nova-novnproxy can't read certificates. Permission denied

[Giuseppe Petralia]

charm-nova-cloud-controller version 17.0.7 revision 370

In bootstack a customer was unable to access novnc vm console.

We found that nova-novncproxy was unable to read the certificate and was showing the following error:

2019-03-08 10:17:58.240 1887177 DEBUG nova.console.websocketproxy [-] exception vmsg /usr/lib/python2.7/dist-packages/websockify/websocket.py:878
2019-03-08 10:17:58.240 1887177 ERROR nova.console.websocketproxy Traceback (most recent call last):
2019-03-08 10:17:58.240 1887177 ERROR nova.console.websocketproxy File "/usr/lib/python2.7/dist-packages/websockify/websocket.py", line 933, in top_new_client
2019-03-08 10:17:58.240 1887177 ERROR nova.console.websocketproxy client = self.do_handshake(startsock, address)
2019-03-08 10:17:58.240 1887177 ERROR nova.console.websocketproxy File "/usr/lib/python2.7/dist-packages/websockify/websocket.py", line 840, in do_handshake
2019-03-08 10:17:58.240 1887177 ERROR nova.console.websocketproxy keyfile=self.key)
2019-03-08 10:17:58.240 1887177 ERROR nova.console.websocketproxy File "/usr/lib/python2.7/dist-packages/eventlet/green/ssl.py", line 379, in wrap_socket
2019-03-08 10:17:58.240 1887177 ERROR nova.console.websocketproxy return GreenSSLSocket(sock, *a, **kw)
2019-03-08 10:17:58.240 1887177 ERROR nova.console.websocketproxy File "/usr/lib/python2.7/dist-packages/eventlet/green/ssl.py", line 68, in __init__
2019-03-08 10:17:58.240 1887177 ERROR nova.console.websocketproxy ca_certs, do_handshake_on_connect and six.PY2, *args, **kw)
2019-03-08 10:17:58.240 1887177 ERROR nova.console.websocketproxy File "/usr/lib/python2.7/ssl.py", line 560, in __init__
2019-03-08 10:17:58.240 1887177 ERROR nova.console.websocketproxy self._context.load_cert_chain(certfile, keyfile)
2019-03-08 10:17:58.240 1887177 ERROR nova.console.websocketproxy IOError: [Errno 13] Permission denied

We workaround the issue with:

chown nova:nova /etc/apache2/ssl/nova/*.local

[Peter Sabaini (peter-sabaini)]

Subscribing field-medium

[Peter Sabaini (peter-sabaini)]

Adding field-high as the workaround ^^ isn't permanent and we're seeing this repeatedly

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/645529

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/645530

[Peter Sabaini (peter-sabaini)]

Would it be possible to get a backport for 18.05 for this fix?

[Chris MacNaughton (chris.macnaughton)]

18.05 is not a supported charm release

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/645529
Committed: https://git.openstack.org/cgit/openstack/charm-nova-cloud-controller/commit/?id=f7674cf35e3b413f3521aecde3ef3c5bf431c6c7
Submitter: Zuul
Branch: master

commit f7674cf35e3b413f3521aecde3ef3c5bf431c6c7
Author: Frode Nordahl <email address hidden>
Date: Fri Mar 22 09:49:09 2019 +0100

    Deprecate separate configuration options for console TLS

    Console TLS will automatically be set up when the Nova API has TLS
    enabled, either through configuration (``ssl_*``) or through
    certificates relation to vault.

    Having multiple knobs to set up the console TLS is not really
    necessary and it adds to complexity.

    Change-Id: I6efb72bced8473ad52e623318a51ed976c7ac31c
    Related-Bug: #1819140

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/645530
Committed: https://git.openstack.org/cgit/openstack/charm-nova-cloud-controller/commit/?id=9414223b22c97a38ff40eefeaeef9c8399e11087
Submitter: Zuul
Branch: master

commit 9414223b22c97a38ff40eefeaeef9c8399e11087
Author: Frode Nordahl <email address hidden>
Date: Fri Mar 22 10:48:26 2019 +0100

    Allow console service to read certificate data

    The console proxy service run as user ``nova`` throughout its lifespan,
    it has no load certificates before dropping privileges mechanism.

    Set file permissions on certificate files to support this.

    Sync charm helpers.

    Closes-Bug: #1819140
    Change-Id: I597b82070e51506c56500267daa2b59d8145b9f9