TripleO's TLS implementation using nova in the undercloud relies on
instance metadata that contains the services a particular instance is
going to host. For example, metadata for a controller (e.g.,
controller-0) will contain JSON that describes the services and
interfaces that are supposed to be hosted on controller (e.g.,
haproxy/controller-0.ctlplane.example.test).
For TLS, we need to generate certificates for those services
automatically. This requires us to parse the metadata for the instance,
determine the services that are supposed to the hosted by that
instance, and then curate unique principals that we add to FreeIPA.
Once the appropriate hosts (e.g., controller-0.example.test), sub-hosts
(e.g., controller-0.ctlplane.example.test), and principals (e.g.,
haproxy/controller-0.ctlplane.example.test) have been added to FreeIPA,
we can generate certificates for that service and configure it to use
TLS.
The commit attempts to introduce a filter that parses metadata from the
instance and returns a list of tuples to the caller. Each tuple is
unique to each service being hosted on an instance and we use them to
generate the requisite entities in FreeIPA for TLS certificates using
ansible-freeipa later.
The functionality was formally a part of novajoin, which is a nova
metadata service.
This patch adds unit tests and relevant env configuration.
Change-Id: Ibbac29a9d2570280cad0f426ad0b0367587bfee7
a3d1af2413