Juniper Openstack

Contrail :: 16.04 18 newton :: openstack puppet provisioning fails to start due to metadata ssl config.

Bug #1724468 reported by Ritam Gangopadhyay on 2017-10-18

This bug affects 1 person

	Status	Importance	Assigned to	Milestone
Juniper Openstack	Status tracked in Trunk
R4.0	Fix Committed	Critical	Dheeraj Gautam	Juniper Openstack r4.0.3.0
R4.1	Fix Committed	Critical	Dheeraj Gautam	Juniper Openstack r4.1.0.0-fcs "r4.1"
Trunk	Fix Committed	Critical	Dheeraj Gautam	Juniper Openstack r5.0.0

Bug Description

Setup:- R4.1 build 18 Newton multi node setup.

nodei19 10.204.217.131 openstack
nodec28 10.204.217.13 controller, analytics, analyticsdb
nodec10 10.204.217.176 controller, analytics, analyticsdb
nodec33 10.204.217.168 controller, analytics, analyticsdb
nodeg37 10.204.217.77 lb
nodei17 10.204.217.129 compute
nodei20 10.204.217.132 compute

*************************************************************************************
*************************************************************************************
cluster json configuration:-

{
    "cluster": [
        {
            "parameters": {
                "provision": {
                    "contrail_4": {
                        "metadata_ssl_enable": true

*************************************************************************************
*************************************************************************************
puppet agent logs:-

Oct 18 12:17:33 nodei19 puppet-agent[19208]: Not using cache on failed catalog
Oct 18 12:17:33 nodei19 puppet-agent[19208]: Could not retrieve catalog; skipping run
Oct 18 12:17:36 nodei19 puppet-agent[19629]: Local environment: "production" doesn't match server specified node environment "contrail_newton", switching agent to "contrail_newton".
Oct 18 12:17:43 nodei19 puppet-agent[19629]: Could not retrieve catalog from remote server: Error 400 on SERVER: Duplicate declaration: Nova_config[DEFAULT/enabled_ssl_apis] is already declared in file /etc/puppet/environments/contrail_newton/modules/nova/manifests/init.pp:747; cannot redeclare at /etc/puppet/environments/contrail_newton/modules/contrail/manifests/profile/openstack/nova.pp:358 on node nodei19.englab.juniper.net
Oct 18 12:17:43 nodei19 puppet-agent[19629]: Not using cache on failed catalog
Oct 18 12:17:43 nodei19 puppet-agent[19629]: Could not retrieve catalog; skipping run
Oct 18 12:17:46 nodei19 puppet-agent[20031]: Local environment: "production" doesn't match server specified node environment "contrail_newton", switching agent to "contrail_newton".
Oct 18 12:17:53 nodei19 puppet-agent[20031]: Could not retrieve catalog from remote server: Error 400 on SERVER: Duplicate declaration: Nova_config[DEFAULT/enabled_ssl_apis] is already declared in file /etc/puppet/environments/contrail_newton/modules/nova/manifests/init.pp:747; cannot redeclare at /etc/puppet/environments/contrail_newton/modules/contrail/manifests/profile/openstack/nova.pp:358 on node nodei19.englab.juniper.net

*************************************************************************************
*************************************************************************************

root@nodec28:~# awk 'NR >= 740 && NR <= 750' /etc/puppet/environments/contrail_newton/modules/nova/manifests/init.pp
    }
  } else {
    nova_config {
      'DEFAULT/enabled_ssl_apis' : ensure => absent;
      'ssl/cert_file' : ensure => absent;
      'ssl/key_file' : ensure => absent;
      'ssl/ca_file' : ensure => absent;
    }
  }

  oslo::messaging::default { 'nova_config':
root@nodec28:~# awk 'NR >= 350 && NR <= 360' /etc/puppet/environments/contrail_newton/modules/contrail/manifests/profile/openstack/nova.pp
    }
    nova_config {
      'DEFAULT/enabled_ssl_apis': value => "metadata";
      'DEFAULT/nova_metadata_protocol': value => "https";
      'DEFAULT/nova_metadata_insecure': value => "True";
      'DEFAULT/ssl_cert_file': value => "/etc/nova/ssl/certs/nova.pem";
      'DEFAULT/ssl_key_file': value => "/etc/nova/ssl/private/novakey.pem";
      'DEFAULT/ssl_ca_file': value => "/etc/nova/ssl/certs/ca.pem";
    }
  }

root@nodec28:~#

Tags:

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-10-26: [Review update] R4.1

Review in progress for https://review.opencontrail.org/36849
Submitter: Dheeraj Gautam (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-10-26: [Review update] R4.0

Review in progress for https://review.opencontrail.org/36850
Submitter: Dheeraj Gautam (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-10-26: [Review update] master

Review in progress for https://review.opencontrail.org/36851
Submitter: Dheeraj Gautam (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-10-26: [Review update] R4.1

Review in progress for https://review.opencontrail.org/36849
Submitter: Dheeraj Gautam (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-10-26: [Review update] master

Review in progress for https://review.opencontrail.org/36851
Submitter: Dheeraj Gautam (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-10-26: [Review update] R4.0

#11

Review in progress for https://review.opencontrail.org/36850
Submitter: Dheeraj Gautam (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-10-26: [Review update] R4.1

