Browse Source

Introducing default_tls_verify

TLS client verification used to be accidentally disabled in libvirt.
This was fixed in libvirt-6.10.0-1.
Which means, once you're using libvirt-6.10.0-1 or higher, a client
certificate is mandatory during live migration with TLS.

If we simply create the client certificate, this will fix live-migration
of newly created instance but will not fix already created instances.

This change will allow us to keep client certificate validation disabled
during the train release cycle and re-enable it from Wallaby and onward.

Related-Change: https://review.opendev.org/c/openstack/tripleo-heat-templates/+/785438/
Related: https://bugzilla.redhat.com/show_bug.cgi?id=1945760
Change-Id: I628e5ef0a50799e44145fe4ed78303d0fdbf5838
(cherry picked from commit e28a1b8b70)
(cherry picked from commit e046a3bf63)
(cherry picked from commit 2d198362d2)
(cherry picked from commit b82062fc2e)
changes/49/787249/1
David Vallee Delisle 1 month ago
parent
commit
43cd2b49cd
3 changed files with 71 additions and 1 deletions
  1. +12
    -0
      manifests/compute/libvirt/qemu.pp
  2. +5
    -0
      releasenotes/notes/qemu-default_tls_verify-57e7afd6670afec2.yaml
  3. +54
    -1
      spec/classes/nova_compute_libvirt_qemu_spec.rb

+ 12
- 0
manifests/compute/libvirt/qemu.pp View File

@ -28,6 +28,10 @@
# (optional) Enables TLS client cert verification when vnc_tls is enabled.
# Defaults to true.
#
# [*default_tls_verify*]
# (optional) Enables TLS client cert verification.
# Defaults to true.
#
# [*memory_backing_dir*]
# (optional) This directory is used for memoryBacking source if configured as file.
# NOTE: big files will be stored here
@ -49,6 +53,7 @@ class nova::compute::libvirt::qemu(
$max_processes = 4096,
$vnc_tls = false,
$vnc_tls_verify = true,
$default_tls_verify = true,
$memory_backing_dir = undef,
$nbd_tls = false,
$libvirt_version = $::nova::compute::libvirt::version::default,
@ -73,6 +78,11 @@ class nova::compute::libvirt::qemu(
$vnc_tls_value = 0
$vnc_tls_verify_value = 0
}
if $default_tls_verify {
$default_tls_verify_value = $default_tls_verify ? { true => 1, false => 0 }
} else {
$default_tls_verify_value = 0
}
if $nbd_tls {
$nbd_tls_value = 1
@ -85,6 +95,7 @@ class nova::compute::libvirt::qemu(
"set max_processes ${max_processes}",
"set vnc_tls ${vnc_tls_value}",
"set vnc_tls_x509_verify ${vnc_tls_verify_value}",
"set default_tls_x509_verify ${default_tls_verify_value}",
]
if $group and !empty($group) {
$augues_group_changes = ["set group ${group}"]
@ -117,6 +128,7 @@ class nova::compute::libvirt::qemu(
'rm group',
'rm vnc_tls',
'rm vnc_tls_x509_verify',
'rm default_tls_x509_verify',
'rm memory_backing_dir',
]
if versioncmp($libvirt_version, '4.5') >= 0 {


+ 5
- 0
releasenotes/notes/qemu-default_tls_verify-57e7afd6670afec2.yaml View File

@ -0,0 +1,5 @@
---
features:
- |
Introducing default_tls_verify for qemu.
This effectively allows operators to enable or disable TLS client certificate verification.

