<div dir="auto">Thanks Brandon for your input.<div dir="auto">We have this IP as stated getting allocated.</div><div dir="auto">Maybe we can pass domain name to get this more predictable.</div><div dir="auto">But in that case also we would need to do the same way as you suggest ?</div><div dir="auto">Will try your and Swogat's suggestions.</div><div dir="auto"><br></div><div dir="auto">Best Regards,</div><div dir="auto">Lokendra </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, 9 Jul 2022, 02:51 Brendan Shephard, <<a href="mailto:bshephar@redhat.com">bshephar@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="auto">Hey,</div><div dir="auto"><br></div><div dir="auto">It looks like you have set the dns name on the SSL certificate to <a href="http://overcloud.example.com" target="_blank" rel="noreferrer">overcloud.example.com</a> instead of the IP address. So the SSL cert validation is failing.</div><div dir="auto"><br></div><div dir="auto"><span style="background-color:rgb(255,255,0);border-color:rgb(0,0,0);color:rgb(0,0,0)">Caused by SSLError(CertificateError(\"hostname 'fd00:fd00:fd00:9900::2ef' doesn't match '<a href="http://overcloud.example.com" rel="noreferrer noreferrer" style="border-color:rgb(66,133,244)" target="_blank">overcloud.example.com</a>'\",),)</span><span style="font-size:x-small;border-color:rgb(0,0,0);color:rgb(0,0,0)">)</span><br></div><div dir="auto"><br></div><div><font color="#000000"><span>Note point number 1 here:</span></font></div><div><a href="https://docs.openstack.org/project-deploy-guide/tripleo-docs/latest/features/ssl.html#certificate-and-public-vip-configuration" target="_blank" rel="noreferrer">https://docs.openstack.org/project-deploy-guide/tripleo-docs/latest/features/ssl.html#certificate-and-public-vip-configuration</a><br></div><div dir="auto"><span style="font-size:x-small;border-color:rgb(0,0,0);color:rgb(0,0,0)"><br></span></div><div><font color="#000000"><span>It's actually worded poorly. I don't believe IP's can be set for the common name, and we need to use subjectAltName instead. See below:</span></font></div><div dir="auto"><span style="font-size:x-small;border-color:rgb(0,0,0);color:rgb(0,0,0)"><br></span></div><div>So, when you create this file:</div><div><pre style="box-sizing:border-box;line-height:16.25px;overflow:auto;font-family:Menlo,Monaco,Consolas,"Courier New",monospace;font-size:13px;padding:20px 30px;margin-top:0px;margin-bottom:10px;color:rgb(255,255,255);word-break:break-all;word-wrap:break-word;background-color:rgb(51,51,51);border:1px solid rgb(204,204,204);border-radius:4px"><span style="box-sizing:border-box;color:rgb(208,208,208)">[</span><span style="box-sizing:border-box;color:rgb(208,208,208)">req</span><span style="box-sizing:border-box;color:rgb(208,208,208)">]</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">default_bits</span> <span style="box-sizing:border-box;color:rgb(208,208,208)">=</span> <span style="box-sizing:border-box;color:rgb(81,178,253)">2048</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">prompt</span> <span style="box-sizing:border-box;color:rgb(208,208,208)">=</span> <span style="box-sizing:border-box;color:rgb(208,208,208)">no</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">default_md</span> <span style="box-sizing:border-box;color:rgb(208,208,208)">=</span> <span style="box-sizing:border-box;color:rgb(208,208,208)">sha256</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">distinguished_name</span> <span style="box-sizing:border-box;color:rgb(208,208,208)">=</span> <span style="box-sizing:border-box;color:rgb(208,208,208)">dn</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">[</span><span style="box-sizing:border-box;color:rgb(208,208,208)">dn</span><span style="box-sizing:border-box;color:rgb(208,208,208)">]</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">C</span><span style="box-sizing:border-box;color:rgb(208,208,208)">=</span><span style="box-sizing:border-box;color:rgb(208,208,208)">AU</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">ST</span><span style="box-sizing:border-box;color:rgb(208,208,208)">=</span><span style="box-sizing:border-box;color:rgb(208,208,208)">Queensland</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">L</span><span