is_cert_provided_in_config check is too strict, ssl_ca should be optional

[Nobuto Murata]

[hooks/keystone_context.py]
     52 def is_cert_provided_in_config():
     53 ca = config('ssl_ca')
     54 cert = config('ssl_cert')
     55 key = config('ssl_key')
     56 return bool(ca and cert and key)

When configuring SSL, keystone charm skips the configuration when ssl_ca is not provided in the charm config. ssl_ca is unnecessary when OS already has a root CA, e.g. GeoTrust.

[Nobuto Murata (nobuto)]

https://review.openstack.org/#/c/494514/

[Nobuto Murata (nobuto)]

Otherwise, non-leader units will be blocked with "Services not running that should be: apache2" because /etc/apache2/ssl/keystone/ is empty.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/494514
Committed: https://git.openstack.org/cgit/openstack/charm-keystone/commit/?id=9a0563bf450e2138e4d67682641de617364ae05f
Submitter: Zuul
Branch: master

commit 9a0563bf450e2138e4d67682641de617364ae05f
Author: Nobuto Murata <email address hidden>
Date: Thu Aug 17 19:24:52 2017 +0700

    Make ssl_ca optional if ssl_cert+ssl_key provided

    ssl_ca is not necessary when ssl_cert is signed by
    a trusted CA, such as GeoTrust, because a trusted
    cert chain is in the system already. Users can just
    provide ssl_cert and ssl_key to enable SSL endpoint
    in that case.

    Closes-Bug: #1711354
    Change-Id: I4a34df1a2c2bf5705e02b713d968a22f4bbf57cf