Mailing List Archive

[tripleo] can't deploy Newton undercloud
I am trying to set up Tripleo for Newton (why Newton you ask? The
RHCSA/RHOSP exam is based on Newton). Unexpectedly, I run into a brick
wall when deploying the undercloud. *Any suggestions how to troubleshoot
this?*

The last messages are:

puppet apply exited with exit code 6
+ '[' 6 '!=' 2 -a 6 '!=' 0 ']'
+ exit 6
[2018-11-05 00:47:13,779] (os-refresh-config) [ERROR] during
configure phase. [Command '['dib-run-parts',
'/usr/libexec/os-refresh-config/configure.d']' returned non-zero
exit status 1]

[2018-11-05 00:47:13,779] (os-refresh-config) [ERROR] Aborting...
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File
"/usr/lib/python2.7/site-packages/instack_undercloud/undercloud.py",
line 1258, in install
    _run_orc(instack_env)
  File
"/usr/lib/python2.7/site-packages/instack_undercloud/undercloud.py",
line 1022, in _run_orc
    _run_live_command(args, instack_env, 'os-refresh-config')
  File
"/usr/lib/python2.7/site-packages/instack_undercloud/undercloud.py",
line 522, in _run_live_command
    raise RuntimeError('%s failed. See log for details.' % name)
RuntimeError: os-refresh-config failed. See log for details.

Neither /var/log nor /opt have any trace of os-refresh-config. *Where
should I look for log? *And***where do I find more information about the
**/puppet apply /**error? /var/log/puppet is empty.*

~/.instack/install-undercloud.log contains one other message labeled
with "error". Not sure if it's relevant:

Error: /Stage[main]/Keystone::Roles::Admin/Keystone_user[admin]:
Could not evaluate: Execution of '/bin/openstack token issue
--format value' returned 1: Certificate did not match expected
hostname: 192.168.126.2. Certificate: {'subjectAltName': (('DNS',
'192.168.126.2'),), 'notBefore': u'Nov  4 15:04:13 2018 GMT',
'serialNumber': u'03553ED8BBF040FEAF44FE8C95A45CB2', 'notAfter':
'Nov  4 14:58:20 2019 GMT', 'version': 3L, 'subject':
((('commonName', u'192.168.126.2'),),), 'issuer': ((('commonName',
u'Local Signing Authority'),), (('commonName',
u'03553ed8-bbf040fe-af44fe8c-95a45cb1'),))}
SSL exception connecting to
https://192.168.126.2:13000/v3/auth/tokens: *hostname
'192.168.126.2' doesn't match '192.168.126.2'* (tried 21, for a
total of 170 seconds)^[.[.0m

So it seems that hostname 192.168.126.2 doesn't match 192.168.126.2.
*How can I convince SSL that they do actually match?*

To get to this point, I followed the steps in the Tripleo install guide
<http://tripleo.org/install/installation/installation.html#installing-the-undercloud>.
The undercloud.conf is almost verbatim from Keith Tenzer's blog
<https://keithtenzer.com/2017/04/20/red-hat-openstack-platform-10-newton-installation-and-configuration-guide/>:

[DEFAULT]

# local interface is connected to the provisioning network
# which is used to PXE-install the overcloud nodes
local_interface = eth0
local_ip = 192.168.126.1/24
undercloud_public_vip = 192.168.126.2
undercloud_admin_vip = 192.168.126.3

masquerade_network = 192.168.126.0/24
dhcp_start = 192.168.126.100
dhcp_end = 192.168.126.150
network_cidr = 192.168.126.0/24
network_gateway = 192.168.126.1
inspection_iprange = 192.168.126.30,192.168.126.99
generate_service_certificate = true
certificate_generation_ca = local
Re: [tripleo] can't deploy Newton undercloud [ In reply to ]
Thanks for the hint, Remo.

Unfortunately the reboot didn't help. Do you know how to switch off SSL?
I only see this in undercloud.conf:

# Certificate file to use for OpenStack service SSL connections.
# Setting this enables SSL for the OpenStack API endpoints, leaving it
# unset disables SSL. (string value)
#undercloud_service_certificate =

The problem: It is already unset. Is there a way to unset it even more?
(kidding)

The Tripleo web site has a section how to enable SSL, but AFAIK nothing
now to not enable it.

I added the openstack list back to the CC.

Bernd

On 11/5/2018 4:50 PM, Remo Mattei wrote:
> Try to turn ssl off there is a bug that may be the issue here but if
> you reboot the under cloud and retry to re-run the install it May
> finishes. So before turning off ssl try reboot rerun install and see
> what happen. 
Re: [tripleo] can't deploy Newton undercloud [ In reply to ]
What about the option "generate_service_certificate", that is 'true' by
default, and you would need to set that as false.


