Use TLS proxy for Redis' internal TLS

This uses the tls_proxy resource in front of the Redis server when
internal TLS is enabled.

bp tls-via-certmonger

Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com>
Change-Id: Ia50933da9e59268b17f56db34d01dcc6b6c38147
(cherry picked from commit 2d1d7875aa6f0b68005c84189627bc0716a7693f)

6 files changed, 118 insertions, 10 deletions

diff --git a/manifests/profile/base/aodh/evaluator.pp b/manifests/profile/base/aodh/evaluator.pp
index 1b25b37..9b3462f 100644
--- a/manifests/profile/base/aodh/evaluator.pp
+++ b/manifests/profile/base/aodh/evaluator.pp
@@ -18,20 +18,30 @@
 #
 # === Parameters
 #
+# [*enable_internal_tls*]
+#   (Optional) Whether TLS in the internal network is enabled or not.
+#   Defaults to hiera('enable_internal_tls', false)
+#
 # [*step*]
 #   (Optional) The current step in deployment. See tripleo-heat-templates
 #   for more details.
 #   Defaults to hiera('step')
 #
 class tripleo::profile::base::aodh::evaluator (
-  $step = Integer(hiera('step')),
+  $enable_internal_tls = hiera('enable_internal_tls', false),
+  $step                = Integer(hiera('step')),
 ) {
 
   include ::tripleo::profile::base::aodh
+  if $enable_internal_tls {
+    $tls_query_param = '?ssl=true'
+  } else {
+    $tls_query_param = ''
+  }
 
   if $step >= 4 {
     class { '::aodh::evaluator':
-      coordination_url => join(['redis://:', hiera('aodh_redis_password'), '@', normalize_ip_for_uri(hiera('redis_vip')), ':6379/']),
+      coordination_url => join(['redis://:', hiera('aodh_redis_password'), '@', normalize_ip_for_uri(hiera('redis_vip')), ':6379/', $tls_query_param]),
     }
   }
 
diff --git a/manifests/profile/base/ceilometer/agent/central.pp b/manifests/profile/base/ceilometer/agent/central.pp
index b8f5d07..955917c 100644
--- a/manifests/profile/base/ceilometer/agent/central.pp
+++ b/manifests/profile/base/ceilometer/agent/central.pp
@@ -18,20 +18,31 @@
 #
 # === Parameters
 #
+# [*enable_internal_tls*]
+#   (Optional) Whether TLS in the internal network is enabled or not.
+#   Defaults to hiera('enable_internal_tls', false)
+#
 # [*step*]
 #   (Optional) The current step in deployment. See tripleo-heat-templates
 #   for more details.
 #   Defaults to hiera('step')
 #
 class tripleo::profile::base::ceilometer::agent::central (
-  $step = Integer(hiera('step')),
+  $enable_internal_tls = hiera('enable_internal_tls', false),
+  $step                = Integer(hiera('step')),
 ) {
   include ::tripleo::profile::base::ceilometer
 
+  if $enable_internal_tls {
+    $tls_query_param = '?ssl=true'
+  } else {
+    $tls_query_param = ''
+  }
+
   if $step >= 4 {
     include ::ceilometer::agent::auth
     class { '::ceilometer::agent::central':
-      coordination_url => join(['redis://:', hiera('ceilometer_redis_password'), '@', normalize_ip_for_uri(hiera('redis_vip')), ':6379/']),
+      coordination_url => join(['redis://:', hiera('ceilometer_redis_password'), '@', normalize_ip_for_uri(hiera('redis_vip')), ':6379/', $tls_query_param]),
     }
   }
 
diff --git a/manifests/profile/base/ceilometer/agent/polling.pp b/manifests/profile/base/ceilometer/agent/polling.pp
index 84f5e46..043b5cd 100644
--- a/manifests/profile/base/ceilometer/agent/polling.pp
+++ b/manifests/profile/base/ceilometer/agent/polling.pp
@@ -26,6 +26,10 @@
 #   (Optional) Use compute namespace for polling agent.
 #   Defaults to false.
 #
+# [*enable_internal_tls*]
+#   (Optional) Whether TLS in the internal network is enabled or not.
+#   Defaults to hiera('enable_internal_tls', false)
+#
 # [*ipmi_namespace*]
 #   (Optional) Use ipmi namespace for polling agent.
 #   Defaults to false.
@@ -44,6 +48,7 @@
 class tripleo::profile::base::ceilometer::agent::polling (
   $central_namespace         = hiera('central_namespace', false),
   $compute_namespace         = hiera('compute_namespace', false),
+  $enable_internal_tls       = hiera('enable_internal_tls', false),
   $ipmi_namespace            = hiera('ipmi_namespace', false),
   $ceilometer_redis_password = hiera('ceilometer_redis_password', undef),
   $redis_vip                 = hiera('redis_vip', undef),
@@ -55,13 +60,19 @@ class tripleo::profile::base::ceilometer::agent::polling (
     include ::tripleo::profile::base::ceilometer::upgrade
   }
 
