Attachment 1474127 Details for Bug 1613576 – Internal TLS patch for Octavia

[patch] Internal TLS patch for Octavia

octavia_internal_tls.patch (text/plain), 6.61 KB, created by Kellen Gattis on 2018-08-07 23:25:10 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kellen Gattis

Created: 2018-08-07 23:25:10 UTC

Size: 6.61 KB

patch

obsolete

>diff -Naur a/openstack-puppet/modules/tripleo/manifests/haproxy.pp b/openstack-puppet/modules/tripleo/manifests/haproxy.pp
>--- a/openstack-puppet/modules/tripleo/manifests/haproxy.pp	2018-07-30 17:11:46.483863541 -0400
>+++ b/openstack-puppet/modules/tripleo/manifests/haproxy.pp	2018-08-02 12:59:36.692863541 -0400
>@@ -1502,6 +1502,7 @@
>       server_names      => hiera('octavia_api_node_names'),
>       public_ssl_port   => $ports[octavia_api_ssl_port],
>       service_network   => $octavia_network,
>+      member_options  => union($haproxy_member_options, $internal_tls_member_options),
>     }
>   }
> 
>diff -Naur a/openstack-puppet/modules/tripleo/manifests/profile/base/octavia/api.pp b/openstack-puppet/modules/tripleo/manifests/profile/base/octavia/api.pp
>--- a/openstack-puppet/modules/tripleo/manifests/profile/base/octavia/api.pp	2018-04-23 13:07:52.000000000 -0400
>+++ b/openstack-puppet/modules/tripleo/manifests/profile/base/octavia/api.pp	2018-08-02 12:55:31.227863541 -0400
>@@ -22,14 +22,56 @@
> #   (Optional) The hostname of the node responsible for bootstrapping tasks
> #   Defaults to hiera('bootstrap_nodeid')
> #
>+# [*certificates_specs*]
>+#   (Optional) The specifications to give to certmonger for the certificate(s)
>+#   it will create.
>+#   Example with hiera:
>+#     apache_certificates_specs:
>+#       httpd-internal_api:
>+#         hostname: <overcloud controller fqdn>
>+#         service_certificate: <service certificate path>
>+#         service_key: <service key path>
>+#         principal: "haproxy/<overcloud controller fqdn>"
>+#   Defaults to hiera('apache_certificate_specs', {}).
>+#
>+# [*enable_internal_tls*]
>+#   (Optional) Whether TLS in the internal network is enabled or not.
>+#   Defaults to hiera('enable_internal_tls', false)
>+#
>+# [*octavia_network*]
>+#   (Optional) The network name where the octavia endpoint is listening on.
>+#   This is set by t-h-t.
>+#   Defaults to hiera('octavia_api_network', undef)
>+#
> # [*step*]
> #   (Optional) The current step in deployment. See tripleo-heat-templates
> #   for more details.
> #   Defaults to hiera('step')
> #
>+# [*tls_proxy_bind_ip*]
>+#   IP on which the TLS proxy will listen on. Required only if
>+#   enable_internal_tls is set.
>+#   Defaults to undef
>+#
>+# [*tls_proxy_fqdn*]
>+#   fqdn on which the tls proxy will listen on. required only used if
>+#   enable_internal_tls is set.
>+#   defaults to undef
>+#
>+# [*tls_proxy_port*]
>+#   port on which the tls proxy will listen on. Only used if
>+#   enable_internal_tls is set.
>+#   defaults to 9876
>+#
> class tripleo::profile::base::octavia::api (
>   $bootstrap_node = hiera('bootstrap_nodeid', undef),
>+  $certificates_specs            = hiera('apache_certificates_specs', {}),
>+  $enable_internal_tls           = hiera('enable_internal_tls', false),
>+  $octavia_network               = hiera('octavia_api_network', undef),
>   $step           = Integer(hiera('step')),
>+  $tls_proxy_bind_ip             = undef,
>+  $tls_proxy_fqdn                = undef,
>+  $tls_proxy_port                = 9876,
> ) {
>   if $::hostname == downcase($bootstrap_node) {
>     $sync_db = true
>@@ -39,6 +81,25 @@
> 
>   include ::tripleo::profile::base::octavia
> 
>+  if $step >= 4 or ($step >= 3 and $sync_db) {
