SSL endpoints fail to be reached by controller manager

[Mohammed Naser]

Under Fedora Atomic, the `/etc/ssl/certs` folder contains the ca-bundle for all verified CAs, however, that file is a symbolic link to another path on the system

[root@k8-mdofxo7h37-0-23rwfgorqnwi-kube-master-ysizlxfst7by fedora]# ls -alh /etc/ssl/certs/ca-bundle.crt
lrwxrwxrwx. 1 root root 49 Jul 23 22:43 /etc/ssl/certs/ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

Therefore, when k8s-controller-manager tries to do anything SSL related (such as attempt to connect to an OpenStack API endpoint behind SSL), it fails and the controller never starts.

The hyperkube image ships with a built in list of vetted CAs which should be enough for most users, so it's probably better to rely on it.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/488511
Committed: https://git.openstack.org/cgit/openstack/magnum/commit/?id=ae15aa6c28e4209e60a52ca6412b9c211f6866f5
Submitter: Jenkins
Branch: master

commit ae15aa6c28e4209e60a52ca6412b9c211f6866f5
Author: Mohammed Naser <email address hidden>
Date: Fri Jul 28 12:08:31 2017 -0400

    Remove /etc/ssl/certs in the controller manager pod

    For system such as Fedora Atomic, the CA bundle files which are
    contained in /etc/ssl/certs are symbolic links to /etc/pki. When
    configuring the controller manager to use an SSL endpoint, it will
    raise an error as it is unable to authenticate the SSL endpoint.

    This patch removes the host mount at /etc/ssl/certs. The Hyperkube
    images already ship a collection of CAs which are likely good for
    all needs.

    Closes-Bug: #1708452

    Change-Id: Ife2b60d1968482a8c3ab9b44abbe401c6230881c

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/magnum 5.0.0 release.