R5.0-micro-services provision - metadata ssl support for vrouter.

[Ritam Gangopadhyay]

To enable ssl for openstack metadata service following needs to be updated in default section of nova.conf on the openstack node:

• enabled_ssl_apis = metadata
• nova_metadata_protocol = https
• nova_metadata_insecure = False
• ssl_cert_file = /etc/contrail/ssl/certs/server.pem
• ssl_key_file = /etc/contrail/ssl/private/server-privkey.pem
• ssl_ca_file = /etc/contrail/ssl/certs/ca-cert.pem

On the vrouter config side ssl fields need to be updated too. The feature description is as below.

https://github.com/Juniper/contrail-controller/wiki/Metadata-service

[Abhay Joshi (abhayj)]

Ritam,

Metadata support is already there in 5.0-micro-services. You can enable it with the following setting :

# contrail_additions : metadata_ssl_enable is set to "yes" to support the SSL
# encryption feature for vrouter when proxying.
metadata_ssl_enable: "no"

in contrail-kolla-ansible/all.yml file. Please see https://github.com/Juniper/contrail-ansible-deployer/wiki/Contrail-with-Kolla-Ocata and https://github.com/Juniper/contrail-kolla-ansible/blob/contrail/ocata/ansible/group_vars/all.yml.

[Ramprakash R (ramprakash)]

All the parameters that used to be in kolla/globals.yml could be given in instances.yaml as below:

...
...
kolla_config:
  kolla_globals:
    metadata_ssl_enabe: yes

This should populate the nova.conf with below configs:

enabled_ssl_apis= metadata
nova_metadata_protocol= https
nova_metadata_insecure= True
ssl_cert_file= /etc/nova/ssl/certs/nova.pem
ssl_key_file= /etc/nova/ssl/private/novakey.pem
ssl_ca_file= /etc/nova/ssl/certs/ca.pem

Note that pem files might have to be generated and placed in this directory in the relevant compute hosts. That will not happen automatically during provision in 5.0.

[vageesan (vageesant)]

Hi Ramprakash,

Provision is failing in my setup with the following log.I see mariadb docker is restarting frequently.Please check into the setup.

SM lite node: 10.204.216.8
Build: 4.1.0-8 ,Ocata – 16.04.2-minimal.
Config file: /root/vageesan/combined_new.json

Thanks
Vageesan.

"2018-03-31 02:35:02,283-INFO-sm_ansible_callback.py:53-append(): TASK [mariadb : Waiting for MariaDB service to be ready]"
"2018-03-31 02:40:59,998-INFO-sm_ansible_callback.py:53-append(): fatal: [10.204.216.11]: FAILED! => (item - None) {"attempts": 10, "changed": false, "failed": true, "module_stderr": "Shared connection to 10.204.216.11 closed.\r\n", "module_stdout": "Traceback (most recent call last):\r\n File \"/tmp/ansible_RfH8hA/ansible_module_wait_for.py\", line 585, in <module>\r\n main()\r\n File \"/tmp/ansible_RfH8hA/ansible_module_wait_for.py\", line 525, in main\r\n response = s.recv(1024)\r\nsocket.error: [Errno 104] Connection reset by peer\r\n", "msg": "MODULE FAILURE", "rc": 0}"
"2018-03-31 02:41:00,428-INFO-sm_ansible_callback.py:53-append(): fatal: [10.204.216.13]: FAILED! => (item - None) {"attempts": 10, "changed": false, "failed": true, "module_stderr": "Shared connection to 10.204.216.13 closed.\r\n", "module_stdout": "Traceback (most recent call last):\r\n File \"/tmp/ansible_qeKMWG/ansible_module_wait_for.py\", line 585, in <module>\r\n main()\r\n File \"/tmp/ansible_qeKMWG/ansible_module_wait_for.py\", line 525, in main\r\n response = s.recv(1024)\r\nsocket.error: [Errno 104] Connection reset by peer\r\n", "msg": "MODULE FAILURE", "rc": 0}"
"2018-03-31 02:41:00,432-INFO-sm_ansible_utils.py:496-send_REST_request(): Sending post request to http://10.204.216.8:9002/ansible_status?server_id=10.204.216.11&state=provision_failed"
"2018-03-31 02:41:00,435-DEBUG-server_mgr_status.py:134-put_ansible_status(): Server status Data nodea15 provision_failed 2018_03_31__02_41_00"

[Sudheendra Rao (sudheendra-k)]

+Ritam, please check.

