Merge "Redis replication does not work with TLS"

docker/services/database/redis.yaml

@@ -36,19 +36,9 @@ parameters:
     default: {}
     description: Parameters specific to the role
     type: json
-  EnableInternalTLS:
-    type: boolean
-    default: false
-
-conditions:
-
-  internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]}
 
 resources:
 
-  ContainersCommon:
-    type: ../containers-common.yaml
-
   RedisBase:
     type: ../../../puppet/services/database/redis.yaml
     properties:
@@ -66,8 +56,6 @@ outputs:
         map_merge:
           - {get_attr: [RedisBase, role_data, config_settings]}
           - redis::daemonize: false
-            tripleo::stunnel::manage_service: false
-            tripleo::stunnel::foreground: 'yes'
       logging_source: {get_attr: [RedisBase, role_data, logging_source]}
       logging_groups: {get_attr: [RedisBase, role_data, logging_groups]}
       service_config_settings: {get_attr: [RedisBase, role_data, service_config_settings]}
@@ -93,60 +81,31 @@ outputs:
             - path: /var/run/redis
               owner: redis:redis
               recurse: true
-        /var/lib/kolla/config_files/redis_tls_proxy.json:
-          command: stunnel /etc/stunnel/stunnel.conf
-          config_files:
-            - source: "/var/lib/kolla/config_files/src/*"
-              dest: "/"
-              merge: true
-              preserve_properties: true
       docker_config:
         step_1:
-          map_merge:
-            - redis_init_logs:
-                start_order: 0
-                detach: false
-                image: &redis_image {get_param: DockerRedisImage}
-                privileged: false
-                user: root
-                volumes:
-                  - /var/log/containers/redis:/var/log/redis
-                command: ['/bin/bash', '-c', 'chown -R redis:redis /var/log/redis']
-            - redis:
-                start_order: 1
-                image: *redis_image
-                net: host
-                privileged: false
-                restart: always
-                volumes:
-                  - /run:/run
-                  - /var/lib/kolla/config_files/redis.json:/var/lib/kolla/config_files/config.json:ro
-                  - /var/lib/config-data/puppet-generated/redis/:/var/lib/kolla/config_files/src:ro
-                  - /etc/localtime:/etc/localtime:ro
-                  - /var/log/containers/redis:/var/log/redis
-                environment:
-                  - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
-            - if:
-                - internal_tls_enabled
-                - redis_tls_proxy:
-                    start_order: 2
-                    image: *redis_image
-                    net: host
-                    user: root
-                    restart: always
-                    volumes:
-                      list_concat:
-                        - {get_attr: [ContainersCommon, volumes]}
-                        -
-                          - /var/lib/kolla/config_files/redis_tls_proxy.json:/var/lib/kolla/config_files/config.json:ro
-                          - /var/lib/config-data/puppet-generated/redis/:/var/lib/kolla/config_files/src:ro
-                          - /etc/pki/tls/certs/redis.crt:/etc/pki/tls/certs/redis.crt:ro
-                          - /etc/pki/tls/private/redis.key:/etc/pki/tls/private/redis.key:ro
-                    environment:
-                      - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
-                - {}
-      metadata_settings:
-        get_attr: [RedisBase, role_data, metadata_settings]
+          redis_init_logs:
+            start_order: 0
+            detach: false
+            image: &redis_image {get_param: DockerRedisImage}
+            privileged: false
+            user: root
+            volumes:
+              - /var/log/containers/redis:/var/log/redis
+            command: ['/bin/bash', '-c', 'chown -R redis:redis /var/log/redis']
+          redis:
+            start_order: 1
+            image: *redis_image
+            net: host
+            privileged: false
+            restart: always
+            volumes:
+              - /run:/run
+              - /var/lib/kolla/config_files/redis.json:/var/lib/kolla/config_files/config.json:ro
+              - /var/lib/config-data/puppet-generated/redis/:/var/lib/kolla/config_files/src:ro
+              - /etc/localtime:/etc/localtime:ro
+              - /var/log/containers/redis:/var/log/redis
+            environment:
+              - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
       host_prep_tasks:
         - name: create persistent directories
           file:

puppet/services/database/redis-base.yaml

@@ -38,12 +38,6 @@ parameters:
     description: Mapping of service endpoint -> protocol. Typically set
                  via parameter_defaults in the resource registry.
     type: json
-  EnableInternalTLS:
-    type: boolean
-    default: false
-
-conditions:
-  use_tls_proxy: {equals : [{get_param: EnableInternalTLS}, true]}
 
