From d5ac6b70f2f6048b4846fa539aa4e870bed6c201 Mon Sep 17 00:00:00 2001
From: Juan Antonio Osorio Robles <jaosorior@redhat.com>
Date: Fri, 27 Jan 2017 17:42:18 +0200
Subject: Force MySQL users to use SSL if internal TLS is enabled

This forces the MySQL users to use SSL when connecting to MySQL.

bp tls-via-certmonger

Depends-On: I24e4c195a31109835739e78a6b53d36f661f9fd0
Change-Id: I98856955132b680a159144204da1d5b400fe9794
---
 manifests/profile/base/database/mysql.pp | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'manifests/profile/base/database/mysql.pp')

diff --git a/manifests/profile/base/database/mysql.pp b/manifests/profile/base/database/mysql.pp
index 8eb6079..ef5f05d 100644
--- a/manifests/profile/base/database/mysql.pp
+++ b/manifests/profile/base/database/mysql.pp
@@ -95,6 +95,9 @@ class tripleo::profile::base::database::mysql (
   if $enable_internal_tls {
     $tls_certfile = $certificate_specs['service_certificate']
     $tls_keyfile = $certificate_specs['service_key']
+
+    # Force users/grants created to use TLS connections
+    Openstacklib::Db::Mysql <||> { tls_options => ['SSL'] }
   } else {
     $tls_certfile = undef
     $tls_keyfile = undef
-- 
cgit 1.2.3-korg