tripleo

Memcached TLS certificate is created for fqdns, while the clients connect with IP addresses

Bug #1929574 reported by Grzegorz Grasza on 2021-05-25

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	tripleo	Fix Released	High	Unassigned

Bug Description

Description
===========

Memcached deploys just fine, but the generated config in memcache uses IPs for endpoints instead of FQDNs, so TLS connections to memcache cannot be verified by pymemcache.

Steps to reproduce
==================

Deploy with TLS-Everywhere and Memcached TLS enabled by including the env files:

* tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml
* tripleo-heat-templates/environments/ssl/enable-memcached-tls.yaml

Expected result
===============

Services are able to connect to Memcached

Actual result
=============

Some services using pymemcached fail validating the certificate

Environment
===========

This will need separate patches for the master branch and Train.

The latest release configures certificates in a new way, using requesting them from certmonger via ansible linux-system-roles

Tags:

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-05-25: Fix proposed to tripleo-heat-templates (stable/train)

Fix proposed to branch: stable/train
Review: https://review.opendev.org/c/openstack/tripleo-heat-templates/+/792994

Changed in tripleo:
status:	New → In Progress

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-05-25: Related fix proposed to puppet-tripleo (stable/train)

Related fix proposed to branch: stable/train
Review: https://review.opendev.org/c/openstack/puppet-tripleo/+/793003

Revision history for this message

Grzegorz Grasza (xek) wrote on 2021-05-26:

As a workaround, the memcached server list could be set via the memcached_node_ips hiera variable.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-05-27: Change abandoned on tripleo-heat-templates (stable/train)

Change abandoned by "Grzegorz Grasza <email address hidden>" on branch: stable/train
Review: https://review.opendev.org/c/openstack/tripleo-heat-templates/+/792994
Reason: Abandoning in favor of https://review.opendev.org/c/openstack/tripleo-heat-templates/+/792131 backport

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-05-27: Change abandoned on puppet-tripleo (stable/train)

Change abandoned by "Grzegorz Grasza <email address hidden>" on branch: stable/train
Review: https://review.opendev.org/c/openstack/puppet-tripleo/+/793003
Reason: Abandoning in favor of https://review.opendev.org/c/openstack/tripleo-heat-templates/+/792131 backport

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-06-17: Fix proposed to puppet-tripleo (stable/train)

Fix proposed to branch: stable/train
Review: https://review.opendev.org/c/openstack/puppet-tripleo/+/796829

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-06-17: Change abandoned on puppet-tripleo (stable/train)

Change abandoned by "Grzegorz Grasza <email address hidden>" on branch: stable/train
Review: https://review.opendev.org/c/openstack/puppet-tripleo/+/796829
Reason: will propose this on master branch

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-06-17: Fix proposed to puppet-tripleo (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/puppet-tripleo/+/796832

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-06-28: Change abandoned on tripleo-heat-templates (master)

Change abandoned by "Grzegorz Grasza <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/tripleo-heat-templates/+/792131
Reason: I'm abandoning this for https://review.opendev.org/c/openstack/puppet-tripleo/+/796832

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-07-20: Fix merged to puppet-tripleo (master)

#10

Reviewed: https://review.opendev.org/c/openstack/puppet-tripleo/+/796832
Committed: https://opendev.org/openstack/puppet-tripleo/commit/49921d57f5753dffe032b9501d1101707ce8cc1e
Submitter: "Zuul (22348)"
Branch: master

commit 49921d57f5753dffe032b9501d1101707ce8cc1e
Author: Grzegorz Grasza <email address hidden>
Date: Thu Jun 17 14:35:52 2021 +0200

Set memcached server list from memcached_node_names

This follows other clustered services (like RabbitMQ) and
uses *_node_names (which contain FQDNs), instead of *_node_ips.

    Certificate for Memcached TLS is also created using FQDN.
    Because of this, validation failed when using pymemcache.
    This patch fixes this issue.

Closes-Bug: #1929574
Change-Id: I9d0ddcc88098a5b891829192f1ce656842d0aa15

Changed in tripleo:
status:	In Progress → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-07-29: Fix proposed to puppet-tripleo (stable/wallaby)

#11

Fix proposed to branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/puppet-tripleo/+/802883

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-08-02: Fix proposed to puppet-tripleo (stable/victoria)

#12

Fix proposed to branch: stable/victoria
Review: https://review.opendev.org/c/openstack/puppet-tripleo/+/803199

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-08-02: Fix proposed to puppet-tripleo (stable/ussuri)

#13

Fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/c/openstack/puppet-tripleo/+/803201

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-08-02: Fix proposed to puppet-tripleo (stable/train)

#14

Fix proposed to branch: stable/train
Review: https://review.opendev.org/c/openstack/puppet-tripleo/+/803205

