Deployment fails when legacy TLS is enabled with selective SSL simultaneously
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Fuel for OpenStack |
Confirmed
|
High
|
Fuel Sustaining |
Bug Description
Fuel 8.0
Environment has "Public TLS" enabled.
At the same time Hiera contains hash 'use_ssl' (data container in case of selective TLS is used), and this 'use_ssl' hash does not have entries for some endpoints. In our case 'use_ssl' contains only swift internal endpoint data:
$ hiera -h use_ssl
use_ssl:
swift: true
swift_internal: true
swift_
content: '-----BEGIN CERTIFICATE-
name: swiftstack.pem
swift_
swift_
At the same time:
$hiera -h public_ssl
{"hostname"
"horizon"=>false,
"services"=>false,
"cert_data"=>"",
"cert_
"metadata"
Most of Fuel Library code will switch to hash 'public_ssl' when it tries to determine public address for such service, if hash 'use_ssl' does not contain such address/hostname
F.e.
osnailyfacter/
$public_ssl_hash = hiera('public_ssl')
$ssl_hash = hiera_hash(
...
$public_address = get_ssl_
So in case described above, $ssl_hash does not contain any 'keystone_public' entries, so manifest keystone.pp will get hostname from $public_ssl_hash, e.g. will try to use 'public.fuel.local' for Keystone public endpoint.
But task 'ssl_dns_setup' which should add these hostnames to /etc/hosts on Openstack nodes, has the following code
osnailyfacter/
if !empty($ssl_hash) {
hosts { $services:
ssl_hash => $ssl_hash,
}
} elsif !empty(
host { $public_
ensure => present,
ip => $public_vip,
So when 'use_ssl' hash in Hiera is not empty (and it is not in our case), use_ssl data will be used as hostname source for Keystone and other services. But here is no Keystone hostname there, and puppet code expects, that hostname 'public.fuel.local' from 'public_ssl' Hiera hash should be used.
So in fact 'public.fuel.local' never will be added to /etc/hosts if Selective TLS hash 'use_ssl' is not empty. This cause expected deployment failures like this
ERROR: Unable to establish connection to https:/
Please, sychronize 2 approaches between each other
Changed in fuel: | |
assignee: | nobody → MOS Maintenance (mos-maintenance) |
milestone: | none → 8.0-updates |
importance: | Undecided → High |
status: | New → Confirmed |
tags: | added: area-mos |
Changed in fuel: | |
assignee: | MOS Maintenance (mos-maintenance) → Fuel Sustaining (fuel-sustaining-team) |
tags: | added: area-library |