On Mon, Nov 5, 2018 at 12:16 PM Bernd Bausch <berndbausch@gmail.com> wrote:

> Thanks for the hint, Remo.
>
> Unfortunately the reboot didn't help. Do you know how to switch off SSL? I
> only see this in undercloud.conf:
>
> # Certificate file to use for OpenStack service SSL connections.
> # Setting this enables SSL for the OpenStack API endpoints, leaving it
> # unset disables SSL. (string value)
> #undercloud_service_certificate =
>
> The problem: It is already unset. Is there a way to unset it even more?
> (kidding)
>
> The Tripleo web site has a section how to enable SSL, but AFAIK nothing
> now to not enable it.
> I added the openstack list back to the CC.
>
> Bernd
> On 11/5/2018 4:50 PM, Remo Mattei wrote:
>
> Try to turn ssl off there is a bug that may be the issue here but if you
> reboot the under cloud and retry to re-run the install it May finishes. So
> before turning off ssl try reboot rerun install and see what happen.
>
>
> _______________________________________________
> Mailing list:
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
> Post to : openstack@lists.openstack.org
> Unsubscribe :
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
>


--
Juan Antonio Osorio R.
e-mail: jaosorior@gmail.com
Re: [tripleo] can't deploy Newton undercloud [ In reply to ]
Yep, after commenting anything that seems to be remotely linked with
"certificate" or "SSL", undercloud installation comletes. Many thanks,
gentlemen!

If anybody has an idea how to successfully deploy a Newton undercloud
/with /SSL, it would be great to hear.

Bernd.

On 11/5/2018 7:49 PM, Juan Antonio Osorio wrote:
> What about the option "generate_service_certificate", that is 'true'
> by default, and you would need to set that as false.
>
>
> On Mon, Nov 5, 2018 at 12:16 PM Bernd Bausch <berndbausch@gmail.com
> <mailto:berndbausch@gmail.com>> wrote:
>
> Thanks for the hint, Remo.
>
> Unfortunately the reboot didn't help. Do you know how to switch
> off SSL? I only see this in undercloud.conf:
>
> # Certificate file to use for OpenStack service SSL connections.
> # Setting this enables SSL for the OpenStack API endpoints,
> leaving it
> # unset disables SSL. (string value)
> #undercloud_service_certificate =
>
> The problem: It is already unset. Is there a way to unset it even
> more? (kidding)
>
> The Tripleo web site has a section how to enable SSL, but AFAIK
> nothing now to not enable it.
>
> I added the openstack list back to the CC.
>
> Bernd
>
> On 11/5/2018 4:50 PM, Remo Mattei wrote:
>> Try to turn ssl off there is a bug that may be the issue here but
>> if you reboot the under cloud and retry to re-run the install it
>> May finishes. So before turning off ssl try reboot rerun install
>> and see what happen. 
>
> _______________________________________________
> Mailing list:
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
> Post to     : openstack@lists.openstack.org
> <mailto:openstack@lists.openstack.org>
> Unsubscribe :
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
>
>
>
> --
> Juan Antonio Osorio R.
> e-mail: jaosorior@gmail.com <mailto:jaosorior@gmail.com>
>
Re: [tripleo] can't deploy Newton undercloud [ In reply to ]
Yes as soon as I get to my computer I will share the info.

Inviato da iPhone

> Il giorno 5 nov 2018, alle ore 11:11, Bernd Bausch <berndbausch@gmail.com> ha scritto:
>
> Thanks for the hint, Remo.
>
> Unfortunately the reboot didn't help. Do you know how to switch off SSL? I only see this in undercloud.conf:
>
> # Certificate file to use for OpenStack service SSL connections.
> # Setting this enables SSL for the OpenStack API endpoints, leaving it
> # unset disables SSL. (string value)
> #undercloud_service_certificate =
>
> The problem: It is already unset. Is there a way to unset it even more? (kidding)
>
> The Tripleo web site has a section how to enable SSL, but AFAIK nothing now to not enable it.
>
> I added the openstack list back to the CC.
> Bernd
>
>> On 11/5/2018 4:50 PM, Remo Mattei wrote:
>> Try to turn ssl off there is a bug that may be the issue here but if you reboot the under cloud and retry to re-run the install it May finishes. So before turning off ssl try reboot rerun install and see what happen.
>
Re: [tripleo] can't deploy Newton undercloud [ In reply to ]
I saw Juan response that should do the steps to bypass the ssl cert.

Remo

Inviato da iPhone

> Il giorno 5 nov 2018, alle ore 13:54, Remo Mattei <Remo@Italy1.com> ha scritto:
>
> Yes as soon as I get to my computer I will share the info.
>
> Inviato da iPhone
>
>> Il giorno 5 nov 2018, alle ore 11:11, Bernd Bausch <berndbausch@gmail.com> ha scritto:
>>
>> Thanks for the hint, Remo.
>>
>> Unfortunately the reboot didn't help. Do you know how to switch off SSL? I only see this in undercloud.conf:
>>
>> # Certificate file to use for OpenStack service SSL connections.
>> # Setting this enables SSL for the OpenStack API endpoints, leaving it
>> # unset disables SSL. (string value)
>> #undercloud_service_certificate =
>>
>> The problem: It is already unset. Is there a way to unset it even more? (kidding)
>>
>> The Tripleo web site has a section how to enable SSL, but AFAIK nothing now to not enable it.
>>
>> I added the openstack list back to the CC.
>> Bernd
>>
>>> On 11/5/2018 4:50 PM, Remo Mattei wrote:
>>> Try to turn ssl off there is a bug that may be the issue here but if you reboot the under cloud and retry to re-run the install it May finishes. So before turning off ssl try reboot rerun install and see what happen.
>>
> _______________________________________________
> Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
> Post to : openstack@lists.openstack.org
> Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack