openstack/ironic-python-agent-builder
Code Issues Proposed changes
9032aad2d3
ironic-python-agent-builder/dib/ironic-python-agent-tls
History
Jay Faulkner 0cc5ba8d72 Advertise HTTPS in IPA ramdisk without Ironic assist 
Before this change, Ironic was required to send
`ipa-advertise-protocol=https` with pxe parameters to make this
code work.

Instead, ensure we *always* advertise https, via static ramdisk
configuration, when TLS is enabled.

Change-Id: I1c0bc85aefe592a2a614f60112a8982e0f03fcf7
2020-09-18 09:36:56 -07:00
..
pre-finalise.d Advertise HTTPS in IPA ramdisk without Ironic assist 2020-09-18 09:36:56 -07:00
element-deps Followups for TLS support 2020-09-09 15:55:02 -07:00
README.rst Add element to configure IPA with TLS, use configdir 2020-09-08 20:40:19 +00:00

README.rst

ironic-python-agent-tls

Adds TLS support to ironic-python-agent-ramdisk.

If enabled without any environment variables set to modify configuration, this element will enable TLS API support in IPA with a self-signed certificate and key created at build time.

Optionally, you can provide your own SSL certifiate and key, and optionally ca, via the following environment variables. They should be set to an accessible path on the build systems filesystem. If set, they will be copied into the built ramdisk, and IPA will be configured to use them.

The environment variables are:
  • DIB_IPA_CERT_FILE should point to the TLS certificate for ramdisk use.
  • DIB_IPA_KEY_FILE should point to the private key matching DIB_IPA_CERT_FILE.
If having a certificate generated, you can configure how it's generated:
  • DIB_IPA_CERT_HOSTNAME the CN for the generated certificate. Defaults to "ipa-ramdisk.example.com".
  • DIB_IPA_CERT_EXPIRATION expiration, in days, for the certificate.

    Defaults to 1095 (three years).

Note that the certificates generated by this element are self-signed, and any nodes using them will need to set agent_verify_ca=False in driver_info.

This element can also configure client certificate validation in IPA. If you wish to validate client certificates, set DIB_IPA_CA_FILE to a CA file you wish IPA client connections to be validated against. This CA file will be copied into the built ramdisk, and IPA will be configured to use it.