+ 54
- 1
spec/classes/nova_compute_libvirt_qemu_spec.rb View File

@ -25,6 +25,7 @@ describe 'nova::compute::libvirt::qemu' do
"rm group",
"rm vnc_tls",
"rm vnc_tls_x509_verify",
"rm default_tls_x509_verify",
"rm memory_backing_dir",
],
}).that_notifies('Service[libvirt]') }
@ -45,6 +46,7 @@ describe 'nova::compute::libvirt::qemu' do
"rm group",
"rm vnc_tls",
"rm vnc_tls_x509_verify",
"rm default_tls_x509_verify",
"rm memory_backing_dir",
"rm nbd_tls",
],
@ -65,6 +67,7 @@ describe 'nova::compute::libvirt::qemu' do
"set max_processes 4096",
"set vnc_tls 0",
"set vnc_tls_x509_verify 0",
"set default_tls_x509_verify 1",
],
:tag => 'qemu-conf-augeas',
}).that_notifies('Service[libvirt]') }
@ -84,6 +87,7 @@ describe 'nova::compute::libvirt::qemu' do
"set max_processes 4096",
"set vnc_tls 0",
"set vnc_tls_x509_verify 0",
"set default_tls_x509_verify 1",
"set nbd_tls 0",
],
:tag => 'qemu-conf-augeas',
@ -106,6 +110,7 @@ describe 'nova::compute::libvirt::qemu' do
"set max_processes 131072",
"set vnc_tls 0",
"set vnc_tls_x509_verify 0",
"set default_tls_x509_verify 1",
],
:tag => 'qemu-conf-augeas',
}).that_notifies('Service[libvirt]') }
@ -127,6 +132,7 @@ describe 'nova::compute::libvirt::qemu' do
"set max_processes 131072",
"set vnc_tls 0",
"set vnc_tls_x509_verify 0",
"set default_tls_x509_verify 1",
"set nbd_tls 0",
],
:tag => 'qemu-conf-augeas',
@ -151,6 +157,7 @@ describe 'nova::compute::libvirt::qemu' do
"set max_processes 131072",
"set vnc_tls 0",
"set vnc_tls_x509_verify 0",
"set default_tls_x509_verify 1",
"set group openvswitch",
"set memory_backing_dir /tmp",
],
@ -173,12 +180,34 @@ describe 'nova::compute::libvirt::qemu' do
"set max_processes 4096",
"set vnc_tls 1",
"set vnc_tls_x509_verify 1",
"set default_tls_x509_verify 1",
],
:tag => 'qemu-conf-augeas',
}).that_notifies('Service[libvirt]') }
end
context 'when configuring qemu without vnc_tls_verify' do
context 'when configuring qemu with default_tls_verify enabled' do
let :params do
{
:configure_qemu => true,
:default_tls_verify => true,
:libvirt_version => '3.9',
}
end
it { is_expected.to contain_augeas('qemu-conf-limits').with({
:context => '/files/etc/libvirt/qemu.conf',
:changes => [
"set max_files 1024",
"set max_processes 4096",
"set vnc_tls 0",
"set vnc_tls_x509_verify 0",
"set default_tls_x509_verify 1",
],
:tag => 'qemu-conf-augeas',
}).that_notifies('Service[libvirt]') }
end
context 'when configuring qemu with vnc_tls_verify disabled' do
let :params do
{
:configure_qemu => true,
@ -194,6 +223,28 @@ describe 'nova::compute::libvirt::qemu' do
"set max_processes 4096",
"set vnc_tls 1",
"set vnc_tls_x509_verify 0",
"set default_tls_x509_verify 1",
],
:tag => 'qemu-conf-augeas',
}).that_notifies('Service[libvirt]') }
end
context 'when configuring qemu with default_tls_verify disabled' do
let :params do
{
:configure_qemu => true,
:default_tls_verify => false,
:libvirt_version => '3.9',
}
end
it { is_expected.to contain_augeas('qemu-conf-limits').with({
:context => '/files/etc/libvirt/qemu.conf',
:changes => [
"set max_files 1024",
"set max_processes 4096",
"set vnc_tls 0",
"set vnc_tls_x509_verify 0",
"set default_tls_x509_verify 0",
],
:tag => 'qemu-conf-augeas',
}).that_notifies('Service[libvirt]') }
@ -214,6 +265,7 @@ describe 'nova::compute::libvirt::qemu' do
"set max_processes 4096",
"set vnc_tls 0",
"set vnc_tls_x509_verify 0",
"set default_tls_x509_verify 1",
],
:tag => 'qemu-conf-augeas',
}).that_notifies('Service[libvirt]') }
@ -234,6 +286,7 @@ describe 'nova::compute::libvirt::qemu' do
"set max_processes 4096",
"set vnc_tls 0",
"set vnc_tls_x509_verify 0",
"set default_tls_x509_verify 1",
"set nbd_tls 1",
],
:tag => 'qemu-conf-augeas',


Loading…
Cancel
Save