tripleo-heat-templates/environments/ssl/enable-internal-tls.j2.yaml
Grzegorz Grasza e329ca915e Generate certificates using ansible role
This is using linux-system-roles.certificate ansible role,
which replaces puppet-certmonger for submitting certificate
requests to certmonger. Each service is configured through
it's heat template.

Partial-Implements: blueprint ansible-certmonger
Depends-On: https://review.rdoproject.org/r/31713
Change-Id: Ib868465c20d97c62cbcb214bfc62d949bd6efc62
2021-03-10 16:28:22 +01:00

43 lines
1.9 KiB
YAML

# *******************************************************************
# This file was created automatically by the sample environment
# generator. Developers should use `tox -e genconfig` to update it.
# Users are recommended to make changes to a copy of the file instead
# of the original, if any customizations are needed.
# *******************************************************************
# title: Enable SSL on OpenStack Internal Endpoints
# description: |
# A Heat environment file which can be used to enable TLS for the internal
# network via certmonger
parameter_defaults:
# ******************************************************
# Static parameters - these are values that must be
# included in the environment but should not be changed.
# ******************************************************
#
# Type: boolean
EnableInternalTLS: True
# Messaging Notification client subscriber parameter to specify an SSL connection to the messaging host.
# Type: string
NotifyUseSSL: True
# Messaging client subscriber parameter to specify an SSL connection to the messaging host.
# Type: string
RpcUseSSL: True
# Extra properties or metadata passed to Nova for the created nodes in the overcloud. It's accessible via the Nova metadata API.
# Type: json
ServerMetadata:
ipa_enroll: True
# *********************
# End static parameters
# *********************
resource_registry:
OS::TripleO::Services::HAProxyInternalTLS: ../../deployment/haproxy/haproxy-internal-tls-certmonger.yaml
OS::TripleO::Services::IpaClient: ../../deployment/ipa/ipaservices-baremetal-ansible.yaml
OS::TripleO::Services::TLSProxyBase: ../../deployment/apache/apache-baremetal-puppet.yaml
{%- for role in roles %}
OS::TripleO::{{role.name}}ServiceServerMetadataHook: ../../extraconfig/nova_metadata/krb-service-principals/{{role.name.lower()}}-role.yaml
{%- endfor %}