API endpoint SSL does not match the VIP address API unusable

[Miguel Angel Ajo]

After a simple deployment with:

bash ./quickstart.sh --teardown all --release master-tripleo-ci --nodes config/nodes/3ctlr_1comp.yml --config config/general_config/pacemaker.yml 127.0.0.2

Later in the undercloud I prepare the containers, and then do the deploy.

I end up in:

$ source overcloudrc

$ openstack server list --all
Certificate did not match expected hostname: 10.0.0.8. Certificate: {'subjectAltName': [('IP Address', '10.0.0.5')], 'subject': ((('commonName', u'10.0.0.5'),),)}
Failed to discover available identity versions when contacting https://10.0.0.8:13000//v3. Attempting to parse version from URL.
Could not determine a suitable URL for the plugin

[Miguel Angel Ajo (mangelajo)]

(overcloud) [stack@undercloud ~]$ cat overcloud_create_ssl_cert.log
2018-03-21 14:25:05 | + openssl genrsa 2048
2018-03-21 14:25:05 | + openssl req -new -x509 -key /home/stack/overcloud-ca-privkey.pem -out /home/stack/overcloud-cacert.pem -days 365 -subj '/C=US/ST=NC/L=Raleigh/O=Red Hat/OU=OOOQ/CN=overcloud'
2018-03-21 14:25:05 | + sudo cp /home/stack/overcloud-cacert.pem /etc/pki/ca-trust/source/anchors/
2018-03-21 14:25:05 | + sudo update-ca-trust extract
2018-03-21 14:25:06 | + openssl req -newkey rsa:2048 -days 365 -nodes -keyout /home/stack/server-key.pem -out /home/stack/server-req.pem -subj '/C=US/ST=NC/L=Raleigh/O=Red Hat/OU=OOOQ/CN=10.0.0.5' -reqexts subjectAltName -config /dev/fd/63
2018-03-21 14:25:06 | ++ printf '[subjectAltName]\nsubjectAltName=IP:10.0.0.5\n[req]req_extensions = v3_req\ndistinguished_name=req_distinguished_name\n[req_distinguished_name]'
2018-03-21 14:25:06 | Generating a 2048 bit RSA private key
2018-03-21 14:25:06 | ...........+++
2018-03-21 14:25:06 | ..............+++
2018-03-21 14:25:06 | writing new private key to '/home/stack/server-key.pem'
2018-03-21 14:25:06 | -----
2018-03-21 14:25:06 | + openssl rsa -in /home/stack/server-key.pem -out /home/stack/server-key.pem
2018-03-21 14:25:06 | writing RSA key
2018-03-21 14:25:06 | + openssl x509 -req -in server-req.pem -days 365 -CA /home/stack/overcloud-cacert.pem -CAkey /home/stack/overcloud-ca-privkey.pem -set_serial 01 -out /home/stack/server-cert.pem -extensions subjectAltName -extfile /dev/fd/63
2018-03-21 14:25:06 | ++ printf '[subjectAltName]\nsubjectAltName=IP:10.0.0.5\n[req]req_extensions = v3_req\ndistinguished_name=req_distinguished_name\n[req_distinguished_name]'
2018-03-21 14:25:06 | Signature ok
2018-03-21 14:25:06 | subject=/C=US/ST=NC/L=Raleigh/O=Red Hat/OU=OOOQ/CN=10.0.0.5
2018-03-21 14:25:06 | Getting CA Private Key

The IP of the cert generation doesn't match the IP address of the VIP

[Daniel Alvarez (dalvarezs)]

A workaround so far that Ajo pointed out:

- Edit overcloud-create-ssl-cert.sh so that it points to the correct VIP
- Execute the above script to generate the necessary certs
- Paste both server-cert.pem and server-key.pem contents into enable-tls.yaml
- Execute overcloud-deploy.sh script again to deploy the new certs

[Marios Andreou (marios-b)]

Bug status has been set to 'Incomplete' and target milestone has been removed due to inactivity. If you disagree please re-set these values and reach out to us on freenode #tripleo

[Launchpad Janitor (janitor)]

[Expired for tripleo because there has been no activity for 60 days.]