tripleo

contrail plugin defaults are using haproxy settings

Bug #1883741 reported by Grzegorz Grasza on 2020-06-16

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	tripleo	Fix Released	High	Grzegorz Grasza	tripleo victoria-1 "tripleo victoria"

Bug Description

Description
===========

The documentation in neutron_plugin.pp[1] states that ca_file and cert_file are by default set from contrail::service_certificate hiera value, however, later in the implementation, tripleo::haproxy::service_certificate is used.

This certificate shouldn't be used in the [keystone*] configuration block, because it contains a private key with which the service is encrypted. The value defaults to /etc/pki/tls/private/overcloud_endpoint.pem, which is not mounted into the neutron_api container, which fails to start.

[1] https://github.com/openstack/puppet-tripleo/blob/stable/queens/manifests/network/contrail/neutron_plugin.pp

Steps to reproduce
==================

Configure the contrail plugin with auth_protocol set to https

Expected result
===============
Contrail connects to keystone

Actual result
=============

INFO neutron.manager [-] Loading core plugin: neutron_plugin_contrail.plugins.opencontrail.contrail_plugin.NeutronPluginContrailCoreV2
ERROR neutron.service [-] Unrecoverable error: please check log for details.: OSError: [Errno 2] No such file or directory: '/etc/pki/tls/private/overcloud_endpoint.pem'
ERROR neutron.service Traceback (most recent call last):
ERROR neutron.service File "/usr/lib/python2.7/site-packages/neutron/service.py", line 86, in serve_wsgi
ERROR neutron.service service.start()
ERROR neutron.service File "/usr/lib/python2.7/site-packages/neutron/service.py", line 62, in start
ERROR neutron.service self.wsgi_app = _run_wsgi(self.app_name)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/neutron/service.py", line 289, in _run_wsgi
ERROR neutron.service app = config.load_paste_app(app_name)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/neutron/common/config.py", line 122, in load_paste_app
ERROR neutron.service app = loader.load_app(app_name)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/oslo_service/wsgi.py", line 353, in load_app
ERROR neutron.service return deploy.loadapp("config:%s" % self.config_path, name=name)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py", line 247, in loadapp
ERROR neutron.service return loadobj(APP, uri, name=name, **kw)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py", line 272, in loadobj
ERROR neutron.service return context.create()
ERROR neutron.service File "/usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py", line 710, in create
ERROR neutron.service return self.object_type.invoke(self)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py", line 144, in invoke
ERROR neutron.service **context.local_conf)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/paste/deploy/util.py", line 55, in fix_call
ERROR neutron.service val = callable(*args, **kw)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/paste/urlmap.py", line 25, in urlmap_factory
ERROR neutron.service app = loader.get_app(app_name, global_conf=global_conf)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py", line 350, in get_app
ERROR neutron.service name=name, global_conf=global_conf).create()
ERROR neutron.service File "/usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py", line 710, in create
ERROR neutron.service return self.object_type.invoke(self)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py", line 144, in invoke
ERROR neutron.service **context.local_conf)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/paste/deploy/util.py", line 55, in fix_call
ERROR neutron.service val = callable(*args, **kw)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/neutron/auth.py", line 47, in pipeline_factory
ERROR neutron.service app = loader.get_app(pipeline[-1])
ERROR neutron.service File "/usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py", line 350, in get_app
ERROR neutron.service name=name, global_conf=global_conf).create()
ERROR neutron.service File "/usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py", line 710, in create
ERROR neutron.service return self.object_type.invoke(self)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py", line 146, in invoke
ERROR neutron.service return fix_call(context.object, context.global_conf, **context.local_conf)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/paste/deploy/util.py", line 55, in fix_call
ERROR neutron.service val = callable(*args, **kw)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/neutron/api/v2/router.py", line 25, in _factory
ERROR neutron.service return pecan_app.v2_factory(global_config, **local_config)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/neutron/pecan_wsgi/app.py", line 47, in v2_factory
ERROR neutron.service startup.initialize_all()
ERROR neutron.service File "/usr/lib/python2.7/site-packages/neutron/pecan_wsgi/startup.py", line 39, in initialize_all
ERROR neutron.service manager.init()
ERROR neutron.service File "/usr/lib/python2.7/site-packages/neutron/manager.py", line 296, in init
ERROR neutron.service NeutronManager.get_instance()
ERROR neutron.service File "/usr/lib/python2.7/site-packages/neutron/manager.py", line 247, in get_instance
ERROR neutron.service cls._create_instance()
ERROR neutron.service File "/usr/lib/python2.7/site-packages/oslo_concurrency/lockutils.py", line 274, in inner
ERROR neutron.service return f(*args, **kwargs)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/neutron/manager.py", line 233, in _create_instance
ERROR neutron.service cls._instance = cls()
ERROR neutron.service File "/usr/lib/python2.7/site-packages/neutron/manager.py", line 132, in __init__
ERROR neutron.service plugin_provider)
ERROR neutron.service File "/usr/lib/python2.7/site-packages/neutron/manager.py", line 166, in _get_plugin_instance
ERROR neutron.service return plugin_class()
ERROR neutron.service File "/opt/plugin/site-packages/neutron_plugin_contrail/plugins/opencontrail/contrail_plugin_base.py", line 232, in __init__
ERROR neutron.service self._parse_class_args()
ERROR neutron.service File "/opt/plugin/site-packages/neutron_plugin_contrail/plugins/opencontrail/contrail_plugin_base.py", line 222, in _parse_class_args
ERROR neutron.service self._build_auth_details()
ERROR neutron.service File "/opt/plugin/site-packages/neutron_plugin_contrail/plugins/opencontrail/contrail_plugin.py", line 96, in _build_auth_details
ERROR neutron.service _DEFAULT_KS_CERT_BUNDLE,certs)
ERROR neutron.service File "/opt/plugin/site-packages/vnc_api/utils.py", line 59, in getCertKeyCaBundle
ERROR neutron.service if os.path.getmtime(cert) > bundle_mod_time:
ERROR neutron.service File "/usr/lib64/python2.7/genericpath.py", line 54, in getmtime
ERROR neutron.service return os.stat(filename).st_mtime
ERROR neutron.service OSError: [Errno 2] No such file or directory: '/etc/pki/tls/private/overcloud_endpoint.pem'
ERROR neutron.service

