From 400c5a9f18325fd4dccb3e621fefd24d4e9a1d7b Mon Sep 17 00:00:00 2001 From: Martin Chlumsky Date: Wed, 10 Mar 2021 21:58:02 -0500 Subject: [PATCH] Switch octavia-api to wsgi running under apache. This change also adds support for Octavia backend TLS. Closes-Bug: #1874228 Depends-On: https://review.opendev.org/c/openstack/kolla/+/779892 Change-Id: I5ff84aec4cdbc15f6a797391815243821dbdbd67 --- .../conf/filter/01-rewrite-0.12.conf.j2 | 2 +- .../conf/filter/01-rewrite-0.14.conf.j2 | 2 +- ansible/roles/octavia/defaults/main.yml | 11 ++++- ansible/roles/octavia/tasks/config.yml | 20 ++++++++- .../octavia/templates/octavia-api.json.j2 | 31 +++++++++++-- .../octavia/templates/octavia-wsgi.conf.j2 | 43 +++++++++++++++++++ .../roles/octavia/templates/octavia.conf.j2 | 3 ++ .../octavia-api-wsgi-cafa913364cb491c.yaml | 9 ++++ 8 files changed, 114 insertions(+), 7 deletions(-) create mode 100644 ansible/roles/octavia/templates/octavia-wsgi.conf.j2 create mode 100644 releasenotes/notes/octavia-api-wsgi-cafa913364cb491c.yaml diff --git a/ansible/roles/common/templates/conf/filter/01-rewrite-0.12.conf.j2 b/ansible/roles/common/templates/conf/filter/01-rewrite-0.12.conf.j2 index 1c607c8ad6..473b7a692c 100644 --- a/ansible/roles/common/templates/conf/filter/01-rewrite-0.12.conf.j2 +++ b/ansible/roles/common/templates/conf/filter/01-rewrite-0.12.conf.j2 @@ -1,7 +1,7 @@ @type rewrite_tag_filter capitalize_regex_backreference yes - rewriterule1 programname ^(cinder-api-access|cloudkitty-api-access|gnocchi-api-access|horizon-access|keystone-apache-admin-access|keystone-apache-public-access|monasca-api-access|placement-api-access|panko-api-access)$ apache_access + rewriterule1 programname ^(cinder-api-access|cloudkitty-api-access|gnocchi-api-access|horizon-access|keystone-apache-admin-access|keystone-apache-public-access|monasca-api-access|octavia-api-access|placement-api-access|panko-api-access)$ apache_access rewriterule2 programname ^(aodh_wsgi_access|barbican_api_uwsgi_access|zun_api_wsgi_access|vitrage_wsgi_access)$ wsgi_access rewriterule3 programname ^(nova-api|nova-compute|nova-compute-ironic|nova-conductor|nova-manage|nova-novncproxy|nova-scheduler|nova-placement-api|placement-api|privsep-helper)$ openstack_python rewriterule4 programname ^(sahara-api|sahara-engine)$ openstack_python diff --git a/ansible/roles/common/templates/conf/filter/01-rewrite-0.14.conf.j2 b/ansible/roles/common/templates/conf/filter/01-rewrite-0.14.conf.j2 index 8ba4468ce4..4337b877f2 100644 --- a/ansible/roles/common/templates/conf/filter/01-rewrite-0.14.conf.j2 +++ b/ansible/roles/common/templates/conf/filter/01-rewrite-0.14.conf.j2 @@ -3,7 +3,7 @@ capitalize_regex_backreference yes key programname - pattern ^(cinder-api-access|cloudkitty-api-access|gnocchi-api-access|horizon-access|keystone-apache-admin-access|keystone-apache-public-access|monasca-api-access|placement-api-access|panko-api-access)$ + pattern ^(cinder-api-access|cloudkitty-api-access|gnocchi-api-access|horizon-access|keystone-apache-admin-access|keystone-apache-public-access|monasca-api-access|octavia-api-access|placement-api-access|panko-api-access)$ tag apache_access diff --git a/ansible/roles/octavia/defaults/main.yml b/ansible/roles/octavia/defaults/main.yml index 9876bf62bd..c2ca8e774a 100644 --- a/ansible/roles/octavia/defaults/main.yml +++ b/ansible/roles/octavia/defaults/main.yml @@ -16,11 +16,15 @@ octavia_services: mode: "http" external: false port: "{{ octavia_api_port }}" + listen_port: "{{ octavia_api_listen_port }}" + tls_backend: "{{ octavia_enable_tls_backend }}" octavia_api_external: enabled: "{{ enable_octavia }}" mode: "http" external: true port: "{{ octavia_api_port }}" + listen_port: "{{ octavia_api_listen_port }}" + tls_backend: "{{ octavia_enable_tls_backend }}" octavia-driver-agent: container_name: octavia_driver_agent group: octavia-driver-agent @@ -105,7 +109,7 @@ octavia_api_enable_healthchecks: "{{ enable_container_healthchecks }}" octavia_api_healthcheck_interval: "{{ default_container_healthcheck_interval }}" octavia_api_healthcheck_retries: "{{ default_container_healthcheck_retries }}" octavia_api_healthcheck_start_period: "{{ default_container_healthcheck_start_period }}" -octavia_api_healthcheck_test: ["CMD-SHELL", "healthcheck_curl http://{{ api_interface_address | put_address_in_context('url') }}:{{ octavia_api_listen_port }}"] +octavia_api_healthcheck_test: ["CMD-SHELL", "healthcheck_curl {{ 'https' if octavia_enable_tls_backend | bool else 'http' }}://{{ api_interface_address | put_address_in_context('url') }}:{{ octavia_api_listen_port }}"] octavia_api_healthcheck_timeout: "{{ default_container_healthcheck_timeout }}" octavia_api_healthcheck: interval: "{{ octavia_api_healthcheck_interval }}" @@ -327,3 +331,8 @@ octavia_amp_network_cidr: 10.1.0.0/24 # Octavia provider drivers octavia_provider_drivers: "amphora:Amphora provider{% if neutron_plugin_agent == 'ovn'%}, ovn:OVN provider{% endif %}" octavia_provider_agents: "amphora_agent{% if neutron_plugin_agent == 'ovn'%}, ovn{% endif %}" + +#################### +# TLS +#################### +octavia_enable_tls_backend: "{{ kolla_enable_tls_backend }}" diff --git a/ansible/roles/octavia/tasks/config.yml b/ansible/roles/octavia/tasks/config.yml index b45adf4c94..c454ea668c 100644 --- a/ansible/roles/octavia/tasks/config.yml +++ b/ansible/roles/octavia/tasks/config.yml @@ -47,7 +47,7 @@ - include_tasks: copy-certs.yml when: - - kolla_copy_ca_into_containers | bool + - kolla_copy_ca_into_containers | bool or octavia_enable_tls_backend | bool - name: Copying over config.json files for services template: @@ -62,6 +62,24 @@ notify: - "Restart {{ item.key }} container" +- name: Copying over octavia-wsgi.conf + vars: + service: "{{ octavia_services['octavia-api'] }}" + become: true + template: + src: "{{ item }}" + dest: "{{ node_config_directory }}/octavia-api/octavia-wsgi.conf" + mode: "0660" + with_first_found: + - "{{ node_custom_config }}/octavia/{{ inventory_hostname }}/octavia-wsgi.conf" + - "{{ node_custom_config }}/octavia/octavia-wsgi.conf" + - "octavia-wsgi.conf.j2" + when: + - inventory_hostname in groups[service.group] + - service.enabled | bool + notify: + - Restart octavia-api container + - name: Copying over octavia.conf vars: service_name: "{{ item.key }}" diff --git a/ansible/roles/octavia/templates/octavia-api.json.j2 b/ansible/roles/octavia/templates/octavia-api.json.j2 index e62a7dc68e..42722db413 100644 --- a/ansible/roles/octavia/templates/octavia-api.json.j2 +++ b/ansible/roles/octavia/templates/octavia-api.json.j2 @@ -1,20 +1,45 @@ +{% set apache_binary = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} +{% set apache_conf_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} { - "command": "octavia-api --config-file /etc/octavia/octavia.conf", + "command": "/usr/sbin/{{ apache_binary }} -DFOREGROUND", "config_files": [ { "source": "{{ container_config_directory }}/octavia.conf", "dest": "/etc/octavia/octavia.conf", "owner": "octavia", "perm": "0600" + }, + { + "source": "{{ container_config_directory }}/octavia-wsgi.conf", + "dest": "/etc/{{ apache_conf_dir }}/octavia-wsgi.conf", + "owner": "octavia", + "perm": "0600" }{% if octavia_policy_file is defined %}, { "source": "{{ container_config_directory }}/{{ octavia_policy_file }}", "dest": "/etc/octavia/{{ octavia_policy_file }}", "owner": "octavia", "perm": "0600" - }{% endif %} - ], + }{% endif %}{% if octavia_enable_tls_backend | bool %}, + { + "source": "{{ container_config_directory }}/octavia-cert.pem", + "dest": "/etc/octavia/certs/octavia-cert.pem", + "owner": "octavia", + "perm": "0600" + }, + { + "source": "{{ container_config_directory }}/octavia-key.pem", + "dest": "/etc/octavia/certs/octavia-key.pem", + "owner": "octavia", + "perm": "0600" + } + {% endif %}], "permissions": [ + { + "path": "/var/log/kolla/octavia", + "owner": "octavia:octavia", + "recurse": true + }, { "path": "/var/run/octavia", "owner": "octavia:octavia" diff --git a/ansible/roles/octavia/templates/octavia-wsgi.conf.j2 b/ansible/roles/octavia/templates/octavia-wsgi.conf.j2 new file mode 100644 index 0000000000..c0c0bb40de --- /dev/null +++ b/ansible/roles/octavia/templates/octavia-wsgi.conf.j2 @@ -0,0 +1,43 @@ +{% set wsgi_directory = '/usr/bin' if octavia_install_type == 'binary' else '/var/lib/kolla/venv/bin' %} +{% if octavia_enable_tls_backend | bool %} +{% if kolla_base_distro in ['centos'] %} +LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so +{% else %} +LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so +{% endif %} +{% endif %} +Listen {{ api_interface_address | put_address_in_context('url') }}:{{ octavia_api_listen_port }} + +ServerSignature Off +ServerTokens Prod +TraceEnable off +TimeOut {{ kolla_httpd_timeout }} +KeepAliveTimeout {{ kolla_httpd_keep_alive }} + +{% if octavia_logging_debug | bool %} +LogLevel info +{% endif %} + + + WSGIDaemonProcess octavia-api processes={{ openstack_service_workers }} threads=1 user=octavia group=octavia display-name=octavia-api + WSGIProcessGroup octavia-api + WSGIScriptAlias / {{ wsgi_directory }}/octavia-wsgi + WSGIApplicationGroup %{GLOBAL} + WSGIPassAuthorization On + = 2.4> + ErrorLogFormat "%{cu}t %M" + + ErrorLog /var/log/kolla/octavia/octavia-api-error.log + LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat + CustomLog /var/log/kolla/octavia/octavia-api-access.log logformat + + + Require all granted + + +{% if octavia_enable_tls_backend | bool %} + SSLEngine On + SSLCertificateFile /etc/octavia/certs/octavia-cert.pem + SSLCertificateKeyFile /etc/octavia/certs/octavia-key.pem +{% endif %} + diff --git a/ansible/roles/octavia/templates/octavia.conf.j2 b/ansible/roles/octavia/templates/octavia.conf.j2 index 190dcc75d7..d766ed5198 100644 --- a/ansible/roles/octavia/templates/octavia.conf.j2 +++ b/ansible/roles/octavia/templates/octavia.conf.j2 @@ -2,6 +2,9 @@ debug = {{ octavia_logging_debug }} log_dir = /var/log/kolla/octavia +{% if service_name == "octavia-api" %} +log_file = octavia-api.log +{% endif %} transport_url = {{ rpc_transport_url }} diff --git a/releasenotes/notes/octavia-api-wsgi-cafa913364cb491c.yaml b/releasenotes/notes/octavia-api-wsgi-cafa913364cb491c.yaml new file mode 100644 index 0000000000..371c1f30c4 --- /dev/null +++ b/releasenotes/notes/octavia-api-wsgi-cafa913364cb491c.yaml @@ -0,0 +1,9 @@ +--- +features: + - | + Switch octavia-api to wsgi running under apache. + - | + Added configuration options to enable backend TLS encryption from HAProxy + to the Octavia service. When used in conjunction with enabling TLS for + service API endpoints, network communication will be encrypted end to end, + from client through HAProxy to the Octavia service.