Typically this is the endpoint that clients would use to connect to barbican from outside.

We came to this conclusion during the attempt to list secrets from outside our environment. As we started debugging we found out that a curl on our external fqdn will respond with the internal vip (10.10.30.100) instead of the external one (curl shown further below).
That's why users won't receive an answer from Barbican.

curl -sk https://foo.bar.net:9311 | jq .
{
  "versions": {
    "values": [
      {
        "status": "stable",
        "updated": "2015-04-28T00:00:00Z",
        "media-types": [
          {
            "base": "application/json",
            "type": "application/vnd.openstack.key-manager-v1+json"
          }
        ],
        "id": "v1",
        "links": [
          {
            "href": "http://10.10.30.100:9311/v1/",
            "rel": "self"
          },
          {
            "href": "http://docs.openstack.org/",
            "type": "text/html",
            "rel": "describedby"
          }
        ]
      }
    ]
  }
}

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/426697

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/426697
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=5229c83a7f7aed98ae3985d5db0129c901790621
Submitter: Jenkins
Branch: master

commit 5229c83a7f7aed98ae3985d5db0129c901790621
Author: Nenad Radojevic <email address hidden>
Date: Mon Jan 30 11:17:39 2017 +0100

    External_fqdn for host_href in barbican.conf

    The barbican service should use the external fqdn as value for the
    host_href parameter. Typically this is the endpoint that clients
    would use to connect to barbican from outside.

    Change-Id: I075acb6335354a61f935d57a7b84f0f92978c9bd
    Closes-Bug: #1660282

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 4.0.0.0rc1 release candidate.