Merge "Make sure IPA has the right ACI" into stable/train

deployment/etcd/etcd-container-puppet.yaml

@@ -205,11 +205,25 @@ outputs:
             - /var/lib/config-data/etcd/etc/etcd/:/etc/etcd:ro
             - /var/lib/etcd:/var/lib/etcd:ro
       host_prep_tasks:
-        - name: create /var/lib/etcd
-          file:
-            path: /var/lib/etcd
-            state: directory
-            setype: svirt_sandbox_file_t
+        list_concat:
+          -
+            - name: create /var/lib/etcd
+              file:
+                path: /var/lib/etcd
+                state: directory
+                setype: svirt_sandbox_file_t
+          -
+            if:
+              - internal_tls_enabled
+              -
+                - name: check if ipa server has required permissions
+                  import_role:
+                    name: tls_everywhere
+                    tasks_from: ipa-server-check
+                  tags:
+                    - opendev-validation
+                    - opendev-validation-tls-everywhere
+              - null
       upgrade_tasks: []
       metadata_settings:
         if: