Merge "Add ability to deploy an overcloud with ssl"

config/general_config/minimal.yml

@@ -23,6 +23,9 @@ network_isolation: true
 # configured public-vip and admin-vip.
 undercloud_generate_service_certificate: True
 
+# This enables the deployment of the overcloud with SSL.
+ssl_overcloud: True
+
 # If `test_tempest` is `true`, run tempests tests, otherwise do not
 # run them.
 test_ping: true

playbooks/quickstart-extras.yml

@@ -30,6 +30,12 @@
   roles:
     - overcloud-prep-network
 
+- name: Prepare the SSL Configuration for the overcloud deployment
+  hosts: undercloud
+  gather_facts: no
+  roles:
+    - { role: tripleo-ssl, when: ssl_overcloud|bool }
+
 # Deploy the overcloud
 - name:  Deploy the overcloud
   hosts: undercloud

quickstart-extras-requirements.txt

@@ -16,6 +16,7 @@ git+https://github.com/redhat-openstack/ansible-role-tripleo-baremetal-prep-virt
 git+https://github.com/redhat-openstack/ansible-role-tripleo-overcloud-prep-baremetal.git#egg=ansible-role-tripleo-overcloud-prep-baremetal
 git+https://github.com/redhat-openstack/ansible-role-tripleo-provision-heat.git#egg=ansible-role-tripleo-provision-heat
 git+https://github.com/redhat-openstack/ansible-role-tripleo-validate-ipmi.git#egg=ansible-role-tripleo-validate-ipmi
+git+https://github.com/redhat-openstack/ansible-role-tripleo-ssl.git#egg=ansible-role-tripleo-ssl
 
 
 # To pull in local development changes

roles/common/defaults/main.yml

@@ -114,6 +114,13 @@ network_isolation: true
 enable_pacemaker: false
 ipv6: false
 
+# This enables the deployment of the overcloud with SSL.
+ssl_overcloud: false
+# If ssl_overcloud is True, then the overcloud public vip must be explicitly
+# specified as part of the deployment configuration. Note that the VIP used has
+# to be set accordingly with the `undercloud_external_network_cidr`.
+overcloud_public_vip: 10.0.0.5
+
 # Set this to `true` if you want your undercloud and overcloud vms to
 # have a VNC console available.
 enable_vnc_console: false