validation feature does not work with SSL

Bug #2071828 reported by Marian Gasparovic
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Snap
Fix Committed
High
Chi Wai CHAN

Bug Description

When tls feature is enabled in Sunbeam `sunbeam enable validation` fails during charm install on SSL

2024-07-03T13:00:55.584Z [container-agent] 2024-07-03 13:00:55 INFO juju-log identity-ops:133: Entering guarded section: 'Bootstrapping'
2024-07-03T13:00:55.664Z [container-agent] 2024-07-03 13:00:55 INFO juju-log identity-ops:133: Checking logging relation readiness...
2024-07-03T13:00:56.716Z [container-agent] 2024-07-03 13:00:56 WARNING juju-log identity-ops:133: Running db-sync, it has not run on this unit before
2024-07-03T13:00:56.718Z [container-agent] 2024-07-03 13:00:56 WARNING juju-log identity-ops:133: Not DB sync ran. Charm does not specify self.db_sync_cmds
2024-07-03T13:00:56.721Z [container-agent] 2024-07-03 13:00:56 INFO juju-log identity-ops:133: Configuring the tempest environment
2024-07-03T13:00:57.283Z [container-agent] 2024-07-03 13:00:57 ERROR juju-log identity-ops:133: Exception raised in section 'Bootstrapping': SSL exception connecting to https://10.246.167.167/openstack-keystone/v3/projects: HTTPSCo
nnectionPool(host='10.246.167.167', port=443): Max retries exceeded with url: /openstack-keystone/v3/projects?domain_id=4447ac70db5249f59615a713f1dd858e (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAIL
ED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)')))
2024-07-03T13:00:57.288Z [container-agent] 2024-07-03 13:00:57 ERROR juju-log identity-ops:133: Traceback (most recent call last):
2024-07-03T13:00:57.288Z [container-agent] File "/var/lib/juju/agents/unit-tempest-0/charm/venv/urllib3/connectionpool.py", line 466, in _make_request
2024-07-03T13:00:57.288Z [container-agent] self._validate_conn(conn)
2024-07-03T13:00:57.288Z [container-agent] File "/var/lib/juju/agents/unit-tempest-0/charm/venv/urllib3/connectionpool.py", line 1095, in _validate_conn
2024-07-03T13:00:57.288Z [container-agent] conn.connect()
2024-07-03T13:00:57.288Z [container-agent] File "/var/lib/juju/agents/unit-tempest-0/charm/venv/urllib3/connection.py", line 652, in connect
2024-07-03T13:00:57.288Z [container-agent] sock_and_verified = _ssl_wrap_socket_and_match_hostname(
2024-07-03T13:00:57.288Z [container-agent] File "/var/lib/juju/agents/unit-tempest-0/charm/venv/urllib3/connection.py", line 805, in _ssl_wrap_socket_and_match_hostname
2024-07-03T13:00:57.288Z [container-agent] ssl_sock = ssl_wrap_socket(
2024-07-03T13:00:57.288Z [container-agent] File "/var/lib/juju/agents/unit-tempest-0/charm/venv/urllib3/util/ssl_.py", line 465, in ssl_wrap_socket
2024-07-03T13:00:57.288Z [container-agent] ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
2024-07-03T13:00:57.288Z [container-agent] File "/var/lib/juju/agents/unit-tempest-0/charm/venv/urllib3/util/ssl_.py", line 509, in _ssl_wrap_socket_impl
2024-07-03T13:00:57.288Z [container-agent] return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
2024-07-03T13:00:57.288Z [container-agent] File "/usr/lib/python3.10/ssl.py", line 513, in wrap_socket
2024-07-03T13:00:57.288Z [container-agent] return self.sslsocket_class._create(
2024-07-03T13:00:57.288Z [container-agent] File "/usr/lib/python3.10/ssl.py", line 1100, in _create
2024-07-03T13:00:57.288Z [container-agent] self.do_handshake()
2024-07-03T13:00:57.288Z [container-agent] File "/usr/lib/python3.10/ssl.py", line 1371, in do_handshake
2024-07-03T13:00:57.288Z [container-agent] self._sslobj.do_handshake()
2024-07-03T13:00:57.288Z [container-agent] ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)

Changed in snap-openstack:
status: New → Triaged
importance: Undecided → High
tags: added: validation
Andrea Ieri (aieri)
tags: added: soleng-452
Chi Wai CHAN (raychan96)
Changed in snap-openstack:
assignee: nobody → Chi Wai CHAN (raychan96)
status: Triaged → Fix Committed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.