Thanks,
Sudhee.

Sent from my iPhone

> On 31-Mar-2018, at 6:18 AM, Vageesan Thanikachalam <email address hidden> wrote:
>
> Hi Ramprakash,
>
> Provision is failing in my setup with the following log.I see mariadb docker is restarting frequently.Please check into the setup.
>
>
> SM lite node: 10.204.216.8
> Build: 4.1.0-8 ,Ocata – 16.04.2-minimal.
> Config file: /root/vageesan/combined_new.json
>
> Thanks
> Vageesan.
>
> "2018-03-31 02:35:02,283-INFO-sm_ansible_callback.py:53-append(): TASK [mariadb : Waiting for MariaDB service to be ready]"
> "2018-03-31 02:40:59,998-INFO-sm_ansible_callback.py:53-append(): fatal: [10.204.216.11]: FAILED! => (item - None) {"attempts": 10, "changed": false, "failed": true, "module_stderr": "Shared connection to 10.204.216.11 closed.\r\n", "module_stdout": "Traceback (most recent call last):\r\n File \"/tmp/ansible_RfH8hA/ansible_module_wait_for.py\", line 585, in <module>\r\n main()\r\n File \"/tmp/ansible_RfH8hA/ansible_module_wait_for.py\", line 525, in main\r\n response = s.recv(1024)\r\nsocket.error: [Errno 104] Connection reset by peer\r\n", "msg": "MODULE FAILURE", "rc": 0}"
> "2018-03-31 02:41:00,428-INFO-sm_ansible_callback.py:53-append(): fatal: [10.204.216.13]: FAILED! => (item - None) {"attempts": 10, "changed": false, "failed": true, "module_stderr": "Shared connection to 10.204.216.13 closed.\r\n", "module_stdout": "Traceback (most recent call last):\r\n File \"/tmp/ansible_qeKMWG/ansible_module_wait_for.py\", line 585, in <module>\r\n main()\r\n File \"/tmp/ansible_qeKMWG/ansible_module_wait_for.py\", line 525, in main\r\n response = s.recv(1024)\r\nsocket.error: [Errno 104] Connection reset by peer\r\n", "msg": "MODULE FAILURE", "rc": 0}"
> "2018-03-31 02:41:00,432-INFO-sm_ansible_utils.py:496-send_REST_request(): Sending post request to http://10.204.216.8:9002/ansible_status?server_id=10.204.216.11&state=provision_failed"
> "2018-03-31 02:41:00,435-DEBUG-server_mgr_status.py:134-put_ansible_status(): Server status Data nodea15 provision_failed 2018_03_31__02_41_00"

[Abhay Joshi (abhayj)]

Comment #3 is NOT APPLICABLE to bug described in this report. The bug is invalid as stated in comments #1 and #2. #3 was something tried on 4.1, person finding it concluded it is this bug and reopened!!

[Ritam Gangopadhyay (ritam)]

As expected metadata_ssl_enable set to true doesn't enable metadata service, instead it fails in ssl cert copy.

Moreover it is not clear how setting metadata_ssl_enable under kolla configs will successfully configure the vrouter conf file.

Here is the task that fails and the error:-

TASK ---- Copy ssl certs for metadata if required

2018-04-13 09:24:25,408 p=24825 u=root | TASK [nova : Copy ssl certs for metadata if required] **********************************************************************************************************************************************
2018-04-13 09:24:25,792 p=24825 u=root | An exception occurred during task execution. To see the full traceback, use -vvv. The error was: AnsibleFileNotFound: Could not find or access '/etc/contrail_smgr/puppet/ssl/nodem14.pem'
2018-04-13 09:24:25,794 p=24825 u=root | failed: [10.204.216.103] (item={u'src': u'/etc/contrail_smgr/puppet/ssl/nodem14.pem', u'dst': u'/etc/nova/ssl/certs/nova.pem'}) => {"changed": false, "item": {"dst": "/etc/nova/ssl/certs/nova.pem", "src": "/etc/contrail_smgr/puppet/ssl/nodem14.pem"}, "msg": "Could not find or access '/etc/contrail_smgr/puppet/ssl/nodem14.pem'"}

[Ramprakash R (ramprakash)]

As mentioned in comment #2, for 5.0, the ssl cert files will not be generated automatically. It needs to be generated manually and placed wherever "local_ssl_directory" is configured to (default is /etc/contrail_smgr/puppet/ssl - you can change it by setting this variable under kolla_globals section). I believe it should still work. Please update if this still does not work.

