Fix SSL handling for galera clusters
The SSL handler was making an assumption a user provided SSL key will always be available. This change forces this role to look for the SSL CA key on a galera server and set it locally IF a user provided SSL ca certificate is not provided. To ensure we're not introducing regressions a cross project repo test has been added to run installations that are with and without ssl. Depends-on: I5f6465f0d955cc1b911a4a76482505edb16c69a8 Change-Id: Ib89dde5cc88182f81d81336f71d9cde89733aa65 Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>
This commit is contained in:
parent
1da9865aab
commit
e5634d99fd
@ -55,10 +55,14 @@ mariadb_repo_filename: "MariaDB"
|
||||
|
||||
# SSL support
|
||||
galera_use_ssl: false
|
||||
# This server is used when pulling an ssl cert onto a given host when a user
|
||||
# defined key is not present. By default this will try and pull from the
|
||||
# "galera_server" group and fall back to localhost.
|
||||
galera_ssl_server: "{{ (groups['galera_server'] | default(['localhost']))[0] }}"
|
||||
# The path where to store the database server CA certificate
|
||||
galera_ssl_ca_cert: /etc/ssl/certs/galera-ca.pem
|
||||
# The path to Galera CA certificate file on the deployment host
|
||||
galera_user_ssl_ca_cert: /etc/openstack_deploy/self_signed_certs/galera-ca.pem
|
||||
# galera_user_ssl_ca_cert: /etc/openstack_deploy/self_signed_certs/galera-ca.pem
|
||||
|
||||
## Set default mirror for openSUSE repositories
|
||||
# NOTE(hwoarang): Ensure that the full path to the 'opensuse' directory is used.
|
||||
|
@ -25,15 +25,3 @@
|
||||
when: galera_client_drop_config_file
|
||||
tags:
|
||||
- galera-client-user-config
|
||||
|
||||
- name: Distribute Galera ssl CA cert
|
||||
copy:
|
||||
dest: "{{ galera_ssl_ca_cert }}"
|
||||
src: "{{ galera_user_ssl_ca_cert }}"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
mode: "0644"
|
||||
when:
|
||||
- galera_use_ssl | bool
|
||||
tags:
|
||||
- galera-client-user-config
|
||||
|
54
tasks/galera_client_ssl.yml
Normal file
54
tasks/galera_client_ssl.yml
Normal file
@ -0,0 +1,54 @@
|
||||
---
|
||||
# Copyright 2017, Rackspace US, Inc.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
- name: Get ca key contents
|
||||
slurp:
|
||||
src: "{{ galera_ssl_ca_cert }}"
|
||||
register: galera_ca
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
delegate_to: "{{ galera_ssl_server }}"
|
||||
when:
|
||||
- galera_user_ssl_ca_cert is not defined
|
||||
|
||||
- name: Check for ca key get failure
|
||||
debug:
|
||||
msg: >
|
||||
The key retrieval task failed or no CA key was found. Check the file
|
||||
"{{ galera_ssl_ca_cert }}" on server "{{ galera_ssl_server }}" before
|
||||
trying again.
|
||||
when:
|
||||
- not galera_ca | success
|
||||
|
||||
- name: Distribute Galera ssl CA cert (SERVER)
|
||||
copy:
|
||||
content: "{{ galera_ca.content | b64decode }}"
|
||||
src: "{{ galera_ssl_ca_cert }}"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
mode: "0644"
|
||||
when:
|
||||
- galera_user_ssl_ca_cert is not defined
|
||||
- galera_ca.content is defined
|
||||
|
||||
- name: Distribute Galera ssl CA cert (USER)
|
||||
copy:
|
||||
dest: "{{ galera_ssl_ca_cert }}"
|
||||
src: "{{ galera_user_ssl_ca_cert }}"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
mode: "0644"
|
||||
when:
|
||||
- galera_user_ssl_ca_cert is defined
|
@ -29,3 +29,7 @@
|
||||
- galera-client-install
|
||||
|
||||
- include: galera_client_post_install.yml
|
||||
|
||||
- include: galera_client_ssl.yml
|
||||
when:
|
||||
- galera_use_ssl | bool
|
||||
|
36
zuul.d/jobs.yaml
Normal file
36
zuul.d/jobs.yaml
Normal file
@ -0,0 +1,36 @@
|
||||
---
|
||||
# Copyright 2017, Rackspace US, Inc.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
- job:
|
||||
name: openstack-ansible-galera_server
|
||||
parent: openstack-ansible-cross-repo-functional
|
||||
required-projects:
|
||||
- name: openstack/openstack-ansible-galera_server
|
||||
vars:
|
||||
osa_test_repo: "openstack/openstack-ansible-galera_server"
|
||||
|
||||
- job:
|
||||
name: openstack-ansible-ssl-galera_server-ubuntu-xenial
|
||||
parent: openstack-ansible-galera_server
|
||||
voting: false
|
||||
vars:
|
||||
tox_env: ssl
|
||||
|
||||
- job:
|
||||
name: openstack-ansible-functional-galera_server-ubuntu-xenial
|
||||
parent: openstack-ansible-galera_server
|
||||
voting: false
|
||||
vars:
|
||||
tox_env: functional
|
@ -21,6 +21,8 @@
|
||||
- openstack-ansible-functional-centos-7
|
||||
- openstack-ansible-functional-opensuse-423
|
||||
- openstack-ansible-functional-ubuntu-xenial
|
||||
- openstack-ansible-ssl-galera_server-ubuntu-xenial
|
||||
- openstack-ansible-functional-galera_server-ubuntu-xenial
|
||||
gate:
|
||||
jobs:
|
||||
- openstack-ansible-linters
|
||||
|
Loading…
Reference in New Issue
Block a user