PKI role permissions change may cause deployment failures

[Andrew Bonney]

The following change in the PKI role has adjusted the default user/group which CA keys are created with from the current user to 'root'.

https://github.com/openstack/ansible-role-pki/commit/7b261e2119b8922128d17f0da4daece90501f07d

In cases where OSA playbooks are run as root this isn't a problem, but in our case we use a non-root user. As a result, the CA key we already have is owned by that user/group and not root. When the certificate-authority.yml or os-octavia-install.yml playbooks run during an upgrade, the attempted change results in a failure:

TASK [pki : Generate CA private key for OctaviaServerRoot] ************************************************************************************************************************************************
fatal: [infra1_octavia_server_container-414c69e4 -> localhost]: FAILED! => {"changed": false, "gid": 3015, "group": "<our group>", "mode": "0600", "msg": "chown failed: [Errno 1] Operation not permitted:
b'/etc/openstack_deploy/pki/roots/OctaviaServerRoot/private/OctaviaServerRoot.key.pem'", "owner": "<out user>", "path": "/etc/openstack_deploy/pki/roots/OctaviaServerRoot/private/OctaviaServerRoot.key.pe
m", "size": 3326, "state": "file", "uid": 3014}

Unfortunately the variables which allow us to override this user/group also require us to override the entire octavia_cert_authorities list.

Ideally the default would be reverted to the current user, but it would also perhaps be useful to have a more global user/group (and mode) in ansible-role-pki for files which are created on the deploy host so that they can be set consistently rather than on an individual basis.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/ansible-role-pki/+/890793

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/ansible-role-pki/+/890793
Committed: https://opendev.org/openstack/ansible-role-pki/commit/307c1feb50e7ae95829ff085a760cf3e1f51abc7
Submitter: "Zuul (22348)"
Branch: master

commit 307c1feb50e7ae95829ff085a760cf3e1f51abc7
Author: Andrew Bonney <email address hidden>
Date: Tue Aug 8 14:05:02 2023 +0100

    Add defaults for owner/group/mode on pki_install_host

    Reverts the default user/group from
    I4a90479261b2721c08e9034fbae0d56de9308676

    Adds global default options so user/group etc can
    be overridden on the setup host

    Some cases of 'omit' for file modes are changed to a
    role-defined default which will override any system umask
    preferences.

    Related-Bug: #2029253
    Change-Id: Id999ccf5f42ee7f6b6b08db67276bb77bc9a21d8

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/ansible-role-pki/+/893247

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/ansible-role-pki/+/893247
Committed: https://opendev.org/openstack/ansible-role-pki/commit/a7e919fee7fba4aea1b54f66cf1e17806b335cae
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit a7e919fee7fba4aea1b54f66cf1e17806b335cae
Author: Andrew Bonney <email address hidden>
Date: Tue Aug 8 14:05:02 2023 +0100

    Add defaults for owner/group/mode on pki_install_host

    Reverts the default user/group from
    I4a90479261b2721c08e9034fbae0d56de9308676

    Adds global default options so user/group etc can
    be overridden on the setup host

    Some cases of 'omit' for file modes are changed to a
    role-defined default which will override any system umask
    preferences.

    Related-Bug: #2029253
    Change-Id: Id999ccf5f42ee7f6b6b08db67276bb77bc9a21d8
    (cherry picked from commit 307c1feb50e7ae95829ff085a760cf3e1f51abc7)