cinder create encrypted volume fails

Bug #1866020 reported by Rima Khoury
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Cinder
New
Undecided
Unassigned

Bug Description

***using openstack/Rocky

I am trying to create an encrypted volume using cinder/openstack CLI commands.
I have configure the key_manager in cinder.conf to have backend=barbican. also followed the documentation provided by openstack in this link:
https://docs.openstack.org/cinder/rocky/configuration/block-storage/volume-encryption.html

but when I run the create command I get the following error:
[stack@undercloud (overcloudrc) ~]$ openstack volume create --size 1 --type LUKS_ceph luks-1
The server has either erred or is incapable of performing the requested operation. (HTTP 500) (Request-ID: req-1c8beaa2-0079-4a9c-bba6-40c8e4d6c7f8)

cinde-volume.log does not show any errors and the cinde-api.log shows the following:

ERROR cinder.api.middleware.fault File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 907, in _send_request
ERROR cinder.api.middleware.fault raise exceptions.SSLError(msg)
ERROR cinder.api.middleware.fault SSLError: SSL exception connecting to https://172.17.1.12:9311: hostname '172.17.1.12' doesn't match either of '10.5.176.100', '10.5.176.100', 'instack.localdomain', 'vip.localdomain', '172.17.1.25'
ERROR cinder.api.middleware.fault

barbican and keystone logs does not show any errors.

configurations:
cinder.conf

[key_manager]
backend = barbican
[barbican]
barbican_endpoint = https://172.17.1.12:9311
auth_endpoint = http://172.17.1.12:5000/v3
certfile = /etc/cinder/cinder-server.pem
keyfile = /etc/cinder/cinder-server.key
cafile = /etc/pki/ca-trust/source/anchors/ca-internal.crt.pem
[keystone_authtoken]
www_authenticate_uri=http://172.17.1.12:5000
auth_uri=http://172.17.1.12:5000
auth_type=password
auth_url=http://172.17.1.12:5000
username=cinder
password= <my cinder password>
user_domain_name=Default
project_name=service
project_domain_name=Default

barbican.conf configurations are more or less the same. I can add them later if needed.

Does someone have an idea of how to fix this?

Rima Khoury (rimakhoury)
tags: added: barbican
tags: removed: barbican
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.