ODL with TLS fails to create certificate/key on host due to no 'odl' user

[Tim Rozet]

In TLS deployments a key and certificate are created for ODL on the host (as owner/group odl/odl). These artifacts are then used to configure TLS for ODL. In containerized deployments these files are still created on the host, and then mounted into the ODL container. However, now that we containerize ODL, it means the RPM is no longer installed on the host, and the 'odl' linux group/user are not created. Thus when deploying with TLS and ODL, there is a puppet error saying:

            "Error: /Stage[main]/Tripleo::Certmonger::Opendaylight/File[/etc/pki/tls/certs/odl.crt]/group: change from root to odl failed: Could not find group odl",
            "Error: /Stage[main]/Tripleo::Certmonger::Opendaylight/File[/etc/pki/tls/private/odl.key]/owner: change from root to odl failed: Could not find user odl",
            "Error: /Stage[main]/Tripleo::Certmonger::Opendaylight/File[/etc/pki/tls/private/odl.key]/group: change from root to odl failed: Could not find group odl"

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/554537

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/554537
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=e11804237e81c8488bd008603638d5f62758acb7
Submitter: Zuul
Branch: master

commit e11804237e81c8488bd008603638d5f62758acb7
Author: Tim Rozet <email address hidden>
Date: Tue Mar 20 09:27:12 2018 -0400

    Fixes incorrect ownership of ODL TLS cert/key

    Deployments were failing because the owner/group of the TLS generated
    certificate and key were set to 'odl'. This user and group does not
    exist in a containerized deployment because the ODL RPM is only
    installed in the container.

    This patch leaves the owner as root for the files which works because
    the files are only used to generate a keystore for ODL (which is owned
    by odl), and the cert/key files themselves are never read by ODL.

    Closes-Bug: 1757135

    Change-Id: Ie5b9e98ea2fc16b820d56272653df4874e81cf68
    Signed-off-by: Tim Rozet <email address hidden>

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/queens
Review: https://review.openstack.org/554909

[OpenStack Infra (hudson-openstack)]

Change abandoned by Emilien Macchi (<email address hidden>) on branch: stable/queens
Review: https://review.openstack.org/554909
Reason: clear up the gate to merge CI blockers, I'll restore the patches.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/554909
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=a364a9dce7f92293ef65b8c98b46e5095777b956
Submitter: Zuul
Branch: stable/queens

commit a364a9dce7f92293ef65b8c98b46e5095777b956
Author: Tim Rozet <email address hidden>
Date: Tue Mar 20 09:27:12 2018 -0400

    Fixes incorrect ownership of ODL TLS cert/key

    Deployments were failing because the owner/group of the TLS generated
    certificate and key were set to 'odl'. This user and group does not
    exist in a containerized deployment because the ODL RPM is only
    installed in the container.

    This patch leaves the owner as root for the files which works because
    the files are only used to generate a keystore for ODL (which is owned
    by odl), and the cert/key files themselves are never read by ODL.

    Closes-Bug: 1757135

    Change-Id: Ie5b9e98ea2fc16b820d56272653df4874e81cf68
    Signed-off-by: Tim Rozet <email address hidden>
    (cherry picked from commit e11804237e81c8488bd008603638d5f62758acb7)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo 8.3.1 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo 9.0.0 release.