064aae8458
This patch provides TLS endpoints secured by a self-signed
certificate. Another patch will provide support for trusted CA-signed
certificates.
A new config.tls.generate-cert option is added that defaults to true.
When true, a self-signed certificate will be generated and OpenStack
API endpoints will be configured to use TLS with that self-signed
certificate. The following config options are added:
snap get microstack config.tls.generate-self-signed
snap get microstack config.tls.cacert-path
snap get microstack config.tls.cert-path
snap get microstack config.tls.key-path
Users can provide their own self-signed certificate by setting
generate-self-signed to false and storing their own certificates/key
at the paths specified by cacert-path, cert-path, and key-path.
'snap set' can also be used to change the cert/key file names.
If using clustering, the certificates/key will be copied from the
control node to the compute nodes. The config for cacert-path,
cert-path, and key-path will be set to the same values as on the
control node.
Other notable changes:
* The existing generate_selfsigned() function is modified to change
the subject alternative name to be made up of the hostname and
optionally an IP. The controller hostname and IP are used when
generating the certificate for self-signed TLS endpoints. The
hostname is now used instead of 'microstack.run' when generating
the clustering certificate.
* This change also aligns logging for nginx and corresponding sites
and moves all nginx sites to {snap_common}/etc/nginx/sites-enabled.
Change-Id: Iceea3127822404a3275fcf8a221cbedc4b52c217
40 lines
1.3 KiB
Bash
Executable File
40 lines
1.3 KiB
Bash
Executable File
#!/bin/bash
|
|
set -ex
|
|
|
|
# Refresh the TEMPLATE.qemu apparmor profile and abstractions.
|
|
rsync -rh $SNAP/etc/apparmor.d $SNAP_COMMON/etc
|
|
|
|
if [ -z "$(snapctl get config)" ]; then
|
|
# [2019-11-15] Handle build 171 (beta) -> 182
|
|
|
|
# We are upgrading from a version of the snap from before we put all
|
|
# config values under a config tree. Set the default values now (the
|
|
# old values were not documented, and we assume that they were not
|
|
# set).
|
|
set-default-config.py
|
|
|
|
# Make a place for our horizon config overrides to live. We piggy
|
|
# back on the above check, because the changes were made
|
|
# concurrently.
|
|
mkdir -p ${SNAP_COMMON}/etc/horizon/local_settings.d
|
|
fi
|
|
|
|
# Add default ports for mysql, rabbit and dashboard services.
|
|
# [2019-11-21] build 171 (beta) -> master
|
|
if [ -z "$(snapctl get config.network.ports.dashboard)" ]; then
|
|
snapctl set config.network.ports.dashboard=443
|
|
fi
|
|
|
|
if [ -z "$(snapctl get config.network.ports.mysql)" ]; then
|
|
snapctl set config.network.ports.mysql=3306
|
|
fi
|
|
|
|
if [ -z "$(snapctl get config.network.ports.rabbit)" ]; then
|
|
snapctl set config.network.ports.rabbit=5672
|
|
fi
|
|
|
|
mkdir -p ${SNAP_COMMON}/log/libvirt/qemu
|
|
mkdir -p /run/lock/snap.$SNAP_INSTANCE_NAME
|
|
|
|
snap-openstack setup # Write any template changes.
|