Hello, I've verified that the current -proposed package fixes the issue for us, for the given use case.
Using the following deployment bundle on a Bionic + Rocky cloud http://paste.ubuntu.com/p/jnVdVvQg7k/ Without the patch, the problem is reproduced as expressed on the case description: ubuntu@niedbalski-bastion:~/stsstack-bundles/openstack/00268110$ openstack secret container create --type='certificate' --name "test- tls-1" --secret="certificate=https://10.5.0.11:9312/v1/secrets/7aa7727d- f39b-45f8-9310-f5c595ad4feb" --secret="private_key=https://10.5.0.11:9312/v1/secrets/189736d1-51d8-4cbe-9638-ceadcbb664ac"; --secret="intermediates=https://10.5.0.11:9312/v1/secrets/70e2cf9c-8110-4d25-a1e3-f7b6f3950e64"; ubuntu@niedbalski-bastion:~/stsstack-bundles/openstack/00268110$ openstack loadbalancer listener create --protocol-port 443 --protocol "TERMINATED_HTTPS" --name "test-listener" --default-tls-container="https://10.5.0.11:9312/v1/containers/b548ab63-474d-4a94-b121-4eae8193fcc1"; -- lb1 The PKCS12 bundle is unreadable. Please check the PKCS12 bundle validity. In addition, make sure it does not require a pass phrase. Error: [('asn1 encoding routines', 'asn1_d2i_read_bio', 'not enough data')] (HTTP 400) (Request-ID: req-c79fbcb1-06d8-47e4-9754-8066596ba262) With the patch applied in the following version: root@juju-be44b9-barbican-10:/home/ubuntu# dpkg -l |grep barbican ii python3-barbicanclient 4.6.0-0ubuntu1.1 all OpenStack Key Management API client - Python 3.x | https://10.5.0.11:9312/v1/containers/bd67d6f4-3a82-4a86-9679-c97a66ceeb19 | None | 2020-05-12T21:37:32+00:00 | ACTIVE | certificate | certificate=https://10.5.0.11:9312/v1/secrets/26ed5706-5f0a-4f9f-b226-e8595031515e | None | | | | | | | private_key=https://10.5.0.11:9312/v1/secrets/9a3bd926-6ba9-46be-8168-6b5e79e09b36 | | +---------------------------------------------------------------------------+----------------+---------------------------+--------+-------------+--------------------------------------------------------------------------------------+-----------+ The issue isn't longer reproducible and listeners can be created. ubuntu@niedbalski-bastion:~/stsstack-bundles/openstack/00268110$ openstack loadbalancer listener create --protocol-port 443 --protocol "TERMINATED_HTTPS" --name "test-listener-2" --default-tls-container="https://10.5.0.11:9312/v1/containers/bd67d6f4-3a82-4a86-9679-c97a66ceeb19"; -- lb2 +-----------------------------+---------------------------------------------------------------------------+ | Field | Value | +-----------------------------+---------------------------------------------------------------------------+ | admin_state_up | True | | connection_limit | -1 | | created_at | 2020-05-12T21:38:28 | | default_pool_id | None | | default_tls_container_ref | https://10.5.0.11:9312/v1/containers/bd67d6f4-3a82-4a86-9679-c97a66ceeb19 | | description | | | id | 971a679d-4a07-4012-8552-fac8f0f450ab | | insert_headers | None | | l7policies | | | loadbalancers | 9a49ae4e-4bae-451d-bcec-b22dadf1df29 | | name | test-listener-2 | | operating_status | OFFLINE | | project_id | 2ab451be592d468bad963a95a342e099 | | protocol | TERMINATED_HTTPS | | protocol_port | 443 | | provisioning_status | PENDING_CREATE | | sni_container_refs | [] | | timeout_client_data | 50000 | | timeout_member_connect | 5000 | | timeout_member_data | 50000 | | timeout_tcp_inspect | 0 | | updated_at | None | | client_ca_tls_container_ref | | | client_authentication | | | client_crl_container_ref | | | allowed_cidrs | | +-----------------------------+---------------------------------------------------------------------------+ ubuntu@niedbalski-bastion:~/stsstack-bundles/openstack/00268110$ openstack loadbalancer listener show 971a679d-4a07-4012-8552-fac8f0f450ab | grep tls | default_tls_container_ref | https://10.5.0.11:9312/v1/containers/bd67d6f4-3a82-4a86-9679-c97a66ceeb19 | | client_ca_tls_container_ref | | ubuntu@niedbalski-bastion:~/stsstack-bundles/openstack/00268110$ openstack loadbalancer listener show 971a679d-4a07-4012-8552-fac8f0f450ab | grep -i provis | provisioning_status | ACTIVE | Therefore, I am marking this verification as completed. Thanks for the help on this. ** Tags removed: verification-needed verification-needed-bionic ** Tags added: verification-done verification-done-bionic -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1867676 Title: Fetching by secret container doesn't raises 404 exception To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1867676/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
