[OpenStack Ansible] [Deployment] Retrieve upper constraints issue
Hello, Following the instruction here (https://docs.openstack.org/project-deploy-guide/openstack-ansible/2025.1/) step by step to deploy openstack with openstack-ansible stable/2025.1 release on four computers (Infra1, Infra2, compute1, compute2) with a fifth computer as deployer (localhost)。 During the execution of command “openstack-ansible setup-infrastructure.yml” error pops up and installation broke. The log is as the following: ... TASK [repo_server : Ensure deploy host u-c directory exists] ******************************************************************************************* ok: [infra1-repo-container-769e886d -> localhost] TASK [repo_server : Retrieve upper constraints using https] ******************************************************************************************** FAILED - RETRYING: [infra1-repo-container-769e886d -> localhost]: Retrieve upper constraints using https (5 retries left). FAILED - RETRYING: [infra1-repo-container-769e886d -> localhost]: Retrieve upper constraints using https (4 retries left). FAILED - RETRYING: [infra1-repo-container-769e886d -> localhost]: Retrieve upper constraints using https (3 retries left). FAILED - RETRYING: [infra1-repo-container-769e886d -> localhost]: Retrieve upper constraints using https (2 retries left). FAILED - RETRYING: [infra1-repo-container-769e886d -> localhost]: Retrieve upper constraints using https (1 retries left). fatal: [infra1-repo-container-769e886d -> localhost]: FAILED! => attempts: 5 changed: false dest: /etc/openstack_deploy/upper-constraints/upper_constraints_bfd91c04caf498be2bfda0732a2a0f9fa9306e07.txt elapsed: 0 gid: 0 group: root mode: '0644' msg: 'Request failed: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)>' owner: root size: 13007 state: file uid: 0 url: https://releases.openstack.org/constraints/upper/bfd91c04caf498be2bfda0732a2... Can anybody please give a clue on what is going on and how to do troubleshooting? Thanks a lot in advance! Regards, Hewi
Hi, Have you tried running a simple CURL from your deploy host (localhost)? Ie: $ curl -I -L https://releases.openstack.org/constraints/upper/bfd91c04caf498be2bfda0732a2... As it seems that the issue happens when you try to fetch upper constraints for local cache. You can also try using github as an alternative source, by adding to your user_variables following: user_requirements_git_url: https://raw.githubusercontent.com/openstack/requirements/bfd91c04caf498be2bf... вс, 5 окт. 2025 г. в 15:24, <holywine@outlook.com>:
Hello,
Following the instruction here ( https://docs.openstack.org/project-deploy-guide/openstack-ansible/2025.1/) step by step to deploy openstack with openstack-ansible stable/2025.1 release on four computers (Infra1, Infra2, compute1, compute2) with a fifth computer as deployer (localhost)。
During the execution of command “openstack-ansible setup-infrastructure.yml” error pops up and installation broke. The log is as the following:
... TASK [repo_server : Ensure deploy host u-c directory exists] ******************************************************************************************* ok: [infra1-repo-container-769e886d -> localhost]
TASK [repo_server : Retrieve upper constraints using https] ******************************************************************************************** FAILED - RETRYING: [infra1-repo-container-769e886d -> localhost]: Retrieve upper constraints using https (5 retries left). FAILED - RETRYING: [infra1-repo-container-769e886d -> localhost]: Retrieve upper constraints using https (4 retries left). FAILED - RETRYING: [infra1-repo-container-769e886d -> localhost]: Retrieve upper constraints using https (3 retries left). FAILED - RETRYING: [infra1-repo-container-769e886d -> localhost]: Retrieve upper constraints using https (2 retries left). FAILED - RETRYING: [infra1-repo-container-769e886d -> localhost]: Retrieve upper constraints using https (1 retries left). fatal: [infra1-repo-container-769e886d -> localhost]: FAILED! => attempts: 5 changed: false dest: /etc/openstack_deploy/upper-constraints/upper_constraints_bfd91c04caf498be2bfda0732a2a0f9fa9306e07.txt elapsed: 0 gid: 0 group: root mode: '0644' msg: 'Request failed: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)>' owner: root size: 13007 state: file uid: 0 url: https://releases.openstack.org/constraints/upper/bfd91c04caf498be2bfda0732a2...
Can anybody please give a clue on what is going on and how to do troubleshooting?
Thanks a lot in advance!
