Add support for TLS to Glance

By overriding the variable `glance_backend_https: True` HTTPS will
be enabled, disabling HTTP support on the glance backend api.

The ansible-role-pki is used to generate the required TLS
certificates if this functionality is enabled.

Depends-On: https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/820532
Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/820572

Change-Id: I5a0302c2fcc73a869de5633b2332a3b53c99590e

defaults/main.yml

@@ -143,6 +143,7 @@ glance_api_service_port: 9292
 glance_service_region: "{{ service_region | default('RegionOne') }}"
 glance_service_name: glance
 glance_service_port: 9292
+# Protocol to be used by default for defining glance service in catalog and configured on load balancer frontend
 glance_service_proto: http
 glance_service_publicuri_proto: "{{ openstack_service_publicuri_proto | default(glance_service_proto) }}"
 glance_service_adminuri_proto: "{{ openstack_service_adminuri_proto | default(glance_service_proto) }}"
@@ -160,6 +161,9 @@ glance_service_internalurl: "{{ glance_service_internaluri }}"
 glance_service_adminuri: "{{ glance_service_adminuri_proto }}://{{ internal_lb_vip_address }}:{{ glance_service_port }}"
 glance_service_adminurl: "{{ glance_service_adminuri }}"
 
+# Define if glance backend should use HTTPS, from load balancer to API backend
+glance_backend_https: "{{ openstack_backend_service_https | default(False) }}"
+
 ## Enable automatic parsing of X-Forwarded-Proto, etc. headers passed by the
 ## load balancer.
 glance_proxy_headers_parsing: True
@@ -280,11 +284,15 @@ glance_services:
     uwsgi_overrides: "{{ glance_api_uwsgi_ini_overrides }}"
     uwsgi_bind_address: "{{ glance_api_bind_address }}"
     uwsgi_port: "{{ glance_api_service_port }}"
+    uwsgi_tls: "{{ glance_backend_https | ternary(glance_uwsgi_tls, {}) }}"
 
 # Glance uWSGI settings
 glance_wsgi_processes_max: 16
 glance_wsgi_processes: "{{ [[(ansible_facts['processor_vcpus']//ansible_facts['processor_threads_per_core'])|default(1), 1] | max * 2, glance_wsgi_processes_max] | min }}"
 glance_wsgi_threads: 1
+glance_uwsgi_tls:
+  crt: "{{ glance_ssl_cert }}"
+  key: "{{ glance_ssl_key }}"
 
 ## Tunable overrides
 glance_glance_api_paste_ini_overrides: {}
@@ -300,3 +308,47 @@ glance_api_uwsgi_ini_overrides: {}
 
 # Specify path on the local filesystem for glance-image-import.conf
 #glance_glance_image_import_conf_location: /path/to/local/glance-image-import.conf
+
+# Storage location for SSL certificate authority
+glance_pki_dir: "{{ openstack_pki_dir }}"
+
+# Delegated host for operating the certificate authority
+glance_pki_setup_host: "{{ openstack_pki_setup_host | default('localhost') }}"
+
+# The local address used for the glance node
+glance_node_address: "{{ ansible_host }}"
+
+# Glance server certificate
+glance_pki_keys_path: "{{ glance_pki_dir ~ '/certs/private/' }}"
+glance_pki_certs_path: "{{ glance_pki_dir ~ '/certs/certs/' }}"
+glance_pki_intermediate_cert_name: "{{ openstack_pki_service_intermediate_cert_name }}"
+glance_pki_intermediate_cert_path: "{{ glance_pki_dir ~ '/roots/' ~ glance_pki_intermediate_cert_name ~ '/certs/' ~ glance_pki_intermediate_cert_name ~ '.crt' }}"
+glance_pki_regen_cert: ''
+glance_pki_certificates:
+  - name: "glance_{{ ansible_facts['hostname'] }}"
+    provider: ownca
+    cn: "{{ ansible_facts['hostname'] }}"
+    san: "{{ 'DNS:' ~ ansible_facts['hostname'] ~ ',IP:' ~ glance_node_address }}"
+    signed_by: "{{ glance_pki_intermediate_cert_name }}"
+
+# Glance destination files for SSL certificates
+glance_ssl_cert: /etc/glance/glance.pem
+glance_ssl_key: /etc/glance/glance.key
+
+# Installation details for SSL certificates
+glance_pki_install_certificates:
+  - src: "{{ glance_user_ssl_cert | default(glance_pki_certs_path ~ 'glance_' ~ ansible_facts['hostname'] ~ '-chain.crt') }}"
+    dest: "{{ glance_ssl_cert }}"
+    owner: "glance"
+    group: "glance"
+    mode: "0644"
+  - src: "{{ glance_user_ssl_key | default(glance_pki_keys_path ~ 'glance_' ~ ansible_facts['hostname'] ~ '.key.pem') }}"
+    dest: "{{ glance_ssl_key }}"
+    owner: "glance"
+    group: "glance"
+    mode: "0600"
+
+# Define user-provided SSL certificates in:
+# /etc/openstack_deploy/user_variables.yml
+#glance_user_ssl_cert: <path to cert on ansible deployment host>
+#glance_user_ssl_key: <path to cert on ansible deployment host>

handlers/main.yml

@@ -27,6 +27,7 @@
   listen:
     - "Restart glance services"
     - "venv changed"
+    - "cert installed"
 
 # NOTE (noonedeadpunk): Remove this task after Xena release
 - name: Remove obsoleted policy.json
@@ -51,6 +52,7 @@
   listen:
     - "Restart glance services"
     - "venv changed"
+    - "cert installed"
 
 - meta: noop
   listen: Manage LB

releasenotes/notes/add-glance-tls-2aaf35f49df9b7eb.yaml

@@ -0,0 +1,8 @@
+---
+features:
+  - |
+    Enable support for TLS to API. TLS is enable by setting
+    ``glance_backend_https`` to ``True``. By default glance will use a
+    self-signed certificate generated during the deployment process using the
+    pki role. User provided certificates can be used by setting the
+    ``glance_user_ssl_cert`` and ``glance_user_ssl_key`` variables.

tasks/main.yml

@@ -79,6 +79,22 @@
   tags:
     - glance-install
 
+- name: Create and install SSL certificates
+  include_role:
+    name: pki
+    tasks_from: main_certs.yml
+  vars:
+    pki_setup_host: "{{ glance_pki_setup_host }}"
+    pki_dir: "{{ glance_pki_dir }}"
+    pki_create_certificates: "{{ glance_user_ssl_cert is not defined and glance_user_ssl_key is not defined }}"
+    pki_regen_cert: "{{ glance_pki_regen_cert }}"
+    pki_certificates: "{{ glance_pki_certificates }}"
+    pki_install_certificates: "{{ glance_pki_install_certificates }}"
+  when:
+    - glance_backend_https
+    - glance-config
+    - pki
+
 - import_tasks: glance_post_install.yml
   tags:
     - glance-config