style="box-sizing:border-box;color:rgb(208,208,208)">=</span><span style="box-sizing:border-box;color:rgb(208,208,208)">Brisbane</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">O</span><span style="box-sizing:border-box;color:rgb(208,208,208)">=</span><span style="box-sizing:border-box;color:rgb(208,208,208)">your</span><span style="box-sizing:border-box;color:rgb(208,208,208)">-</span><span style="box-sizing:border-box;color:rgb(208,208,208)">org</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">OU</span><span style="box-sizing:border-box;color:rgb(208,208,208)">=</span><span style="box-sizing:border-box;color:rgb(208,208,208)">admin</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">emailAddress</span><span style="box-sizing:border-box;color:rgb(208,208,208)">=</span><span style="box-sizing:border-box;color:rgb(208,208,208)">me</span><span style="box-sizing:border-box;color:rgb(255,165,0)">@example</span><span style="box-sizing:border-box;color:rgb(208,208,208)">.</span><span style="box-sizing:border-box;color:rgb(208,208,208)">com</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">CN</span><span style="box-sizing:border-box;color:rgb(208,208,208)">=</span><span style="box-sizing:border-box;color:rgb(208,208,208)">openstack</span><span style="box-sizing:border-box;color:rgb(208,208,208)">.</span><span style="box-sizing:border-box;color:rgb(208,208,208)">example</span><span style="box-sizing:border-box;color:rgb(208,208,208)">.</span><span style="box-sizing:border-box;color:rgb(208,208,208)">com</span></pre></div></div><div><br></div><div>Remove the CN= part from that file:</div><div><pre style="font-size:13px;box-sizing:border-box;line-height:16.25px;overflow:auto;font-family:Menlo,Monaco,Consolas,"Courier New",monospace;padding:20px 30px;margin-top:0px;margin-bottom:10px;color:rgb(255,255,255);word-break:break-all;word-wrap:break-word;background-color:rgb(51,51,51);border:1px solid rgb(204,204,204);border-radius:4px"><span style="box-sizing:border-box;color:rgb(208,208,208)">[</span><span style="box-sizing:border-box;color:rgb(208,208,208)">req</span><span style="box-sizing:border-box;color:rgb(208,208,208)">]</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">default_bits</span> <span style="box-sizing:border-box;color:rgb(208,208,208)">=</span> <span style="box-sizing:border-box;color:rgb(81,178,253)">2048</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">prompt</span> <span style="box-sizing:border-box;color:rgb(208,208,208)">=</span> <span style="box-sizing:border-box;color:rgb(208,208,208)">no</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">default_md</span> <span style="box-sizing:border-box;color:rgb(208,208,208)">=</span> <span style="box-sizing:border-box;color:rgb(208,208,208)">sha256</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">distinguished_name</span> <span style="box-sizing:border-box;color:rgb(208,208,208)">=</span> <span style="box-sizing:border-box;color:rgb(208,208,208)">dn</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">[</span><span style="box-sizing:border-box;color:rgb(208,208,208)">dn</span><span style="box-sizing:border-box;color:rgb(208,208,208)">]</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">C</span><span style="box-sizing:border-box;color:rgb(208,208,208)">=</span><span style="box-sizing:border-box;color:rgb(208,208,208)">AU</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">ST</span><span style="box-sizing:border-box;color:rgb(208,208,208)">=</span><span style="box-sizing:border-box;color:rgb(208,208,208)">Queensland</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">L</span><span style="box-sizing:border-box;color:rgb(208,208,208)">=</span><span style="box-sizing:border-box;color:rgb(208,208,208)">Brisbane</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">O</span><span style="box-sizing:border-box;color:rgb(208,208,208)">=</span><span style="box-sizing:border-box;color:rgb(208,208,208)">your</span><span style="box-sizing:border-box;color:rgb(208,208,208)">-</span><span style="box-sizing:border-box;color:rgb(208,208,208)">org</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">OU</span><span style="box-sizing:border-box;color:rgb(208,208,208)">=</span><span style="box-sizing:border-box;color:rgb(208,208,208)">admin</span>
