aboutsummaryrefslogtreecommitdiffstats
path: root/manifests/profile
diff options
context:
space:
mode:
authorJenkins <jenkins@review.openstack.org>2017-04-25 17:33:53 +0000
committerGerrit Code Review <review@openstack.org>2017-04-25 17:33:53 +0000
commitbaecff6c3ca47400ace7fb6ef5a83cd0a206041a (patch)
treeb5f7f850ad31af7a55eb5371b849fe1acedadc45 /manifests/profile
parent03828da512f0260b7f94e5edb9a9916b6187fbbb (diff)
parent60d187ee0bc87c33e4b6e4d79983089157ce7565 (diff)
Merge "Enable internal network TLS for etcd"
Diffstat (limited to 'manifests/profile')
-rw-r--r--manifests/profile/base/certmonger_user.pp9
-rw-r--r--manifests/profile/base/etcd.pp57
2 files changed, 56 insertions, 10 deletions
diff --git a/manifests/profile/base/certmonger_user.pp b/manifests/profile/base/certmonger_user.pp
index 4d91ac9..b63fb7f 100644
--- a/manifests/profile/base/certmonger_user.pp
+++ b/manifests/profile/base/certmonger_user.pp
@@ -58,12 +58,18 @@
# it will create.
# Defaults to hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}).
#
+# [*etcd_certificate_specs*]
+# (Optional) The specifications to give to certmonger for the certificate(s)
+# it will create.
+# Defaults to hiera('tripleo::profile::base::etcd::certificate_specs', {}).
+#
class tripleo::profile::base::certmonger_user (
$apache_certificates_specs = hiera('apache_certificates_specs', {}),
$haproxy_certificates_specs = hiera('tripleo::profile::base::haproxy::certificates_specs', {}),
$libvirt_certificates_specs = hiera('libvirt_certificates_specs', {}),
$mysql_certificate_specs = hiera('tripleo::profile::base::database::mysql::certificate_specs', {}),
$rabbitmq_certificate_specs = hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}),
+ $etcd_certificate_specs = hiera('tripleo::profile::base::etcd::certificate_specs', {}),
) {
include ::tripleo::certmonger::ca::libvirt
@@ -87,4 +93,7 @@ class tripleo::profile::base::certmonger_user (
unless empty($rabbitmq_certificate_specs) {
ensure_resource('class', 'tripleo::certmonger::rabbitmq', $rabbitmq_certificate_specs)
}
+ unless empty($etcd_certificate_specs) {
+ ensure_resource('class', 'tripleo::certmonger::etcd', $etcd_certificate_specs)
+ }
}
diff --git a/manifests/profile/base/etcd.pp b/manifests/profile/base/etcd.pp
index c29c937..9f5d180 100644
--- a/manifests/profile/base/etcd.pp
+++ b/manifests/profile/base/etcd.pp
@@ -34,26 +34,63 @@
# (Optional) Array of host(s) for etcd nodes.
# Defaults to hiera('etcd_node_ips', []).
#
+# [*certificate_specs*]
+# (Optional) The specifications to give to certmonger for the certificate
+# it will create. Note that the certificate nickname must be 'etcd' in
+# the case of this service.
+# Example with hiera:
+# tripleo::profile::base::etcd::certificate_specs:
+# hostname: <overcloud controller fqdn>
+# service_certificate: <service certificate path>
+# service_key: <service key path>
+# principal: "etcd/<overcloud controller fqdn>"
+# Defaults to {}.
+#
+# [*enable_internal_tls*]
+# (Optional) Whether TLS in the internal network is enabled or not.
+# Defaults to hiera('enable_internal_tls', false)
+#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
# Defaults to hiera('step')
#
class tripleo::profile::base::etcd (
- $bind_ip = '127.0.0.1',
- $client_port = '2379',
- $peer_port = '2380',
- $nodes = hiera('etcd_node_names', []),
- $step = hiera('step'),
+ $bind_ip = '127.0.0.1',
+ $client_port = '2379',
+ $peer_port = '2380',
+ $nodes = hiera('etcd_node_names', []),
+ $certificate_specs = {},
+ $enable_internal_tls = hiera('enable_internal_tls', false),
+ $step = hiera('step'),
) {
+
+ validate_hash($certificate_specs)
+
+ if $enable_internal_tls {
+ $tls_certfile = $certificate_specs['service_certificate']
+ $tls_keyfile = $certificate_specs['service_key']
+ $protocol = 'https'
+ } else {
+ $tls_certfile = undef
+ $tls_keyfile = undef
+ $protocol = 'http'
+ }
+
if $step >= 2 {
class {'::etcd':
- listen_client_urls => "http://${bind_ip}:${client_port}",
- advertise_client_urls => "http://${bind_ip}:${client_port}",
- listen_peer_urls => "http://${bind_ip}:${peer_port}",
- initial_advertise_peer_urls => "http://${bind_ip}:${peer_port}",
- initial_cluster => regsubst($nodes, '.+', "\\0=http://\\0:${peer_port}"),
+ listen_client_urls => "${protocol}://${bind_ip}:${client_port}",
+ advertise_client_urls => "${protocol}://${bind_ip}:${client_port}",
+ listen_peer_urls => "${protocol}://${bind_ip}:${peer_port}",
+ initial_advertise_peer_urls => "${protocol}://${bind_ip}:${peer_port}",
+ initial_cluster => regsubst($nodes, '.+', "\\0=${protocol}://\\0:${peer_port}"),
proxy => 'off',
+ cert_file => $tls_certfile,
+ key_file => $tls_keyfile,
+ client_cert_auth => $enable_internal_tls,
+ peer_cert_file => $tls_certfile,
+ peer_key_file => $tls_keyfile,
+ peer_client_cert_auth => $enable_internal_tls,
}
}
}