x
/
fuel-ccp-heat
Code Issues Proposed changes

Add TLS support for Heat component 

Change-Id: Ifbfe3d0fa85d3a7f28586d3b82e309f49698479f
This commit is contained in:
Sergey Kraynev 2017-02-06 09:17:38 +00:00
parent f7a38eb5df
commit e5ed7fe74f
9 changed files with 110 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
service/files/defaults.yaml
View File

@ -1,5 +1,7 @@
configs:
heat:
tls:
enabled: true
api_port:
cont: 8004
ingress: orchestration

24
service/files/heat.conf.j2
View File

@ -30,18 +30,42 @@ auth_url = {{ address('keystone', keystone.admin_port, with_scheme=True) }}
auth_plugin = password
auth_type = password
{% if heat.tls.enabled %}
[oslo_middleware]
enable_proxy_headers_parsing = true
[ec2authtoken]
ca_file = /opt/ccp/etc/tls/ca.pem
{% endif %}
[clients_keystone]
auth_uri = {{ address('keystone', keystone.public_port, with_scheme=True) }}
{% if security.tls.create_certificates %}
# Add this option independently from all services components, because
# Heat uses certificates only from Keystone section and then passes this
# session as argument for other clients. So it's not possible to have separate
# certificates for each client. There is a corresponding bug in upstream:
# https://bugs.launchpad.net/heat/+bug/1669367
ca_file = /opt/ccp/etc/tls/ca.pem
{% endif %}
[clients_heat]
endpoint_type = {{ heat.heat_endpoint_type }}
[heat_api]
{% if heat.tls.enabled %}
bind_host = 127.0.0.1
{% else %}
bind_host = {{ network_topology["private"]["address"] }}
{% endif %}
bind_port = {{ heat.api_port.cont }}
[heat_api_cfn]
{% if heat.tls.enabled %}
bind_host = 127.0.0.1
{% else %}
bind_host = {{ network_topology["private"]["address"] }}
{% endif %}
bind_port = {{ heat.api_cfn_port.cont }}
[cache]

9
service/files/nginx-api-cfn.conf.j2 Normal file
View File

@ -0,0 +1,9 @@
server {
listen {{ network_topology["private"]["address"] }}:{{ heat.api_cfn_port.cont }} ssl;
include common/ssl.conf;
location / {
proxy_pass http://heat_api_cfn;
include common/proxy-headers.conf;
}
}

9
service/files/nginx-api.conf.j2 Normal file
View File

@ -0,0 +1,9 @@
server {
listen {{ network_topology["private"]["address"] }}:{{ heat.api_port.cont }} ssl;
include common/ssl.conf;
location / {
proxy_pass http://heat_api;
include common/proxy-headers.conf;
}
}

1
service/files/server-cert.pem.j2 Normal file
View File

@ -0,0 +1 @@
{{ security.tls.server_cert }}

1
service/files/server-key.pem.j2 Normal file
View File

@ -0,0 +1 @@
{{ security.tls.server_key }}

6
service/files/upstreams.conf.j2 Normal file
View File

@ -0,0 +1,6 @@
upstream heat_api {
server 127.0.0.1:{{ heat.api_port.cont }};
}
upstream heat_api_cfn {
server 127.0.0.1:{{ heat.api_cfn_port.cont }};
}

29
service/heat-api-cfn.yaml
View File

@ -39,8 +39,37 @@ service:
files:
- heat-conf
command: heat-api-cfn --config-file /etc/heat/heat.conf
# {% if heat.tls.enabled %}
- name: nginx-heat-api-cfn
image: nginx
daemon:
files:
- upstreams
- servers
- server-cert
- server-key
command: nginx
# {% endif %}
files:
heat-conf:
path: /etc/heat/heat.conf
content: heat.conf.j2
# {% if heat.tls.enabled %}
servers:
path: /etc/nginx/conf.d/servers.conf
content: nginx-api-cfn.conf.j2
perm: "0400"
upstreams:
path: /etc/nginx/conf.d/upstreams.conf
content: upstreams.conf.j2
perm: "0400"
server-cert:
path: /opt/ccp/etc/tls/server-cert.pem
content: server-cert.pem.j2
perm: "0400"
server-key:
path: /opt/ccp/etc/tls/server-key.pem
content: server-key.pem.j2
perm: "0400"
# {% endif %}

29
service/heat-api.yaml
View File

@ -100,8 +100,37 @@ service:
files:
- heat-conf
command: heat-api --config-file /etc/heat/heat.conf
# {% if heat.tls.enabled %}
- name: nginx-heat-api
image: nginx
daemon:
files:
- upstreams
- servers
- server-cert
- server-key
command: nginx
# {% endif %}
files:
heat-conf:
path: /etc/heat/heat.conf
content: heat.conf.j2
# {% if heat.tls.enabled %}
servers:
path: /etc/nginx/conf.d/servers.conf
content: nginx-api.conf.j2
perm: "0400"
upstreams:
path: /etc/nginx/conf.d/upstreams.conf
content: upstreams.conf.j2
perm: "0400"
server-cert:
path: /opt/ccp/etc/tls/server-cert.pem
content: server-cert.pem.j2
perm: "0400"
server-key:
path: /opt/ccp/etc/tls/server-key.pem
content: server-key.pem.j2
perm: "0400"
# {% endif %}