Refactor galera_use_ssl behaviour

With PKI role in place in most cases you don't need to explicitly
provide path to the CA file because PKI role ensures that CA is trusted
by the system overall. In the meanwhile in PyMySQL [1] you must either
provide CA file or cert/key or enable verify.

Since current behaviour is to provide path to the custom CA we expect
certificate being trusted overall. Thus we enable cert verification when
galera_use_ssl is True.

[1] 78f0cf99e5/pymysql/connections.py (L267)

Change-Id: I94b3f8ba5116cdfb94e9d0dc575bd7edb1d27b3c
This commit is contained in:
Dmitriy Rabotyagov 2021-09-21 16:26:57 +03:00
parent 83fba27a14
commit a422c42665
2 changed files with 2 additions and 2 deletions

View File

@ -57,7 +57,7 @@ manila_galera_address: "{{ galera_address | default('127.0.0.1') }}"
manila_galera_user: manila
manila_galera_database: manila
manila_galera_use_ssl: "{{ galera_use_ssl | default(False) }}"
manila_galera_ssl_ca_cert: "{{ galera_ssl_ca_cert | default('/etc/ssl/certs/galera-ca.pem') }}"
manila_galera_ssl_ca_cert: "{{ galera_ssl_ca_cert | default('') }}"
manila_galera_port: "{{ galera_port | default('3306') }}"
manila_db_max_overflow: "{{ openstack_db_max_overflow | default('50') }}"
manila_db_max_pool_size: "{{ openstack_db_max_pool_size | default('5') }}"

View File

@ -47,7 +47,7 @@ enabled_share_backends={% for backend in manila_backends | dictsort %}{{ backend
{% endfor %}
[database]
connection = mysql+pymysql://{{ manila_galera_user }}:{{ manila_container_mysql_password }}@{{ manila_galera_address }}/{{ manila_galera_database }}?charset=utf8{% if manila_galera_use_ssl | bool %}&ssl_ca={{ manila_galera_ssl_ca_cert }}{% endif +%}
connection = mysql+pymysql://{{ manila_galera_user }}:{{ manila_container_mysql_password }}@{{ manila_galera_address }}/{{ manila_galera_database }}?charset=utf8{% if manila_galera_use_ssl | bool %}&ssl_verify_cert=true{% if manila_galera_ssl_ca_cert | length > 0 %}&ssl_ca={{ manila_galera_ssl_ca_cert }}{% endif %}{% endif +%}
max_overflow = {{ manila_db_max_overflow }}
max_pool_size = {{ manila_db_max_pool_size }}
pool_timeout = {{ manila_db_pool_timeout }}