Age | Commit message (Collapse) | Author | Files | Lines |
|
This is requires for when libvirt is running over a container, since
we shouldn't try to restart the libvirt process, but the container
itself.
bp tls-via-certmonger-containers
Change-Id: I26a7748b37059ea37f460d8c70ef684cc41b16d3
|
|
|
|
|
|
|
|
|
|
|
|
|
|
We need to make it configurable since these commands don't apply for
containerized environments. This way we can restart containers or
disable restarting and rely on other means.
This stems from the issue that some services get accidentally started by
certmonger on containerized environments, which makes the container
initialization fail.
bp tls-via-certmonger-containers
Change-Id: I62ff89362cfcc80e6e62fad09110918c36802813
|
|
|
|
|
|
|
|
|
|
This adds a TLS proxy in front of it so it serves TLS in the internal
network.
bp tls-via-certmonger
Change-Id: I97ac2da29be468c75713fe2fae7e6d84cae8f67c
|
|
|
|
If we're using local registries, we may want to use different
registries e.g. for Ceph and for OpenStack. We allow multiple
registries in general for this purpose, and we should also allow it in
the insecure registry configuration.
Change-Id: I5cddd20a123a85516577bde1b793a30d43171285
Related-Bug: #1709310
|
|
|
|
|
|
This enables the usage of TLS by the apache vhost that hosts horizon.
bp tls-via-certmonger
Change-Id: I7f2e11eb60c7b075e8a59f28682ecc50eeb95c3e
|
|
This removes clutter from the main haproxy manifest and allows TLS in
the internal network as well. Trying to keep the previous behavior.
bp tls-via-certmonger-containers
Change-Id: I1a68771cc7be7fb2b32abbad81db7890bd2c5502
|
|
Change-Id: Id3277c97052e1dd88e6d2de6c5f92b32b95fa210
|
|
This makes sure that the database creation is only executed on the mysql
profile (or container if that's enabled), and stops the conflicts and
errors that were happening when barbican was deployed in containerized
environments.
Change-Id: Ib5c99482f62397fc5fb79a9dc537dfb06ee7f4df
Closes-Bug: #1710928
|
|
Generate a cron job and a config for logrotate
to be run against containerized services logs.
Related-bug: #1700912
Change-Id: Ib9d5d8ca236296179182613e1ff625deea168614
Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
|
|
The current code exposes an unused public listen directive in HAProxy
for the keystone admin endpoint. This is not ideal and should be
removed, as it exposes the service unnecessarily. We should stick to
just exposing it to the ctlplane network as is the default.
If folks really need to expose it to the public network, they can do so
by modifying the ServiceNetMap through t-h-t and setting the keystone
admin endpoint's network to external.
Now, for "single" or "internal" haproxy endpoints, this adds the ability
to detect if they're using the external network, and thus use TLS on it.
Which is something a deployer would want if they exposed the keystone
admin endpoint in such a way.
Change-Id: I79563f62fd49a4f7654779157ebda3c239d6dd22
Closes-Bug: #1710909
Closes-Bug: #1639996
|
|
|
|
|
|
|
|
|
|
The internal details of enabling IPv6 have moved upstream[1], so just
set the ipv6 flag when desired and don't worry about the details
anymore!
[1] https://github.com/puppetlabs/puppetlabs-rabbitmq/pull/552
Closes-Bug: #1710658
Change-Id: Ib22507c4d02f0fae5c0189ab7e040efac3df7e2f
|
|
This changes adds Dell EMC VMAX backend as composable service
and matches the tripleo-heat-templates.
Change-Id: I6e3b4ed6477c7ee56aef4e9849893229ca648c85
Implements: blueprint dellemc-vmax-manila
|
|
This changes adds Dell EMC VMAX ISCSI backend as composable service
and matches the tripleo-heat-templates.
Change-Id: Ifc169c60994856e382b76b72e020624ca64eef9f
Implements: blueprint dellemc-vmax-isci
|
|
|
|
|
|
|
|
|
|
Both fs and key are handled by ceph-ansible, move fs and key
creation out of manila manifest to assure that it works with and
without ceph-ansbile.
Client-side manila key is created from ceph-mds and ceph-external
templates in I6308a317ffe0af244396aba5197c85e273e69f68.
Depends-On: I6308a317ffe0af244396aba5197c85e273e69f68
Partially-Implements: blueprint nfs-ganesha
Change-Id: I2b5567a39ac8737e80758b705818cc1807dc8bf1
|
|
This was missed from a previous commit, as described in the bug report.
We need to set this variable in this case as well, else it will use the
undefined variable, thus ignoring anything that the user had set.
Change-Id: I6810e7bb3eed16a6478974ac759c3f720a41120a
Closes-Bug: #1709332
|
|
In a containerized environment the haproxy class might not be defined,
so this was made optional. On the other hand, this also retrieves the
CRL before any certmonger_certificate resources are created.
bp tls-via-certmonger-containers
Change-Id: I2078da7757ff3af1d05d36315fcebd54bb4ca3ec
|
|
When mds creates manila key [1], then manila manifest needs to check
first if this resource already exists otherwise puppet fails.
[1] I6308a317ffe0af244396aba5197c85e273e69f68
Change-Id: I3f18bbe476c4f43fa4e162cc66c5df443122cd0c
|
|
|
|
|
|
In non-containerized deployments, HAProxy can be configured to use TLS
for proxying internal services.
Fix the creation of the of the haproxy bundle resource to enable TLS
when configured. The keys and certs files, as well as the crl file are
all passed as configuration files and must be copied by Kolla at
container startup.
Change-Id: I4b72739446c63f0f0ac9f859314a4d6746e20255
Partial-Bug: #1709563
|
|
|
|
In non-containerized deployments, RabbitMQ can be configured to use TLS for
serving and mirroring traffic.
Fix the creation of the rabbitmq bundle resource to enable TLS when configured.
The key and cert are passed as other configuration files and must be copied by
Kolla at container startup.
Change-Id: Ia64d79462de7012e5bceebf0ffe478a1cccdd6c9
Partial-Bug: #1709558
|
|
|
|
This only enables correct offline upgrade for now, proper rolling
upgrade support will follow in the Queens release.
Change-Id: Iebbd0c6dfc704ba2e0b5176d607354dd31f13a0d
Depends-On: I548c80cf138b661ba3a5e45a6dfe8711f3322ed0
Partial-Bug: #1708149
|
|
|
|
The latest version of puppet now require the class dependencies included
in the unit tests.
Change-Id: I0b6462f697f2d8012f8a785660c004f3efb13fdc
|
|
In non-containerized deployments, Galera can be configured to use TLS
for gcomm group communication when enable_internal_tls is set to true.
Fix the creation of the mysql bundle resource to enable TLS when
configured. The key and cert are passed as other configuration files
and must be copied by Kolla at container startup.
Change-Id: If845baa7b0a437c28148c817b7f94d540ca15814
Partial-Bug: #1708135
|
|
|
|
|