Renewing overcloud SSL certificate fails

[Marius Cornea]

Description of problem:
Renewing overcloud SSL certificate fails

How reproducible:
100%

Steps to Reproduce:
1. Deploy SSL enabled overcloud with pacemaker
2. Regenerate SSL certificate/key and update the undercloud system store
3. Deploy overcloud with updated certificate and key

Actual results:
Deployment finishes but certificate validation fails when calling keystone api:

SSL exception connecting to https://172.16.18.25:13000/v2.0/tokens: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)

Expected results:
The keystone api succeeds as the undercloud certificate store has been updated with the new certificate.

Additional info:
After doing pcs resource restart haproxy on one of the controller the connection is successful so it seems we're missing a haproxy reload step when the certificate is updated.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/381136

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/381136
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=b74b6793d28beb67d63eb1eafa9ed36ed4e92335
Submitter: Jenkins
Branch: master

commit b74b6793d28beb67d63eb1eafa9ed36ed4e92335
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Mon Oct 3 16:56:21 2016 +0300

    reload HAProxy config in HA setups when certificate is updated

    When updating a certificate for HAProxy, we only do a reload of the
    configuration on non-HA setups. This means that if we try the same in
    an HA setup, the cloud will still serve the old certificate and that
    leads to several issues, such as serving a revoked or even a
    compromised certificate for some time, or just SSL issues that the
    certificate doesn't match. This enables a reload for HA cases too.

    Change-Id: Ib8ca2fe91be345ef4324fc8265c45df8108add7a
    Closes-Bug: #1629886

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/381374

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/381374
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=bb555cf3fe05e630ca037ccbc1fc85a303e36ef3
Submitter: Jenkins
Branch: stable/newton

commit bb555cf3fe05e630ca037ccbc1fc85a303e36ef3
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Mon Oct 3 16:56:21 2016 +0300

    reload HAProxy config in HA setups when certificate is updated

    When updating a certificate for HAProxy, we only do a reload of the
    configuration on non-HA setups. This means that if we try the same in
    an HA setup, the cloud will still serve the old certificate and that
    leads to several issues, such as serving a revoked or even a
    compromised certificate for some time, or just SSL issues that the
    certificate doesn't match. This enables a reload for HA cases too.

    Change-Id: Ib8ca2fe91be345ef4324fc8265c45df8108add7a
    Closes-Bug: #1629886
    (cherry picked from commit b74b6793d28beb67d63eb1eafa9ed36ed4e92335)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 5.0.0.0rc3 release candidate.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 5.0.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 6.0.0.0b1 development milestone.