active controller swacted unexpected upon installed password protected private key into TPM

[mhg]

Brief Description
-----------------
After installing password protected private key using CLI, controllers was swacted automatically, and alarms 'Configuration is out-of-date' and others were raised for both controllers.

Severity
--------
Minor

Steps to Reproduce
------------------
1 enable https using CLI
2 attempt to install a password protected private certificate to TPM
    system certificate-install -p serverpass -m tpm_mode tpm-test-files/server-with-key-and-password.pem

Expected Behavior
------------------
- the system continued to work without issue after the CLI executed

Actual Behavior
----------------
the CLI ran successfully but
    - alarms 'Configuration is out-of-date' and others were raised for both controllers
    - existing ssh sessions to the active controller were broken from server side
    - active controller was swacting automatically
    - host key of the floating IP was changed
After a 5+ minutes later, the previous standby controller became newly active controller, all alarms were automatically cleared, and no further findings observed.

Reproducibility
---------------
Reproducible

System Configuration
--------------------
Multi-node system

Branch/Pull Time/Commit
-----------------------
master as of build-date-time
StarlingX Upstream as of 2018-12-27_20-18-00

Timestamp/Logs
--------------
Dec. 31, 2018, 10:07 p.m

[Ghada Khalil (gkhalil)]

Marking as release gating - issue is reproducible and results in an unexpected system swact

[Paul-Emile Element (paul-emileelement)]

Please note that the alarms are expected in that case. The swact, however is not necessary.

[Andy (andy.wrs)]

This issue is observed with load from "StarlingX Upstream as of 2018-12-27_20-18-00". It will happen when HTTPS is enabled. But based on "https://wiki.openstack.org/wiki/StarlingX/Containers/Limitations", HTTPS configrations are not supported yet in containerized Openstack Services. So probably we have to wait until HTTPS is supported.

[Andy (andy.wrs)]

The swact after passphrase protected certificate is installed as tpm mode is no longer seen as tested in load:

BUILD_ID="20190503T013000Z"

Platform Horizon is working properly with the installed tpm mode certificate.

Suggest the issue to be closed.