diff options
author | Jenkins <jenkins@review.openstack.org> | 2017-07-31 19:32:33 +0000 |
---|---|---|
committer | Gerrit Code Review <review@openstack.org> | 2017-07-31 19:32:33 +0000 |
commit | ee2a53afb1ad8f45be7d3986f5de2b6731048c65 (patch) | |
tree | d525eb07f2480969d74c643793c1daff2f050d29 /manifests/haproxy.pp | |
parent | 48ead62f6fcb1b833c044f099644cb32a06c3206 (diff) | |
parent | e51e79692032d2cf8c6092e86c5a28a0e7f1832d (diff) |
Merge "Enable TLS for the HAProxy stats interface"
Diffstat (limited to 'manifests/haproxy.pp')
-rw-r--r-- | manifests/haproxy.pp | 41 |
1 files changed, 13 insertions, 28 deletions
diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp index 34b236f..a3d088a 100644 --- a/manifests/haproxy.pp +++ b/manifests/haproxy.pp @@ -772,12 +772,6 @@ class tripleo::haproxy ( $controller_hosts_names_real = downcase(any2array(split($controller_hosts_names, ','))) } - # TODO(bnemec): When we have support for SSL on private and admin endpoints, - # have the haproxy stats endpoint use that certificate by default. - if $haproxy_stats_certificate { - $haproxy_stats_bind_certificate = $haproxy_stats_certificate - } - $horizon_vip = hiera('horizon_vip', $controller_virtual_ip) if $service_certificate { # NOTE(jaosorior): If the horizon_vip and the public_virtual_ip are the @@ -815,16 +809,6 @@ class tripleo::haproxy ( } } - if $haproxy_stats_bind_certificate { - $haproxy_stats_bind_opts = { - "${controller_virtual_ip}:1993" => union($haproxy_listen_bind_param, ['ssl', 'crt', $haproxy_stats_bind_certificate]), - } - } else { - $haproxy_stats_bind_opts = { - "${controller_virtual_ip}:1993" => $haproxy_listen_bind_param, - } - } - $mysql_vip = hiera('mysql_vip', $controller_virtual_ip) $mysql_bind_opts = { "${mysql_vip}:3306" => $haproxy_listen_bind_param, @@ -891,19 +875,20 @@ class tripleo::haproxy ( } if $haproxy_stats { - $stats_base = ['enable', 'uri /'] - if $haproxy_stats_password { - $stats_config = union($stats_base, ["auth ${haproxy_stats_user}:${haproxy_stats_password}"]) + if $haproxy_stats_certificate { + $haproxy_stats_certificate_real = $haproxy_stats_certificate + } elsif $use_internal_certificates { + # NOTE(jaosorior): Right now it's hardcoded to use the ctlplane network + $haproxy_stats_certificate_real = $internal_certificates_specs["haproxy-ctlplane"]['service_pem'] } else { - $stats_config = $stats_base - } - haproxy::listen { 'haproxy.stats': - bind => $haproxy_stats_bind_opts, - mode => 'http', - options => { - 'stats' => $stats_config, - }, - collect_exported => false, + $haproxy_stats_certificate_real = undef + } + class { '::tripleo::haproxy::stats': + haproxy_listen_bind_param => $haproxy_listen_bind_param, + ip => $controller_virtual_ip, + password => $haproxy_stats_password, + certificate => $haproxy_stats_certificate_real, + user => $haproxy_stats_user, } } |