Mysql: Enable SSL

Change-Id: Ia4276ef65947c36c5d3712859381bd7536018b0c

manifests/aodh.pp

@@ -35,6 +35,7 @@ class openstack_integration::aodh (
       'password' => 'aodh',
       'database' => 'aodh',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'aodh':

manifests/barbican.pp

@@ -31,6 +31,7 @@ class openstack_integration::barbican {
       'password' => 'barbican',
       'database' => 'barbican',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'barbican::keystone::auth':

manifests/cinder.pp

@@ -73,6 +73,7 @@ class openstack_integration::cinder (
       'password' => 'cinder',
       'database' => 'cinder',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'cinder':

manifests/config.pp

@@ -24,6 +24,8 @@ class openstack_integration::config (
   $notify_backend = 'rabbit',
 ) {
 
+  include openstack_integration::params
+
   $messaging_default_proto = $rpc_backend
   $messaging_notify_proto  = $notify_backend
 
@@ -35,6 +37,9 @@ class openstack_integration::config (
       $messaging_default_port = '5671'
     }
     $messaging_notify_port = '5671'
+    $db_extra = {
+      'ssl_ca' => $::openstack_integration::params::ca_bundle_cert_path,
+    }
   } else {
     $proto = 'http'
     if $rpc_backend == 'amqp' {
@@ -43,6 +48,7 @@ class openstack_integration::config (
       $messaging_default_port = '5672'
     }
     $messaging_notify_port = '5672'
+    $db_extra = {}
   }
 
   $rabbit_port = $messaging_notify_port

manifests/designate.pp

@@ -47,6 +47,7 @@ class openstack_integration::designate {
       'password' => 'designate',
       'database' => 'designate',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'designate::coordination':

manifests/ec2api.pp

@@ -36,6 +36,7 @@ class openstack_integration::ec2api {
           'password' => 'ec2api',
           'database' => 'ec2api',
           'charset'  => 'utf8',
+          'extra'    => $::openstack_integration::config::db_extra,
         }),
       }
       class { 'ec2api::db::sync': }

manifests/glance.pp

@@ -107,6 +107,7 @@ class openstack_integration::glance (
       'password' => 'glance',
       'database' => 'glance',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'glance::api':

manifests/gnocchi.pp

@@ -42,6 +42,7 @@ class openstack_integration::gnocchi (
       'password' => 'gnocchi',
       'database' => 'gnocchi',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'gnocchi':

manifests/heat.pp

@@ -53,6 +53,7 @@ class openstack_integration::heat (
       'password' => 'heat',
       'database' => 'heat',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'heat':

manifests/ironic.pp

@@ -26,6 +26,7 @@ class openstack_integration::ironic {
       'password' => 'ironic',
       'database' => 'ironic',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'ironic':
@@ -110,6 +111,7 @@ class openstack_integration::ironic {
       'password' => 'ironic-inspector',
       'database' => 'ironic-inspector',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'ironic::inspector::ironic':

manifests/keystone.pp

@@ -57,6 +57,7 @@ class openstack_integration::keystone (
       'password' => 'keystone',
       'database' => 'keystone',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'keystone::logging':

manifests/magnum.pp

@@ -69,6 +69,7 @@ class openstack_integration::magnum (
       'password' => 'magnum',
       'database' => 'magnum',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
 

manifests/manila.pp

@@ -58,6 +58,7 @@ class openstack_integration::manila (
       'password' => 'manila',
       'database' => 'manila',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'manila':

manifests/mistral.pp

@@ -33,6 +33,7 @@ class openstack_integration::mistral {
       'password' => 'mistral',
       'database' => 'mistral',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'mistral':

manifests/murano.pp

@@ -61,6 +61,7 @@ class openstack_integration::murano {
       'password' => 'murano',
       'database' => 'murano',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'murano::keystone::authtoken':

