Fix SSL handling for galera clusters

The SSL handler was making an assumption a user provided SSL key will
always be available. This change forces this role to look for the SSL
CA key on a galera server and set it locally IF a user provided SSL ca
certificate is not provided.

To ensure we're not introducing regressions a cross project repo test
has been added to run installations that are with and without ssl.

Depends-on: I5f6465f0d955cc1b911a4a76482505edb16c69a8
Change-Id: Ib89dde5cc88182f81d81336f71d9cde89733aa65
Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>

defaults/main.yml

@@ -55,10 +55,14 @@ mariadb_repo_filename: "MariaDB"
 
 # SSL support
 galera_use_ssl: false
+# This server is used when pulling an ssl cert onto a given host when a user
+# defined key is not present. By default this will try and pull from the
+# "galera_server" group and fall back to localhost.
+galera_ssl_server: "{{ (groups['galera_server'] | default(['localhost']))[0] }}"
 # The path where to store the database server CA certificate
 galera_ssl_ca_cert: /etc/ssl/certs/galera-ca.pem
 # The path to Galera CA certificate file on the deployment host
-galera_user_ssl_ca_cert: /etc/openstack_deploy/self_signed_certs/galera-ca.pem
+# galera_user_ssl_ca_cert: /etc/openstack_deploy/self_signed_certs/galera-ca.pem
 
 ## Set default mirror for openSUSE repositories
 # NOTE(hwoarang): Ensure that the full path to the 'opensuse' directory is used.

tasks/galera_client_post_install.yml

@@ -25,15 +25,3 @@
   when: galera_client_drop_config_file
   tags:
     - galera-client-user-config
-
-- name: Distribute Galera ssl CA cert
-  copy:
-    dest: "{{ galera_ssl_ca_cert }}"
-    src: "{{ galera_user_ssl_ca_cert }}"
-    owner: "root"
-    group: "root"
-    mode: "0644"
-  when:
-    - galera_use_ssl | bool
-  tags:
-    - galera-client-user-config

tasks/galera_client_ssl.yml

@@ -0,0 +1,54 @@
+---
+# Copyright 2017, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Get ca key contents
+  slurp:
+    src: "{{ galera_ssl_ca_cert }}"
+  register: galera_ca
+  changed_when: false
+  failed_when: false
+  delegate_to: "{{ galera_ssl_server }}"
+  when:
+    - galera_user_ssl_ca_cert is not defined
+
+- name: Check for ca key get failure
+  debug:
+    msg: >
+      The key retrieval task failed or no CA key was found. Check the file
+      "{{ galera_ssl_ca_cert }}" on server "{{ galera_ssl_server }}" before
+      trying again.
+  when:
+    - not galera_ca | success
+
+- name: Distribute Galera ssl CA cert (SERVER)
+  copy:
+    content: "{{ galera_ca.content | b64decode }}"
+    src: "{{ galera_ssl_ca_cert }}"
+    owner: "root"
+    group: "root"
+    mode: "0644"
+  when:
+    - galera_user_ssl_ca_cert is not defined
+    - galera_ca.content is defined
+
+- name: Distribute Galera ssl CA cert (USER)
+  copy:
+    dest: "{{ galera_ssl_ca_cert }}"
+    src: "{{ galera_user_ssl_ca_cert }}"
+    owner: "root"
+    group: "root"
+    mode: "0644"
+  when:
+    - galera_user_ssl_ca_cert is defined

tasks/main.yml

@@ -29,3 +29,7 @@
     - galera-client-install
 
 - include: galera_client_post_install.yml
+
+- include: galera_client_ssl.yml
+  when:
+    - galera_use_ssl | bool

zuul.d/jobs.yaml

@@ -0,0 +1,36 @@
+---
+# Copyright 2017, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- job:
+    name: openstack-ansible-galera_server
+    parent: openstack-ansible-cross-repo-functional
+    required-projects:
+      - name: openstack/openstack-ansible-galera_server
+    vars:
+      osa_test_repo: "openstack/openstack-ansible-galera_server"
+
+- job:
+    name: openstack-ansible-ssl-galera_server-ubuntu-xenial
+    parent: openstack-ansible-galera_server
+    voting: false
+    vars:
+      tox_env: ssl
+
+- job:
+    name: openstack-ansible-functional-galera_server-ubuntu-xenial
+    parent: openstack-ansible-galera_server
+    voting: false
+    vars:
+      tox_env: functional

zuul.d/project.yaml

@@ -21,6 +21,8 @@
         - openstack-ansible-functional-centos-7
         - openstack-ansible-functional-opensuse-423
         - openstack-ansible-functional-ubuntu-xenial
+        - openstack-ansible-ssl-galera_server-ubuntu-xenial
+        - openstack-ansible-functional-galera_server-ubuntu-xenial
     gate:
       jobs:
         - openstack-ansible-linters