Enable TLS for the HAProxy stats interface

This creates a new class for the stats interface and furtherly
configures it to also use the certificates that are provided by
certmonger (via the internal_certificates_specs variable).

Note that the already existing haproxy_stats_certificate still works and
will take precedence if it's set.

bp tls-via-certmonger

Change-Id: Iea65d91648ab13dbe6ec20241a1a7c95ce856e3e

1 files changed, 13 insertions, 28 deletions

diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp
index 5a59c10..497c9da 100644
--- a/manifests/haproxy.pp
+++ b/manifests/haproxy.pp
@@ -766,12 +766,6 @@ class tripleo::haproxy (
     $controller_hosts_names_real = downcase(any2array(split($controller_hosts_names, ',')))
   }
 
-  # TODO(bnemec): When we have support for SSL on private and admin endpoints,
-  # have the haproxy stats endpoint use that certificate by default.
-  if $haproxy_stats_certificate {
-    $haproxy_stats_bind_certificate = $haproxy_stats_certificate
-  }
-
   $horizon_vip = hiera('horizon_vip', $controller_virtual_ip)
   if $service_certificate {
     # NOTE(jaosorior): If the horizon_vip and the public_virtual_ip are the
@@ -809,16 +803,6 @@ class tripleo::haproxy (
     }
   }
 
-  if $haproxy_stats_bind_certificate {
-    $haproxy_stats_bind_opts = {
-      "${controller_virtual_ip}:1993" => union($haproxy_listen_bind_param, ['ssl', 'crt', $haproxy_stats_bind_certificate]),
-    }
-  } else {
-    $haproxy_stats_bind_opts = {
-      "${controller_virtual_ip}:1993" => $haproxy_listen_bind_param,
-    }
-  }
-
   $mysql_vip = hiera('mysql_vip', $controller_virtual_ip)
   $mysql_bind_opts = {
     "${mysql_vip}:3306" => $haproxy_listen_bind_param,
@@ -884,19 +868,20 @@ class tripleo::haproxy (
   }
 
   if $haproxy_stats {
-    $stats_base = ['enable', 'uri /']
-    if $haproxy_stats_password {
-      $stats_config = union($stats_base, ["auth ${haproxy_stats_user}:${haproxy_stats_password}"])
+    if $haproxy_stats_certificate {
+      $haproxy_stats_certificate_real = $haproxy_stats_certificate
+    } elsif $use_internal_certificates {
+      # NOTE(jaosorior): Right now it's hardcoded to use the ctlplane network
+      $haproxy_stats_certificate_real = $internal_certificates_specs["haproxy-ctlplane"]['service_pem']
     } else {
-      $stats_config = $stats_base
-    }
-    haproxy::listen { 'haproxy.stats':
-      bind             => $haproxy_stats_bind_opts,
-      mode             => 'http',
-      options          => {
-        'stats' => $stats_config,
-      },
-      collect_exported => false,
+      $haproxy_stats_certificate_real = undef
+    }
+    class { '::tripleo::haproxy::stats':
+      haproxy_listen_bind_param => $haproxy_listen_bind_param,
+      ip                        => $controller_virtual_ip,
+      password                  => $haproxy_stats_password,
+      certificate               => $haproxy_stats_certificate_real,
+      user                      => $haproxy_stats_user,
     }
   }