FreeIPA enroll can't work

[Cédric Jeanneret deactivated]

OpenStack version: Ocata
Heat templates: 564e3feeb9c518851afde9ed778360e4032e9213 (as per github "stable/ocata" branch)

Hello,

Using tripleO on a CentOS 7, the FreeIPA enroll for the overcloud can't work.

The puppet/extraconfig/tls/freeipa-enroll.yaml has at least issues:
- needs a fixed OTP
- uses the CloudDomain as realm without any way to override that

The OTP stands for "one time password" and is attached to a host - using it like that means we must configure nodes beforehand in the IPA, and generate an OTP. But we can't pass per-host OTP. So that won't work.
More over, the undercloud being in the freeIPA, using novajoin command, allow that host to create other hosts - the right way would be to make the undercloud generate the hosts in freeIPA, and inject the OTP on the fly for each host.
The undercloud has an /etc/krb5.keytab that can be used for authentication.

The CloudDomain used as realm issue is less important, but in our case, the realm is not the same value, hence the ipa-client-install won't work either.

Unless I missed some documentation in some obscure place, this receipt can't work for the said reasons.

For the records, I used the following documentation:
http://tripleo.org/install/advanced_deployment/tls_everywhere.html

I also stumbled on that one:
https://jaormx.github.io/2016/testing-out-the-tls-everywhere-patches-for-tripleo/

The latter is a bit more complete (among things, the generation of the environment file…), but still, the OTP part is a blocker if we deploy on more than one host. And still, the enrollment shouldn't need any manual step in freeIPA, providing the host names are generated by the installer…

Any advice (or correction) would be good :).

Thank you in advance!

Cheers,

C.

[Cédric Jeanneret deactivated (cjeanneret-c2c-deactivated)]

Hello,

Some more information, in case that might help as well.

After digging a lot in novajoin part, I stumbled on the novajoin-server service. That service serves as a proxy to freeIPA, using the undercloud keytab credentials in order to create the host and get an OTP.
That part is exactly what I was talking about, but apparently it's not really documented, at least not in the doc I pointed earlier.

That said, there are some issues there:
- apparently, it's not working with the cloud-init version (0.7.5) shipped in the centos overcloud images we can find here:
https://images.rdoproject.org/ocata/delorean/current-tripleo/stable/
- apparently, it won't work either with 0.7.9
- apparently, it needs 0.7.6, which isn't shipped in Centos7 at all
- more over, there's apparently a login for the service itself, and I can't find anything about it

If I understand well, the novajoin-server is called/accessed by nova when we hit http://169.254.169.254/openstack/2016-10-06/vendor_data2.json, and should add a "join" hash entry with the OTP and other information, like the fqdn.

And the README for novajoin is, well, deprecated: almost all the settings we can set are flagged as deprecated.

So for now: nothing is working as expected…

Cheers,

C.

[Juan Antonio Osorio Robles (juan-osorio-robles)]

So, unfortunately this is a limitation in ocata. One OTP per group of nodes. However, this issue is fixed in pike, for which the document you referenced applies to[1]. It relies on a service called novajoin, and will automatically provision the OTPs and trigger FreeIPA client registration through cloud-init, thanks to a service called novajoin. However, as mentioned, this is only applicable for Pike.

[1] http://tripleo.org/install/advanced_deployment/tls_everywhere.html

[Cédric Jeanneret deactivated (cjeanneret-c2c-deactivated)]

Hello Juan,

duh… no I understand why I lost about 3 days with that issue.
Would be a good idea to mention openstack versions in the docs -.-. Pike isn't stable for now, I didn't think it would apply to it…

That said: I'm pretty close to have the novajoin part working - I "just" have an authentication issue. Or is that the part that won't work on ocata at all?

Cheers,

C.

[Juan Antonio Osorio Robles (juan-osorio-robles)]

That file is no longer supported and we should use novajoin instead for enrollment.