Browse Source

Do not generate apache/haproxy certs for invalid networks

Certs were being generated for all networks in service net map.
This was failing as we do not generate hieradata for all of these networks.

Switching from yaql to jinga templating to match the logic that
generates the hieradata.

Change-Id: Ic6c25aceb07ea3824a8fb23549bc5d1205e5cefc
Closes-bug: 1748023
Closes-Bug: 1748053
changes/22/541922/5
Oliver Walsh 4 years ago
parent
commit
fa66c327fc
  1. 10
      puppet/services/apache.j2.yaml
  2. 11
      puppet/services/haproxy-internal-tls-certmonger.j2.yaml
  3. 10
      tripleo_heat_templates/tests/test_yaql.py

10
puppet/services/apache.yaml → puppet/services/apache.j2.yaml

@ -61,10 +61,12 @@ resources:
# NOTE(jaosorior) Get unique network names to create
# certificates for those. We skip the tenant network since
# we don't need a certificate for that.
yaql:
expression: list($.data.values().toSet().where($ != tenant))
data:
get_param: ServiceNetMap
- ctlplane
{%- for network in networks %}
{%- if network.name_lower != 'tenant' %}
- {{network.name_lower}}
{%- endif %}
{%- endfor %}
outputs:
role_data:

11
puppet/services/haproxy-internal-tls-certmonger.yaml → puppet/services/haproxy-internal-tls-certmonger.j2.yaml

@ -47,11 +47,12 @@ resources:
# certificates for those. We skip the tenant network since
# we don't need a certificate for that, and the external
# network will be handled in another template.
yaql:
expression: list($.data.map.items().map($1[1])).distinct().where($ != external and $ != tenant)
data:
map:
get_param: ServiceNetMap
- ctlplane
{%- for network in networks if network.vip|default(false) %}
{%- if network.name_lower != 'external' and network.name_lower != 'tenant' %}
- {{network.name_lower}}
{%- endif %}
{%- endfor %}
outputs:
role_data:

10
tripleo_heat_templates/tests/test_yaql.py

@ -33,13 +33,3 @@ class YAQLTestCase(base.BaseTestCase):
data = data[i]
return data['yaql']['expression']
def test_apache_networks(self):
snippet = self.get_snippet(
'puppet/services/apache.yaml',
'resources.ApacheNetworks.properties.value')
self.assertEqual(
['service'],
yaql.eval(
snippet,
{'data': {'nova': 'tenant', 'cinder': 'service',
'glance': 'service'}}))

Loading…
Cancel
Save