<span style="box-sizing:border-box;color:rgb(208,208,208)">emailAddress</span><span style="box-sizing:border-box;color:rgb(208,208,208)">=</span><span style="box-sizing:border-box;color:rgb(208,208,208)">me</span><span style="box-sizing:border-box;color:rgb(255,165,0)">@example</span><span style="box-sizing:border-box;color:rgb(208,208,208)">.</span><span style="box-sizing:border-box;color:rgb(208,208,208)">com</span></pre></div><div><br></div><div>Then in the v3.ext file set IP.1=fd00:fd00:fd00:9900::2ef like so:</div><div><pre style="box-sizing:border-box;line-height:16.25px;overflow:auto;font-family:Menlo,Monaco,Consolas,"Courier New",monospace;padding:20px 30px;margin-top:0px;margin-bottom:10px;word-break:break-all;word-wrap:break-word;background-color:rgb(51,51,51);border:1px solid rgb(204,204,204);border-radius:4px"><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">authorityKeyIdentifier</span><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">=</span><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">keyid</span><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">,</span><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">issuer</span><font color="#ffffff" style="font-size:13px">
</font><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">basicConstraints</span><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">=</span><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">CA</span><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">:</span><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">FALSE</span><font color="#ffffff" style="font-size:13px">
</font><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">keyUsage</span><font color="#ffffff" style="font-size:13px"> </font><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">=</span><font color="#ffffff" style="font-size:13px"> </font><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">digitalSignature</span><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">,</span><font color="#ffffff" style="font-size:13px"> </font><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">nonRepudiation</span><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">,</span><font color="#ffffff" style="font-size:13px"> </font><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">keyEncipherment</span><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">,</span><font color="#ffffff" style="font-size:13px"> </font><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">dataEncipherment</span><font color="#ffffff" style="font-size:13px">
</font><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">subjectAltName</span><font color="#ffffff" style="font-size:13px"> </font><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">=</span><font color="#ffffff" style="font-size:13px"> </font><span style="font-size:13px;color:rgb(255,165,0);box-sizing:border-box">@alt_names</span><font color="#ffffff" style="font-size:13px">
</font><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">[</span><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">alt_names</span><span style="font-size:13px;color:rgb(208,208,208);box-sizing:border-box">]</span><font color="#ffffff" style="font-size:13px">
</font><font color="#d0d0d0" style="font-size:13px"><span>IP.1=</span></font><span style="font-family:Arial,Helvetica,sans-serif;background-color:rgb(255,255,255)">fd00:fd00:fd00:9900::2ef</span></pre></div><div><br></div><div><br></div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, 8 Jul 2022 at 10:31 pm, Swogat Pradhan <<a href="mailto:swogatpradhan22@gmail.com" target="_blank" rel="noreferrer">swogatpradhan22@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)"><div dir="auto">What is the domain name you have specified in the undercloud.conf file?<div dir="auto">And what is the fqdn name used for the generation of the SSL cert?</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, 8 Jul 2022, 5:38 pm Lokendra Rathour, <<a href="mailto:lokendrarathour@gmail.com" target="_blank" rel="noreferrer">lokendrarathour@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)"><div dir="ltr">Hi Team,<div>We were trying to install overcloud with SSL enabled for which the UC is installed, but OC install is getting failed at step 4:</div><div><br></div><div>ERROR</div><div>:<font size="1" style="color:rgb(0,0,0)">nectionPool(host='fd00:fd00:fd00:9900::2ef', port=13000): Max retries exceeded with url: / (Caused by SSLError(CertificateError(\"hostname 'fd00:fd00:fd00:9900::2ef' doesn't match '<a href="http://undercloud.com" rel="noreferrer noreferrer" target="_blank">undercloud.com</a>'\",),))\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}</font></div><font size="1" style="color:rgb(0,0,0)">2022-07-08 17:03:23.606739 | 5254009a-6a3c-adb1-f96f-0000000072ac | FATAL | Clean up legacy Cinder keystone catalog entries | undercloud | item={'service_name': 'cinderv3', 'service_type': 'volume'} | error={"ansible_index_var": "cinder_api_service", "ansible_loop_var": "item", "changed": false, "cinder_api_service": 1, "item": {"service_name": "cinderv3", "service_type": "volume"}, "module_stderr": "Failed to discover available identity versions when contacting https://[fd00:fd00:fd00:9900::2ef]:13000. Attempting to parse version from URL.\nTraceback (most recent call last):\n File \"/usr/lib/python3.6/site-packages/urllib3/connectionpool.py\", line 600, in urlopen\n chunked=chunked)\n File \"/usr/lib/python3.6/site-packages/urllib3/connectionpool.py\", line 343, in _make_request\n self._validate_conn(conn)\n File \"/usr/lib/python3.6/site-packages/urllib3/connectionpool.py\", line 839, in _validate_conn\n conn.connect()\n File \"/usr/lib/python3.6/site-packages/urllib3/connection.py\", line 378, in connect\n _match_hostname(cert, self.assert_hostname or server_hostname)\n File \"/usr/lib/python3.6/site-packages/urllib3/connection.py\", line 388, in _match_hostname\n match_hostname(cert, asserted_hostname)\n File \"/usr/lib64/python3.6/ssl.py\", line 291, in match_hostname\n % (hostname, dnsnames[0]))\nssl.CertificateError: hostname 'fd00:fd00:fd00:9900::2ef' doesn't match '<a href="http://undercloud.com" rel="noreferrer noreferrer" target="_blank">undercloud.com</a>'\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"/usr/lib/python3.6/site-packages/requests/adapters.py\", line 449, in send\n timeout=timeout\n File \"/usr/lib/python3.6/site-packages/urllib3/connectionpool.py\", line 638, in urlopen\n _stacktrace=sys.exc_info()[2])\n File \"/usr/lib/python3.6/site-packages/urllib3/util/retry.py\", line 399, in increment\n raise MaxRetryError(_pool, url, error or ResponseError(cause))\nurllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='fd00:fd00:fd00:9900::2ef', port=13000): Max retries exceeded with url: / (Caused by SSLError(CertificateError(\"hostname 'fd00:fd00:fd00:9900::2ef' doesn't match '<a href="http://undercloud.com" rel="noreferrer noreferrer" target="_blank">undercloud.com</a>'\",),))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 1022, in _send_request\n resp = self.session.request(method, url, **kwargs)\n File \"/usr/lib/python3.6/site-packages/requests/sessions.py\", line 533, in request\n resp = self.send(prep, **send_kwargs)\n File \"/usr/lib/python3.6/site-packages/requests/sessions.py\", line 646, in send\n r = adapter.send(request, **kwargs)\n File \"/usr/lib/python3.6/site-packages/requests/adapters.py\", line 514, in send\n raise SSLError(e, request=request)\nrequests.exceptions.SSLError: HTTPSConnectionPool(host='fd00:fd00:fd00:9900::2ef', port=13000): Max retries exceeded with url: / (Caused by SSLError(CertificateError(\"hostname 'fd00:fd00:fd00:9900::2ef' doesn't match '<a href="http://undercloud.com" rel="noreferrer noreferrer" target="_blank">undercloud.com</a>'\",),))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/generic/base.py\", line 138, in _do_create_plugin\n authenticated=False)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/base.py\", line 610, in get_discovery\n authenticated=authenticated)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/discover.py\", line 1452, in get_discovery\n disc = Discover(session, url, authenticated=authenticated)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/discover.py\", line 