0acfc345e1
https://github.com/openstack/tripleo-heat-templates/blob/master/environments/ssl/enable-internal-tls.yaml#L22 uses RPCUseSSL only and misses the NotifyUseSSL variable. The reason this is a problem is that commands/services that will kick off a notification are likely to hang due to this. Imagine the following scenario: 1. TLS configured everywhere 2. keystone-manage bootstrap actually hangs The reason for this is that the messaging string in the keystone container will look like the following: [oslo_messaging_notifications] transport_url=rabbit://guest:AC8DjGviXCQks8MWjQdAjYW9L@overcloud-controller-0.internalapi.tripleodomain.example.com:5672/?ssl=0 By gdb-ing on to the keystone-manage process (thanks Damien, for the idea) we can see that we are stuck in oslo calls connecting to rabbit without tls Closes-Bug: #1795462 Change-Id: I0d25527131fa4cd293994a0511bba1144510c4d8
41 lines
1.7 KiB
YAML
41 lines
1.7 KiB
YAML
# *******************************************************************
|
|
# This file was created automatically by the sample environment
|
|
# generator. Developers should use `tox -e genconfig` to update it.
|
|
# Users are recommended to make changes to a copy of the file instead
|
|
# of the original, if any customizations are needed.
|
|
# *******************************************************************
|
|
# title: Enable SSL on OpenStack Internal Endpoints
|
|
# description: |
|
|
# A Heat environment file which can be used to enable TLS for the internal
|
|
# network via certmonger
|
|
parameter_defaults:
|
|
# ******************************************************
|
|
# Static parameters - these are values that must be
|
|
# included in the environment but should not be changed.
|
|
# ******************************************************
|
|
#
|
|
# Type: boolean
|
|
EnableInternalTLS: True
|
|
|
|
# Messaging Notification client subscriber parameter to specify an SSL connection to the messaging host.
|
|
# Type: string
|
|
NotifyUseSSL: True
|
|
|
|
# Messaging client subscriber parameter to specify an SSL connection to the messaging host.
|
|
# Type: string
|
|
RpcUseSSL: True
|
|
|
|
# Extra properties or metadata passed to Nova for the created nodes in the overcloud. It's accessible via the Nova metadata API.
|
|
# Type: json
|
|
ServerMetadata:
|
|
ipa_enroll: True
|
|
|
|
# *********************
|
|
# End static parameters
|
|
# *********************
|
|
resource_registry:
|
|
OS::TripleO::ServiceServerMetadataHook: ../../extraconfig/nova_metadata/krb-service-principals.yaml
|
|
OS::TripleO::Services::CertmongerUser: ../../puppet/services/certmonger-user.yaml
|
|
OS::TripleO::Services::HAProxyInternalTLS: ../../puppet/services/haproxy-internal-tls-certmonger.yaml
|
|
OS::TripleO::Services::TLSProxyBase: ../../puppet/services/apache.yaml
|