Fixes missing SSL configuration for Neutron DHCP agent

Currently when deploying with TLS for internal API traffic, Neutron is
not configured to securely communicate with OVSDB.  In regular OVS agent
deployments OVS listens on ptcp and accepts any incoming connection.  In
ODL deployments OVS is configured to only listen for pssl connections.
To allow Neutron agents to communicate with OVSDB in pssl, Neutron needs
to be configured with SSL key/certificate in order to connect to OVS.

This patch adds key/certificate generation for NeutronBase service to be
consumed by any agent.  The only agent required with ODL is DHCP, so
this patch only addresses configuring SSL there.  However, a future
patch could enable SSL for default ML2/OVS agent deployments as well by
building off of this change.

Note, by default OVSDB listens on port 6640.  This does not work in ODL
deployments when ODL is on the control node because ODL also listens
on port 6640.  Therefore from the ODL service, the ovsdb_connection
setting for DHCP agent is modified when ODL is deployed.

Depends-On: I82281eefa1aa81207ccd8ea565cffc6ca0ec48de
Depends-On: I4bbaf00f0776cab0be34d814a541fb2fd1e64326

Closes-Bug: 1746762

Change-Id: I97352027d7f750d0820610fb9e06f82b47e77056
Signed-off-by: Tim Rozet <trozet@redhat.com>
This commit is contained in:
Tim Rozet 2018-02-01 17:06:10 -05:00
parent c4bd454739
commit 2adb2b6f57
5 changed files with 87 additions and 0 deletions

View File

@ -36,6 +36,18 @@ parameters:
default: {} default: {}
description: Parameters specific to the role description: Parameters specific to the role
type: json type: json
EnableInternalTLS:
type: boolean
default: false
InternalTLSCAFile:
default: '/etc/ipa/ca.crt'
type: string
description: Specifies the default CA cert to use if TLS is used for
services in the internal network.
conditions:
internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]}
resources: resources:
@ -64,6 +76,10 @@ outputs:
map_merge: map_merge:
- get_attr: [NeutronBase, role_data, config_settings] - get_attr: [NeutronBase, role_data, config_settings]
- get_attr: [NeutronLogging, config_settings] - get_attr: [NeutronLogging, config_settings]
- if:
- internal_tls_enabled
- tripleo::certmonger::neutron::postsave_cmd: "true" # TODO: restart the container here
- {}
logging_source: {get_attr: [NeutronBase, role_data, logging_source]} logging_source: {get_attr: [NeutronBase, role_data, logging_source]}
logging_groups: {get_attr: [NeutronBase, role_data, logging_groups]} logging_groups: {get_attr: [NeutronBase, role_data, logging_groups]}
service_config_settings: {get_attr: [NeutronBase, role_data, service_config_settings]} service_config_settings: {get_attr: [NeutronBase, role_data, service_config_settings]}
@ -110,8 +126,21 @@ outputs:
- /lib/modules:/lib/modules:ro - /lib/modules:/lib/modules:ro
- /run/openvswitch:/run/openvswitch - /run/openvswitch:/run/openvswitch
- /var/lib/neutron:/var/lib/neutron - /var/lib/neutron:/var/lib/neutron
-
if:
- internal_tls_enabled
- - /etc/pki/tls/certs/neutron.crt:/etc/pki/tls/certs/neutron.crt:ro
- /etc/pki/tls/private/neutron.key:/etc/pki/tls/private/neutron.key:ro
- list_join:
- ':'
- - {get_param: InternalTLSCAFile}
- {get_param: InternalTLSCAFile}
- 'ro'
- null
environment: environment:
- KOLLA_CONFIG_STRATEGY=COPY_ALWAYS - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
metadata_settings:
get_attr: [NeutronBase, role_data, metadata_settings]
host_prep_tasks: host_prep_tasks:
list_concat: list_concat:
- {get_attr: [NeutronLogging, host_prep_tasks]} - {get_attr: [NeutronLogging, host_prep_tasks]}

