Enabling SSL on overcloud endpoints fails on containerized overcloud

[Juan Antonio Osorio Robles]

Updating a non-TLS overcloud to one that uses TLS doesn't work. This is due to pacemaker not updating the bind-mounts for the container.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/557653

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/557653
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=8b85faf7e66a49977f7fd18512e1534488ca4f07
Submitter: Zuul
Branch: master

commit 8b85faf7e66a49977f7fd18512e1534488ca4f07
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Thu Mar 29 08:52:59 2018 +0000

    Mount the public TLS certificate for HAProxy on up(date|grade) on pacemaker

    As part of the minor update workflow and the update workflow, this changes
    the pacemaker haproxy bundle resource to add the needed mount for public
    TLS to work.

    This also handles the reloading of the container to fetch any new certificates
    and if needed, it will restart the pacemaker resource (for upgrades), since
    we would need pacemaker to re-create the resource.

    Change-Id: I850f4de17e7f7e3b46deb27119227ef76658dcb5
    Closes-Bug: #1759797

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/queens
Review: https://review.openstack.org/560322

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/560322
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=9e7417b267fb6db2b974b07ffac3904d6e8164d6
Submitter: Zuul
Branch: stable/queens

commit 9e7417b267fb6db2b974b07ffac3904d6e8164d6
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Thu Mar 29 08:52:59 2018 +0000

    Mount the public TLS certificate for HAProxy on up(date|grade) on pacemaker

    As part of the minor update workflow and the update workflow, this changes
    the pacemaker haproxy bundle resource to add the needed mount for public
    TLS to work.

    This also handles the reloading of the container to fetch any new certificates
    and if needed, it will restart the pacemaker resource (for upgrades), since
    we would need pacemaker to re-create the resource.

    Change-Id: I850f4de17e7f7e3b46deb27119227ef76658dcb5
    Closes-Bug: #1759797
    (cherry picked from commit 8b85faf7e66a49977f7fd18512e1534488ca4f07)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 9.0.0.0b2 development milestone.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 8.0.2 release.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/pike
Review: https://review.openstack.org/617701

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/617701
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=5b7fd457885fec89d0fd731b9e42034868565c96
Submitter: Zuul
Branch: stable/pike

commit 5b7fd457885fec89d0fd731b9e42034868565c96
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Thu Mar 29 08:52:59 2018 +0000

    Mount the public TLS certificate for HAProxy on up(date|grade) on pacemaker

    As part of the minor update workflow and the update workflow, this changes
    the pacemaker haproxy bundle resource to add the needed mount for public
    TLS to work.

    This also handles the reloading of the container to fetch any new certificates
    and if needed, it will restart the pacemaker resource (for upgrades), since
    we would need pacemaker to re-create the resource.

    Change-Id: I850f4de17e7f7e3b46deb27119227ef76658dcb5
    Closes-Bug: #1759797
    (cherry picked from commit 8b85faf7e66a49977f7fd18512e1534488ca4f07)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 7.0.18 release.