536, in __init__\n authenticated=authenticated)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/discover.py\", line 102, in get_version_data\n resp = session.get(url, headers=headers, authenticated=authenticated)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 1141, in get\n return self.request(url, 'GET', **kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 931, in request\n resp = send(**kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 1026, in _send_request\n raise exceptions.SSLError(msg)\nkeystoneauth1.exceptions.connection.SSLError: SSL exception connecting to https://[fd00:fd00:fd00:9900::2ef]:13000: HTTPSConnectionPool(host='fd00:fd00:fd00:9900::2ef', port=13000): Max retries exceeded with url: / (Caused by SSLError(CertificateError(\"hostname 'fd00:fd00:fd00:9900::2ef' doesn't match '<a href="http://undercloud.com" rel="noreferrer noreferrer" target="_blank">undercloud.com</a>'\",),))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"<stdin>\", line 102, in <module>\n File \"<stdin>\", line 94, in _ansiballz_main\n File \"<stdin>\", line 40, in invoke_module\n File \"/usr/lib64/python3.6/runpy.py\", line 205, in run_module\n return _run_module_code(code, init_globals, run_name, mod_spec)\n File \"/usr/lib64/python3.6/runpy.py\", line 96, in _run_module_code\n mod_name, mod_spec, pkg_name, script_name)\n File \"/usr/lib64/python3.6/runpy.py\", line 85, in _run_code\n exec(code, run_globals)\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_7ikyjf7t/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/modules/catalog_service.py\", line 185, in <module>\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_7ikyjf7t/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/modules/catalog_service.py\", line 181, in main\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_7ikyjf7t/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/module_utils/openstack.py\", line 407, in __call__\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_7ikyjf7t/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/modules/catalog_service.py\", line 141, in run\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/_identity.py\", line 517, in search_services\n services = self.list_services()\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/_identity.py\", line 492, in list_services\n if self._is_client_version('identity', 2):\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/openstackcloud.py\", line 460, in _is_client_version\n client = getattr(self, client_name)\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/_identity.py\", line 32, in _identity_client\n 'identity', min_version=2, max_version='3.latest')\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/openstackcloud.py\", line 407, in _get_versioned_client\n if adapter.get_endpoint():\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/adapter.py\", line 291, in get_endpoint\n return self.session.get_endpoint(auth or self.auth, **kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 1243, in get_endpoint\n return auth.get_endpoint(self, **kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/base.py\", line 380, in get_endpoint\n allow_version_hack=allow_version_hack, **kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/base.py\", line 271, in get_endpoint_data\n service_catalog = self.get_access(session).service_catalog\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/base.py\", line 134, in get_access\n self.auth_ref = self.get_auth_ref(session)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/generic/base.py\", line 206, in get_auth_ref\n self._plugin = self._do_create_plugin(session)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/generic/base.py\", line 161, i<span style="background-color:rgb(255,255,0)">n _do_create_plugin\n 'auth_url is correct. %s' % e)\nkeystoneauth1.exceptions.discovery.DiscoveryFailure: Could not find versioned identity endpoints when attempting to authenticate. Please check that your auth_url is correct. SSL exception connecting to https://[fd00:fd00:fd00:9900::2ef]:13000: HTTPSConnectionPool(host='fd00:fd00:fd00:9900::2ef', port=13000): Max retries