Copy ovn ssl certs and keys to config directories
Currently some AVC denials are appearing in audit.log, because neutron and octavia are not allowed to access to cert/key files in openvswitch directories. This change ensures these cert/key files are copied to individual config directories. Change-Id: I79b8603fe61e42d8444dc2fee77725434da9c69c
This commit is contained in:
Takashi Kajinami
parent
47ea9d4991
commit
a0372071ba
@ -40,6 +40,7 @@ class openstack_integration::config (
|
||||
$db_extra = {
|
||||
'ssl_ca' => $::openstack_integration::params::ca_bundle_cert_path,
|
||||
}
|
||||
$ovn_proto = 'ssl'
|
||||
} else {
|
||||
$proto = 'http'
|
||||
if $rpc_backend == 'amqp' {
|
||||
@ -49,6 +50,7 @@ class openstack_integration::config (
|
||||
}
|
||||
$messaging_notify_port = '5672'
|
||||
$db_extra = {}
|
||||
$ovn_proto = 'tcp'
|
||||
}
|
||||
|
||||
$rabbit_port = $messaging_notify_port
|
||||
@ -76,4 +78,7 @@ class openstack_integration::config (
|
||||
$keystone_auth_uri = "${base_url}:5000"
|
||||
$keystone_admin_uri = "${base_url}:5000"
|
||||
$tooz_url = "redis://:a_big_secret@${ip_for_url}:6379?ssl=${::openstack_integration::config::ssl}"
|
||||
|
||||
$ovn_nb_connection = "${ovn_proto}:${ip_for_url}:6641"
|
||||
$ovn_sb_connection = "${ovn_proto}:${ip_for_url}:6642"
|
||||
}
|
||||
|
||||
@ -53,6 +53,36 @@ class openstack_integration::neutron (
|
||||
require => Package['neutron'],
|
||||
}
|
||||
Exec['update-ca-certificates'] ~> Service<| tag == 'neutron-service' |>
|
||||
|
||||
if $driver == 'ovn' {
|
||||
['ovnnb', 'ovnsb'].each |$ovndb| {
|
||||
["${ovndb}-privkey.pem", "${ovndb}-cert.pem"].each |$ovn_ssl_file| {
|
||||
file { "/etc/neutron/${ovn_ssl_file}":
|
||||
ensure => present,
|
||||
owner => 'neutron',
|
||||
mode => '0600',
|
||||
source => "/etc/openvswitch/${ovn_ssl_file}",
|
||||
require => [
|
||||
Anchor['neutron::install::end'],
|
||||
Vswitch::Pki::Cert[$ovndb]
|
||||
],
|
||||
notify => Anchor['neutron::service::begin'],
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
file { '/etc/neutron/switchcacert.pem':
|
||||
ensure => present,
|
||||
owner => 'neutron',
|
||||
mode => '0600',
|
||||
source => '/var/lib/openvswitch/pki/switchca/cacert.pem',
|
||||
require => [
|
||||
Anchor['neutron::install::end'],
|
||||
Class['vswitch::pki::Cacert'],
|
||||
],
|
||||
notify => Anchor['neutron::service::begin'],
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if $facts['os']['name'] == 'CentOS' {
|
||||
@ -279,24 +309,19 @@ class openstack_integration::neutron (
|
||||
}
|
||||
}
|
||||
'ovn': {
|
||||
include openstack_integration::ovn
|
||||
# NOTE(tkajinam): neutron::plugins::ml2::ovn requires neutron::plugins::ml2,
|
||||
# thus it should be included after neutron::plugins::ml2.
|
||||
class { 'neutron::plugins::ml2::ovn':
|
||||
ovn_nb_connection => $::openstack_integration::ovn::ovn_nb_connection,
|
||||
ovn_nb_private_key => $::openstack_integration::ovn::ovn_nb_db_ssl_key,
|
||||
ovn_nb_certificate => $::openstack_integration::ovn::ovn_nb_db_ssl_cert,
|
||||
ovn_nb_ca_cert => $::openstack_integration::ovn::ovn_nb_db_ssl_ca_cert,
|
||||
ovn_sb_connection => $::openstack_integration::ovn::ovn_sb_connection,
|
||||
ovn_sb_private_key => $::openstack_integration::ovn::ovn_sb_db_ssl_key,
|
||||
ovn_sb_certificate => $::openstack_integration::ovn::ovn_sb_db_ssl_cert,
|
||||
ovn_sb_ca_cert => $::openstack_integration::ovn::ovn_sb_db_ssl_ca_cert,
|
||||
ovn_nb_connection => $::openstack_integration::config::ovn_nb_connection,
|
||||
ovn_nb_private_key => '/etc/neutron/ovnnb-privkey.pem',
|
||||
ovn_nb_certificate => '/etc/neutron/ovnnb-cert.pem',
|
||||
ovn_nb_ca_cert => '/etc/neutron/switchcacert.pem',
|
||||
ovn_sb_connection => $::openstack_integration::config::ovn_sb_connection,
|
||||
ovn_sb_private_key => '/etc/neutron/ovnsb-privkey.pem',
|
||||
ovn_sb_certificate => '/etc/neutron/ovnsb-cert.pem',
|
||||
ovn_sb_ca_cert => '/etc/neutron/switchcacert.pem',
|
||||
ovn_metadata_enabled => true,
|
||||
}
|
||||
if $::openstack_integration::config::ssl {
|
||||
File['/etc/openvswitch/ovnnb-privkey.pem'] -> Anchor['neutron::config::end']
|
||||
File['/etc/openvswitch/ovnsb-privkey.pem'] -> Anchor['neutron::config::end']
|
||||
}
|
||||
}
|
||||
'linuxbridge': {
|
||||
class { 'neutron::agents::ml2::linuxbridge':
|
||||
@ -328,10 +353,10 @@ class openstack_integration::neutron (
|
||||
shared_secret => 'a_big_secret',
|
||||
metadata_host => $metadata_host,
|
||||
metadata_protocol => $metadata_protocol,
|
||||
ovn_sb_connection => $::openstack_integration::ovn::ovn_sb_connection,
|
||||
ovn_sb_private_key => $::openstack_integration::ovn::ovn_sb_db_ssl_key,
|
||||
ovn_sb_certificate => $::openstack_integration::ovn::ovn_sb_db_ssl_cert,
|
||||
ovn_sb_ca_cert => $::openstack_integration::ovn::ovn_sb_db_ssl_ca_cert,
|
||||
ovn_sb_connection => $::openstack_integration::config::ovn_sb_connection,
|
||||
ovn_sb_private_key => '/etc/neutron/ovnsb-privkey.pem',
|
||||
ovn_sb_certificate => '/etc/neutron/ovnsb-cert.pem',
|
||||
ovn_sb_ca_cert => '/etc/neutron/switchcacert.pem',
|
||||
}
|
||||
} else {
|
||||
class { 'neutron::agents::metadata':
|
||||
|
||||
@ -27,6 +27,36 @@ class openstack_integration::octavia (
|
||||
require => Package['octavia'],
|
||||
}
|
||||
Exec['update-ca-certificates'] ~> Service['httpd']
|
||||
|
||||
if $provider_driver == 'ovn' {
|
||||
['ovnnb', 'ovnsb'].each |$ovndb| {
|
||||
["${ovndb}-privkey.pem", "${ovndb}-cert.pem"].each |$ovn_ssl_file| {
|
||||
file { "/etc/octavia/${ovn_ssl_file}":
|
||||
ensure => present,
|
||||
owner => 'octavia',
|
||||
mode => '0600',
|
||||
source => "/etc/openvswitch/${ovn_ssl_file}",
|
||||
require => [
|
||||
Anchor['octavia::install::end'],
|
||||
Vswitch::Pki::Cert[$ovndb]
|
||||
],
|
||||
notify => Anchor['octavia::service::begin'],
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
file { '/etc/octavia/switchcacert.pem':
|
||||
ensure => present,
|
||||
owner => 'octavia',
|
||||
mode => '0600',
|
||||
source => '/var/lib/openvswitch/pki/switchca/cacert.pem',
|
||||
require => [
|
||||
Anchor['octavia::install::end'],
|
||||
Class['vswitch::pki::Cacert'],
|
||||
],
|
||||
notify => Anchor['octavia::service::begin'],
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
class { 'octavia::logging':
|
||||
@ -129,20 +159,15 @@ class openstack_integration::octavia (
|
||||
}
|
||||
$enabled_provider_agents = 'ovn'
|
||||
|
||||
include openstack_integration::ovn
|
||||
class { 'octavia::provider::ovn':
|
||||
ovn_nb_connection => $::openstack_integration::ovn::ovn_nb_connection,
|
||||
ovn_nb_private_key => $::openstack_integration::ovn::ovn_nb_db_ssl_key,
|
||||
ovn_nb_certificate => $::openstack_integration::ovn::ovn_nb_db_ssl_cert,
|
||||
ovn_nb_ca_cert => $::openstack_integration::ovn::ovn_nb_db_ssl_ca_cert,
|
||||
ovn_sb_connection => $::openstack_integration::ovn::ovn_sb_connection,
|
||||
ovn_sb_private_key => $::openstack_integration::ovn::ovn_sb_db_ssl_key,
|
||||
ovn_sb_certificate => $::openstack_integration::ovn::ovn_sb_db_ssl_cert,
|
||||
ovn_sb_ca_cert => $::openstack_integration::ovn::ovn_sb_db_ssl_ca_cert,
|
||||
}
|
||||
if $::openstack_integration::config::ssl {
|
||||
File['/etc/openvswitch/ovnnb-privkey.pem'] -> Anchor['octavia::config::end']
|
||||
File['/etc/openvswitch/ovnsb-privkey.pem'] -> Anchor['octavia::config::end']
|
||||
ovn_nb_connection => $::openstack_integration::config::ovn_nb_connection,
