<div dir="ltr">Hi,<div><br>I found the difference between the two. </div><div>On fedora-coreos inside the heat container that is ran by podman REQUESTS_CA_BUNDLE has the value /etc/pki/ca-trust/source/anchors/openstack-ca.pem which is empty.</div><div>On fedora-atomic the var has the value /etc/pki/tls/certs/ca-bundle.crt</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 22, 2020 at 3:14 PM Ionut Biru <<a href="mailto:ionut@fleio.com">ionut@fleio.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hello,<div><br></div><div>I've deployed the same kubernetes version on fedora-atomic but with use_podman=true and worked flawless.</div><div>Maybe is an issue with fedora-coreos?</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 22, 2020 at 9:53 AM Ionut Biru <<a href="mailto:ionut@fleio.com" target="_blank">ionut@fleio.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hello,<div><br></div><div>I don't have cafile configured in keystone_authtoken and keystone_auth. I did copied letsencrypt cafile and configured it but now magnum cannot communicate with keystone even at simple as coe cluster list.</div><div><br></div><div> CRITICAL keystonemiddleware.auth_token [-] Unable to validate token: Could not find versioned identity endpoints when attempting to authenticate. <br></div><div> (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify ies exceeded with url: / (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",),)<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 22, 2020 at 3:02 AM Feilong Wang <<a href="mailto:feilong@catalyst.net.nz" target="_blank">feilong@catalyst.net.nz</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF">
<p>Hi Ionut,</p>
<p>Would you mind sharing your magnum.conf? I think you may need the
<b>cafile</b> config option for both <b>keystone_authtoken</b>
and <b>keystone_auth.</b><br>
</p>
<p><br>
</p>
<div>On 22/01/20 11:01 AM, Ionut Biru wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">Hello guys,
<div><br>
</div>
<div>I'm trying to deploy a kubernetes cluster using magnum 9.2
with fedora-coreos-31.20200113.3.1-openstack.</div>
<div><br>
</div>
<div>Master vm is deployed correctly but the cluster is never
deployed since podman returns the following error:</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div>Jan 21 21:55:14 k8s-cluster002-mn5qgp6qlmw6-master-0
podman[2433]: Authorization failed: SSL exception connecting
to <a href="https://api.mydomain.cloud:5000/v3/auth/tokens" target="_blank">https://api.mydomain.cloud:5000/v3/auth/tokens</a>: HTTPSConnectionPool(host='api.mydomain.cloud',
port=5000): Max retries exceeded with url:
/v3/auth/tokens (Caused by SSLError(SSLError(185090184,
u'[X509] no certificate or crl found (_ssl.c:3063)'),))<br>
</div>
<div><br>
</div>
<div>I do have a valid letsencrypt certification on that
particular domain.</div>
<div><br>
</div>
<div> curl <a href="https://api.mydomain.cloud:5000/v3/auth/tokens" target="_blank">https://api.mydomain.cloud:5000/v3/auth/tokens</a><br>
{"error": {"message": "The request you have made requires
authentication.", "code": 401, "title": "Unauthorized"}}<br>
</div>
<div><br>
</div>
<div>I was wondering, do you guys seen this issue before?
Below is the template.</div>
<div><br>
</div>
<div><a href="https://paste.xinu.at/OC0Ic/" target="_blank">https://paste.xinu.at/OC0Ic/</a><br>
</div>
-- <br>
<div dir="ltr">
<div dir="ltr">Ionut Biru - <a href="https://fleio.com" target="_blank">https://fleio.com</a><br>
</div>
</div>
</div>
</div>
</blockquote>
<pre cols="72">--
Cheers & Best regards,
Feilong Wang (王飞龙)
Head of R&D
Catalyst Cloud - Cloud Native New Zealand
--------------------------------------------------------------------------
Tel: +64-48032246
Email: <a href="mailto:flwang@catalyst.net.nz" target="_blank">flwang@catalyst.net.nz</a>
Level 6, Catalyst House, 150 Willis Street, Wellington
-------------------------------------------------------------------------- </pre>
</div>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr"><div dir="ltr">Ionut Biru - <a href="https://fleio.com" target="_blank">https://fleio.com</a><br></div></div>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr"><div dir="ltr">Ionut Biru - <a href="https://fleio.com" target="_blank">https://fleio.com</a><br></div></div>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr">Ionut Biru - <a href="https://fleio.com" target="_blank">https://fleio.com</a><br></div></div>