33 lines
1.5 KiB
ReStructuredText
33 lines
1.5 KiB
ReStructuredText
|
=======================
|
||
|
|
ironic-python-agent-tls
|
||
|
|
=======================
|
||
|
|
Adds TLS support to ironic-python-agent-ramdisk.
|
||
|
|
|
||
|
|
If enabled without any environment variables set to modify configuration,
|
||
|
|
this element will enable TLS API support in IPA with a self-signed certificate
|
||
|
|
and key created at build time.
|
||
|
|
|
||
|
|
Optionally, you can provide your own SSL certifiate and key, and optionally
|
||
|
|
ca, via the following environment variables. They should be set to an
|
||
|
|
accessible path on the build systems filesystem. If set, they will be copied
|
||
|
|
into the built ramdisk, and IPA will be configured to use them.
|
||
|
|
|
||
|
|
The environment variables are:
|
||
|
|
- ``DIB_IPA_CERT_FILE`` should point to the TLS certificate for ramdisk use.
|
||
|
|
- ``DIB_IPA_KEY_FILE`` should point to the private key matching
|
||
|
|
``DIB_IPA_CERT_FILE``.
|
||
|
|
|
||
|
|
If having a certificate generated, you can configure how it's generated:
|
||
|
|
- ``DIB_IPA_CERT_HOSTNAME`` the CN for the generated
|
||
|
|
certificate. Defaults to "ipa-ramdisk.example.com".
|
||
|
|
- ``DIB_IPA_CERT_EXPIRATION`` expiration, in days, for the certificate.
|
||
|
|
Defaults to 1095 (three years).
|
||
|
|
|
||
|
|
Note that the certificates generated by this element are self-signed, and
|
||
|
|
any nodes using them will need to set agent_verify_ca=False in driver_info.
|
||
|
|
|
||
|
|
This element can also configure client certificate validation in IPA. If you
|
||
|
|
wish to validate client certificates, set ``DIB_IPA_CA_FILE`` to a CA file
|
||
|
|
you wish IPA client connections to be validated against. This CA file will
|
||
|
|
be copied into the built ramdisk, and IPA will be configured to use it.
|