This patch provides TLS endpoints secured by a self-signed
certificate. Another patch will provide support for trusted CA-signed
certificates.
A new config.tls.generate-cert option is added that defaults to true.
When true, a self-signed certificate will be generated and OpenStack
API endpoints will be configured to use TLS with that self-signed
certificate. The following config options are added:
snap get microstack config.tls.generate-self-signed
snap get microstack config.tls.cacert-path
snap get microstack config.tls.cert-path
snap get microstack config.tls.key-path
Users can provide their own self-signed certificate by setting
generate-self-signed to false and storing their own certificates/key
at the paths specified by cacert-path, cert-path, and key-path.
'snap set' can also be used to change the cert/key file names.
If using clustering, the certificates/key will be copied from the
control node to the compute nodes. The config for cacert-path,
cert-path, and key-path will be set to the same values as on the
control node.
Other notable changes:
* The existing generate_selfsigned() function is modified to change
the subject alternative name to be made up of the hostname and
optionally an IP. The controller hostname and IP are used when
generating the certificate for self-signed TLS endpoints. The
hostname is now used instead of 'microstack.run' when generating
the clustering certificate.
* This change also aligns logging for nginx and corresponding sites
and moves all nginx sites to {snap_common}/etc/nginx/sites-enabled.
Change-Id: Iceea3127822404a3275fcf8a221cbedc4b52c217
Make MicroStack strictly confined, albeit in devmode for now.
Addresses unpredictable breakages with apt package upgrades in eoan
and focal, and sets the stage for a better isolated, less fragile snap
going forward.
We now use layouts to handle libvirt and qemu setting paths at compile
time. This is cleaner than the organize hack.
Moved away from calls to systemctl in init, as a strictly confined
snap cannot call systemctl on a non snappy system.
Disabled call to sysctl to set ipv4_fowarding, as we don't have access
to sysctl in a strictly confined snap. This may break some users, and
we need to figure out a way to address the breakage.
Got rid of questions.shell.shell routine, moving rabbitmq setup into a
bash script instead (it's just cleaner).
Moved keypair creation into launch script, as it's difficult to do
sensible things with keypair creation in the init script, which is
running using sudo, and therefore doesn't have access to
/home/<someuser>/snap
Added (but commented out) code that will check to verify that plugs
are connected before running microstack.init or ovs-vsctl. This code
may go away entirely, as we plan on auto connecting all of our
interfaces, and don't technically need to guard against not having
them connected.
Added temporary local upper-constraints file, to fix an issue where
upstream upper-constraints was breaking pip install by setting a
neutron version. This needs a better long term fix, but works for now.
Closes-bug: 1860660
Change-Id: Iaf1f1482609f05285ed9061317b32e90bffd2da0
Added build-environment to qemu (works around issue where patchelf was
not finding libs).
Added hack to force wrapping of all non bash apps, to work around
snapd issue with multiple instances of PATH in the snap environment.
Also snuck in fix for horizon build. Horizon is specified in upstream
constraints now, which means that our build fails if we try to build
it from source in the same part that looks at the constriants file.
Misc fixes to make the tests nicer.
Change-Id: I50c88878c4f9dbb07006cab899a717e334be07d0
Fixed backticks so that they actually wrap the whole command.
Added code to gamely make a guess about the username of the launched
instance and the location of the ssh key. Falls back on placeholders
if it can't.
Closes-bug 1850586
Change-Id: I980ee8617dfc4bf7c60846052d66ff18cf8aa8e9
Addresses requests to make it easier to avoid conflicts between the
Horizon dashboard and http services that might already be running on
the machine.
Configurable via snap config. Exposing via arguments to .init and
testing post init configuration is left for a separate PR.
Eventually, these may move to non standard ports by default. This PR
sets the stage for that, but further discussion is needed before we
decide whether to implement.
(This commit also contains a sneaky fix for the username display at the
end of the launch script.)
Closes-Bug: 1814829
Change-Id: If728d6ec8024bca4d3e809637fbdcc03ed4e6934
This enables basic clustering functionality. We add:
tools/cluster/cluster/daemon.py: A server that handles validation of
cluster passwords.
tools/cluster/cluster/client.py: A client for this server.
Important Note: This prototype does not support TLS, and the
functionality in the client and server is basic. Before we roll
clustering out to production, we need to have those two chat over TLS,
and be much more careful about verifying credentials.
Also included ...
Various fixes and changes to the init script and config templates to
support cluster configuration, and allow for the fact that we may have
endpoint references for two network ips.
Updates to snapcraft.yaml, adding the new tooling.
A more formalized config infrastructure. It's still a TODO to move the
specification out of the implicit definition in the install hook, and
into a nice, explicit, well documented yaml file.
Added nesting to the Question classes in the init script, as well as
strings pointing at config keys, rather than having the config be
implicitly indicated by the Question subclass' name. (This allows us
to put together a config spec that doesn't require the person reading
the spec to understand what Questions are, and how they are
implemented.)
Renamed and unified the "unit" and "lint" tox environments, to allow
for the multiple Python tools that we want to lint and test.
Added hooks in the init script to make it possible to do automated
testing, and added an automated test for a cluster. Run with "tox -e
cluster".
Added cirros image to snap, to work around sporadic issues downloading
it from download.cirros.net.
Removed ping logic from snap, to workaround failures in gate. Need to
add it back in once we fix them.
Change-Id: I44ccd16168a7ed41486464df8c9e22a14d71ccfd
Moved security rules and keypair creation into init first.
Launch script now takes image name as positional argument, and name of
instance as a named argument. This makes it work more like launch in
other Canonical tools.
Written in Python, for ease of maintenance.
--retry and --wait args allow it to behave like tests expect it to,
while humans will get a much more intuitive (and much less noisy)
experience.
Also increased time we wait for a ping on the host, to allow for
slower, pure qemu, emulation times, and bring it in line with what
Tempest does in similar situations.
Change-Id: I11dcc098012468e9c88dcc7af78cde6920f31ecd
