IPA fails ironic devstack jobs when tls-proxy is enabled in devstack

[Clark Boylan]

Little background on this is I have slowly been trying to get various jobs that use devstack to pass with tls-proxy enabled with the eventual goal being that tls-proxy is just enabled in devstack by default.

One class of jobs that fail are those that use IPA and devstack together because the fake baremetal nodes fail to talk to the glance api when it has a cert signed by the temporary devstack CA in front of it.

There are two ways we can address this. The first is get the image to trust the devstack CA. This is problematic bceause this CA is different for every job run so we will need to modify the IPA image somehow in every test to update the trusted certs there to include the devstack CA. The second is to just not verify tls cert authenticity. This is definitely more straightforward but likely less than ideal if anyone is using the images we run in test in production too.

For test log details you can look at the jobs run against https://review.openstack.org/#/c/372374/ which is a throw away change that just forces TLS on to test things. You can also use that to test any changes you might make using depends on.

[Dmitry Tantsur (divius)]

Moved to ironic, as I think it should be fixed in the devstack plugin.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/469836

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/469837

[Ramamani Yeleswarapu (ramamani-yeleswarapu)]

Hi Dmitry, a fix is needed for ironic-inspector as well?

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/489778

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/469836
Committed: https://git.openstack.org/cgit/openstack/ironic/commit/?id=f75ff901a9e9253e695900f5a821f39a1a5dfb67
Submitter: Jenkins
Branch: master

commit f75ff901a9e9253e695900f5a821f39a1a5dfb67
Author: Dmitry Tantsur <email address hidden>
Date: Thu Jun 1 12:35:33 2017 +0200

    [devstack] add support for running behind tls-proxy

    * pass ipa-insecure=1 to the ramdisk

      DevStack is moving to having TLS by default with self-signed certificates.
      As embedding these certificates in the image will require rebuilding it
      on every run, let's just not verify them in devstack.

    * enable running ironic-api behind tls-proxy

    Change-Id: Id1c3c44e044c2741f7f3f2ce5510a11ebb2344d9
    Closes-Bug: #1694842
    Co-Authored-By: Ramamani Yeleswarapu <email address hidden>

[Ramamani Yeleswarapu (ramamani-yeleswarapu)]

Posted a patch to project-config to enable tls for ironic gate jobs (except the grenade jobs):

https://review.openstack.org/#/c/492231/

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/492664

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/ironic 9.0.0 release.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/newton
Review: https://review.openstack.org/495428

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/ocata
Review: https://review.openstack.org/495430

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/pike
Review: https://review.openstack.org/495432

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/499768

[OpenStack Infra (hudson-openstack)]

Change abandoned by Dmitry Tantsur (<email address hidden>) on branch: stable/newton
Review: https://review.openstack.org/495428
Reason: Hi! As stable/newton goes EOL really soon, I have to abandon this change.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ramamani Yeleswarapu (<email address hidden>) on branch: stable/ocata
Review: https://review.openstack.org/495430
Reason: Testing complete. Patch merged.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ramamani Yeleswarapu (<email address hidden>) on branch: stable/pike
Review: https://review.openstack.org/495432
Reason: Testing complete. Patch merged.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ramamani Yeleswarapu (<email address hidden>) on branch: master
Review: https://review.openstack.org/492664
Reason: Testing complete. Patch merged.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ramamani Yeleswarapu (<email address hidden>) on branch: master
Review: https://review.openstack.org/499768
Reason: Testing complete. Patch merged.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ramamani Yeleswarapu (<email address hidden>) on branch: master
Review: https://review.openstack.org/489778
Reason: Testing complete.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Dmitry Tantsur (<email address hidden>) on branch: master
Review: https://review.openstack.org/469837
Reason: I think this is no longer needed

[Julia Kreger (juliaashleykreger)]

Changing ironic-inspector state to incomplete. The bug was for IPA, and fixed in ironic's devstack plugin. I'm unsure if any further action is required in ironic-inspector at this time.

[Julia Kreger (juliaashleykreger)]

Given the age, marking invalid.