|
||||
ovn_nb_private_key => '/etc/octavia/ovnnb-privkey.pem',
|
||||
ovn_nb_certificate => '/etc/octavia/ovnnb-cert.pem',
|
||||
ovn_nb_ca_cert => '/etc/octavia/switchcacert.pem',
|
||||
ovn_sb_connection => $::openstack_integration::config::ovn_sb_connection,
|
||||
ovn_sb_private_key => '/etc/octavia/ovnsb-privkey.pem',
|
||||
ovn_sb_certificate => '/etc/octavia/ovnsb-cert.pem',
|
||||
ovn_sb_ca_cert => '/etc/octavia/switchcacert.pem',
|
||||
}
|
||||
} else{
|
||||
$enabled_provider_drivers = undef
|
||||
|
||||
@ -10,8 +10,6 @@ class openstack_integration::ovn(
|
||||
class { 'vswitch::pki::cacert': }
|
||||
vswitch::pki::cert { ['ovnnb', 'ovnsb', 'ovncontroller']: }
|
||||
|
||||
$proto = 'ssl'
|
||||
|
||||
$ovn_nb_db_ssl_key = '/etc/openvswitch/ovnnb-privkey.pem'
|
||||
$ovn_nb_db_ssl_cert = '/etc/openvswitch/ovnnb-cert.pem'
|
||||
$ovn_nb_db_ssl_ca_cert = '/var/lib/openvswitch/pki/switchca/cacert.pem'
|
||||
@ -23,31 +21,25 @@ class openstack_integration::ovn(
|
||||
$ovn_controller_ssl_cert = '/etc/openvswitch/ovncontroller-cert.pem'
|
||||
$ovn_controller_ssl_ca_cert = '/var/lib/openvswitch/pki/switchca/cacert.pem'
|
||||
|
||||
# NOTE(tkajinam): ovn-pki generates a private key with 0600, owned by root
|
||||
# but that does not allow access by ovn/neutron/octavia.
|
||||
file { '/etc/openvswitch/ovnnb-privkey.pem':
|
||||
ensure => present,
|
||||
mode => '0644',
|
||||
subscribe => Exec['ovs-req-and-sign-cert-ovnnb'],
|
||||
}
|
||||
file { '/etc/openvswitch/ovnsb-privkey.pem':
|
||||
ensure => present,
|
||||
mode => '0644',
|
||||
subscribe => Exec['ovs-req-and-sign-cert-ovnsb'],
|
||||
}
|
||||
file { '/etc/openvswitch/ovncontroller-privkey.pem':
|
||||
ensure => present,
|
||||
mode => '0644',
|
||||
subscribe => Exec['ovs-req-and-sign-cert-ovncontroller'],
|
||||
['ovnnb', 'ovnsb'].each |$ovndb| {
|
||||
file { "/etc/openvswitch/${ovndb}-privkey.pem":
|
||||
ensure => present,
|
||||
mode => '0600',
|
||||
owner => 'openvswitch',
|
||||
group => 'openvswitch',
|
||||
require => Vswitch::Pki::Cert[$ovndb],
|
||||
} ~> Service['northd']
|
||||
}
|
||||
|
||||
File['/etc/openvswitch/ovnnb-privkey.pem'] -> Service['northd']
|
||||
File['/etc/openvswitch/ovnsb-privkey.pem'] -> Service['northd']
|
||||
File['/etc/openvswitch/ovncontroller-privkey.pem'] -> Service['controller']
|
||||
file { '/etc/openvswitch/ovncontroller-privkey.pem':
|
||||
ensure => present,
|
||||
mode => '0600',
|
||||
owner => 'openvswitch',
|
||||
group => 'openvswitch',
|
||||
require => Vswitch::Pki::Cert['ovncontroller'],
|
||||
} ~> Service['controller']
|
||||
|
||||
} else {
|
||||
$proto = 'tcp'
|
||||
|
||||
$ovn_nb_db_ssl_key = undef
|
||||
$ovn_nb_db_ssl_cert = undef
|
||||
$ovn_nb_db_ssl_ca_cert = undef
|
||||
@ -60,9 +52,6 @@ class openstack_integration::ovn(
|
||||
$ovn_controller_ssl_ca_cert = undef
|
||||
}
|
||||
|
||||
$ovn_nb_connection = "${proto}:${::openstack_integration::config::ip_for_url}:6641"
|
||||
$ovn_sb_connection = "${proto}:${::openstack_integration::config::ip_for_url}:6642"
|
||||
|
||||
class { 'ovn::northd':
|
||||
dbs_listen_ip => $::openstack_integration::config::ip_for_url,
|
||||
ovn_nb_db_ssl_key => $ovn_nb_db_ssl_key,
|
||||
@ -73,7 +62,7 @@ class openstack_integration::ovn(
|
||||
ovn_sb_db_ssl_ca_cert => $ovn_sb_db_ssl_ca_cert,
|
||||
}
|
||||
class { 'ovn::controller':
|
||||
ovn_remote => $ovn_sb_connection,
|
||||
ovn_remote => $::openstack_integration::config::ovn_sb_connection,
|
||||
ovn_encap_ip => $::openstack_integration::config::host,
|
||||
ovn_bridge_mappings => ['external:br-ex'],
|
||||
ovn_cms_options => 'enable-chassis-as-gw',
|
||||
|
||||
Loading…
Reference in New Issue
Block a user