diff options
| author |   Juan Antonio Osorio Robles <jaosorior@redhat.com> | 2017-08-22 18:19:23 +0000 |
|---|---|---|
| committer | Juan Antonio Osorio Robles <jaosorior@redhat.com> | 2017-08-23 05:10:58 +0000 |
| commit | 2696eadaa0f2453b118d3012d8a5494842eb791a (patch) | |
| tree | ae99751b782ad5352cfcd14e34c59ee24487c4d1 | |
| parent | 55383ffac624964b6921ec6706cfc97f495af2d4 (diff) | |
Docker: Enable TLS in the internal network for libvirt
Bind mounts the necessary certs and keys to enable live migrations
using TLS.
bp tls-via-certmonger-containers
Depends-On: I26a7748b37059ea37f460d8c70ef684cc41b16d3
Change-Id: I81efa85d916823f740bf320c88a248403743a45b
| -rw-r--r-- | docker/services/nova-libvirt.yaml | 17 | ||||
| -rw-r--r-- | environments/docker-services-tls-everywhere.yaml | 5 |
2 files changed, 21 insertions, 1 deletions
diff --git a/docker/services/nova-libvirt.yaml b/docker/services/nova-libvirt.yaml index 47414083..8f151cfe 100644 --- a/docker/services/nova-libvirt.yaml +++ b/docker/services/nova-libvirt.yaml @@ -113,7 +113,10 @@ outputs: value: service_name: {get_attr: [NovaLibvirtBase, role_data, service_name]} config_settings: - get_attr: [NovaLibvirtBase, role_data, config_settings] + map_merge: + - get_attr: [NovaLibvirtBase, role_data, config_settings] + - tripleo::profile::base::certmonger_user::libvirt_postsave_cmd: "true" # TODO: restart the libvirt container here + step_config: &step_config list_join: - "\n" @@ -201,6 +204,16 @@ outputs: - /var/lib/libvirt:/var/lib/libvirt - /var/log/libvirt/qemu:/var/log/libvirt/qemu:ro - /var/log/containers/nova:/var/log/nova + - + if: + - use_tls_for_live_migration + - + - /etc/ipa/ca.crt:/etc/pki/CA/cacert.pem:ro + - /etc/pki/libvirt/servercert.pem:/etc/pki/libvirt/servercert.pem:ro + - /etc/pki/libvirt/private/serverkey.pem:/etc/pki/libvirt/private/serverkey.pem:ro + - /etc/pki/libvirt/clientcert.pem:/etc/pki/libvirt/clientcert.pem:ro + - /etc/pki/libvirt/private/clientkey.pem:/etc/pki/libvirt/private/clientkey.pem:ro + - null environment: - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS step_4: @@ -256,6 +269,8 @@ outputs: - libvirtd.service - virtlogd.socket when: libvirt_installed.rc == 0 + metadata_settings: + get_attr: [NovaLibvirtBase, role_data, metadata_settings] upgrade_tasks: - name: Stop and disable libvirtd service tags: step2 diff --git a/environments/docker-services-tls-everywhere.yaml b/environments/docker-services-tls-everywhere.yaml index e15cc3e3..ba190e7c 100644 --- a/environments/docker-services-tls-everywhere.yaml +++ b/environments/docker-services-tls-everywhere.yaml @@ -14,6 +14,7 @@ resource_registry: OS::TripleO::Services::CeilometerAgentNotification: ../docker/services/ceilometer-agent-notification.yaml OS::TripleO::Services::ComputeCeilometerAgent: ../docker/services/ceilometer-agent-compute.yaml OS::TripleO::Services::ComputeNeutronOvsAgent: ../docker/services/neutron-ovs-agent.yaml + OS::TripleO::Services::ContainersLogrotateCrond: ../docker/services/logrotate-crond.yaml OS::TripleO::Services::GlanceApi: ../docker/services/glance-api.yaml OS::TripleO::Services::GnocchiApi: ../docker/services/gnocchi-api.yaml OS::TripleO::Services::GnocchiMetricd: ../docker/services/gnocchi-metricd.yaml @@ -23,8 +24,10 @@ resource_registry: OS::TripleO::Services::HeatApiCfn: ../docker/services/heat-api-cfn.yaml OS::TripleO::Services::HeatEngine: ../docker/services/heat-engine.yaml OS::TripleO::Services::Horizon: ../docker/services/horizon.yaml + OS::TripleO::Services::Iscsid: ../docker/services/iscsid.yaml OS::TripleO::Services::Keystone: ../docker/services/keystone.yaml OS::TripleO::Services::Memcached: ../docker/services/memcached.yaml + OS::TripleO::Services::Multipathd: ../docker/services/multipathd.yaml OS::TripleO::Services::MySQL: ../docker/services/database/mysql.yaml OS::TripleO::Services::NeutronApi: ../docker/services/neutron-api.yaml OS::TripleO::Services::NeutronCorePlugin: ../docker/services/neutron-plugin-ml2.yaml @@ -34,8 +37,10 @@ resource_registry: OS::TripleO::Services::NeutronOvsAgent: ../docker/services/neutron-ovs-agent.yaml OS::TripleO::Services::NeutronServer: ../docker/services/neutron-api.yaml OS::TripleO::Services::NovaApi: ../docker/services/nova-api.yaml + OS::TripleO::Services::NovaCompute: ../docker/services/nova-compute.yaml OS::TripleO::Services::NovaConductor: ../docker/services/nova-conductor.yaml OS::TripleO::Services::NovaConsoleauth: ../docker/services/nova-consoleauth.yaml + OS::TripleO::Services::NovaLibvirt: ../docker/services/nova-libvirt.yaml OS::TripleO::Services::NovaMetadata: ../docker/services/nova-metadata.yaml OS::TripleO::Services::NovaMigrationTarget: ../docker/services/nova-migration-target.yaml OS::TripleO::Services::NovaPlacement: ../docker/services/nova-placement.yaml |