889163cd83
We've been using InternalTLSCAFile parameter when enabling
public TLS for undercloud and is quite confusing. We recently
changed to use it in clouds.yaml and it would break when
both public and internal TLS are enabled for overcloud and both
use different CA certs. This adds a new parameter which we
will use in clouds.yaml, that would default to empty string
assuming that the certificates are trusted.
Closes-Bug: #1883818
Change-Id: Id6f612a91255b3158be821c363ca852c6b5d7496
Depends-On: https://review.opendev.org/737998
(cherry picked from commit 2acb0d376b)
46 lines
2.1 KiB
YAML
46 lines
2.1 KiB
YAML
# *******************************************************************
|
|
# This file was created automatically by the sample environment
|
|
# generator. Developers should use `tox -e genconfig` to update it.
|
|
# Users are recommended to make changes to a copy of the file instead
|
|
# of the original, if any customizations are needed.
|
|
# *******************************************************************
|
|
# title: Enable SSL on OpenStack Internal Endpoints
|
|
# description: |
|
|
# A Heat environment file which can be used to enable TLS for the internal
|
|
# network via certmonger
|
|
parameter_defaults:
|
|
# ******************************************************
|
|
# Static parameters - these are values that must be
|
|
# included in the environment but should not be changed.
|
|
# ******************************************************
|
|
#
|
|
# Type: boolean
|
|
EnableInternalTLS: True
|
|
|
|
# Messaging Notification client subscriber parameter to specify an SSL connection to the messaging host.
|
|
# Type: string
|
|
NotifyUseSSL: True
|
|
|
|
# Messaging client subscriber parameter to specify an SSL connection to the messaging host.
|
|
# Type: string
|
|
RpcUseSSL: True
|
|
|
|
# Extra properties or metadata passed to Nova for the created nodes in the overcloud. It's accessible via the Nova metadata API.
|
|
# Type: json
|
|
ServerMetadata:
|
|
ipa_enroll: True
|
|
|
|
# *********************
|
|
# End static parameters
|
|
# *********************
|
|
resource_registry:
|
|
OS::TripleO::Services::CertmongerUser: ../../deployment/certs/certmonger-user-baremetal-puppet.yaml
|
|
OS::TripleO::Services::HAProxyInternalTLS: ../../deployment/haproxy/haproxy-internal-tls-certmonger.yaml
|
|
OS::TripleO::Services::IpaClient: ../../deployment/ipa/ipaclient-baremetal-ansible.yaml
|
|
# FIXME(xek): after removal of novajoin, switch to using this service instead
|
|
# OS::TripleO::Services::IpaClient: ../../deployment/ipa/ipaservices-baremetal-ansible.yaml
|
|
OS::TripleO::Services::TLSProxyBase: ../../deployment/apache/apache-baremetal-puppet.yaml
|
|
{%- for role in roles %}
|
|
OS::TripleO::{{role.name}}ServiceServerMetadataHook: ../../extraconfig/nova_metadata/krb-service-principals/{{role.name.lower()}}-role.yaml
|
|
{%- endfor %}
|