+  if $enable_internal_tls {
+    $tls_query_param = '?ssl=true'
+  } else {
+    $tls_query_param = ''
+  }
+
   if $step >= 4 {
     include ::ceilometer::agent::auth
     class { '::ceilometer::agent::polling':
       central_namespace => $central_namespace,
       compute_namespace => $compute_namespace,
       ipmi_namespace    => $ipmi_namespace,
-      coordination_url  => join(['redis://:', $ceilometer_redis_password, '@', normalize_ip_for_uri($redis_vip), ':6379/']),
+      coordination_url  => join(['redis://:', $ceilometer_redis_password, '@', normalize_ip_for_uri($redis_vip), ':6379/', $tls_query_param]),
     }
   }
 }
diff --git a/manifests/profile/base/certmonger_user.pp b/manifests/profile/base/certmonger_user.pp
index cc29cd5..54d9e15 100644
--- a/manifests/profile/base/certmonger_user.pp
+++ b/manifests/profile/base/certmonger_user.pp
@@ -78,6 +78,11 @@
 #   it will create.
 #   Defaults to hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}).
 #
+# [*redis_certificate_specs*]
+#   (Optional) The specifications to give to certmonger for the certificate(s)
+#   it will create.
+#   Defaults to hiera('redis_certificate_specs', {}).
+#
 # [*etcd_certificate_specs*]
 #   (Optional) The specifications to give to certmonger for the certificate(s)
 #   it will create.
@@ -93,6 +98,7 @@ class tripleo::profile::base::certmonger_user (
   $mongodb_certificate_specs  = hiera('mongodb_certificate_specs',{}),
   $mysql_certificate_specs    = hiera('tripleo::profile::base::database::mysql::certificate_specs', {}),
   $rabbitmq_certificate_specs = hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}),
+  $redis_certificate_specs    = hiera('redis_certificate_specs', {}),
   $etcd_certificate_specs     = hiera('tripleo::profile::base::etcd::certificate_specs', {}),
 ) {
   unless empty($haproxy_certificates_specs) {
@@ -137,6 +143,9 @@ class tripleo::profile::base::certmonger_user (
   unless empty($rabbitmq_certificate_specs) {
     ensure_resource('class', 'tripleo::certmonger::rabbitmq', $rabbitmq_certificate_specs)
   }
+  unless empty($redis_certificate_specs) {
+    ensure_resource('class', 'tripleo::certmonger::redis', $redis_certificate_specs)
+  }
   unless empty($etcd_certificate_specs) {
     ensure_resource('class', 'tripleo::certmonger::etcd', $etcd_certificate_specs)
   }
diff --git a/manifests/profile/base/database/redis.pp b/manifests/profile/base/database/redis.pp
index e357359..8d4ed94 100644
--- a/manifests/profile/base/database/redis.pp
+++ b/manifests/profile/base/database/redis.pp
@@ -22,6 +22,26 @@
 #   (Optional) Hostname of Redis master
 #   Defaults to hiera('bootstrap_nodeid')
 #
+# [*certificate_specs*]
+#   (Optional) The specifications to give to certmonger for the certificate(s)
+#   it will create.
+#   Example with hiera:
+#     redis_certificate_specs:
+#       hostname: <overcloud controller fqdn>
+#       service_certificate: <service certificate path>
+#       service_key: <service key path>
+#       principal: "haproxy/<overcloud controller fqdn>"
+#   Defaults to hiera('redis_certificate_specs', {}).
+#
+# [*enable_internal_tls*]
+#   (Optional) Whether TLS in the internal network is enabled or not.
+#   Defaults to hiera('enable_internal_tls', false)
+#
+# [*redis_network*]
+#   (Optional) The network name where the redis endpoint is listening on.
+#   This is set by t-h-t.
+#   Defaults to hiera('redis_network', undef)
+#
