diff options
| author |   Jenkins <jenkins@review.openstack.org> | 2016-08-26 16:27:36 +0000 |
|---|---|---|
| committer |   Gerrit Code Review <review@openstack.org> | 2016-08-26 16:27:36 +0000 |
| commit | 3fe6c1aa1cca3be8ee20cbbcdf9b807d11a97dcf (patch) | |
| tree | 66d5cbe55649711b4a83f0622338bdda6fd6c00f | |
| parent | 3f5a6b1a820f9cbb1943c628348f93b9f8a6b22b (diff) | |
| parent | 9a6f712849ec742a5dbe7298ad152404c664be6a (diff) | |
Merge "Add deployment of CAs via hieradata"
| -rw-r--r-- | environments/inject-trust-anchor-hiera.yaml | 8 | ||||
| -rw-r--r-- | overcloud-resource-registry-puppet.yaml | 1 | ||||
| -rw-r--r-- | overcloud.yaml | 5 | ||||
| -rw-r--r-- | puppet/services/ca-certs.yaml | 35 |
4 files changed, 49 insertions, 0 deletions
diff --git a/environments/inject-trust-anchor-hiera.yaml b/environments/inject-trust-anchor-hiera.yaml new file mode 100644 index 00000000..b4908c1b --- /dev/null +++ b/environments/inject-trust-anchor-hiera.yaml @@ -0,0 +1,8 @@ +parameter_defaults: + CAMap: + first-ca-name: + content: | + The content of the CA cert goes here + second-ca-name: + content: | + The content of the CA cert goes here diff --git a/overcloud-resource-registry-puppet.yaml b/overcloud-resource-registry-puppet.yaml index ab4d249f..008f42f7 100644 --- a/overcloud-resource-registry-puppet.yaml +++ b/overcloud-resource-registry-puppet.yaml @@ -130,6 +130,7 @@ resource_registry: # services OS::TripleO::Services: puppet/services/services.yaml + OS::TripleO::Services::CACerts: puppet/services/ca-certs.yaml OS::TripleO::Services::CephMon: OS::Heat::None OS::TripleO::Services::CephOSD: OS::Heat::None OS::TripleO::Services::CephClient: OS::Heat::None diff --git a/overcloud.yaml b/overcloud.yaml index 93150555..b534deb9 100644 --- a/overcloud.yaml +++ b/overcloud.yaml @@ -134,6 +134,7 @@ parameters: ControllerServices: default: + - OS::TripleO::Services::CACerts - OS::TripleO::Services::CephMon - OS::TripleO::Services::CephExternal - OS::TripleO::Services::CinderApi @@ -204,6 +205,7 @@ parameters: ComputeServices: default: + - OS::TripleO::Services::CACerts - OS::TripleO::Services::CephClient - OS::TripleO::Services::CephExternal - OS::TripleO::Services::Timezone @@ -237,6 +239,7 @@ parameters: type: json BlockStorageServices: default: + - OS::TripleO::Services::CACerts - OS::TripleO::Services::CinderVolume - OS::TripleO::Services::Kernel - OS::TripleO::Services::Ntp @@ -261,6 +264,7 @@ parameters: type: json ObjectStorageServices: default: + - OS::TripleO::Services::CACerts - OS::TripleO::Services::Kernel - OS::TripleO::Services::Ntp - OS::TripleO::Services::SwiftStorage @@ -288,6 +292,7 @@ parameters: type: json CephStorageServices: default: + - OS::TripleO::Services::CACerts - OS::TripleO::Services::CephOSD - OS::TripleO::Services::Kernel - OS::TripleO::Services::Ntp diff --git a/puppet/services/ca-certs.yaml b/puppet/services/ca-certs.yaml new file mode 100644 index 00000000..1a534156 --- /dev/null +++ b/puppet/services/ca-certs.yaml @@ -0,0 +1,35 @@ +heat_template_version: 2016-04-08 + +description: > + HAproxy service configured with Puppet + +parameters: + ServiceNetMap: + default: {} + description: Mapping of service_name -> network name. Typically set + via parameter_defaults in the resource registry. This + mapping overrides those in ServiceNetMapDefaults. + type: json + DefaultPasswords: + default: {} + type: json + EndpointMap: + default: {} + description: Mapping of service endpoint -> protocol. Typically set + via parameter_defaults in the resource registry. + type: json + CAMap: + description: > + Map containing the CA certs and information needed for deploying them. + default: {} + type: json + +outputs: + role_data: + description: Role data for injecting CA certificates. + value: + service_name: ca_certs + config_settings: + tripleo::trusted_cas::ca_map: {get_param: CAMap} + step_config: | + include ::tripleo::trusted_cas |