Regards, Hewi
Hi Dmitriy, Thanks for reply! As your instruction 1) change the source to github 2) add user_requirements_git_url in user_variables. The issue is the same. I checked the folder /etc/openstack_deploy/upper-constraints/ the constraints file is acutally there. Running the curl command it reports some error looks to be related to certificate. Not sure if this is related... The console trace is as below: ... EXIT NOTICE [Playbook execution failure] ************************************** =============================================================================== root@Server-05:/opt/openstack-ansible/playbooks# cd /etc/openstack_deploy/upper-constraints/ root@Server-05:/etc/openstack_deploy/upper-constraints# ls upper_constraints_bfd91c04caf498be2bfda0732a2a0f9fa9306e07.txt root@Server-05:/etc/openstack_deploy/upper-constraints# curl -I -L https://releases.openstack.org/constraints/upper/bfd91c04caf498be2bfda0732a2... curl: (2) no URL specified curl: try 'curl --help' or 'curl --manual' for more information -bash: https://releases.openstack.org/constraints/upper/bfd91c04caf498be2bfda0732a2...: No such file or directory root@Server-05:/etc/openstack_deploy/upper-constraints# https://releases.openstack.org/constraints/upper/bfd91c04caf498be2bfda0732a2... -bash: https://releases.openstack.org/constraints/upper/bfd91c04caf498be2bfda0732a2...: No such file or directory root@Server-05:/etc/openstack_deploy/upper-constraints# curl -I -L https://releases.openstack.org/constraints/upper/bfd91c04caf498be2bfda0732a2... curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above. root@Server-05:/etc/openstack_deploy/upper-constraints# Does this imply a certifcate issue or network connection issue, since it seems infra1-repo-container did not get the file which is ready in the place? Thanks!
Hi Holywine, Yes, it appears your host is encountering issues verifying the Let's Encrypt certificate, which I assume is currently used by both GitHub and OpenDev. Based on your output, `infra1-repo-container` does delegate tasks to `localhost`. However, regardless of whether the file already exists, Ansible needs to check the remote URL to ensure the content is up-to-date. Therefore, the core issue seems to be with certificate verification on your host(s). I would suggest starting by checking that the `ca-certificates` package is installed and updated to its latest version. Then I would also try to debug the issue using openssl client, ie: openssl s_client -showcerts -servername releases.openstack.org -connect releases.openstack.org:443 </dev/null Best regards, Dmitriy On Mon, 6 Oct 2025, 03:12 , <holywine@outlook.com> wrote:
Hi Dmitriy,
Thanks for reply!
As your instruction 1) change the source to github 2) add user_requirements_git_url in user_variables. The issue is the same.
I checked the folder /etc/openstack_deploy/upper-constraints/ the constraints file is acutally there. Running the curl command it reports some error looks to be related to certificate. Not sure if this is related... The console trace is as below:
... EXIT NOTICE [Playbook execution failure] **************************************
=============================================================================== root@Server-05:/opt/openstack-ansible/playbooks# cd /etc/openstack_deploy/upper-constraints/ root@Server-05:/etc/openstack_deploy/upper-constraints# ls upper_constraints_bfd91c04caf498be2bfda0732a2a0f9fa9306e07.txt root@Server-05:/etc/openstack_deploy/upper-constraints# curl -I -L
https://releases.openstack.org/constraints/upper/bfd91c04caf498be2bfda0732a2... curl: (2) no URL specified curl: try 'curl --help' or 'curl --manual' for more information -bash: https://releases.openstack.org/constraints/upper/bfd91c04caf498be2bfda0732a2...: No such file or directory root@Server-05:/etc/openstack_deploy/upper-constraints# https://releases.openstack.org/constraints/upper/bfd91c04caf498be2bfda0732a2... -bash: https://releases.openstack.org/constraints/upper/bfd91c04caf498be2bfda0732a2...: No such file or directory root@Server-05:/etc/openstack_deploy/upper-constraints# curl -I -L https://releases.openstack.org/constraints/upper/bfd91c04caf498be2bfda0732a2... curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above. root@Server-05:/etc/openstack_deploy/upper-constraints#
Does this imply a certifcate issue or network connection issue, since it seems infra1-repo-container did not get the file which is ready in the place?
Thanks!
Dear Dmitriy, Sincerely appreciate for the help! It is indeed the glitches of Internet connection which lead to the issue. It is resolved now. Best Regards hewi
participants (2)
-
Dmitriy Rabotyagov
-
holywine＠outlook.com