View File

@ -113,10 +113,14 @@ parameters:
description: Driver or drivers to handle sending notifications. description: Driver or drivers to handle sending notifications.
constraints: constraints:
- allowed_values: [ 'messagingv2', 'noop' ] - allowed_values: [ 'messagingv2', 'noop' ]
EnableInternalTLS:
type: boolean
default: false
conditions: conditions:
dhcp_agents_zero: {equals : [{get_param: NeutronDhcpAgentsPerNetwork}, 0]} dhcp_agents_zero: {equals : [{get_param: NeutronDhcpAgentsPerNetwork}, 0]}
service_debug_unset: {equals : [{get_param: NeutronDebug}, '']} service_debug_unset: {equals : [{get_param: NeutronDebug}, '']}
internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]}
outputs: outputs:
role_data: role_data:
@ -152,3 +156,28 @@ outputs:
- dhcp_agents_zero - dhcp_agents_zero
- {} - {}
- tripleo::profile::base::neutron::dhcp_agents_per_network: {get_param: NeutronDhcpAgentsPerNetwork} - tripleo::profile::base::neutron::dhcp_agents_per_network: {get_param: NeutronDhcpAgentsPerNetwork}
- if:
- internal_tls_enabled
- generate_service_certificates: true
tripleo::profile::base::neutron::certificate_specs:
service_certificate: '/etc/pki/tls/certs/neutron.crt'
service_key: '/etc/pki/tls/private/neutron.key'
hostname:
str_replace:
template: "%{hiera('fqdn_NETWORK')}"
params:
NETWORK: {get_param: [ServiceNetMap, NeutronApiNetwork]}
principal:
str_replace:
template: "neutron/%{hiera('fqdn_NETWORK')}"
params:
NETWORK: {get_param: [ServiceNetMap, NeutronApiNetwork]}
- null
metadata_settings:
if:
- internal_tls_enabled
-
- service: neutron
network: {get_param: [ServiceNetMap, NeutronApiNetwork]}
type: node
- null

View File

@ -69,9 +69,18 @@ parameters:
default: 'neutron.agent.linux.interface.OVSInterfaceDriver' default: 'neutron.agent.linux.interface.OVSInterfaceDriver'
description: Neutron DHCP Agent interface driver description: Neutron DHCP Agent interface driver
type: string type: string
EnableInternalTLS:
type: boolean
default: false
InternalTLSCAFile:
default: '/etc/ipa/ca.crt'
type: string
description: Specifies the default CA cert to use if TLS is used for
services in the internal network.
conditions: conditions:
service_debug_unset: {equals: [{get_param: NeutronDhcpAgentDebug}, '']} service_debug_unset: {equals: [{get_param: NeutronDhcpAgentDebug}, '']}
internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]}
resources: resources:
@ -112,6 +121,12 @@ outputs:
proto: 'udp' proto: 'udp'
chain: 'OUTPUT' chain: 'OUTPUT'
dport: 68 dport: 68
- if:
- internal_tls_enabled
- neutron::agents::dhcp::ovsdb_agent_ssl_key_file: '/etc/pki/tls/private/neutron.key'
neutron::agents::dhcp::ovsdb_agent_ssl_cert_file: '/etc/pki/tls/certs/neutron.crt'
neutron::agents::dhcp::ovsdb_agent_ssl_ca_file: {get_param: InternalTLSCAFile}
- {}
service_config_settings: service_config_settings:
fluentd: fluentd:
tripleo_fluentd_groups_neutron_dhcp: tripleo_fluentd_groups_neutron_dhcp:
@ -137,3 +152,5 @@ outputs:
- step|int == 1 - step|int == 1
- neutron_dhcp_agent_enabled.rc == 0 - neutron_dhcp_agent_enabled.rc == 0
service: name=neutron-dhcp-agent state=stopped service: name=neutron-dhcp-agent state=stopped
metadata_settings:
get_attr: [NeutronBase, role_data, metadata_settings]

View File

@ -160,6 +160,12 @@ outputs:
opendaylight::tls_ca_cert_file: {get_param: InternalTLSCAFile} opendaylight::tls_ca_cert_file: {get_param: InternalTLSCAFile}
opendaylight::tls_keystore_password: {get_param: OpenDaylightTLSKeystorePassword} opendaylight::tls_keystore_password: {get_param: OpenDaylightTLSKeystorePassword}
- {} - {}
service_config_settings:
neutron_dhcp:
if:
- internal_tls_enabled
- neutron::agents::dhcp::ovsdb_connection: 'ssl:127.0.0.1:6639'
- neutron::agents::dhcp::ovsdb_connection: 'tcp:127.0.0.1:6639'
step_config: | step_config: |
include tripleo::profile::base::neutron::opendaylight include tripleo::profile::base::neutron::opendaylight
upgrade_tasks: upgrade_tasks:

View File

@ -0,0 +1,6 @@
---
fixes:
- |
Fixes issue in OpenDaylight deployments where SSL between Neutron DHCP
agent with OVS did not work due to missing SSL certificate/key
configuration.