Add doc about rolling back from https to http - #2513
Conversation
📝 WalkthroughAdded documentation for rolling back OpenBao TLS from HTTPS to HTTP. The procedure disables external, internal, and backend TLS, redeploys services, removes TLS-related HAProxy rules, and restarts HAProxy. WalkthroughThe OpenBao configuration guide now documents how to revert HTTPS to HTTP. The procedure covers Kolla TLS settings, service redeployment, controller HAProxy configuration, and HAProxy restart actions. ChangesOpenBao HTTP rollback
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: 🟡 Moderate · up to The rollback guide may leave clients pointed at HTTPS endpoints after services return to HTTP, causing connectivity failures, and it does not clearly identify configuration files or the scope of RabbitMQ and HAProxy changes. These gaps should be addressed or explicitly accepted before merging. 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: de17fe65-df2b-4155-9071-e9de8b054af5
📒 Files selected for processing (1)
doc/source/configuration/openbao.rst
📜 Review details
⏰ Context from checks skipped due to timeout. (5)
- GitHub Check: stackhpc/check
- GitHub Check: Ansible 2.19 lint with Python 3.12
- GitHub Check: Ansible 2.20 lint with Python 3.12
- GitHub Check: Tox docs with Python 3.12
- GitHub Check: Tox releasenotes with Python 3.12
🔇 Additional comments (3)
doc/source/configuration/openbao.rst (3)
463-464: LGTM!
466-473: 🗄️ Data Integrity & IntegrationState whether RabbitMQ TLS is included in this rollback.
The enablement procedure sets
rabbitmq_enable_tls: "yes"at Lines [432-433], but this block disables only the three API/backend flags. If this section rolls back all TLS settings, also setrabbitmq_enable_tls: false; otherwise state that RabbitMQ TLS remains enabled.
475-485: 🩺 Stability & AvailabilityConfirm the HAProxy rollback source and scope.
Determine whether
neutron-tls-proxy.cfgandglance-tls-proxy.cfgare generated by Kayobe or Kolla. If they are generated, remove the source configuration and reconfigure HAProxy on every controller instead of deleting files on one controller. Document the expected interruption.
| If the system needs a roll back from HTTPS to HTTP, you can set variable for each TLS to false | ||
| then re run ``kayobe overcloud service deploy``. | ||
|
|
||
| .. code-block:: | ||
|
|
||
| kolla_enable_tls_external: false | ||
| kolla_enable_tls_internal: false | ||
| kolla_enable_tls_backend: false |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Name the configuration files for the rollback variables.
Earlier steps place kolla_enable_tls_external and kolla_enable_tls_internal in etc/kayobe/kolla.yml, and kolla_enable_tls_backend in etc/kayobe/kolla/globals.yml, with environment-specific alternatives. This step only says “set variable”. Add the exact paths to prevent a partial rollback.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Reconfigure the endpoint catalogue and clients to use HTTP.
The warning at Lines [389-393] states that changing the API protocol requires endpoint catalogue and client reconfiguration. This rollback only changes Kolla TLS flags. Add the reverse endpoint and client changes before or as part of kayobe overcloud service deploy; otherwise clients can continue to call https:// endpoints after services return to HTTP.
1 participant
No description provided.