sahara broken if SSL enabled

[Roman Sokolkov]

Sahara has two flags "public_identity_ca_file" and "public_object_store_ca_file". There should be path to CA certificate that is used for OpenStack APIs.

But Fuel puts there whole PEM file with: Key, Cert and cert chain. which is wrong and breaks Sahara cluster deployment with following error

http://paste.openstack.org/show/592049/

Right solution: put only cert and chain in pem file.

Steps to reproduce:
1) Deploy MOS with Sahara and own certificate (Put Key, cert and chain)
2) Try to deploy Sahara cluster with http://docs.openstack.org/developer/sahara/devref/quickstart.html

Expected result:
Sahara cluster will be deployed

Actual result:
Sahara cluster fails with error above

[Stanislaw Bogatkin (sbogatkin)]

>Right solution: put only cert and chain in pem file.

It looks right only when you don't know that haproxy needs both key and cert in pem file and we use haproxy everywhere, for each service in cluster. We also did this for sahara in our default installation, but this behavior was broken in https://github.com/openstack/fuel-library/commit/8966ed1bf7cc9b5f883458c33375e99ad57bfea6 and it needs to fixed.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/411758

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/411828

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/411828
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=37945bfd0bdb2b4016a7659a62b7f282dfa0c7f4
Submitter: Jenkins
Branch: master

commit 37945bfd0bdb2b4016a7659a62b7f282dfa0c7f4
Author: Stanislaw Bogatkin <email address hidden>
Date: Fri Dec 16 17:05:42 2016 +0300

    Remove private key from cert chain in /etc

    As we use /etc as a TLS certchain store so we should remove
    private key from it as it doesn't needed there.

    Change-Id: I3041e8de1519395cc6018845285ed1b949225a52
    Closes-Bug: #1650284

[OpenStack Infra (hudson-openstack)]

Change abandoned by Stanislaw Bogatkin (<email address hidden>) on branch: master
Review: https://review.openstack.org/411758
Reason: In favor of I3041e8de1519395cc6018845285ed1b949225a52

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/fuel-library 11.0.0.0rc1 release candidate.