exceeded with url: / (Caused by SSLError(CertificateError(\"hostname 'fd00:fd00:fd00:9900::2ef' doesn't match '<a href="http://overcloud.example.com" rel="noreferrer noreferrer" target="_blank">overcloud.example.com</a>'\",),)</span>)\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}<br>2022-07-08 17:03:23.609354 | 5254009a-6a3c-adb1-f96f-0000000072ac | TIMING | Clean up legacy Cinder keystone catalog entries | undercloud | 0:11:01.271914 | 2.47s<br>2022-07-08 17:03:23.611094 | 5254009a-6a3c-adb1-f96f-0000000072ac | TIMING | Clean up legacy Cinder keystone catalog entries | undercloud | 0:11:01.273659 | 2.47s<br><br>PLAY RECAP *********************************************************************<br>localhost : ok=0 changed=0 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0<br>overcloud-controller-0 : ok=437 changed=104 unreachable=0 failed=0 skipped=214 rescued=0 ignored=0<br>overcloud-controller-1 : ok=436 changed=101 unreachable=0 failed=0 skipped=214 rescued=0 ignored=0<br>overcloud-controller-2 : ok=431 changed=101 unreachable=0 failed=0 skipped=214 rescued=0 ignored=0<br>overcloud-novacompute-0 : ok=345 changed=83 unreachable=0 failed=0 skipped=198 rescued=0 ignored=0<br><span style="background-color:rgb(255,255,0)">undercloud : ok=28 changed=7 unreachable=0 failed=1 skipped=3 rescued=0 ignored=0</span><br>2022-07-08 17:03:23.647270 | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Summary Information ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>2022-07-08 17:03:23.647907 | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Total Tasks: 1373 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</font><div><div><br></div><div><br></div><div>in the deploy.sh:</div><div><br></div><div>openstack overcloud deploy --templates \<br> -r /home/stack/templates/roles_data.yaml \<br> --networks-file /home/stack/templates/custom_network_data.yaml \<br> --vip-file /home/stack/templates/custom_vip_data.yaml \<br> --baremetal-deployment /home/stack/templates/overcloud-baremetal-deploy.yaml \<br> --network-config \<br> -e /home/stack/templates/environment.yaml \<br> -e /usr/share/openstack-tripleo-heat-templates/environments/services/ironic-conductor.yaml \<br> -e /usr/share/openstack-tripleo-heat-templates/environments/services/ironic-inspector.yaml \<br> -e /usr/share/openstack-tripleo-heat-templates/environments/services/ironic-overcloud.yaml \<br> -e /home/stack/templates/ironic-config.yaml \<br> -e /usr/share/openstack-tripleo-heat-templates/environments/external-ceph.yaml \<br> -e /usr/share/openstack-tripleo-heat-templates/environments/services/ptp.yaml \<br><span style="background-color:rgb(255,255,0)"> -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-tls.yaml \<br> -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-endpoints-public-ip.yaml \<br> -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/inject-trust-anchor.yaml \</span><br> -e /usr/share/openstack-tripleo-heat-templates/environments/docker-ha.yaml \<br> -e /usr/share/openstack-tripleo-heat-templates/environments/podman.yaml \<br> -e /home/stack/containers-prepare-parameter.yaml<br></div><div><br></div><div>Addition lines as highlighted in yellow were passed with modifications:</div><div><span style="background-color:rgb(255,255,0)">tls-endpoints-public-ip.yaml:</span><br></div><div><span style="background-color:rgb(255,255,0)">Passed as is in the defaults.</span></div><div><span style="background-color:rgb(255,255,0)">enable-tls.yaml:</span><br></div></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div># *******************************************************************<br># This file was created automatically by the sample environment<br># generator. Developers should use `tox -e genconfig` to update it.<br># Users are recommended to make changes to a copy of the file instead<br># of the original, if any customizations are needed.<br># *******************************************************************<br># title: Enable SSL on OpenStack Public Endpoints<br># description: |<br># Use this environment to pass in certificates for SSL deployments.<br># For these values to take effect, one of the tls-endpoints-*.yaml<br># environments must also be used.<br>parameter_defaults:<br> # Set CSRF_COOKIE_SECURE / SESSION_COOKIE_SECURE in Horizon<br> # Type: boolean<br> HorizonSecureCookies: True<br><br> # Specifies the default CA cert to use if TLS is used for services in the public network.<br> # Type: string<br> PublicTLSCAFile: '/etc/pki/ca-trust/source/anchors/overcloud-cacert.pem'<br><br> # The content of the SSL certificate (without Key) in PEM format.<br> # Type: string<br> SSLRootCertificate: |<br> -----BEGIN CERTIFICATE-----<br> ----*** CERTICATELINES TRIMMED **<br> -----END CERTIFICATE-----<br><br> SSLCertificate: |<br> -----BEGIN CERTIFICATE-----<br>
