Comment 2 for bug 1782251

This problem is caused by the /usr/share/openstack-puppet/modules/tripleo/manifests/network/contrail/neutron_plugin.pp file, which is delivered by the puppet-tripleo-8.3.2-8.el7ost.noarch package of the rhel-7-server-openstack-13-rpms repository.

Workaround - before overcloud deploy:

To prevent this issue you can customize the overcloud image used to deploy the overcloud roles. This image has the puppet-tripleo package already installed so you can modify it to remove the setting of `certfile`. For example:

mkdir images; cd images
for i in /usr/share/rhosp-director-images/overcloud-full-latest-13.0.tar /usr/share/rhosp-director-images/ironic-python-agent-latest-13.0.tar; do tar -xvf $i; done
openstack overcloud image upload --image-path
virt-customize -a overcloud-full.qcow2 --run-command 'sed -i "/certfile/d" /usr/share/openstack-puppet/modules/tripleo/manifests/network/contrail/neutron_plugin.pp'
openstack overcloud image upload --image-path $PWD

Workaround - after overcloud deploy

If the overcloud has already been deployed and neutron is having difficulty processing requests, then the configuration can be adjusted and the neutron_api container can be restarted. For example,

# SSH to the host(s) with the neutron_api container
sudo sed -i "/certfile/d" /var/lib/config-data/puppet-generated/neutron/etc/neutron/plugins/opencontrail/ContrailPlugin.ini
sudo docker stop neutron_api
sudo docker start neutron_api

This issue is fixed in Contrail Cloud 13.