openstack
/
tripleo-heat-templates
Code Issues Proposed changes

docker/all: Bind-mount OpenSSL CA bundle 

The containers also need to trust the CA's that the overcloud node
trusts, else we'll get SSL verification failures.

bp tls-via-certmonger-containers

Change-Id: I7d3412a6273777712db2c90522e365c413567c49
This commit is contained in:
Juan Antonio Osorio Robles 2017-04-11 11:43:06 +00:00
parent 87f41c6ec6
commit 39f63c5efa
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
docker/docker-puppet.py
View File

@ -202,6 +202,12 @@ def mp_puppet_config((config_volume, puppet_tags, manifest, config_image, volume
'--volume', '/usr/share/openstack-puppet/modules/:/usr/share/openstack-puppet/modules/:ro',
'--volume', '/var/lib/config-data/:/var/lib/config-data/:rw',
'--volume', 'tripleo_logs:/var/log/tripleo/',
# OpenSSL trusted CA injection
'--volume', '/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro',
'--volume', '/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro',
'--volume', '/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro',
'--volume', '/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro',
# script injection
'--volume', '%s:%s:rw' % (sh_script, sh_script) ]
for volume in volumes: