Merge "Qdr: InternalTLS support."
This commit is contained in:
commit
ca2985bf8f
24
files/certmonger-metrics-qdr-refresh.sh
Normal file
24
files/certmonger-metrics-qdr-refresh.sh
Normal file
@ -0,0 +1,24 @@
|
||||
#!/bin/bash
|
||||
|
||||
|
||||
container_cli=$(hiera -c /etc/puppet/hiera.yaml container_cli docker)
|
||||
|
||||
container_name=$($container_cli ps --format="{{.Names}}" | grep metrics_qdr)
|
||||
|
||||
service_certificate="$(hiera -c /etc/puppet/hiera.yaml tripleo::metrics::qdr::service_certificate)"
|
||||
|
||||
service_key="$(hiera -c /etc/puppet/hiera.yaml tripleo::metrics::qdr::service_key)"
|
||||
|
||||
# Copy the new cert from the mount-point to the real path
|
||||
$container_cli exec "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_certificate" "$service_certificate"
|
||||
|
||||
# Copy the new key from the mount-point to the real path
|
||||
$container_cli exec "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_key" "$service_key"
|
||||
|
||||
# Set appropriate permissions
|
||||
$container_cli exec "$container_name" chown qdrouterd:qdrouterd "$service_certificate"
|
||||
|
||||
$container_cli exec "$container_name" chown qdrouterd:qdrouterd "$service_key"
|
||||
|
||||
# Trigger a container restart to read the new certificates
|
||||
$container_cli restart $container_name
|
89
manifests/certmonger/metrics_qdr.pp
Normal file
89
manifests/certmonger/metrics_qdr.pp
Normal file
@ -0,0 +1,89 @@
|
||||
# Copyright 2016 Red Hat, Inc.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
#
|
||||
# == Class: tripleo::certmonger::metrics_qdr
|
||||
#
|
||||
# Request a certificate for the MetricsQdr service and do the necessary setup.
|
||||
#
|
||||
# === Parameters
|
||||
#
|
||||
# [*hostname*]
|
||||
# The hostname of the node. this will be set in the CN of the certificate.
|
||||
#
|
||||
# [*service_certificate*]
|
||||
# The path to the certificate that will be used for TLS in this service.
|
||||
#
|
||||
# [*service_key*]
|
||||
# The path to the key that will be used for TLS in this service.
|
||||
#
|
||||
# [*certmonger_ca*]
|
||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
||||
# Defaults to hiera('certmonger_ca', 'local').
|
||||
#
|
||||
# [*dnsnames*]
|
||||
# (Optional) The DNS names that will be added for the SubjectAltNames entry
|
||||
# in the certificate. If left unset, the value will be set to the $hostname.
|
||||
# This parameter can take both a string or an array of strings.
|
||||
# Defaults to $hostname
|
||||
#
|
||||
# [*postsave_cmd*]
|
||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
||||
# If nothing is given, it will default to: "systemctl restart ${service name}"
|
||||
# Defaults to undef.
|
||||
#
|
||||
# [*principal*]
|
||||
# (Optional) The haproxy service principal that is set for metrics_qdr in kerberos.
|
||||
# Defaults to undef
|
||||
#
|
||||
class tripleo::certmonger::metrics_qdr (
|
||||
$hostname,
|
||||
$service_certificate,
|
||||
$service_key,
|
||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
||||
$postsave_cmd = undef,
|
||||
$principal = undef,
|
||||
) {
|
||||
include ::certmonger
|
||||
include ::qdr::params
|
||||
|
||||
ensure_resource('file', '/usr/bin/certmonger-metrics-qdr-refresh.sh', {
|
||||
source => 'puppet:///modules/tripleo/certmonger-metrics-qdr-refresh.sh',
|
||||
mode => '0700',
|
||||
seltype => 'bin_t',
|
||||
notify => Service['certmonger']
|
||||
})
|
||||
|
||||
certmonger_certificate { 'metrics_qdr' :
|
||||
ensure => 'present',
|
||||
certfile => $service_certificate,
|
||||
keyfile => $service_key,
|
||||
hostname => $hostname,
|
||||
dnsname => $hostname,
|
||||
principal => $principal,
|
||||
postsave_cmd => $postsave_cmd,
|
||||
ca => $certmonger_ca,
|
||||
wait => true,
|
||||
require => Class['::certmonger'],
|
||||
}
|
||||
|
||||
file { $service_certificate :
|
||||
require => Certmonger_certificate['metrics_qdr'],
|
||||
}
|
||||
file { $service_key :
