fbea6d2d35
We've been merging quite a few improvements for Ocatavia chart recently but we've been skipping testing them. This PS adds the Octavia test case which tests the simplest load balancing env with two workload instances and one amphora instance. The PS also brings some changes to the Octavia chart: - Run driver agent as a separate deployment on network nodes - Run worker as a daemonset (same as health manager) on network nodes. It creates an interface attached to the Octavia management network to get access to amophora instances. Change-Id: Id12e30eb7aac432e3f12b83e1f93d98e54c503cf Signed-off-by: Vladimir Kozhukalov <kozhukalov@gmail.com>
145 lines
4.3 KiB
INI
145 lines
4.3 KiB
INI
# OpenSSL root CA configuration file.
|
|
|
|
[ ca ]
|
|
# `man ca`
|
|
default_ca = CA_default
|
|
|
|
[ CA_default ]
|
|
# Directory and file locations.
|
|
dir = ./
|
|
certs = $dir/certs
|
|
crl_dir = $dir/crl
|
|
new_certs_dir = $dir/newcerts
|
|
database = $dir/index.txt
|
|
serial = $dir/serial
|
|
RANDFILE = $dir/private/.rand
|
|
|
|
# The root key and root certificate.
|
|
private_key = $dir/private/ca.key.pem
|
|
certificate = $dir/certs/ca.cert.pem
|
|
|
|
# For certificate revocation lists.
|
|
crlnumber = $dir/crlnumber
|
|
crl = $dir/crl/ca.crl.pem
|
|
crl_extensions = crl_ext
|
|
default_crl_days = 30
|
|
|
|
# SHA-1 is deprecated, so use SHA-2 instead.
|
|
default_md = sha256
|
|
|
|
name_opt = ca_default
|
|
cert_opt = ca_default
|
|
# 10 years
|
|
default_days = 7300
|
|
preserve = no
|
|
policy = policy_strict
|
|
|
|
[ CA_intermediate ]
|
|
# Directory and file locations.
|
|
dir = ./intermediate_ca
|
|
certs = $dir/certs
|
|
crl_dir = $dir/crl
|
|
new_certs_dir = $dir/newcerts
|
|
database = $dir/index.txt
|
|
serial = $dir/serial
|
|
RANDFILE = $dir/private/.rand
|
|
|
|
# The root key and root certificate.
|
|
private_key = ./private/ca.key.pem
|
|
certificate = ./certs/ca.cert.pem
|
|
|
|
# For certificate revocation lists.
|
|
crlnumber = $dir/crlnumber
|
|
crl = $dir/crl/ca.crl.pem
|
|
crl_extensions = crl_ext
|
|
default_crl_days = 30
|
|
|
|
# SHA-1 is deprecated, so use SHA-2 instead.
|
|
default_md = sha256
|
|
|
|
name_opt = ca_default
|
|
cert_opt = ca_default
|
|
# 5 years
|
|
default_days = 3650
|
|
preserve = no
|
|
policy = policy_strict
|
|
|
|
[ policy_strict ]
|
|
# The root CA should only sign intermediate certificates that match.
|
|
# See the POLICY FORMAT section of `man ca`.
|
|
countryName = match
|
|
stateOrProvinceName = match
|
|
organizationName = match
|
|
organizationalUnitName = optional
|
|
commonName = supplied
|
|
emailAddress = optional
|
|
|
|
[ req ]
|
|
# Options for the `req` tool (`man req`).
|
|
default_bits = 2048
|
|
distinguished_name = req_distinguished_name
|
|
string_mask = utf8only
|
|
|
|
# SHA-1 is deprecated, so use SHA-2 instead.
|
|
default_md = sha256
|
|
|
|
# Extension to add when the -x509 option is used.
|
|
x509_extensions = v3_ca
|
|
|
|
[ req_distinguished_name ]
|
|
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
|
|
countryName = Country Name (2 letter code)
|
|
stateOrProvinceName = State or Province Name
|
|
localityName = Locality Name
|
|
0.organizationName = Organization Name
|
|
organizationalUnitName = Organizational Unit Name
|
|
commonName = Common Name
|
|
emailAddress = Email Address
|
|
|
|
# Optionally, specify some defaults.
|
|
countryName_default = US
|
|
stateOrProvinceName_default = Oregon
|
|
localityName_default = Corvallis
|
|
0.organizationName_default = OpenStack
|
|
organizationalUnitName_default = Octavia
|
|
emailAddress_default =
|
|
commonName_default = example.org
|
|
|
|
[ v3_ca ]
|
|
# Extensions for a typical CA (`man x509v3_config`).
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid:always,issuer
|
|
basicConstraints = critical, CA:true
|
|
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
|
|
|
|
[ v3_intermediate_ca ]
|
|
# Extensions for a typical intermediate CA (`man x509v3_config`).
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid:always,issuer
|
|
basicConstraints = critical, CA:true, pathlen:0
|
|
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
|
|
|
|
[ usr_cert ]
|
|
# Extensions for client certificates (`man x509v3_config`).
|
|
basicConstraints = CA:FALSE
|
|
nsCertType = client, email
|
|
nsComment = "OpenSSL Generated Client Certificate"
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid,issuer
|
|
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
|
|
extendedKeyUsage = clientAuth, emailProtection
|
|
|
|
[ server_cert ]
|
|
# Extensions for server certificates (`man x509v3_config`).
|
|
basicConstraints = CA:FALSE
|
|
nsCertType = server
|
|
nsComment = "OpenSSL Generated Server Certificate"
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid,issuer:always
|
|
keyUsage = critical, digitalSignature, keyEncipherment
|
|
extendedKeyUsage = serverAuth
|
|
|
|
[ crl_ext ]
|
|
# Extension for CRLs (`man x509v3_config`).
|
|
authorityKeyIdentifier=keyid:always
|