rabbitmq cert and keys are injected incorretly after certmonger regenerates them

[Damien Ciabrini]

When certmonger resubmit a certificate to the IPA server, it calls a post_save script that fails to inject the updated certificate and key because it fetches an invalid hiera key:

[root@messaging-1 ~]# /usr/bin/certmonger-rabbitmq-refresh.sh
Traceback (most recent call last):
        9: from /bin/hiera:246:in `<main>'
        8: from /usr/share/ruby/vendor_ruby/hiera.rb:116:in `lookup'
        7: from /usr/share/ruby/vendor_ruby/hiera/backend.rb:267:in `lookup'
        6: from /usr/share/ruby/vendor_ruby/hiera/backend.rb:267:in `each'
        5: from /usr/share/ruby/vendor_ruby/hiera/backend.rb:272:in `block in lookup'
        4: from /usr/share/ruby/vendor_ruby/hiera/backend.rb:272:in `catch'
        3: from /usr/share/ruby/vendor_ruby/hiera/backend.rb:279:in `block (2 levels) in lookup'
        2: from /usr/share/ruby/vendor_ruby/hiera/backend.rb:316:in `qualified_lookup'
        1: from /usr/share/ruby/vendor_ruby/hiera/backend.rb:316:in `each'
/usr/share/ruby/vendor_ruby/hiera/backend.rb:329:in `block in qualified_lookup': Hiera type mismatch: Got String when a hash-like object was expected to access value using 'service_certificate' from key 'tripleo::rabbitmq::service_certificate.service_certificate' (Exception)
Traceback (most recent call last):
        9: from /bin/hiera:246:in `<main>'
        8: from /usr/share/ruby/vendor_ruby/hiera.rb:116:in `lookup'
        7: from /usr/share/ruby/vendor_ruby/hiera/backend.rb:267:in `lookup'
        6: from /usr/share/ruby/vendor_ruby/hiera/backend.rb:267:in `each'
        5: from /usr/share/ruby/vendor_ruby/hiera/backend.rb:272:in `block in lookup'
        4: from /usr/share/ruby/vendor_ruby/hiera/backend.rb:272:in `catch'
        3: from /usr/share/ruby/vendor_ruby/hiera/backend.rb:279:in `block (2 levels) in lookup'
        2: from /usr/share/ruby/vendor_ruby/hiera/backend.rb:316:in `qualified_lookup'
        1: from /usr/share/ruby/vendor_ruby/hiera/backend.rb:316:in `each'
/usr/share/ruby/vendor_ruby/hiera/backend.rb:329:in `block in qualified_lookup': Hiera type mismatch: Got String when a hash-like object was expected to access value using 'service_key' from key 'tripleo::rabbitmq::service_certificate.service_key' (Exception)
tar: Substituting `.' for empty member name
tar: : Cannot stat: No such file or directory
tar: Substituting `.' for empty member name
tar: : Cannot stat: No such file or directory
tar: Exiting with failure status due to previous errors
cp: -r not specified; omitting directory '/var/lib/kolla/config_files/src-tls'
chown: cannot access '': No such file or directory
chown: cannot access '': No such file or directory

[Damien Ciabrini (dciabrin)]

This does not happen in master, but is specific to Victoria and Train where the scripts still reside in puppet-tripleo

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/victoria
Review: https://review.opendev.org/c/openstack/puppet-tripleo/+/806135

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/train
Review: https://review.opendev.org/c/openstack/puppet-tripleo/+/806136

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/c/openstack/puppet-tripleo/+/806330

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/puppet-tripleo/+/806135
Committed: https://opendev.org/openstack/puppet-tripleo/commit/76ecde4cf5ab514a9f4ffdb8ed8bf23f04999047
Submitter: "Zuul (22348)"
Branch: stable/victoria

commit 76ecde4cf5ab514a9f4ffdb8ed8bf23f04999047
Author: Damien Ciabrini <email address hidden>
Date: Thu Aug 26 12:53:24 2021 +0200

    Fix rabbitmq certificate reload after it is resubmitted

    When certmonger resubmit a certificate, make sure that
    the post_save command reads the right hiera key to
    update the certificate file into the running rabbitmq
    container.

    Change-Id: Ic7f66b83611794d41105941c15c32479fe876980
    Closes-Bug: #1941727

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/puppet-tripleo/+/806136
Committed: https://opendev.org/openstack/puppet-tripleo/commit/48d6566567234e7269a29eff8d56208dd49b2884
Submitter: "Zuul (22348)"
Branch: stable/train

commit 48d6566567234e7269a29eff8d56208dd49b2884
Author: Damien Ciabrini <email address hidden>
Date: Thu Aug 26 12:53:24 2021 +0200

    Fix rabbitmq certificate reload after it is resubmitted

    When certmonger resubmit a certificate, make sure that
    the post_save command reads the right hiera key to
    update the certificate file into the running rabbitmq
    container.

    Change-Id: Ic7f66b83611794d41105941c15c32479fe876980
    Closes-Bug: #1941727
    (cherry picked from commit 42a29d04139f938f180b66060d8580325a57ff11)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/puppet-tripleo/+/806330
Committed: https://opendev.org/openstack/puppet-tripleo/commit/1b540eaa2629d5fc4a7f0eb56d4165a1f4b22fb8
Submitter: "Zuul (22348)"
Branch: stable/ussuri

commit 1b540eaa2629d5fc4a7f0eb56d4165a1f4b22fb8
Author: Damien Ciabrini <email address hidden>
Date: Thu Aug 26 12:53:24 2021 +0200

    Fix rabbitmq certificate reload after it is resubmitted

    When certmonger resubmit a certificate, make sure that
    the post_save command reads the right hiera key to
    update the certificate file into the running rabbitmq
    container.

    Change-Id: Ic7f66b83611794d41105941c15c32479fe876980
    Closes-Bug: #1941727
    (cherry picked from commit 42a29d04139f938f180b66060d8580325a57ff11)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo 12.7.1 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo 13.7.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo train-eol release.