----*** CERTICATELINES TRIMMED **<br> -----END CERTIFICATE-----<br> # The content of an SSL intermediate CA certificate in PEM format.<br> # Type: string<br> SSLIntermediateCertificate: ''<br><br> # The content of the SSL Key in PEM format.<br> # Type: string<br> SSLKey: |<br> -----BEGIN PRIVATE KEY-----<br>
----*** CERTICATELINES TRIMMED **<br> -----END PRIVATE KEY-----<br><br> # ******************************************************<br> # Static parameters - these are values that must be<br> # included in the environment but should not be changed.<br> # ******************************************************<br> # The filepath of the certificate as it will be stored in the controller.<br> # Type: string<br> DeployedSSLCertificatePath: /etc/pki/tls/private/overcloud_endpoint.pem<br><br> # *********************<br> # End static parameters<br> # *********************<br></div></div></blockquote><div><div><span style="background-color:rgb(255,255,0)">inject-trust-anchor.yaml</span><span style="background-color:rgb(255,255,0)"><br></span></div></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div># *******************************************************************<br># This file was created automatically by the sample environment<br># generator. Developers should use `tox -e genconfig` to update it.<br># Users are recommended to make changes to a copy of the file instead<br># of the original, if any customizations are needed.<br># *******************************************************************<br># title: Inject SSL Trust Anchor on Overcloud Nodes<br># description: |<br># When using an SSL certificate signed by a CA that is not in the default<br># list of CAs, this environment allows adding a custom CA certificate to<br># the overcloud nodes.<br>parameter_defaults:<br> # The content of a CA's SSL certificate file in PEM format. This is evaluated on the client side.<br> # Mandatory. This parameter must be set by the user.<br> # Type: string<br> SSLRootCertificate: |<br> -----BEGIN CERTIFICATE-----<br>
----*** CERTICATELINES TRIMMED **<br> -----END CERTIFICATE-----<br><br>resource_registry:<br> OS::TripleO::NodeTLSCAData: ../../puppet/extraconfig/tls/ca-inject.yaml<br></div></div></blockquote><div><div><br></div><div><br></div><div><br></div><div>The procedure to create such files was followed using: </div><div><a href="https://docs.openstack.org/project-deploy-guide/tripleo-docs/latest/features/ssl.html" rel="noreferrer noreferrer" target="_blank">Deploying with SSL — TripleO 3.0.0 documentation (openstack.org)</a><br></div><div><br></div><div>Idea is to deploy overcloud with SSL enabled i.e<b> <span style="font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif;font-size:14px;color:rgb(51,51,51)">Self-signed IP-based certificate, without DNS. </span></b></div><div><span style="font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif;font-size:14px;color:rgb(51,51,51)"><br></span></div><div><span style="font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif;font-size:14px;color:rgb(51,51,51)">Any idea around this error would be of great help.</span></div><div><br></div>--<br><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div>skype: lokendrarathour</div><div dir="ltr"><img width="200" height="41" src="https://ci3.googleusercontent.com/mail-sig/AIorK4zyd6LpJOGqagxmzUlY59eMQx0-FN0t8HtjdtGE7VLZSKIxBUz3bI7z-MBqbgDVg1-XbtvHgN_ATJ10N6bonyO-JSGTtl5s_mNSbDoXBg"><br></div><div dir="ltr"><br></div></div></div></div></div></div></div>
</blockquote></div>
</blockquote></div></div>
</div>
</blockquote></div>