 # [*redis_node_ips*]
 #   (Optional) List of Redis node ips
 #   Defaults to hiera('redis_node_ips')
@@ -31,12 +51,57 @@
 #   for more details.
 #   Defaults to hiera('step')
 #
+# [*tls_proxy_bind_ip*]
+#   IP on which the TLS proxy will listen on. Required only if
+#   enable_internal_tls is set.
+#   Defaults to undef
+#
+# [*tls_proxy_fqdn*]
+#   fqdn on which the tls proxy will listen on. required only used if
+#   enable_internal_tls is set.
+#   defaults to undef
+#
+# [*tls_proxy_port*]
+#   port on which the tls proxy will listen on. Only used if
+#   enable_internal_tls is set.
+#   defaults to 6379
+#
 class tripleo::profile::base::database::redis (
-  $bootstrap_nodeid = hiera('bootstrap_nodeid'),
-  $redis_node_ips   = hiera('redis_node_ips'),
-  $step             = Integer(hiera('step')),
+  $bootstrap_nodeid    = hiera('bootstrap_nodeid'),
+  $certificate_specs  = hiera('redis_certificate_specs', {}),
+  $enable_internal_tls = hiera('enable_internal_tls', false),
+  $redis_network       = hiera('redis_network', undef),
+  $redis_node_ips      = hiera('redis_node_ips'),
+  $step                = Integer(hiera('step')),
+  $tls_proxy_bind_ip   = undef,
+  $tls_proxy_fqdn      = undef,
+  $tls_proxy_port      = 6379,
 ) {
   if $step >= 2 {
+    if $enable_internal_tls {
+      if !$redis_network {
+        fail('redis_network is not set in the hieradata.')
+      }
+      if !$tls_proxy_bind_ip {
+        fail('tls_proxy_bind_ip is not set in the hieradata.')
+      }
+      if !$tls_proxy_fqdn {
+        fail('tls_proxy_fqdn is required if internal TLS is enabled.')
+      }
+      $tls_certfile = $certificate_specs['service_certificate']
+      $tls_keyfile = $certificate_specs['service_key']
+
+      include ::tripleo::stunnel
+
+      ::tripleo::stunnel::service_proxy { 'redis':
+        accept_host  => $tls_proxy_bind_ip,
+        accept_port  => $tls_proxy_port,
+        connect_port => $tls_proxy_port,
+        certificate  => $tls_certfile,
+        key          => $tls_keyfile,
+        notify       => Class['::redis'],
+      }
+    }
     if downcase($bootstrap_nodeid) == $::hostname {
       $slaveof = undef
     } else {
diff --git a/manifests/profile/base/gnocchi/api.pp b/manifests/profile/base/gnocchi/api.pp
index 88177fd..c958359 100644
--- a/manifests/profile/base/gnocchi/api.pp
+++ b/manifests/profile/base/gnocchi/api.pp
@@ -84,9 +84,11 @@ class tripleo::profile::base::gnocchi::api (
     }
     $tls_certfile = $certificates_specs["httpd-${gnocchi_network}"]['service_certificate']
     $tls_keyfile = $certificates_specs["httpd-${gnocchi_network}"]['service_key']
+    $tls_query_param = '?ssl=true'
   } else {
     $tls_certfile = undef
     $tls_keyfile = undef
+    $tls_query_param = ''
   }
 
   if $step >= 4 and $sync_db {
@@ -104,11 +106,11 @@ class tripleo::profile::base::gnocchi::api (
 
   if $step >= 4 {
     class { '::gnocchi::storage':
-      coordination_url => join(['redis://:', $gnocchi_redis_password, '@', normalize_ip_for_uri($redis_vip), ':6379/']),
+      coordination_url => join(['redis://:', $gnocchi_redis_password, '@', normalize_ip_for_uri($redis_vip), ':6379/', $tls_query_param]),
     }
 
     class { '::gnocchi::storage::incoming::redis':
-      redis_url => join(['redis://:', $gnocchi_redis_password, '@', normalize_ip_for_uri($redis_vip), ':6379/']),
+      redis_url => join(['redis://:', $gnocchi_redis_password, '@', normalize_ip_for_uri($redis_vip), ':6379/', $tls_query_param]),
     }
 
     case $gnocchi_backend {