From 224b2cf3962b1b0241d3dcdb21296f97c57e0ed1 Mon Sep 17 00:00:00 2001 From: Dmitriy Rabotyagov Date: Tue, 21 Sep 2021 15:44:37 +0300 Subject: [PATCH] Refactor galera_use_ssl behaviour With PKI role in place in most cases you don't need to explicitly provide path to the CA file because PKI role ensures that CA is trusted by the system overall. In the meanwhile in PyMySQL [1] you must either provide CA file or cert/key or enable verify. Since current behaviour is to provide path to the custom CA we expect certificate being trusted overall. Thus we enable cert verification when galera_use_ssl is True. [1] https://github.com/PyMySQL/PyMySQL/blob/78f0cf99e5d5351df0821442e4dc35c49a6390c6/pymysql/connections.py#L267 Change-Id: I933e1edbd4260e2bd61bcceec3ddad8aea85353c --- defaults/main.yml | 2 +- templates/masakari.conf.j2 | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 786c0ca..8c985fc 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -49,7 +49,7 @@ masakari_galera_address: "{{ galera_address | default('127.0.0.1') }}" masakari_galera_database: masakari masakari_galera_user: masakari masakari_galera_use_ssl: "{{ galera_use_ssl | default(False) }}" -masakari_galera_ssl_ca_cert: "{{ galera_ssl_ca_cert | default('/etc/ssl/certs/galera-ca.pem') }}" +masakari_galera_ssl_ca_cert: "{{ galera_ssl_ca_cert | default('') }}" masakari_galera_port: "{{ galera_port | default('3306') }}" masakari_pip_install_args: "{{ pip_install_options | default('') }}" diff --git a/templates/masakari.conf.j2 b/templates/masakari.conf.j2 index 2812283..1aa05e1 100644 --- a/templates/masakari.conf.j2 +++ b/templates/masakari.conf.j2 @@ -40,10 +40,10 @@ memcache_secret_key = {{ memcached_encryption_key }} service_token_roles_required = True [database] -connection = mysql+pymysql://{{ masakari_galera_user }}:{{ masakari_container_mysql_password }}@{{ masakari_galera_address }}/{{ masakari_galera_database }}?charset=utf8{% if masakari_galera_use_ssl | bool %}&ssl_ca={{ masakari_galera_ssl_ca_cert }}{% endif %} +connection = mysql+pymysql://{{ masakari_galera_user }}:{{ masakari_container_mysql_password }}@{{ masakari_galera_address }}/{{ masakari_galera_database }}?charset=utf8{% if masakari_galera_use_ssl | bool %}&ssl_verify_cert=true{% if masakari_galera_ssl_ca_cert | length > 0 %}&ssl_ca={{ masakari_galera_ssl_ca_cert }}{% endif %}{% endif %} [taskflow] -connection = mysql+pymysql://{{ masakari_galera_user }}:{{ masakari_container_mysql_password }}@{{ masakari_galera_address }}/{{ masakari_galera_database }}?charset=utf8{% if masakari_galera_use_ssl | bool %}&ssl_ca={{ masakari_galera_ssl_ca_cert }}{% endif %} +connection = mysql+pymysql://{{ masakari_galera_user }}:{{ masakari_container_mysql_password }}@{{ masakari_galera_address }}/{{ masakari_galera_database }}?charset=utf8{% if masakari_galera_use_ssl | bool %}&ssl_verify_cert=true{% if masakari_galera_ssl_ca_cert | length > 0 %}&ssl_ca={{ masakari_galera_ssl_ca_cert }}{% endif %}{% endif %} [host_failure] evacuate_all_instances = true