7f2ee8566a
Default like undercloud for public TLS. Though this is little confusing we're using the same parameter for both undercloud and overclud. For classic public TLS and certmonger-based internal TLS, where we use both enable-tls.yaml and enable-internal-tls.yaml, we reset it back to use the default ipa cacert. Change-Id: Icfef2768ebb90c1818f157c762b6981d24393ac3 Closes-Bug: #1880936
50 lines
2.3 KiB
YAML
50 lines
2.3 KiB
YAML
# *******************************************************************
|
|
# This file was created automatically by the sample environment
|
|
# generator. Developers should use `tox -e genconfig` to update it.
|
|
# Users are recommended to make changes to a copy of the file instead
|
|
# of the original, if any customizations are needed.
|
|
# *******************************************************************
|
|
# title: Enable SSL on OpenStack Internal Endpoints
|
|
# description: |
|
|
# A Heat environment file which can be used to enable TLS for the internal
|
|
# network via certmonger
|
|
parameter_defaults:
|
|
# Specifies the default CA cert to use if TLS is used for services in the internal network.
|
|
# Type: string
|
|
InternalTLSCAFile: /etc/ipa/ca.crt
|
|
|
|
# ******************************************************
|
|
# Static parameters - these are values that must be
|
|
# included in the environment but should not be changed.
|
|
# ******************************************************
|
|
#
|
|
# Type: boolean
|
|
EnableInternalTLS: True
|
|
|
|
# Messaging Notification client subscriber parameter to specify an SSL connection to the messaging host.
|
|
# Type: string
|
|
NotifyUseSSL: True
|
|
|
|
# Messaging client subscriber parameter to specify an SSL connection to the messaging host.
|
|
# Type: string
|
|
RpcUseSSL: True
|
|
|
|
# Extra properties or metadata passed to Nova for the created nodes in the overcloud. It's accessible via the Nova metadata API.
|
|
# Type: json
|
|
ServerMetadata:
|
|
ipa_enroll: True
|
|
|
|
# *********************
|
|
# End static parameters
|
|
# *********************
|
|
resource_registry:
|
|
OS::TripleO::Services::CertmongerUser: ../../deployment/certs/certmonger-user-baremetal-puppet.yaml
|
|
OS::TripleO::Services::HAProxyInternalTLS: ../../deployment/haproxy/haproxy-internal-tls-certmonger.yaml
|
|
OS::TripleO::Services::IpaClient: ../../deployment/ipa/ipaclient-baremetal-ansible.yaml
|
|
# FIXME(xek): after removal of novajoin, switch to using this service instead
|
|
# OS::TripleO::Services::IpaClient: ../../deployment/ipa/ipaservices-baremetal-ansible.yaml
|
|
OS::TripleO::Services::TLSProxyBase: ../../deployment/apache/apache-baremetal-puppet.yaml
|
|
{%- for role in roles %}
|
|
OS::TripleO::{{role.name}}ServiceServerMetadataHook: ../../extraconfig/nova_metadata/krb-service-principals/{{role.name.lower()}}-role.yaml
|
|
{%- endfor %}
|