Point InternalTLSVncCAFile to /etc/ipa/ca.crt

In case the freeipa CA is a sub CA of an external CA the
InternalTLSVncCAFile requrested does not have the full CA
chain and only have the free IPA CA. As a result qemu
which can not verify the vnc certificate sent by the
vnc-proxy. The issue is in certmonger[1] as it does not return the
full CA chain.

As a workaround, until certmonger is fixed, this change points the
InternalTLSVncCAFile to /etc/ipa/ca.crt which has the full CA chain.

[1] - https://bugzilla.redhat.com/show_bug.cgi?id=1710632

Change-Id: I750c5572505ff58b8164906754f1bcaf4fd256e0

deployment/nova/nova-libvirt-container-puppet.yaml

@@ -102,7 +102,7 @@ parameters:
     type: string
     description: Specifies the CA cert to use for NBD TLS.
   InternalTLSVncCAFile:
-    default: '/etc/pki/CA/certs/vnc.crt'
+    default: '/etc/ipa/ca.crt'
     type: string
     description: Specifies the CA cert to use for VNC TLS.
   InternalTLSQemuCAFile:

deployment/nova/nova-vnc-proxy-container-puppet.yaml

@@ -51,7 +51,7 @@ parameters:
                  enable TLS transaport for libvirt VNC and configure the
                  relevant keys for libvirt.
   InternalTLSVncCAFile:
-    default: '/etc/pki/CA/certs/vnc.crt'
+    default: '/etc/ipa/ca.crt'
     type: string
     description: Specifies the CA cert to use for VNC TLS.
   LibvirtVncCACert:

releasenotes/notes/nova_point_InternalTLSVncCAFile_to_ipa_ca-23830eab2b91fdf8.yaml

@@ -0,0 +1,10 @@
+---
+fixes:
+  - |
+    In case the freeipa CA is a sub CA of an external CA the InternalTLSVncCAFile
+    requrested does not have the full CA chain and only have the free IPA
+    CA. As a result qemu which can not verify the vnc certificate sent by
+    the vnc-proxy. The issue is in certmonger as it does not return the full
+    CA chain.
+    As a workaround, until certmonger is fixed, this change points the
+    InternalTLSVncCAFile to /etc/ipa/ca.crt which has the full CA chain.