3daded6242
TLS can be used to encrypt and authenticate the connection with OpenStack endpoints. This patch provides the necessary parameters and changes the resulting service configurations to enable TLS for the Kolla deployed OpenStack cloud. The new input parameters are: kolla_enable_tls_external: "yes" or "no" (default is "no") kolla_external_fqdn_cert: "/etc/kolla/certificates/haproxy.pem" kolla_external_fqdn_cacert: "/etc/kolla/certificates/haproxy-ca.crt" Implements: blueprint kolla-ssl Change-Id: I48ef8a781c3035d58817f9bf6f36d59a488bab41
42 lines
1.3 KiB
YAML
42 lines
1.3 KiB
YAML
---
|
|
- name: Ensuring config directories exist
|
|
file:
|
|
path: "{{ node_config_directory }}/{{ item }}"
|
|
state: "directory"
|
|
recurse: yes
|
|
with_items:
|
|
- "certificates/private"
|
|
|
|
- name: Creating SSL configuration file
|
|
template:
|
|
src: "{{ item }}.j2"
|
|
dest: "{{ node_config_directory }}/certificates/{{ item }}"
|
|
with_items:
|
|
- "openssl-kolla.cnf"
|
|
|
|
- name: Creating Key
|
|
command: creates="{{ item }}" openssl genrsa -out {{ item }}
|
|
with_items:
|
|
- "{{ node_config_directory }}/certificates/private/haproxy.key"
|
|
|
|
- name: Creating Server Certificate
|
|
command: creates="{{ item }}" openssl req -new -nodes -sha256 -x509 \
|
|
-subj "/C=US/ST=NC/L=RTP/O=kolla/CN={{ kolla_external_fqdn }}" \
|
|
-config {{ node_config_directory }}/certificates/openssl-kolla.cnf \
|
|
-days 3650 \
|
|
-extensions v3_req \
|
|
-key {{ node_config_directory }}/certificates/private/haproxy.key \
|
|
-out {{ item }}
|
|
with_items:
|
|
- "{{ node_config_directory }}/certificates/private/haproxy.crt"
|
|
|
|
- name: Creating CA Certificate File
|
|
copy:
|
|
src: "{{ node_config_directory }}/certificates/private/haproxy.crt"
|
|
dest: "{{ node_config_directory }}/certificates/haproxy-ca.crt"
|
|
|
|
- name: Creating Server PEM File
|
|
assemble:
|
|
src: "{{ node_config_directory }}/certificates/private"
|
|
dest: "{{ node_config_directory }}/certificates/haproxy.pem"
|