-
Bug
-
Resolution: Done
-
Major
-
rhos-18.0.0
-
None
-
False
-
-
False
-
?
-
glance-operator-bundle-container-1.0.0-44
-
None
-
-
-
Moderate
Setting any non zero value to OpenStackControlPlane.spec.glance.quotas fileds results in certificate errors in the glance-operator logs and Glance will not be Ready.
- lastTransitionTime: "2024-05-06T10:32:42Z" message: 'GlanceAPI error occured Get "https://keystone-public-openstack.apps-crc.testing/": tls: failed to verify certificate: x509: certificate signed by unknown authority' reason: Error severity: Warning status: "False" type: Ready
2024-05-06T10:32:42Z INFO glance-resource default {"name": "glance"} 2024-05-06T10:32:42Z INFO glance-resource validate update {"diff": " &v1beta1.Glance{\n \tTypeMeta: {Kind: \"Glance\", APIVersion: \"glance.openstack.org/v1beta1\"},\n \tObjectMeta: v1.ObjectMeta{\n \t\t... // 4 identical fields\n \t\tUID: \"f222521b-d420-4615-9030-8ce1bfb65766\",\n \t\tResourceVersion: \"57225\",\n- \t\tGeneration: 2,\n+ \t\tGeneration: 3,\n \t\tCreationTimestamp: {Time: s\"2024-05-06 10:09:39 +0000 UTC\"},\n \t\tDeletionTimestamp: nil,\n \t\t... // 3 identical fields\n \t\tOwnerReferences: {{APIVersion: \"core.openstack.org/v1beta1\", Kind: \"OpenStackControlPlane\", Name: \"openstack-galera-network-isolation\", UID: \"0f30d393-8737-40c9-a822-341d251008d2\", ...}},\n \t\tFinalizers: {\"Glance\"},\n \t\tManagedFields: []v1.ManagedFieldsEntry{\n- \t\t\t{\n- \t\t\t\tManager: \"manager\",\n- \t\t\t\tOperation: \"Update\",\n- \t\t\t\tAPIVersion: \"glance.openstack.org/v1beta1\",\n- \t\t\t\tTime: s\"2024-05-06 10:11:20 +0000 UTC\",\n- \t\t\t\tFieldsType: \"FieldsV1\",\n- \t\t\t\tFieldsV1: s`{\"f:metadata\":{\"f:finalizers\":{\".\":{},\"v:\\\"Glance\\\"\":{}},\"f:ownerReferences\":{\".\":{},\"k:{\\\"uid\\\":\\\"0f30d393-8737-40c9-a822-341d2`...,\n- \t\t\t},\n \t\t\t{Manager: \"manager\", Operation: \"Update\", APIVersion: \"glance.openstack.org/v1beta1\", Time: s\"2024-05-06 10:12:15 +0000 UTC\", ...},\n+ \t\t\t{\n+ \t\t\t\tManager: \"manager\",\n+ \t\t\t\tOperation: \"Update\",\n+ \t\t\t\tAPIVersion: \"glance.openstack.org/v1beta1\",\n+ \t\t\t\tTime: s\"2024-05-06 10:32:42 +0000 UTC\",\n+ \t\t\t\tFieldsType: \"FieldsV1\",\n+ \t\t\t\tFieldsV1: s`{\"f:metadata\":{\"f:finalizers\":{\".\":{},\"v:\\\"Glance\\\"\":{}},\"f:ownerReferences\":{\".\":{},\"k:{\\\"uid\\\":\\\"0f30d393-8737-40c9-a822-341d2`...,\n+ \t\t\t},\n \t\t},\n \t},\n \tSpec: v1beta1.GlanceSpec{\n \t\tContainerImage: \"quay.io/podified-antelope-centos9/openstack-glance-api@sha256:58\"...,\n \t\tGlanceSpecCore: v1beta1.GlanceSpecCore{\n \t\t\t... // 12 identical fields\n \t\t\tGlanceAPIs: {\"default\": {Replicas: &1, ContainerImage: \"quay.io/podified-antelope-centos9/openstack-glance-api@sha256:58\"..., NetworkAttachments: {\"storage\"}, Override: {Service: {\"internal\": {OverrideSpec: {EmbeddedLabelsAnnotations: &{Labels: {\"osctlplane\": \"\", \"osctlplane-service\": \"glance\", \"tlGlanceAPI\": \"glance-default-single\"}, Annotations: {\"metallb.universe.tf/address-pool\": \"internalapi\", \"metallb.universe.tf/allow-shared-ip\": \"internalapi\", \"metallb.universe.tf/loadBalancerIPs\": \"172.17.0.80\"}}, Spec: &{Type: \"LoadBalancer\"}}}, \"public\": {OverrideSpec: {EmbeddedLabelsAnnotations: &{Labels: {\"osctlplane\": \"\", \"osctlplane-service\": \"glance\", \"tlGlanceAPI\": \"glance-default-single\"}}}, EndpointURL: &\"https://glance-default-public-openstack.apps-crc.testing\"}}}, ...}},\n \t\t\tExtraMounts: nil,\n \t\t\tQuotas: v1beta1.QuotaLimits{\n \t\t\t\tImageSizeTotal: 0,\n \t\t\t\tImageStageTotal: 0,\n- \t\t\t\tImageCountTotal: 0,\n+ \t\t\t\tImageCountTotal: 15,\n \t\t\t\tImageCountUpload: 0,\n \t\t\t},\n \t\t\tImageCache: {},\n \t\t\tKeystoneEndpoint: \"default\",\n \t\t\tDBPurge: {Age: 30, Schedule: \"1 0 * * *\"},\n \t\t},\n \t},\n \tStatus: {Hash: {\"dbsync\": \"n59fh87h5bh568h69h64dh5fbh5d9h79h64ch546h564h65hddhf5h569h67dh5d\"...}, APIEndpoints: {\"default-internal\": \"https://glance-default-internal.openstack.svc:9292\", \"default-public\": \"https://glance-default-public-openstack.apps-crc.testing\"}, ServiceID: \"3673354dff274135b7196400716a0376\", Conditions: {{Type: \"Ready\", Status: \"True\", LastTransitionTime: {Time: s\"2024-05-06 10:12:15 +0000 UTC\"}, Reason: \"Ready\", ...}, {Type: \"CronJobReady\", Status: \"True\", LastTransitionTime: {Time: s\"2024-05-06 10:10:57 +0000 UTC\"}, Reason: \"Ready\", ...}, {Type: \"DBReady\", Status: \"True\", LastTransitionTime: {Time: s\"2024-05-06 10:10:35 +0000 UTC\"}, Reason: \"Ready\", ...}, {Type: \"DBSyncReady\", Status: \"True\", LastTransitionTime: {Time: s\"2024-05-06 10:10:57 +0000 UTC\"}, Reason: \"Ready\", ...}, ...}, ...},\n }\n"} 2024-05-06T10:32:42Z INFO controllers.Glance Reconciling Service 'glance' 2024-05-06T10:32:42Z INFO controllers.Glance Successfully ensured MariaDBAccount glance exists; database username is glance_de5e {"ObjectType": "*v1beta1.MariaDBAccount", "ObjectNamespace": "openstack", "ObjectName": "glance"} 2024-05-06T10:32:42Z INFO controllers.Glance Applied new databasehostname openstack.openstack.svc to MariaDBDatabase glance 2024-05-06T10:32:42Z INFO controllers.Glance Reconciling Service 'glance' init 2024-05-06T10:32:42Z INFO controllers.Glance Reconciled Service 'glance' init successfully 2024-05-06T10:32:42Z ERROR Reconciler error {"controller": "glance", "controllerGroup": "glance.openstack.org", "controllerKind": "Glance", "Glance": {"name":"glance","namespace":"openstack"}, "namespace": "openstack", "name": "glance", "reconcileID": "d8220468-0183-4a94-b91d-4535f5ac892a", "error": "Get \"https://keystone-public-openstack.apps-crc.testing/\": tls: failed to verify certificate: x509: certificate signed by unknown authority"} sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler /opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.5/pkg/internal/controller/controller.go:329 sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem /opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.5/pkg/internal/controller/controller.go:266 sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2 /opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.5/pkg/internal/controller/controller.go:227
I guess this is broken since we enabled TLS. Based on the keystone code we need to pass tlsconfig to the client https://github.com/openstack-k8s-operators/keystone-operator/blob/7e1e3b111ee9f16b5354d3b7c923267d36228842/api/v1beta1/keystoneapi.go#L143
- is depended on by
-
OSPRH-1373 Enable Unified Keystone Quotas support in Glance operator
-
- Closed
-
- relates to
-
OSPRH-6259 Cleaning services fails when internal TLS is enabled
-
- Closed
-
- links to
- mentioned on