[TLS Everywhere] Syntax error in 15-horizon_ssl_vhost.conf SSLVerifyClient: Invalid argument 'true'

[Grzegorz Grasza]

Description
===========
"Manage container systemd services and cleanup old systemd healthchecks for /var/lib/tripleo-config/container-startup-config/step_3" task fails with
"Service horizon has not started yet" on master.

Steps to reproduce
==================

Install or upgrade TripleO with TLS Everywhere enabled.

Expected result
===============

Deployment is successful.

Actual result
=============

Deployment fails with:

2020-11-17 15:19:34,314 p=14394 u=stack n=ansible | 2020-11-17 15:19:34.312912 | fa163ea7-b5c6-33ba-c416-0000000047e8 | FATAL | Manage container systemd services and cleanup old systemd healthchecks for /var/lib/tripleo-config/container-startup-config/step_3 | controller-0 | error={"changed": false, "msg": "Service horizon has not started yet"}

Environment
===========

This happened to me when doing a re-deploy on master.

Logs & Configs
==============

On further inspection, heat container fails with:
2020-11-17T15:19:39.277731792+00:00 stderr F + exec /usr/sbin/httpd -DFOREGROUND
2020-11-17T15:19:39.306252757+00:00 stderr F AH00526: Syntax error on line 37 of /etc/httpd/conf.d/15-horizon_ssl_vhost.conf:
2020-11-17T15:19:39.306252757+00:00 stderr F SSLVerifyClient: Invalid argument 'true'

/var/lib/config-data/puppet-generated/horizon/etc/httpd/conf.d/15-horizon_ssl_vhost.conf
contains the error, which is configured in horizon-container-puppet.yaml:
horizon::ssl_verify_client: true

As per documentation, this should be one of none, optional, require or optional_no_ca:

https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#SSLVerifyClient

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/763172

[Grzegorz Grasza (xek)]

It looks like the bug was introduced in https://review.opendev.org/#/c/758032/ so the fix should be backported to all of the releases it was cherry-picked to.

[Grzegorz Grasza (xek)]

In t-h-t it was introduced in https://review.opendev.org/#/c/759285/

There is a "revert" of this patch, which doesn't really revert it:
https://review.opendev.org/#/c/759772/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/763172
Committed: https://opendev.org/openstack/tripleo-heat-templates/commit/d476a31a08687ec3203027441af2e09973be0e94
Submitter: Zuul
Branch: master

commit d476a31a08687ec3203027441af2e09973be0e94
Author: Grzegorz Grasza <email address hidden>
Date: Wed Nov 18 13:34:54 2020 +0100

    Fix the value of ssl_verify_client

    As per documentation, this should be one of
    none, optional, require or optional_no_ca:

    https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#SSLVerifyClient

    Change-Id: Ia586151169e7f359a2a58a33b4ac9526d0113679
    Closes-bug: #1904731

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/victoria
Review: https://review.opendev.org/763495

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 14.0.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 13.2.0 release.