Add MySQL connection SSL support

When 'magnum_galera_use_ssl' is True, use an encrypted connection to
the database using either a self-signed or user-provided CA certificate.

A new non-voting test has been added to verify that the role remains
functional when enabling SSL features.

Change-Id: I1ac622926542ff6a3dfca7be3703f33ede4013df
Partial-Bug: 1667789
This commit is contained in:
Jimmy McCrory 2017-12-14 11:21:21 -08:00
parent 736d170733
commit e2c5cc2cee
5 changed files with 37 additions and 1 deletions

View File

@ -71,6 +71,8 @@ magnum_developer_constraints:
# Database vars
magnum_galera_database_name: magnum_service
magnum_galera_user: magnum
magnum_galera_use_ssl: "{{ galera_use_ssl | default(False) }}"
magnum_galera_ssl_ca_cert: "{{ galera_ssl_ca_cert | default('/etc/ssl/certs/galera-ca.pem') }}"
# Rabbit vars
magnum_rabbitmq_userid: magnum

View File

@ -16,7 +16,7 @@ region_name = {{ magnum_cinder_service_region }}
endpoint_type = internalURL
[database]
connection = mysql+pymysql://{{ magnum_galera_user }}:{{ magnum_galera_password }}@{{ magnum_galera_address }}/{{ magnum_galera_database_name }}?charset=utf8
connection = mysql+pymysql://{{ magnum_galera_user }}:{{ magnum_galera_password }}@{{ magnum_galera_address }}/{{ magnum_galera_database_name }}?charset=utf8{% if magnum_galera_use_ssl | bool %}&ssl_ca={{ magnum_galera_ssl_ca_cert }}{% endif %}
[glance_client]
endpoint_type = internalURL

11
tox.ini
View File

@ -103,6 +103,17 @@ commands =
bash -c "{toxinidir}/tests/common/test-ansible-functional.sh"
[testenv:ssl]
deps =
{[testenv:ansible]deps}
setenv =
{[testenv]setenv}
ANSIBLE_PARAMETERS=-vvv -e galera_use_ssl=True
commands =
bash -c "{toxinidir}/tests/tests-repo-clone.sh"
bash -c "{toxinidir}/tests/common/test-ansible-functional.sh"
[testenv:linters]
deps =
{[testenv:ansible]deps}

21
zuul.d/jobs.yaml Normal file
View File

@ -0,0 +1,21 @@
---
# Copyright 2017, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
- job:
name: openstack-ansible-magnum-ssl-nv
parent: openstack-ansible-functional-ubuntu-xenial
voting: false
vars:
tox_env: ssl

View File

@ -21,6 +21,7 @@
- openstack-ansible-functional-centos-7-nv
- openstack-ansible-functional-opensuse-423-nv
- openstack-ansible-functional-ubuntu-xenial
- openstack-ansible-magnum-ssl-nv
experimental:
jobs:
- openstack-ansible-integrated-deploy-aio
@ -28,3 +29,4 @@
jobs:
- openstack-ansible-linters
- openstack-ansible-functional-ubuntu-xenial
- openstack-ansible-magnum-ssl-nv