There are two tls issues currently in neutron:
A) neutron_api is doing bind mounting tls certs directly from the host and then chowning them from then container.
"Source": "/etc/pki/tls/private/ovn_neutron_client.key",
"Destination": "/etc/pki/tls/private/ovn_neutron_client.key",
"Source": "/etc/pki/tls/certs/ovn_neutron_client.crt",
"Destination": "/etc/pki/tls/certs/ovn_neutron_client.crt",
And then it thinks it can chown it inside the container via the kolla script:
[root@controller-0 stdouts]# more /var/lib/kolla/config_files/neutron_api.json
...
{
"optional": true,
"owner": "neutron:neutron",
"path": "/etc/pki/tls/certs/ovn_neutron_client.crt",
"perm": "0644"
},
{
"optional": true,
"owner": "neutron:neutron",
"path": "/etc/pki/tls/private/ovn_neutron_client.key",
"perm": "0644"
}
What needs to happen here is that we drop the bind mounts, and copy in the certs via kolla and put them in /var/lib/config-data/puppet-generated/...... Just like galera is doing.
This typically breaks the updating of the certs, but that is currently not working for neutron_ovn anyway since the cert has no post-command in certmonger:
Request ID 'neutron_ovn':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/etc/pki/tls/private/ovn_neutron_client.key'
certificate: type=FILE,location='/etc/pki/tls/certs/ovn_neutron_client.crt'
CA: IPA
issuer: CN=Certificate Authority,O=REDHAT.LOCAL
subject: CN=controller-1.internalapi.redhat.local,O=REDHAT.LOCAL
expires: 2021-11-14 15:44:20 UTC
dns: controller-1.internalapi.redhat.local
principal name: <email address hidden>
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command:
track: yes
auto-renew: yes
Also fun fact, it would not even work with bind mounts because a new cert would create a new inode and when you bind mount a single file and change the inode on the host the container will not see any changes at all.
B) The logging in the neutron_server_tls_proxy container is not persisted to the host
Fix proposed to branch: master
Review: https:/