Etcd user/group is missing in Internal TLS setup for DCN HCI computes

[Bogdan Dobrelya]

In TLS DCN HCI setup, when etcd is wanted as DLM for Cinder A/A to be ran on edge sites, there is an issue that puppet fails to configure certmonger:

Error: /Stage[main]/Tripleo::Certmonger::Etcd/File[/etc/pki/tls/certs/etcd.crt]/group: change from 'root' to 'etcd' failed: Could not find group etcd

This is because we do not configure etcd on HCI hosts, but puppet needs etcd user and group to complete the certificates creation. Those certificates will be used with etcd container later.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/740421

[Alan Bishop (alan-bishop)]

Can you point me to an example of this failure? I've never encountered it in my own tests.

[Bogdan Dobrelya (bogdando)]

removed train backport candidate since there is no plans (yet) to backport Cinder A/A with TLS & etcd as DLM into train

[OpenStack Infra (hudson-openstack)]

Change abandoned by Bogdan Dobrelya (bogdando) (<email address hidden>) on branch: master
Review: https://review.opendev.org/740421

[Bogdan Dobrelya (bogdando)]

unsure if this is still relevant

[Alan Bishop (alan-bishop)]

@bogdando, no, I don't believe this is still relevant. A number of tweaks were required in multiple projects to get full containerized etcd to support TLS, and it's working now.