Add TLS support to heat backends

By overriding the variable `heat_backend_ssl: True` HTTPS will
be enabled, disabling HTTP support on the heat backend api.

The ansible-role-pki is used to generate the required TLS
certificates if this functionality is enabled.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085
Change-Id: Ifb904adc61f1461e646c3fce0bd062f526b8e446
This commit is contained in:
Damian Dabrowski 2023-04-08 17:46:56 +02:00
parent 5061ec247c
commit 0964f87c69
3 changed files with 74 additions and 0 deletions

View File

@ -252,6 +252,7 @@ heat_services:
uwsgi_overrides: "{{ heat_api_uwsgi_ini_overrides }}"
uwsgi_port: "{{ heat_service_port }}"
uwsgi_bind_address: "{{ heat_api_uwsgi_bind_address }}"
uwsgi_tls: "{{ heat_backend_ssl | ternary(heat_uwsgi_tls, {}) }}"
heat-api-cfn:
group: heat_api_cfn
service_name: heat-api-cfn
@ -262,6 +263,7 @@ heat_services:
uwsgi_overrides: "{{ heat_api_cfn_uwsgi_ini_overrides }}"
uwsgi_port: "{{ heat_cfn_service_port }}"
uwsgi_bind_address: "{{ heat_api_cfn_uwsgi_bind_address }}"
uwsgi_tls: "{{ heat_backend_ssl | ternary(heat_uwsgi_tls, {}) }}"
heat-engine:
group: heat_engine
service_name: heat-engine
@ -287,6 +289,9 @@ heat_wsgi_processes: "{{ [[ansible_facts['processor_vcpus']|default(1), 1] | max
heat_wsgi_threads: 1
heat_api_uwsgi_bind_address: "{{ openstack_service_bind_address | default('0.0.0.0') }}"
heat_api_cfn_uwsgi_bind_address: "{{ openstack_service_bind_address | default('0.0.0.0') }}"
heat_uwsgi_tls:
crt: "{{ heat_ssl_cert }}"
key: "{{ heat_ssl_key }}"
## Tunable overrides
heat_heat_conf_overrides: {}
@ -295,3 +300,51 @@ heat_default_yaml_overrides: {}
heat_aws_cloudwatch_alarm_yaml_overrides: {}
heat_aws_rds_dbinstance_yaml_overrides: {}
heat_policy_overrides: {}
###
### Backend TLS
###
# Define if communication between haproxy and service backends should be
# encrypted with TLS.
heat_backend_ssl: "{{ openstack_service_backend_ssl | default(False) }}"
# Storage location for SSL certificate authority
heat_pki_dir: "{{ openstack_pki_dir | default('/etc/openstack_deploy/pki') }}"
# Delegated host for operating the certificate authority
heat_pki_setup_host: "{{ openstack_pki_setup_host | default('localhost') }}"
# heat server certificate
heat_pki_keys_path: "{{ heat_pki_dir ~ '/certs/private/' }}"
heat_pki_certs_path: "{{ heat_pki_dir ~ '/certs/certs/' }}"
heat_pki_intermediate_cert_name: "{{ openstack_pki_service_intermediate_cert_name | default('ExampleCorpIntermediate') }}"
heat_pki_regen_cert: ''
heat_pki_san: "{{ openstack_pki_san | default('DNS:' ~ ansible_facts['hostname'] ~ ',IP:' ~ management_address) }}"
heat_pki_certificates:
- name: "heat_{{ ansible_facts['hostname'] }}"
provider: ownca
cn: "{{ ansible_facts['hostname'] }}"
san: "{{ heat_pki_san }}"
signed_by: "{{ heat_pki_intermediate_cert_name }}"
# heat destination files for SSL certificates
heat_ssl_cert: /etc/heat/heat.pem
heat_ssl_key: /etc/heat/heat.key
# Installation details for SSL certificates
heat_pki_install_certificates:
- src: "{{ heat_user_ssl_cert | default(heat_pki_certs_path ~ 'heat_' ~ ansible_facts['hostname'] ~ '-chain.crt') }}"
dest: "{{ heat_ssl_cert }}"
owner: "{{ heat_system_user_name }}"
group: "{{ heat_system_user_name }}"
mode: "0644"
- src: "{{ heat_user_ssl_key | default(heat_pki_keys_path ~ 'heat_' ~ ansible_facts['hostname'] ~ '.key.pem') }}"
dest: "{{ heat_ssl_key }}"
owner: "{{ heat_system_user_name }}"
group: "{{ heat_system_user_name }}"
mode: "0600"
# Define user-provided SSL certificates
#heat_user_ssl_cert: <path to cert on ansible deployment host>
#heat_user_ssl_key: <path to cert on ansible deployment host>

View File

@ -23,3 +23,4 @@
listen:
- "venv changed"
- "systemd service changed"
- "cert installed"

View File

@ -102,6 +102,26 @@
tags:
- heat-install
- name: Create and install SSL certificates
include_role:
name: pki
tasks_from: main_certs.yml
apply:
tags:
- heat-config
- pki
vars:
pki_setup_host: "{{ heat_pki_setup_host }}"
pki_dir: "{{ heat_pki_dir }}"
pki_create_certificates: "{{ heat_user_ssl_cert is not defined and heat_user_ssl_key is not defined }}"
pki_regen_cert: "{{ heat_pki_regen_cert }}"
pki_certificates: "{{ heat_pki_certificates }}"
pki_install_certificates: "{{ heat_pki_install_certificates }}"
when:
- heat_backend_ssl
tags:
- always
- import_tasks: heat_post_install.yml
tags:
- heat-config