[Nitish Krishna Kaveri (nitishk)]

When SSL_ENABLE is set to True in contrail_configuration, the node-init containers create self signed certs per host and put them in /etc/contrail/ssl/certs/ and /etc/contrail/ssl/private/ on the host and inside the relevant containers
I am following the default paths mentioned here:
https://github.com/Juniper/contrail-container-builder/blob/master/containers/base/common.sh#L28

The Check-ins to do this creation/mounting as already merged.
Please set SSL_ENABLE to True and try the above paths

[Abhay Joshi (abhayj)]

Ritam,

Please try #8 above and reopen if still broken.

[Ritam Gangopadhyay (ritam)]

Will try it but still not sure how that solves configuring nova.conf and vrouter.conf with metadata ssl parameters.

[Ritam Gangopadhyay (ritam)]

Enabled the below flags:-

[root@nodec28 ~]# cat contrail-ansible-deployer/config/instances.yaml | grep SSL
  SSL_ENABLE: True
[root@nodec28 ~]# cat contrail-ansible-deployer/config/instances.yaml | grep metadata_ss
    metadata_ssl_enable: yes
[root@nodec28 ~]#

Provisioning failed while searching for cert/key files under contrail_smgr directory.
1. Looks like the path needs to be changed in the task.
2. Cert/Key file copy should happen before openstack provisioning is done because copy code is part of contrail provisioning right now which happens after openstack provisioning.
3. I am not sure who needs to look into it, whether from contrail side or openstack side so moving it back to triage.

Here is the ansible task failure seen on my setup, setup is nodec28 and available.

**********************************
**********************************
**********************************
**********************************

2018-04-15 10:15:14,534 p=26013 u=root | TASK [nova : Copy ssl certs for metadata if required] **********************************************************************************************************************************************
2018-04-15 10:15:14,679 p=26013 u=root | An exception occurred during task execution. To see the full traceback, use -vvv. The error was: AnsibleFileNotFound: Could not find or access '/etc/contrail_smgr/puppet/ssl/nodei19.pem'
2018-04-15 10:15:14,679 p=26013 u=root | failed: [10.204.217.131] (item={u'src': u'/etc/contrail_smgr/puppet/ssl/nodei19.pem', u'dst': u'/etc/nova/ssl/certs/nova.pem'}) => {"changed": false, "item": {"dst": "/etc/nova/ssl/certs/nova.pem", "src": "/etc/contrail_smgr/puppet/ssl/nodei19.pem"}, "msg": "Could not find or access '/etc/contrail_smgr/puppet/ssl/nodei19.pem'"}
2018-04-15 10:15:14,746 p=26013 u=root | An exception occurred during task execution. To see the full traceback, use -vvv. The error was: AnsibleFileNotFound: Could not find or access '/etc/contrail_smgr/puppet/ssl/nodeg37.pem'
2018-04-15 10:15:14,747 p=26013 u=root | failed: [10.204.217.77] (item={u'src': u'/etc/contrail_smgr/puppet/ssl/nodeg37.pem', u'dst': u'/etc/nova/ssl/certs/nova.pem'}) => {"changed": false, "item": {"dst": "/etc/nova/ssl/certs/nova.pem", "src": "/etc/contrail_smgr/puppet/ssl/nodeg37.pem"}, "msg": "Could not find or access '/etc/contrail_smgr/puppet/ssl/nodeg37.pem'"}
2018-04-15 10:15:14,748 p=26013 u=root | An exception occurred during task execution. To see the full traceback, use -vvv. The error was: AnsibleFileNotFound: Could not find or access '/etc/contrail_smgr/puppet/ssl/ca-cert.pem'
2018-04-15 10:15:14,748 p=26013 u=root | failed: [10.204.217.131] (item={u'src': u'/etc/contrail_smgr/puppet/ssl/ca-cert.pem', u'dst': u'/etc/nova/ssl/certs/ca.pem'}) => {"changed": false, "item": {"dst": "/etc/nova/ssl/certs/ca.pem", "src": "/etc/contrail_smgr/puppet/ssl/ca-cert.pem"}, "msg": "Could not find or access '/etc/contrail_smgr/puppet/ssl/ca-cert.pem'"}
2018-04-15 10:15:14,749 p=26013 u=root | An exception occurred during task execution. To see the full traceback, use -vvv. The error was: AnsibleFileNotFound: Could not find or access '/etc/contrail_smgr/puppet/ssl/ca-cert.pem...

