Fix neutron api TLS issues
There are two tls issues currently in neutron: A) neutron_api is doing bind mounting tls certs directly from the host and then chowning them from then container. "Source": "/etc/pki/tls/private/ovn_neutron_client.key", "Destination": "/etc/pki/tls/private/ovn_neutron_client.key", "Source": "/etc/pki/tls/certs/ovn_neutron_client.crt", "Destination": "/etc/pki/tls/certs/ovn_neutron_client.crt", And then it thinks it can chown it inside the container via the kolla script: [root@controller-0 stdouts]# more /var/lib/kolla/config_files/neutron_api.json ... { "optional": true, "owner": "neutron:neutron", "path": "/etc/pki/tls/certs/ovn_neutron_client.crt", "perm": "0644" }, { "optional": true, "owner": "neutron:neutron", "path": "/etc/pki/tls/private/ovn_neutron_client.key", "perm": "0644" } What needs to happen here is that we drop the direct bind mounts, and copy in the certs via kolla. Just like galera is doing. Tested and with this patch I correctly get a Train/OSP16 TLS everywhere deployment with a working neutron: Before: (overcloud) [stack@undercloud-0 ~]$ openstack network list HttpException: 503: Server Error for url: https://overcloud.redhat.local:13696/v2.0/networks, No server is available to handle this request.: 503 Service Unavailable After: (overcloud) [stack@undercloud-0 ~]$ openstack network list (overcloud) [stack@undercloud-0 ~]$ B) The logging in the neutron_server_tls_proxy container is not persisted to the host Before: [root@controller-0 ~]# ls -l /var/log/containers/httpd/neutron-api/ [root@controller-0 ~]# After: [root@controller-0 ~]# ls -l /var/log/containers/httpd/neutron-api/ total 136 -rw-r--r--. 1 root root 400 Nov 15 17:43 error_log -rw-r--r--. 1 root root 72784 Nov 15 17:53 neutron-api-proxy_access_ssl.log -rw-r--r--. 1 root root 2748 Nov 15 17:43 neutron-api-proxy_error_ssl.log [root@controller-0 ~]# Change-Id: Ia1c22b8981fb735a052707516f73313c4e5ca93c Closes-Bug: #1852779
This commit is contained in:
parent
08f029cf7c
commit
a7db39af7c
|
@ -420,6 +420,11 @@ outputs:
|
||||||
dest: "/"
|
dest: "/"
|
||||||
merge: true
|
merge: true
|
||||||
preserve_properties: true
|
preserve_properties: true
|
||||||
|
- source: "/var/lib/kolla/config_files/src-tls/*"
|
||||||
|
dest: "/"
|
||||||
|
merge: true
|
||||||
|
optional: true
|
||||||
|
preserve_properties: true
|
||||||
permissions:
|
permissions:
|
||||||
- path: /var/log/neutron
|
- path: /var/log/neutron
|
||||||
owner: neutron:neutron
|
owner: neutron:neutron
|
||||||
|
@ -485,8 +490,8 @@ outputs:
|
||||||
- if:
|
- if:
|
||||||
- ovn_and_tls
|
- ovn_and_tls
|
||||||
-
|
-
|
||||||
- /etc/pki/tls/certs/ovn_neutron_client.crt:/etc/pki/tls/certs/ovn_neutron_client.crt
|
- /etc/pki/tls/certs/ovn_neutron_client.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/ovn_neutron_client.crt:ro
|
||||||
- /etc/pki/tls/private/ovn_neutron_client.key:/etc/pki/tls/private/ovn_neutron_client.key
|
- /etc/pki/tls/private/ovn_neutron_client.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/ovn_neutron_client.key:ro
|
||||||
- null
|
- null
|
||||||
environment:
|
environment:
|
||||||
map_merge:
|
map_merge:
|
||||||
|
@ -502,6 +507,7 @@ outputs:
|
||||||
volumes:
|
volumes:
|
||||||
list_concat:
|
list_concat:
|
||||||
- {get_attr: [ContainersCommon, volumes]}
|
- {get_attr: [ContainersCommon, volumes]}
|
||||||
|
- {get_attr: [NeutronLogging, volumes]}
|
||||||
-
|
-
|
||||||
- /var/lib/kolla/config_files/neutron_server_tls_proxy.json:/var/lib/kolla/config_files/config.json:ro
|
- /var/lib/kolla/config_files/neutron_server_tls_proxy.json:/var/lib/kolla/config_files/config.json:ro
|
||||||
- /var/lib/config-data/puppet-generated/neutron/:/var/lib/kolla/config_files/src:ro
|
- /var/lib/config-data/puppet-generated/neutron/:/var/lib/kolla/config_files/src:ro
|
||||||
|
|
Loading…
Reference in New Issue