manifests/mysql.pp

@@ -1,13 +1,27 @@
 class openstack_integration::mysql {
 
   include openstack_integration::config
+  include openstack_integration::params
+
+  $mysql_conf_dir = $::openstack_integration::params::mysql_conf_dir
+
+  if $::openstack_integration::config::ssl {
+    openstack_integration::ssl_key { 'mysql':
+      key_path => "${mysql_conf_dir}/${facts['networking']['fqdn']}.pem",
+      require  => Package['mysql-server'],
+      notify   => Service['mysqld'],
+    }
+  }
 
   class { 'mysql::server':
     override_options => {
       'mysqld' => {
         'bind-address' => $::openstack_integration::config::host,
+        'ssl'          => $::openstack_integration::config::ssl,
+        'ssl-ca'       => $::openstack_integration::params::ca_bundle_cert_path,
+        'ssl-cert'     => $::openstack_integration::params::cert_path,
+        'ssl-key'      => "${mysql_conf_dir}/${facts['networking']['fqdn']}.pem",
       },
     },
   }
-
 }

manifests/neutron.pp

@@ -234,6 +234,7 @@ class openstack_integration::neutron (
       'password' => 'neutron',
       'database' => 'neutron',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'neutron::server':

manifests/nova.pp

@@ -111,6 +111,7 @@ class openstack_integration::nova (
       'password' => 'nova',
       'database' => 'nova',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
     api_database_connection => os_database_connection({
       'dialect'  => 'mysql+pymysql',
@@ -119,6 +120,7 @@ class openstack_integration::nova (
       'password' => 'nova',
       'database' => 'nova_api',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'nova':

manifests/octavia.pp

@@ -40,6 +40,7 @@ class openstack_integration::octavia (
       'password' => 'octavia',
       'database' => 'octavia',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'octavia':

manifests/params.pp

@@ -7,6 +7,7 @@ class openstack_integration::params {
       $update_ca_certs_cmd = '/usr/bin/update-ca-trust force-enable && /usr/bin/update-ca-trust extract'
       $mysql_charset       = 'utf8'
       $mysql_collate       = 'utf8_general_ci'
+      $mysql_conf_dir      = '/etc/my.cnf.d'
     }
     'Debian': {
       $ca_bundle_cert_path = '/etc/ssl/certs/puppet_openstack.pem'
@@ -14,6 +15,7 @@ class openstack_integration::params {
       $update_ca_certs_cmd = '/usr/sbin/update-ca-certificates -f'
       $mysql_charset       = 'utf8mb3'
       $mysql_collate       = 'utf8mb3_general_ci'
+      $mysql_conf_dir      = '/etc/mysql'
     }
     default: {
       fail("Unsupported osfamily: ${facts['os']['family']} operatingsystem")

manifests/placement.pp

@@ -48,6 +48,7 @@ class openstack_integration::placement {
       'password' => 'placement',
       'database' => 'placement',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   include placement::db::sync

manifests/sahara.pp

@@ -48,6 +48,7 @@ class openstack_integration::sahara (
       'password' => 'sahara',
       'database' => 'sahara',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'sahara':

manifests/trove.pp

@@ -27,6 +27,7 @@ class openstack_integration::trove {
       'password' => 'trove',
       'database' => 'trove',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'trove':

manifests/vitrage.pp

@@ -31,6 +31,7 @@ class openstack_integration::vitrage {
       'password' => 'vitrage',
       'database' => 'vitrage',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
 

manifests/watcher.pp

@@ -29,6 +29,7 @@ class openstack_integration::watcher {
       'password' => 'watcher',
       'database' => 'watcher',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
   }
   class { 'watcher::keystone::auth':

manifests/zaqar.pp

@@ -38,8 +38,8 @@ class openstack_integration::zaqar {
       'password' => 'zaqar',
       'database' => 'zaqar',
       'charset'  => 'utf8',
+      'extra'    => $::openstack_integration::config::db_extra,
     }),
-
   }
   class {'zaqar::messaging::swift':
     auth_url => "${::openstack_integration::config::keystone_auth_uri}/v3",