[Abhay Joshi (abhayj)]

Hi Alexey,

Can you please confirm if your change for SSL certs in control, also takes care of vrouter? If not, please add that too.

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42187
Submitter: alexey-mr (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42188
Submitter: alexey-mr (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42187
Submitter: alexey-mr (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42188
Submitter: alexey-mr (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42187
Submitter: Andrey Pavlov (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42188
Submitter: Andrey Pavlov (<email address hidden>)

[alexey-mr (alexey-morlang)]

To populate vrouter agent config with ssl settins for metadata it is needed to provide variables:
METADATA_SSL_ENABLE=true
# parameters below are optional (if keep them empty insecure ssl be used (w/o cert strict checking), if some orchestrator layer support cert/key generation the exact files could be passed via:
METADATA_SSL_CERTFILE
METADATA_SSL_KEYFILE
METADATA_SSL_CA_CERTFILE
(If provided certs if not in PEM format the format should be specified in METADATA_SSL_CERT_TYPE)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/42188
Committed: http://github.com/Juniper/contrail-container-builder/commit/0f57372a4e9900e8ed7a54b21faee4a06b6759fe
Submitter: Zuul v3 CI (<email address hidden>)
Branch: R5.0

commit 0f57372a4e9900e8ed7a54b21faee4a06b6759fe
Author: alexey-mr <email address hidden>
Date: Thu Apr 19 18:41:55 2018 +0300

Provision metadata ssl options for agent config

Change-Id: I1bce4f06b0fcedcc298de65eaebf4afcf57ac182
Closes-Bug: #1759576

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/42187
Committed: http://github.com/Juniper/contrail-container-builder/commit/fe74357a68453b47ba1e1c19134926d97d492055
Submitter: Zuul v3 CI (<email address hidden>)
Branch: master

commit fe74357a68453b47ba1e1c19134926d97d492055
Author: alexey-mr <email address hidden>
Date: Thu Apr 19 18:41:55 2018 +0300

Provision metadata ssl options for agent config

Change-Id: I1bce4f06b0fcedcc298de65eaebf4afcf57ac182
Closes-Bug: #1759576

[Ritam Gangopadhyay (ritam)]

Provisioning fails to find certs while bringing up nova with the following error:-

2018-04-24 10:25:12,661 p=1887 u=root | TASK [nova : Copy ssl certs for metadata if required] **********************************************************************************************************************************************
2018-04-24 10:25:12,964 p=1887 u=root | An exception occurred during task execution. To see the full traceback, use -vvv. The error was: AnsibleFileNotFound: Could not find or access '/etc/contrail/ssl/nodei19.pem'
2018-04-24 10:25:12,964 p=1887 u=root | failed: [10.204.217.131] (item={u'src': u'/etc/contrail/ssl/nodei19.pem', u'dst': u'/etc/nova/ssl/certs/nova.pem'}) => {"changed": false, "item": {"dst": "/etc/nova/ssl/certs/nova.pem", "src": "/etc/contrail/ssl/nodei19.pem"}, "msg": "Could not find or access '/etc/contrail/ssl/nodei19.pem'"}
2018-04-24 10:25:12,965 p=1887 u=root | An exception occurred during task execution. To see the full traceback, use -vvv. The error was: AnsibleFileNotFound: Could not find or access '/etc/contrail/ssl/nodeg37.pem'
2018-04-24 10:25:12,965 p=1887 u=root | failed: [10.204.217.77] (item={u'src': u'/etc/contrail/ssl/nodeg37.pem', u'dst': u'/etc/nova/ssl/certs/nova.pem'}) => {"changed": false, "item": {"dst": "/etc/nova/ssl/certs/nova.pem", "src": "/etc/contrail/ssl/nodeg37.pem"}, "msg": "Could not find or access '/etc/contrail/ssl/nodeg37.pem'"}
2018-04-24 10:25:12,966 p=1887 u=root | An exception occurred during task execution. To see the full traceback, use -vvv. The error was: AnsibleFileNotFound: Could not find or access '/etc/contrail/ssl/ca-cert.pem'
2018-04-24 10:25:12,966 p=1887 u=root | failed: [10.204.217.131] (item={u'src': u'/etc/contrail/ssl/ca-cert.pem', u'dst': u'/etc/nova/ssl/certs/ca.pem'}) => {"changed": false, "item": {"dst": "/etc/nova/ssl/certs/ca.pem", "src": "/etc/contrail/ssl/ca-cert.pem"}, "msg": "Could not find or access '/etc/contrail/ssl/ca-cert.pem'"}
2018-04-24 10:25:12,967 p=1887 u=root | An exception occurred during task execution. To see the full traceback, use -vvv. The error was: AnsibleFileNotFound: Could not find or access '/etc/contrail/ssl/nodec33.pem'
2018-04-24 10:25:12,967 p=1887 u=root | failed: [10.204.217.168] (item={u'src': u'/etc/contrail/ssl/nodec33.pem', u'dst': u'/etc/nova/ssl/certs/nova.pem'}) => {"changed": false, "item": {"dst": "/etc/nova/ssl/certs/nova.pem", "src": "/etc/contrail/ssl/nodec33.pem"}, "msg": "Could not find or access '/etc/contrail/ssl/nodec33.pem'"}
2018-04-24 10:25:12,968 p=1887 u=root | An exception occurred during task execution. To see the full traceback, use -vvv. The error was: AnsibleFileNotFound: Could not find or access '/etc/contrail/ssl/nodei20.pem'
2018-04-24 10:25:12,968 p=1887 u=root | failed: [10.204.217.132] (item={u'src': u'/etc/contrail/ssl/nodei20.pem', u'dst': u'/etc/nova/ssl/certs/nova.pem'}) => {"changed": false, "item": {"dst": "/etc/nova/ssl/certs/nova.pem", "src": "/etc/contrail/ssl/nodei20.pem"}, "msg": "Could not find or access '/etc/contrail/ssl/nodei20.pem'"}
2018-04-24 10:25:12,978 p=1887 u=root | An exception occurred during task execution. To see the full traceback, use -vvv. The e...

