Skip to content

Add doc about rolling back from https to http #2513

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
seunghun1ee wants to merge 1 commit into
base: stackhpc/2026.1
Choose a base branch
from
Open

Add doc about rolling back from https to http #2513

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions doc/source/configuration/openbao.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -460,6 +460,30 @@ Enable the required TLS variables in kayobe and kolla

kayobe overcloud host command run --command "systemctl restart kolla-nova_compute-container.service" --become --show-output -l compute

Rolling back to HTTP
--------------------

If the system needs a roll back from HTTPS to HTTP, you can set variable for each TLS to false
then re run ``kayobe overcloud service deploy``.

.. code-block::

kolla_enable_tls_external: false
kolla_enable_tls_internal: false
kolla_enable_tls_backend: false
Comment on lines +466 to +473

@coderabbitai coderabbitai Bot Aug 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Name the configuration files for the rollback variables.

Earlier steps place kolla_enable_tls_external and kolla_enable_tls_internal in etc/kayobe/kolla.yml, and kolla_enable_tls_backend in etc/kayobe/kolla/globals.yml, with environment-specific alternatives. This step only says “set variable”. Add the exact paths to prevent a partial rollback.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Reconfigure the endpoint catalogue and clients to use HTTP.

The warning at Lines [389-393] states that changing the API protocol requires endpoint catalogue and client reconfiguration. This rollback only changes Kolla TLS flags. Add the reverse endpoint and client changes before or as part of kayobe overcloud service deploy; otherwise clients can continue to call https:// endpoints after services return to HTTP.


Once the role back is done, you may need to delete TLS related HAProxy rules at controller hosts.

.. code-block::

# From controller hosts, remove TLS related HAProxy rules
cd /etc/kolla/haproxy/services.d
rm neutron-tls-proxy.cfg
rm glance-tls-proxy.cfg

# Then restart HAProxy
systemctl restart kolla-haproxy-container

Pulp TLS
========

Expand Down
Loading