Environment
===========
Queens/OSP13

Tags:

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2020-06-16: Fix proposed to puppet-tripleo (master)

Fix proposed to branch: master
Review: https://review.opendev.org/735957

Changed in tripleo:
assignee:	nobody → Grzegorz Grasza (xek)
status:	New → In Progress

Bogdan Dobrelya (bogdando) on 2020-06-23

Changed in tripleo:
milestone:	none → victoria-1
importance:	Undecided → High
tags:	added: queens-backport-potential train-backport-potential ussuri-backport-potential

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2020-06-23: Fix merged to puppet-tripleo (master)

Reviewed: https://review.opendev.org/735957
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=9befc582571757cfd2bfd45f491617af3d563af8
Submitter: Zuul
Branch: master

commit 9befc582571757cfd2bfd45f491617af3d563af8
Author: Grzegorz Grasza <email address hidden>
Date: Tue Jun 16 18:03:03 2020 +0200

Fix the default values for ca_file and cert_file

    Before this change, the values were set to haproxy defaults,
    however, these should not be used. The keystone endpoint
    should be verified by the system's default CA certificates,
    which are mounted into the neutron_api container.

    Change-Id: I35b39a1bc0e1793116831485180a49da5e0a019a
    Closes-Bug: #1883741
    Resolves: rhbz#1844592

Changed in tripleo:
status:	In Progress → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2020-06-24: Fix proposed to puppet-tripleo (stable/ussuri)

Fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/737719

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2020-06-24: Fix proposed to puppet-tripleo (stable/train)

Fix proposed to branch: stable/train
Review: https://review.opendev.org/737720

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2020-06-24: Fix proposed to puppet-tripleo (stable/stein)

Fix proposed to branch: stable/stein
Review: https://review.opendev.org/737721

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2020-06-24: Fix proposed to puppet-tripleo (stable/rocky)

Fix proposed to branch: stable/rocky
Review: https://review.opendev.org/737722

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2020-06-24: Fix proposed to puppet-tripleo (stable/queens)

Fix proposed to branch: stable/queens
Review: https://review.opendev.org/737723

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2020-06-25: Fix merged to puppet-tripleo (stable/ussuri)

Reviewed: https://review.opendev.org/737719
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=c76b60b4ab090aa2bbb8c28fbec299aa6ec8a6ae
Submitter: Zuul
Branch: stable/ussuri

commit c76b60b4ab090aa2bbb8c28fbec299aa6ec8a6ae
Author: Grzegorz Grasza <email address hidden>
Date: Tue Jun 16 18:03:03 2020 +0200

Fix the default values for ca_file and cert_file

    Change-Id: I35b39a1bc0e1793116831485180a49da5e0a019a
    Closes-Bug: #1883741
    Resolves: rhbz#1844592
    (cherry picked from commit 9befc582571757cfd2bfd45f491617af3d563af8)

tags:	added: in-stable-ussuri
tags:	added: in-stable-train

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2020-06-25: Fix merged to puppet-tripleo (stable/train)

Reviewed: https://review.opendev.org/737720
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=b9a5dae6044ef44960d6af739eb9170e96afa01f
Submitter: Zuul
Branch: stable/train

commit b9a5dae6044ef44960d6af739eb9170e96afa01f
Author: Grzegorz Grasza <email address hidden>
Date: Tue Jun 16 18:03:03 2020 +0200

Fix the default values for ca_file and cert_file

    Change-Id: I35b39a1bc0e1793116831485180a49da5e0a019a
    Closes-Bug: #1883741
    Resolves: rhbz#1844592
    (cherry picked from commit 9befc582571757cfd2bfd45f491617af3d563af8)

tags:

added: in-stable-stein

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2020-06-25: Fix merged to puppet-tripleo (stable/stein)

#10

Reviewed: https://review.opendev.org/737721
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=31fd3545ea684338bc204ae49f3afafcbaa2a23a
Submitter: Zuul
Branch: stable/stein

commit 31fd3545ea684338bc204ae49f3afafcbaa2a23a
Author: Grzegorz Grasza <email address hidden>
Date: Tue Jun 16 18:03:03 2020 +0200

Fix the default values for ca_file and cert_file

    Change-Id: I35b39a1bc0e1793116831485180a49da5e0a019a
    Closes-Bug: #1883741
    Resolves: rhbz#1844592
    (cherry picked from commit 9befc582571757cfd2bfd45f491617af3d563af8)

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2020-06-26: Fix merged to puppet-tripleo (stable/queens)

#11

Reviewed: https://review.opendev.org/737723
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=095bc0ea8cfba8a4439cfa5f0e4665d17574a07b
Submitter: Zuul
Branch: stable/queens

commit 095bc0ea8cfba8a4439cfa5f0e4665d17574a07b
Author: Grzegorz Grasza <email address hidden>
Date: Tue Jun 16 18:03:03 2020 +0200

Fix the default values for ca_file and cert_file

    Change-Id: I35b39a1bc0e1793116831485180a49da5e0a019a
    Closes-Bug: #1883741
    Resolves: rhbz#1844592
    (cherry picked from commit 9befc582571757cfd2bfd45f491617af3d563af8)