>+    if $enable_internal_tls {
>+      if !$octavia_network {
>+        fail('octavia_api_network is not set in the hieradata.')
>+      }
>+      $tls_certfile = $certificates_specs["httpd-${octavia_network}"]['service_certificate']
>+      $tls_keyfile = $certificates_specs["httpd-${octavia_network}"]['service_key']
>+
>+      ::tripleo::tls_proxy { 'octavia-api':
>+        servername => $tls_proxy_fqdn,
>+        ip         => $tls_proxy_bind_ip,
>+        port       => $tls_proxy_port,
>+        tls_cert   => $tls_certfile,
>+        tls_key    => $tls_keyfile,
>+        notify     => Class['::octavia::api'],
>+      }
>+    }
>+  }
>+
>   # We start the Octavia API server on the bootstrap node first, because
>   # it will try to populate tables and we need to make sure this happens
>   # before it starts on other nodes
>diff -Naur a/openstack-tripleo-heat-templates/puppet/services/octavia-api.yaml b/openstack-tripleo-heat-templates/puppet/services/octavia-api.yaml
>--- a/openstack-tripleo-heat-templates/puppet/services/octavia-api.yaml	2018-06-20 09:30:34.000000000 -0400
>+++ b/openstack-tripleo-heat-templates/puppet/services/octavia-api.yaml	2018-08-02 15:55:57.309863541 -0400
>@@ -60,11 +60,17 @@
>       e.g. { octavia-context_is_admin: { key: context_is_admin, value: 'role:admin' } }
>     default: {}
>     type: json
>+  EnableInternalTLS:
>+    type: boolean
>+    default: false
>+
>+conditions:
>+  use_tls_proxy: {equals : [{get_param: EnableInternalTLS}, true]}
> 
> resources:
> 
>-  OctaviaBase:
>-    type: ./octavia-base.yaml
>+  TLSProxyBase:
>+    type: OS::TripleO::Services::TLSProxyBase
>     properties:
>       ServiceData: {get_param: ServiceData}
>       ServiceNetMap: {get_param: ServiceNetMap}
>@@ -72,6 +78,7 @@
>       EndpointMap: {get_param: EndpointMap}
>       RoleName: {get_param: RoleName}
>       RoleParameters: {get_param: RoleParameters}
>+      EnableInternalTLS: {get_param: EnableInternalTLS}
> 
> outputs:
>   role_data:
>@@ -81,7 +88,7 @@
>       monitoring_subscription: {get_param: MonitoringSubscriptionOctaviaApi}
>       config_settings:
>         map_merge:
>-          - get_attr: [OctaviaBase, role_data, config_settings]
>+          - get_attr: [TLSProxyBase, role_data, config_settings]
>           - octavia::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri] }
>             octavia::policy::policies: {get_param: OctaviaApiPolicies}
>             octavia::db::database_connection:
>@@ -103,7 +110,23 @@
>                 dport:
>                   - 9876
>                   - 13876
>-            octavia::api::host: {get_param: [ServiceNetMap, OctaviaApiNetwork]}
>+            tripleo::profile::base::octavia::api::tls_proxy_bind_ip:
>+              get_param: [ServiceNetMap, OctaviaApiNetwork]
>+            tripleo::profile::base::octavia::api::tls_proxy_fqdn:
>+              str_replace:
>+                template:
>+                  "%{hiera('fqdn_$NETWORK')}"
>+                params:
>+                  $NETWORK: {get_param: [ServiceNetMap, OctaviaApiNetwork]}
>+            tripleo::profile::base::octavia::api::tls_proxy_port:
>+              get_param: [EndpointMap, OctaviaInternal, port]
>+            # Bind to localhost if internal TLS is enabled, since we put a TLs
>+            # proxy in front.
>+            octavia::api::host:
>+              if:
>+              - use_tls_proxy
>+              - '127.0.0.1'
>+              - {get_param: [ServiceNetMap, OctaviaApiNetwork]}
>       step_config: |
>         include tripleo::profile::base::octavia::api
>       service_config_settings:

Actions: View | Diff

Attachments on bug 1613576: 1474127