Drop the empty octavia certificate placeholders - #877
Merged
Merged
Conversation
The template shipped four zero-byte files under environments/kolla/files/overlays/octavia/: client.cert-and-key.pem client_ca.cert.pem server_ca.cert.pem server_ca.key.pem These are the amphora certificates. The deploy guide already documents generating them, with octavia-certificates and copy-octavia-certificates run as part of bringing Octavia up, so the procedure is not the gap. The placeholders are. Empty files are worse than absent ones, because Kolla already guards this. Its octavia precheck stats each of the four names and fails when one does not exist, which is a clear failure at the right time. A zero-byte file satisfies that stat, so the precheck passes, the empty PEMs are copied into the service configuration, and Octavia instead fails much later at first use with CertificateGenerationException: Unable to load PEM file leaving every load balancer in ERROR. So the placeholders turned off the one check that catches a skipped or misordered cert step, and turned a loud early failure into a quiet late one. Remove them so the precheck fires again, and leave a .gitkeep in their place carrying the explanation: what the four files are, why they are not shipped, the two commands, a pointer to the deploy guide, and the secret the CA is keyed to. It is not one of the names Kolla looks for, so it does not re-create the problem. The file is load-bearing rather than decorative, which is why it is a .gitkeep and not a README. copy-octavia-certificates installs the certificates with docker cp, which creates the files but not the directory holding them, and git carries no empty directory -- so removing this file removes the directory and the copy fails on a missing path. .gitkeep is the name that says "this directory has to exist", it is already used that way elsewhere in this template (environments/kolla/certificates/ca/), and it is far less likely to be tidied away than a README. Assisted-by: Claude:claude-opus-5 Signed-off-by: Roger Luethi <luethi@osism.tech>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The template shipped four zero-byte files under
environments/kolla/files/overlays/octavia/:client.cert-and-key.pem,client_ca.cert.pem,server_ca.cert.pem,server_ca.key.pem.These are the amphora certificates. The deploy guide already documents generating them, with
octavia-certificatesandcopy-octavia-certificatesrun as part of bringing Octavia up, so the procedure is not the gap. The placeholders are.Empty files are worse than absent ones, because Kolla already guards this. Its octavia precheck stats each of the four names and fails when one does not exist — a clear failure at the right time. A zero-byte file satisfies that stat, so the precheck passes, the unusable files are copied into the service configuration, and Octavia instead fails much later at first use with
CertificateGenerationException: Unable to load PEM file, leaving every load balancer inERROR. The placeholders turned off the one check that catches a skipped or misordered cert step.Removing them lets the precheck fire again. A
.gitkeeptakes their place carrying the explanation: what the four files are, why they are not shipped, the two commands, a pointer to the deploy guide, and the secret the CA is keyed to. It is not one of the names Kolla looks for, so it does not re-create the problem.It is a
.gitkeeprather than a README because the file is load-bearing: the certificates are installed into this directory rather than committed, so it has to exist beforehand, and git carries no empty directory..gitkeepis the name that says that, is already used that way elsewhere in this template (environments/kolla/certificates/ca/), and is less likely to be tidied away.Related, in another repository — the play that installs the certificates does not create its own target directory, which is what makes a marker file necessary here at all:
Neither change depends on the other. Repositories generated before this one keep the directory via the placeholders; repositories generated after it get the
.gitkeep. Landing the playbook change first simply means this file is documentation rather than the only thing holding the directory open.🤖 Generated with Claude Code