Pike HA overcloud is broken when using TLS everywhere

[Damien Ciabrini]

Deploying an overcloud with templates for HA and TLS everywhere currently results in a failure during the configuration generation for the redis service:

root@controller-0 heat-admin]# docker logs -f docker-puppet-redis
+ mkdir -p /etc/puppet
+ cp -a /tmp/puppet-etc/auth.conf /tmp/puppet-etc/hiera.yaml /tmp/puppet-etc/hieradata /tmp/puppet-etc/modules /tmp/puppet-etc/puppet.conf /tmp/puppet-etc/ssl /etc/puppet
+ rm -Rf /etc/puppet/ssl
+ echo '{"step": 6}'
+ TAGS=
+ '[' -n file,file_line,concat,augeas,cron,exec ']'
+ TAGS='--tags file,file_line,concat,augeas,cron,exec'
+ origin_of_time=/var/lib/config-data/redis.origin_of_time
+ touch /var/lib/config-data/redis.origin_of_time
+ sync
+ set +e
+ FACTER_hostname=controller-0
+ FACTER_uuid=docker
+ /usr/bin/puppet apply --detailed-exitcodes --color=false --logdest syslog --logdest console --modulepath=/etc/puppet/modules:/usr/share/openstack-puppet/modules --tags file,file_line,concat,augeas,cron,exec /etc/config.pp
Failed to get D-Bus connection: Operation not permitted
Notice: hiera(): Cannot load backend module_data: cannot load such file -- hiera/backend/module_data_backend
Warning: Undefined variable 'deploy_config_name';
   (file & line not available)
Notice: hiera(): Cannot load backend module_data: cannot load such file -- hiera/backend/module_data_backend
Error: Evaluation Error: Error while evaluating a Function Call, tls_proxy_bind_ip is not set in the hieradata. at /etc/puppet/modules/tripleo/manifests/profile/base/database/redis.pp:86:9 on node controller-0.redhat.local
+ rc=1
+ set -e
+ '[' 1 -ne 2 -a 1 -ne 0 ']'
+ exit 1

While Redis doesn't support TLS everywhere is Pike, it relies on the base puppet modules which lately uses TLS bits when TLS everywhere is enabled.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/pike
Review: https://review.openstack.org/586862

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/pike
Review: https://review.openstack.org/586863

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/586862
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=e856816558e2d28dd6e52885089b3685a8cc145f
Submitter: Zuul
Branch: stable/pike

commit e856816558e2d28dd6e52885089b3685a8cc145f
Author: Damien Ciabrini <email address hidden>
Date: Sun Jul 29 03:15:08 2018 -0400

    Do not target Redis over TLS when using HA Redis profile

    In Pike Redis doesn't support being accessed over a TLS tunnel when
    configured for HA deployments.

    Make sure the Redis clients (gnocchi and HAProxy) won't use TLS to
    access Redis and will still honor the other bits of TLS everywhere
    configuration. Also, make that change limited to HA and allow
    non-HA stack to connect to Redis over a TLS tunnel.

    Change-Id: I3b50ebf50046d33d49fbb555c2ee3bc6b3c2eaf9
    Partial-Bug: 1784205

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/586863
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=59f4dabd96164045fdead2b71f3d604e1f07ad26
Submitter: Zuul
Branch: stable/pike

commit 59f4dabd96164045fdead2b71f3d604e1f07ad26
Author: Damien Ciabrini <email address hidden>
Date: Sun Jul 29 03:29:58 2018 -0400

    Do not target Redis over TLS when using HA Redis profile

    In Pike, Redis doesn't support being accessed over a TLS tunnel when
    configured for HA deployments.

    Fix the Redis service configuration by force-disabling the TLS
    bits in the generated Redis config, as well as in the Redis clients
    configuration (gnocchi_api and HAProxy). The hiera keys are
    defined in service_config_settings to be compatible with composable HA.

    Change-Id: I1602f2b90d7166df05e9a34057064010d6a31afe
    Closes-Bug: 1784205
    Depends-On: I3b50ebf50046d33d49fbb555c2ee3bc6b3c2eaf9

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 7.0.15 release.