# *******************************************************************
# This file was created automatically by the sample environment
# generator. Developers should use `tox -e genconfig` to update it.
# Users are recommended to make changes to a copy of the file instead
# of the original, if any customizations are needed.
# *******************************************************************
# title: Enable SSL on OpenStack Internal Endpoints
# description: |
#   A Heat environment file which can be used to enable TLS for the internal
#   network via certmonger
parameter_defaults:
  # Specifies the default CA cert to use if TLS is used for services in the internal network.
  # Type: string
  InternalTLSCAFile: /etc/ipa/ca.crt

  # ******************************************************
  # Static parameters - these are values that must be
  # included in the environment but should not be changed.
  # ******************************************************
  # 
  # Type: boolean
  EnableInternalTLS: True

  # Messaging Notification client subscriber parameter to specify an SSL connection to the messaging host.
  # Type: string
  NotifyUseSSL: True

  # Messaging client subscriber parameter to specify an SSL connection to the messaging host.
  # Type: string
  RpcUseSSL: True

  # Extra properties or metadata passed to Nova for the created nodes in the overcloud. It's accessible via the Nova metadata API.
  # Type: json
  ServerMetadata:
    ipa_enroll: True

  # *********************
  # End static parameters
  # *********************
resource_registry:
  OS::TripleO::Services::CertmongerUser: ../../deployment/certs/certmonger-user-baremetal-puppet.yaml
  OS::TripleO::Services::HAProxyInternalTLS: ../../deployment/haproxy/haproxy-internal-tls-certmonger.yaml
  OS::TripleO::Services::IpaClient: ../../deployment/ipa/ipaclient-baremetal-ansible.yaml
  # FIXME(xek): after removal of novajoin, switch to using this service instead
  # OS::TripleO::Services::IpaClient: ../../deployment/ipa/ipaservices-baremetal-ansible.yaml
  OS::TripleO::Services::TLSProxyBase: ../../deployment/apache/apache-baremetal-puppet.yaml
{%- for role in roles %}
  OS::TripleO::{{role.name}}ServiceServerMetadataHook: ../../extraconfig/nova_metadata/krb-service-principals/{{role.name.lower()}}-role.yaml
{%- endfor %}