[alexey-mr (alexey-morlang)]

There is no needs to use certs for nova provisioning.
Instead it is needed to configure openstack to enable SSL on VIPs (for haproxy) only, metadata are to be accessed via VIP from compute nodes. And it is to be done by kolla - not by contail-container-build or contrail-ansible-depllyer.

[Nitish Krishna Kaveri (nitishk)]

I think I know what the issue is. Let me debug and close

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42476
Submitter: alexey-mr (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42477
Submitter: Nitish Krishna Kaveri (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42476
Submitter: Andrey Pavlov (<email address hidden>)

[Ritam Gangopadhyay (ritam)]

With review 42476 patched and below knobs in by instances.yml

contrail_configuration:
  METADATA_SSL_ENABLE: True

kolla_config:
  kolla_globals:
    metadata_ssl_enable: "yes"
    tls_bind_info_internal: "yes"

**********************************************
**********************************************
**********************************************

I am hitting haproxy bring up error

TASK [haproxy : Copying over haproxy.cfg] **********************************************************************************************************************************************************
failed: [10.204.217.131] (item=/root/contrail-kolla-ansible/ansible/roles/haproxy/templates/haproxy.cfg.j2) => {"changed": false, "item": "/root/contrail-kolla-ansible/ansible/roles/haproxy/templates/haproxy.cfg.j2", "msg": "AnsibleError: template error while templating string: expected token ':', got '}'. String: {% set tls_bind_info = 'ssl crt /etc/haproxy/haproxy.pem' if kolla_enable_tls_external | bool else '' %}\n{% set tls_bind_info_internal = 'ssl crt /etc/haproxy/haproxy-internal.pem' if kolla_enable_tls_internal | bool else '' %}\n{% set tls_bind_info_nova_metadata = {{ tls_bind_info_internal }} if metadata_ssl_enable | bool else '' %}\nglobal\n chroot /var/lib/haproxy\n user haproxy\n group haproxy\n daemon\n{% if orchestration_engine != 'KUBERNETES' %}\n log {{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}:{{ fluentd_syslog_port }} local1\n{% endif %}\n maxconn 4000\n stats socket /var/lib/kolla/haproxy/haproxy.sock\n{% if kolla_enable_tls_external | bool %}\n ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES\n ssl-default-bind-options no-sslv3 no-tlsv10\n tune.ssl.default-dh-param 4096\n{% endif %}\n\ndefaults\n log global\n mode http\n option redispatch\n option httplog\n option forwardfor\n retries 3\n timeout http-request 10s\n timeout queue 1m\n timeout connect 10s\n timeout client {{ haproxy_client_timeout }}\n timeout server {{ haproxy_server_timeout }}\n timeout check 10s\n\nlisten stats\n bind {{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}:{{ haproxy_stats_port }}\n mode http\n stats enable\n stats uri /\n stats refresh 15s\n stats realm Haproxy\\ Stats\n stats auth {{ haproxy_user }}:{{ haproxy_password }}\n\n{% if enable_rabbitmq | bool %}\nlisten rabbitmq_management\n bind {{ kolla_internal_vip_address }}:{{ rabbitmq_management_port }}\n{% for host in groups['rabbitmq'] %}\n server {{ hostvars[host]['ansible_hostname'] }} {{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ rabbitmq_management_port }} check inter 2000 rise 2 fall 5\n{% endfor %}\n{% endif %}\n\n{% if enable_mongodb | bool %}\nlisten mongodb\n bind {{ kolla_internal_vip_address }}:{{ mongodb_port }}\n{% for host in groups['mongodb'] %}\n server {{ hostvars[host]['ansible_hostname'] }} {{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ mongodb_port }} check inter 2000 rise 2 fall 5\n{% endfor %}\n{% endif %}\n\n{% if enable_keystone | bool %}\nlisten keystone_internal\n bind {{ kolla_internal_vip_a...

[Ritam Gangopadhyay (ritam)]

With review 42476 patched and below knobs in by instances.yml

contrail_configuration:
  METADATA_SSL_ENABLE: True

kolla_config:
  kolla_globals:
    metadata_ssl_enable: "yes"
    tls_bind_info_internal: "yes"

**********************************************
**********************************************
**********************************************

I am hitting haproxy bring up error

TASK [haproxy : Copying over haproxy.cfg] **********************************************************************************************************************************************************
failed: [10.204.217.131] (item=/root/contrail-kolla-ansible/ansible/roles/haproxy/templates/haproxy.cfg.j2) => {"changed": false, "item": "/root/contrail-kolla-ansible/ansible/roles/haproxy/templates/haproxy.cfg.j2", "msg": "AnsibleError: template error while templating string: expected token ':', got '}'. String: {% set tls_bind_info = 'ssl crt /etc/haproxy/haproxy.pem' if kolla_enable_tls_external | bool else '' %}\n{% set tls_bind_info_internal = 'ssl crt /etc/haproxy/haproxy-internal.pem' if kolla_enable_tls_internal | bool else '' %}\n{% set tls_bind_info_nova_metadata = {{ tls_bind_info_internal }} if metadata_ssl_enable | bool else '' %}\nglobal\n chroot /var/lib/haproxy\n user haproxy\n group haproxy\n daemon\n{% if orchestration_engine != 'KUBERNETES' %}\n log {{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}:{{ fluentd_syslog_port }} local1\n{% endif %}\n maxconn 4000\n stats socket /var/lib/kolla/haproxy/haproxy.sock\n{% if kolla_enable_tls_external | bool %}\n ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES\n ssl-default-bind-options no-sslv3 no-tlsv10\n tune.ssl.default-dh-param 4096\n{%

[Ritam Gangopadhyay (ritam)]

These are just few lines of the error full logs can be found at /var/log/ansible.log on c28

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42476
Submitter: Andrey Pavlov (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42483
Submitter: alexey-mr (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42484
Submitter: alexey-mr (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42483
Submitter: alexey-mr (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42484
Submitter: alexey-mr (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42484
Submitter: Andrey Pavlov (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42483
Submitter: Andrey Pavlov (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42484
Submitter: Andrey Pavlov (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42483
Submitter: Andrey Pavlov (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42476
Submitter: Andrey Pavlov (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42483
Submitter: Andrey Pavlov (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42483
Submitter: alexey-mr (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42484
Submitter: alexey-mr (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42483
Submitter: Andrey Pavlov (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42484
Submitter: Andrey Pavlov (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/42476
Submitter: Andrey Pavlov (<email address hidden>)

[alexey-mr (alexey-morlang)]

We've discussed it yesterday and Michael's position is to wait for RHOSP13 where this feature is supported. Kolla and Helm doesn't support this feature for internal api, so we will not support it too in Kolla/Helm deployments. We agree with Michael.

Rudra, please deal with this bug as you see fit.

[Sivakumar Ganapathy (hotlava51)]

Removed vrouter tag as it is not a vrouter bug.

[Ritam Gangopadhyay (ritam)]

As per comment #56 metadata ssl feature is no longer supported from R5.0 so moving this bug to invalid.