openstack/openstack-ansible
Code Issues Proposed changes

Merge "rabbitmq: default to using TLS for management user interface"

Browse Source
This commit is contained in:
Zuul
2022-07-29 10:16:42 +00:00
committed by Gerrit Code Review
parent 25d9d01d17 0cc8e039ea
commit 3e4ee68a73
3 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
inventory/group_vars/all/all.yml
View File

@@ -137,3 +137,6 @@ repo_service_user_name: nginx
repo_service_group_name: www-data repo_service_group_name: www-data
venv_build_host_user_name: "{{ repo_service_user_name }}" venv_build_host_user_name: "{{ repo_service_user_name }}"
venv_build_host_group_name: "{{ repo_service_group_name }}" venv_build_host_group_name: "{{ repo_service_group_name }}"
# Set RabbitMQ management UI to use TLS
rabbitmq_management_ssl: true

6
inventory/group_vars/haproxy/haproxy.yml
View File

@@ -458,9 +458,11 @@ haproxy_placement_service:
haproxy_rabbitmq_service: haproxy_rabbitmq_service:
haproxy_service_name: rabbitmq_mgmt haproxy_service_name: rabbitmq_mgmt
haproxy_backend_nodes: "{{ groups['rabbitmq'] | default([]) }}" haproxy_backend_nodes: "{{ groups['rabbitmq'] | default([]) }}"
haproxy_ssl: False haproxy_ssl: "{{ rabbitmq_management_ssl | bool }}"
haproxy_backend_ssl: "{{ rabbitmq_management_ssl | bool }}"
haproxy_backend_ca: False
haproxy_bind: "{{ [internal_lb_vip_address] }}" haproxy_bind: "{{ [internal_lb_vip_address] }}"
haproxy_port: 15672 haproxy_port: "{{ (rabbitmq_management_ssl | bool) | ternary(15671, 15672) }}"
haproxy_balance_type: http haproxy_balance_type: http
haproxy_backend_options: haproxy_backend_options:
- "httpchk HEAD / HTTP/1.0\\r\\nUser-agent:\\ osa-haproxy-healthcheck" - "httpchk HEAD / HTTP/1.0\\r\\nUser-agent:\\ osa-haproxy-healthcheck"

7
releasenotes/notes/rabbitmq-upgrade-management-ssl-d6a7f77f2a65ffa9.yaml Normal file
View File

@@ -0,0 +1,7 @@
---
upgrade:
- |
The RabbitMQ management interface surfaced via HAProxy defaults to using
TLS from the Yoga release. Note that when using TLS the default port
switches from 15672 to 15671. TLS can be disabled if required by adjusting
'rabbitmq_management_ssl'.