#13

Review in progress for https://review.opencontrail.org/36849
Submitter: Dheeraj Gautam (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-10-26: A change has been merged

#15

Reviewed: https://review.opencontrail.org/36849
Committed: http://github.com/Juniper/contrail-puppet/commit/c6eef79c7d01d1bd4849ccf03265351cb0157c39
Submitter: Zuul (<email address hidden>)
Branch: R4.1

commit c6eef79c7d01d1bd4849ccf03265351cb0157c39
Author: Dheeraj Gautam <email address hidden>
Date: Wed Oct 25 19:45:16 2017 -0700

support ssl_metadata

Closes-Bug: #1724468

pass ssl variables to nova class during init

PATCH 2:
only metadata server can be on SSL

PATCH 3:
1. fix missed comma
2. remove not needed config, previosuly added

Change-Id: I63037a7e0bc3975cc44864586ff717cfe1cd2d16

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-10-27: [Review update] R4.0

#16

Review in progress for https://review.opencontrail.org/36850
Submitter: Dheeraj Gautam (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-10-27: [Review update] master

#18

Review in progress for https://review.opencontrail.org/36851
Submitter: Dheeraj Gautam (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-10-27: A change has been merged

#20

Reviewed: https://review.opencontrail.org/36851
Committed: http://github.com/Juniper/contrail-puppet/commit/2c22e48d1abd44f85e586ad34398a74c81ec08bb
Submitter: Zuul (<email address hidden>)
Branch: master

commit 2c22e48d1abd44f85e586ad34398a74c81ec08bb
Author: Dheeraj Gautam <email address hidden>
Date: Wed Oct 25 19:45:16 2017 -0700

support ssl_metadata

Closes-Bug: #1724468

pass ssl variables to nova class during init

PATCH 2:
only metadata server can be on SSL

PATCH 3:
1. fix missed comma
2. remove not needed config, previosuly added

Change-Id: I63037a7e0bc3975cc44864586ff717cfe1cd2d16
(cherry picked from commit c6eef79c7d01d1bd4849ccf03265351cb0157c39)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-10-27:

#21

Reviewed: https://review.opencontrail.org/36850
Committed: http://github.com/Juniper/contrail-puppet/commit/020282dece05dc6a01b9e2c864ff833d6a149d1b
Submitter: Zuul (<email address hidden>)
Branch: R4.0

commit 020282dece05dc6a01b9e2c864ff833d6a149d1b
Author: Dheeraj Gautam <email address hidden>
Date: Wed Oct 25 19:45:16 2017 -0700

support ssl_metadata

Closes-Bug: #1724468

pass ssl variables to nova class during init

PATCH 2:
only metadata server can be on SSL

PATCH 3:
1. fix missed comma
2. remove not needed config, previosuly added

Change-Id: I63037a7e0bc3975cc44864586ff717cfe1cd2d16
(cherry picked from commit c6eef79c7d01d1bd4849ccf03265351cb0157c39)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-11-10: [Review update] R4.1

#22

Review in progress for https://review.opencontrail.org/37401
Submitter: Dheeraj Gautam (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-11-10: [Review update] R4.0

#24

Review in progress for https://review.opencontrail.org/37402
Submitter: Dheeraj Gautam (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-11-10: [Review update] master

#26

Review in progress for https://review.opencontrail.org/37403
Submitter: Dheeraj Gautam (<email address hidden>)

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-11-11: A change has been merged

#28

Reviewed: https://review.opencontrail.org/37402
Committed: http://github.com/Juniper/contrail-puppet/commit/c75101d2274859a114591f2e9c177e996fa736a5
Submitter: Zuul (<email address hidden>)
Branch: R4.0

commit c75101d2274859a114591f2e9c177e996fa736a5
Author: Dheeraj Gautam <email address hidden>
Date: Fri Nov 10 09:15:44 2017 -0800

some more configuration are needed for metadata ssl feature.

Change-Id: Ifd66bfe88a06737f9738ae2d7aefd400de445c69
Closes-Bug: #1724468

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-11-11:

#29

Reviewed: https://review.opencontrail.org/37403
Committed: http://github.com/Juniper/contrail-puppet/commit/58d7a114228a1a6dccd3c801904d01e60a9065ab
Submitter: Zuul (<email address hidden>)
Branch: master

commit 58d7a114228a1a6dccd3c801904d01e60a9065ab
Author: Dheeraj Gautam <email address hidden>
Date: Fri Nov 10 09:15:44 2017 -0800

some more configuration are needed for metadata ssl feature.

Change-Id: Ifd66bfe88a06737f9738ae2d7aefd400de445c69
Closes-Bug: #1724468

Revision history for this message

OpenContrail Admin (ci-admin-f) wrote on 2017-11-11:

#30

Reviewed: https://review.opencontrail.org/37401
Committed: http://github.com/Juniper/contrail-puppet/commit/6797cce840b8e695665baa00f5e23be65511e5df
Submitter: Zuul (<email address hidden>)
Branch: R4.1

commit 6797cce840b8e695665baa00f5e23be65511e5df
Author: Dheeraj Gautam <email address hidden>
Date: Fri Nov 10 09:15:44 2017 -0800

some more configuration are needed for metadata ssl feature.

Change-Id: Ifd66bfe88a06737f9738ae2d7aefd400de445c69
Closes-Bug: #1724468

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.