summaryrefslogtreecommitdiffstats
path: root/docker
diff options
context:
space:
mode:
authorJuan Antonio Osorio Robles <jaosorior@redhat.com>2017-08-22 18:19:23 +0000
committerJuan Antonio Osorio Robles <jaosorior@redhat.com>2017-08-23 05:10:58 +0000
commit2696eadaa0f2453b118d3012d8a5494842eb791a (patch)
treeae99751b782ad5352cfcd14e34c59ee24487c4d1 /docker
parent55383ffac624964b6921ec6706cfc97f495af2d4 (diff)
Docker: Enable TLS in the internal network for libvirt
Bind mounts the necessary certs and keys to enable live migrations using TLS. bp tls-via-certmonger-containers Depends-On: I26a7748b37059ea37f460d8c70ef684cc41b16d3 Change-Id: I81efa85d916823f740bf320c88a248403743a45b
Diffstat (limited to 'docker')
-rw-r--r--docker/services/nova-libvirt.yaml17
1 files changed, 16 insertions, 1 deletions
diff --git a/docker/services/nova-libvirt.yaml b/docker/services/nova-libvirt.yaml
index 47414083..8f151cfe 100644
--- a/docker/services/nova-libvirt.yaml
+++ b/docker/services/nova-libvirt.yaml
@@ -113,7 +113,10 @@ outputs:
value:
service_name: {get_attr: [NovaLibvirtBase, role_data, service_name]}
config_settings:
- get_attr: [NovaLibvirtBase, role_data, config_settings]
+ map_merge:
+ - get_attr: [NovaLibvirtBase, role_data, config_settings]
+ - tripleo::profile::base::certmonger_user::libvirt_postsave_cmd: "true" # TODO: restart the libvirt container here
+
step_config: &step_config
list_join:
- "\n"
@@ -201,6 +204,16 @@ outputs:
- /var/lib/libvirt:/var/lib/libvirt
- /var/log/libvirt/qemu:/var/log/libvirt/qemu:ro
- /var/log/containers/nova:/var/log/nova
+ -
+ if:
+ - use_tls_for_live_migration
+ -
+ - /etc/ipa/ca.crt:/etc/pki/CA/cacert.pem:ro
+ - /etc/pki/libvirt/servercert.pem:/etc/pki/libvirt/servercert.pem:ro
+ - /etc/pki/libvirt/private/serverkey.pem:/etc/pki/libvirt/private/serverkey.pem:ro
+ - /etc/pki/libvirt/clientcert.pem:/etc/pki/libvirt/clientcert.pem:ro
+ - /etc/pki/libvirt/private/clientkey.pem:/etc/pki/libvirt/private/clientkey.pem:ro
+ - null
environment:
- KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
step_4:
@@ -256,6 +269,8 @@ outputs:
- libvirtd.service
- virtlogd.socket
when: libvirt_installed.rc == 0
+ metadata_settings:
+ get_attr: [NovaLibvirtBase, role_data, metadata_settings]
upgrade_tasks:
- name: Stop and disable libvirtd service
tags: step2