 outputs:
   role_data:
@@ -59,20 +53,10 @@ outputs:
         # internal_api -> IP
         # internal_api_uri -> [IP]
         # internal_api_subnet - > IP/CIDR
-        # Bind to localhost if internal TLS is enabled, since we put a TLs
-        # proxy in front.
-        redis::bind:
-          if:
-          - use_tls_proxy
-          - 'localhost'
-          - {get_param: [ServiceNetMap, RedisNetwork]}
+        redis::bind: {get_param: [ServiceNetMap, RedisNetwork]}
         redis::port: 6379
         redis::sentinel::master_name: "%{hiera('bootstrap_nodeid')}"
         redis::sentinel::redis_host: "%{hiera('bootstrap_nodeid_ip')}"
         redis::sentinel::notification_script: '/usr/local/bin/redis-notifications.sh'
-        redis::sentinel::sentinel_bind:
-          if:
-          - use_tls_proxy
-          - 'localhost'
-          - {get_param: [ServiceNetMap, RedisNetwork]}
+        redis::sentinel::sentinel_bind: {get_param: [ServiceNetMap, RedisNetwork]}
         redis::ulimit: {get_param: RedisFDLimit}

puppet/services/database/redis.yaml

@@ -30,15 +30,8 @@ parameters:
     description: Mapping of service endpoint -> protocol. Typically set
                  via parameter_defaults in the resource registry.
     type: json
-  EnableInternalTLS:
-    type: boolean
-    default: false
-
-conditions:
-  use_tls_proxy: {equals : [{get_param: EnableInternalTLS}, true]}
 
 resources:
-
   RedisBase:
     type: ./redis-base.yaml
     properties:
@@ -48,7 +41,6 @@ resources:
       EndpointMap: {get_param: EndpointMap}
       RoleName: {get_param: RoleName}
       RoleParameters: {get_param: RoleParameters}
-      EnableInternalTLS: {get_param: EnableInternalTLS}
 
 outputs:
   role_data:
@@ -63,41 +55,8 @@ outputs:
                 dport:
                   - 6379
                   - 26379
-            tripleo::profile::base::database::redis::tls_proxy_bind_ip:
-              get_param: [ServiceNetMap, RedisNetwork]
-            tripleo::profile::base::database::redis::tls_proxy_fqdn:
-              str_replace:
-                template:
-                  "%{hiera('fqdn_$NETWORK')}"
-                params:
-                  $NETWORK: {get_param: [ServiceNetMap, RedisNetwork]}
-            tripleo::profile::base::database::redis::tls_proxy_port: 6379
-          - if:
-            - use_tls_proxy
-            - redis_certificate_specs:
-                service_certificate: '/etc/pki/tls/certs/redis.crt'
-                service_key: '/etc/pki/tls/private/redis.key'
-                hostname:
-                  str_replace:
-                    template: "%{hiera('cloud_name_NETWORK')}"
-                    params:
-                      NETWORK: {get_param: [ServiceNetMap, RedisNetwork]}
-                principal:
-                  str_replace:
-                    template: "redis/%{hiera('cloud_name_NETWORK')}"
-                    params:
-                      NETWORK: {get_param: [ServiceNetMap, RedisNetwork]}
-            - {}
       step_config: |
         include ::tripleo::profile::base::database::redis
-      metadata_settings:
-        if:
-          - use_tls_proxy
-          -
-            - service: redis
-              network: {get_param: [ServiceNetMap, RabbitmqNetwork]}
-              type: vip
-          - null
       upgrade_tasks:
         - name: Check if redis is deployed
           command: systemctl is-enabled redis

puppet/services/pacemaker/database/redis.yaml

@@ -53,16 +53,5 @@ outputs:
           - redis::service_manage: false
             redis::notify_service: false
             redis::managed_by_cluster_manager: true
-            tripleo::profile::pacemaker::database::redis::tls_proxy_bind_ip:
-              get_param: [ServiceNetMap, RedisNetwork]
-            tripleo::profile::pacemaker::database::redis::tls_proxy_fqdn:
-              str_replace:
-                template:
-                  "%{hiera('fqdn_$NETWORK')}"
-                params:
-                  $NETWORK: {get_param: [ServiceNetMap, RedisNetwork]}
-            tripleo::profile::pacemaker::database::redis::tls_proxy_port: 6379
       step_config: |
         include ::tripleo::profile::pacemaker::database::redis
-      metadata_settings:
-        get_attr: [RedisBase, role_data, metadata_settings]