|
||||
require => Certmonger_certificate['metrics_qdr'],
|
||||
}
|
||||
|
||||
File[$service_certificate] ~> Service<| title == $::qdr::params::service_name |>
|
||||
File[$service_key] ~> Service<| title == $::qdr::params::service_name |>
|
||||
}
|
@ -82,6 +82,11 @@
|
||||
# certificate is renewed.
|
||||
# Defaults to undef
|
||||
#
|
||||
# [*qdr_certificate_specs*]
|
||||
# (Optional) The specifications to give to certmonger fot the certificate(s)
|
||||
# it will create.
|
||||
# Defaults to hiera('tripleo::profile::base::metrics::qdr::certificate_specs', {}).
|
||||
#
|
||||
# [*mysql_certificate_specs*]
|
||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
||||
# it will create.
|
||||
@ -150,6 +155,7 @@ class tripleo::profile::base::certmonger_user (
|
||||
$libvirt_vnc_postsave_cmd = undef,
|
||||
$qemu_certificates_specs = hiera('qemu_certificates_specs', {}),
|
||||
$qemu_postsave_cmd = undef,
|
||||
$qdr_certificate_specs = hiera('tripleo::profile::base::metrics::qdr::certificate_specs', {}),
|
||||
$mysql_certificate_specs = hiera('tripleo::profile::base::database::mysql::certificate_specs', {}),
|
||||
$rabbitmq_certificate_specs = hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}),
|
||||
$redis_certificate_specs = hiera('redis_certificate_specs', {}),
|
||||
@ -217,6 +223,9 @@ class tripleo::profile::base::certmonger_user (
|
||||
# existing and need to be refreshed if it changed.
|
||||
Tripleo::Certmonger::Haproxy<||> ~> Haproxy::Listen<||>
|
||||
}
|
||||
unless empty($qdr_certificate_specs) {
|
||||
ensure_resource('class', 'tripleo::certmonger::metrics_qdr', $qdr_certificate_specs)
|
||||
}
|
||||
unless empty($mysql_certificate_specs) {
|
||||
ensure_resource('class', 'tripleo::certmonger::mysql', $mysql_certificate_specs)
|
||||
}
|
||||
|
@ -35,6 +35,18 @@
|
||||
# This argument must be string, even if the numeric form is used.
|
||||
# Defaults to '5666'
|
||||
#
|
||||
# [*certificate_specs*]
|
||||
# (optional) The specification to give to certmonger for the certificate
|
||||
# it will create. Note that the certificate nickname must be 'qdr' in
|
||||
# the case of this service.
|
||||
# Example with hiera:
|
||||
# tripleo::profile::base::metrics::qdr::certificate_specs:
|
||||
# hostname: <overcloud controller fqdn>
|
||||
# service_certificate: <service certificate path>
|
||||
# service_key: <service key path>
|
||||
# principal: "qdr/<overcloud controller fqdn>"
|
||||
# Defaults to {}.
|
||||
#
|
||||
# [*listener_require_encrypt*]
|
||||
# (optional) Require the connection to the peer to be encrypted
|
||||
# Defaults to 'no'
|
||||
@ -98,6 +110,7 @@ class tripleo::profile::base::metrics::qdr (
|
||||
$password = undef,
|
||||
$listener_addr = 'localhost',
|
||||
$listener_port = '5666',
|
||||
$certificate_specs = {},
|
||||
$listener_require_ssl = false,
|
||||
$listener_require_encrypt = false,
|
||||
$listener_sasl_mech = undef,
|
||||
|
Loading…
Reference in New Issue
Block a user