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-08-03: Fix merged to puppet-tripleo (stable/wallaby)

#15

Reviewed: https://review.opendev.org/c/openstack/puppet-tripleo/+/802883
Committed: https://opendev.org/openstack/puppet-tripleo/commit/c56c26dfc6cc00e2d9e17d2845c48d6f044eda77
Submitter: "Zuul (22348)"
Branch: stable/wallaby

commit c56c26dfc6cc00e2d9e17d2845c48d6f044eda77
Author: Grzegorz Grasza <email address hidden>
Date: Thu Jun 17 14:35:52 2021 +0200

Set memcached server list from memcached_node_names

This follows other clustered services (like RabbitMQ) and
uses *_node_names (which contain FQDNs), instead of *_node_ips.

    Certificate for Memcached TLS is also created using FQDN.
    Because of this, validation failed when using pymemcache.
    This patch fixes this issue.

    Closes-Bug: #1929574
    Change-Id: I9d0ddcc88098a5b891829192f1ce656842d0aa15
    (cherry picked from commit 49921d57f5753dffe032b9501d1101707ce8cc1e)

tags:

added: in-stable-wallaby

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-08-16: Fix included in openstack/puppet-tripleo 14.2.2

#16

This issue was fixed in the openstack/puppet-tripleo 14.2.2 release.

Bogdan Dobrelya (bogdando) on 2021-08-16

Changed in tripleo:
importance:	Undecided → High

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-09-13: Fix merged to puppet-tripleo (stable/victoria)

#17

Reviewed: https://review.opendev.org/c/openstack/puppet-tripleo/+/803199
Committed: https://opendev.org/openstack/puppet-tripleo/commit/74b5ba27b71ee9a66d29ff89e14851bf19985ca7
Submitter: "Zuul (22348)"
Branch: stable/victoria

commit 74b5ba27b71ee9a66d29ff89e14851bf19985ca7
Author: Grzegorz Grasza <email address hidden>
Date: Thu Jun 17 14:35:52 2021 +0200

Set memcached server list from memcached_node_names

This follows other clustered services (like RabbitMQ) and
uses *_node_names (which contain FQDNs), instead of *_node_ips.

    Certificate for Memcached TLS is also created using FQDN.
    Because of this, validation failed when using pymemcache.
    This patch fixes this issue.

    Closes-Bug: #1929574
    Change-Id: I9d0ddcc88098a5b891829192f1ce656842d0aa15
    (cherry picked from commit 49921d57f5753dffe032b9501d1101707ce8cc1e)

tags:

added: in-stable-victoria

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-09-15: Fix merged to puppet-tripleo (stable/ussuri)

#18

Reviewed: https://review.opendev.org/c/openstack/puppet-tripleo/+/803201
Committed: https://opendev.org/openstack/puppet-tripleo/commit/89fc3e6b0c3caeafe70b415917dc435c4e938676
Submitter: "Zuul (22348)"
Branch: stable/ussuri

commit 89fc3e6b0c3caeafe70b415917dc435c4e938676
Author: Grzegorz Grasza <email address hidden>
Date: Thu Jun 17 14:35:52 2021 +0200

Set memcached server list from memcached_node_names

This follows other clustered services (like RabbitMQ) and
uses *_node_names (which contain FQDNs), instead of *_node_ips.

    Certificate for Memcached TLS is also created using FQDN.
    Because of this, validation failed when using pymemcache.
    This patch fixes this issue.

    Closes-Bug: #1929574
    Change-Id: I9d0ddcc88098a5b891829192f1ce656842d0aa15
    (cherry picked from commit 49921d57f5753dffe032b9501d1101707ce8cc1e)

tags:

added: in-stable-ussuri

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-09-15: Fix merged to puppet-tripleo (stable/train)

#19

Reviewed: https://review.opendev.org/c/openstack/puppet-tripleo/+/803205
Committed: https://opendev.org/openstack/puppet-tripleo/commit/057fbbdb90f9f4a5472f4be2a8c892a1c4551b35
Submitter: "Zuul (22348)"
Branch: stable/train

commit 057fbbdb90f9f4a5472f4be2a8c892a1c4551b35
Author: Grzegorz Grasza <email address hidden>
Date: Thu Jun 17 14:35:52 2021 +0200

Set memcached server list from memcached_node_names

This follows other clustered services (like RabbitMQ) and
uses *_node_names (which contain FQDNs), instead of *_node_ips.

    Certificate for Memcached TLS is also created using FQDN.
    Because of this, validation failed when using pymemcache.
    This patch fixes this issue.

    Closes-Bug: #1929574
    Change-Id: I9d0ddcc88098a5b891829192f1ce656842d0aa15
    (cherry picked from commit 49921d57f5753dffe032b9501d1101707ce8cc1e)