openstack/puppet-tripleo
Code Issues Proposed changes

Merge "Add TLS for nova metadata service"

Browse Source
This commit is contained in:
Jenkins
2017-08-19 03:06:40 +00:00
committed by Gerrit Code Review
parent f7d34f038d 264f22835a
commit c34163c79b
2 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
manifests/haproxy.pp
View File

@@ -1035,6 +1035,7 @@ class tripleo::haproxy (
'option' => [ 'httpchk', ], 'option' => [ 'httpchk', ],
}, },
service_network => $nova_metadata_network, service_network => $nova_metadata_network,
member_options => union($haproxy_member_options, $internal_tls_member_options),
} }
} }

40
manifests/profile/base/nova/api.pp
View File

@@ -46,18 +46,42 @@
# Nova Team discourages it. # Nova Team discourages it.
# Defaults to hiera('nova_wsgi_enabled', false) # Defaults to hiera('nova_wsgi_enabled', false)
# #
# [*nova_metadata_network*]
# (Optional) The network name where the nova metadata endpoint is listening on.
# This is set by t-h-t.
# Defaults to hiera('nova_metadata_network', undef)
#
# [*step*] # [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates # (Optional) The current step in deployment. See tripleo-heat-templates
# for more details. # for more details.
# Defaults to hiera('step') # Defaults to hiera('step')
# #
# [*metadata_tls_proxy_bind_ip*]
# IP on which the TLS proxy will listen on. Required only if
# enable_internal_tls is set.
# Defaults to undef
#
# [*metadata_tls_proxy_fqdn*]
# fqdn on which the tls proxy will listen on. required only used if
# enable_internal_tls is set.
# defaults to undef
#
# [*metadata_tls_proxy_port*]
# port on which the tls proxy will listen on. Only used if
# enable_internal_tls is set.
# defaults to 8080
#
class tripleo::profile::base::nova::api ( class tripleo::profile::base::nova::api (
$bootstrap_node = hiera('bootstrap_nodeid', undef), $bootstrap_node = hiera('bootstrap_nodeid', undef),
$certificates_specs = hiera('apache_certificates_specs', {}), $certificates_specs = hiera('apache_certificates_specs', {}),
$enable_internal_tls = hiera('enable_internal_tls', false), $enable_internal_tls = hiera('enable_internal_tls', false),
$nova_api_network = hiera('nova_api_network', undef), $nova_api_network = hiera('nova_api_network', undef),
$nova_api_wsgi_enabled = hiera('nova_wsgi_enabled', false), $nova_api_wsgi_enabled = hiera('nova_wsgi_enabled', false),
$nova_metadata_network = hiera('nova_metadata_network', undef),
$step = Integer(hiera('step')), $step = Integer(hiera('step')),
$metadata_tls_proxy_bind_ip = undef,
$metadata_tls_proxy_fqdn = undef,
$metadata_tls_proxy_port = 8775,
) { ) {
if $::hostname == downcase($bootstrap_node) { if $::hostname == downcase($bootstrap_node) {
$sync_db = true $sync_db = true
@@ -73,6 +97,22 @@ class tripleo::profile::base::nova::api (
} }
if $step >= 4 or ($step >= 3 and $sync_db) { if $step >= 4 or ($step >= 3 and $sync_db) {
if $enable_internal_tls {
if !$nova_metadata_network {
fail('nova_metadata_network is not set in the hieradata.')
}
$metadata_tls_certfile = $certificates_specs["httpd-${nova_metadata_network}"]['service_certificate']
$metadata_tls_keyfile = $certificates_specs["httpd-${nova_metadata_network}"]['service_key']
::tripleo::tls_proxy { 'nova-metadata-api':
servername => $metadata_tls_proxy_fqdn,
ip => $metadata_tls_proxy_bind_ip,
port => $metadata_tls_proxy_port,
tls_cert => $metadata_tls_certfile,
tls_key => $metadata_tls_keyfile,
}
Tripleo::Tls_proxy['nova-metadata-api'] ~> Anchor<| title == 'nova::service::begin' |>
}
class { '::nova::api': class { '::nova::api':
sync_db => $sync_db, sync_db => $sync_db,