Merge "Add TLS capabilities to Memcached service" into stable/train

deployment/memcached/memcached-container-puppet.yaml

@@ -66,8 +66,13 @@ parameters:
                  of the internal network. Use this parameter with caution and be aware of
                  opening memcached to external network can be dangerous.
     type: string
+  MemcachedTLS:
+    default: false
+    description: Set to True to enable TLS on Memcached service.
+    type: boolean
 
 conditions:
+  internal_tls_enabled: {equals: [{get_param: MemcachedTLS}, true]}
   memcached_network_unset: {equals : [{get_param: MemcachedIpSubnet}, '']}
   service_debug:
     or:
@@ -87,6 +92,8 @@ outputs:
       service_name: memcached
       monitoring_subscription: {get_param: MonitoringSubscriptionMemcached}
       config_settings:
+        map_merge:
+          -
             # NOTE: bind IP is found in hiera replacing the network name with the local node IP
             # for the given network; replacement examples (eg. for internal_api):
             # internal_api -> IP
@@ -144,6 +151,27 @@ outputs:
                     proto: 'tcp'
                     source: {get_param: MemcachedIpSubnet}
             memcached::logstdout: true
+            tripleo::profile::base::memcached::enable_internal_memcached_tls: {get_param: MemcachedTLS}
+          -
+            if:
+            - internal_tls_enabled
+            - generate_service_certificates: true
+              tripleo::memcached::service_certificate: '/etc/pki/tls/certs/memcached.crt'
+              tripleo::profile::base::memcached::certificate_specs:
+                service_certificate: '/etc/pki/tls/certs/memcached.crt'
+                service_key: '/etc/pki/tls/private/memcached.key'
+                hostname:
+                  str_replace:
+                    template: "%{hiera('fqdn_$NETWORK')}"
+                    params:
+                      $NETWORK: {get_param: [ServiceNetMap, MemcachedNetwork]}
+                principal:
+                  str_replace:
+                    template: "memcached/%{hiera('fqdn_$NETWORK')}"
+                    params:
+                      $NETWORK: {get_param: [ServiceNetMap, MemcachedNetwork]}
+                postsave_cmd: "/usr/bin/certmonger-memcached-refresh.sh"
+            - {}
       service_config_settings:
         collectd:
             tripleo.collectd.plugins.memcached:
@@ -167,10 +195,21 @@ outputs:
               dest: "/"
               merge: true
               preserve_properties: true
+            - source: "/var/lib/kolla/config_files/src-tls/*"
+              dest: "/"
+              merge: true
+              preserve_properties: true
+              optional: true
           permissions:
             - path: /var/log/memcached
               owner: memcached:memcached
               recurse: true
+            - path: /etc/pki/tls/certs/memcached.crt
+              owner: memcached:memcached
+              optional: true
+            - path: /etc/pki/tls/private/memcached.key
+              owner: memcached:memcached
+              optional: true
       docker_config:
         step_1:
           memcached:
@@ -188,8 +227,22 @@ outputs:
                   - /var/lib/kolla/config_files/memcached.json:/var/lib/kolla/config_files/config.json:ro
                   - /var/lib/config-data/puppet-generated/memcached:/var/lib/kolla/config_files/src:rw,z
                   - /var/log/containers/memcached:/var/log/memcached:rw
+                - if:
+                  - internal_tls_enabled
+                  -
+                    - /etc/pki/tls/certs/memcached.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/memcached.crt:ro
+                    - /etc/pki/tls/private/memcached.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/memcached.key:ro
+                  - null
             environment:
               KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
+      metadata_settings:
+        if:
+          - internal_tls_enabled
+          -
+            - service: memcached
+              network: {get_param: [ServiceNetMap, MemcachedNetwork]}
+              type: node
+          - null
       host_prep_tasks:
         - name: create persistent directories
           file: