diff options
author | Jenkins <jenkins@review.openstack.org> | 2017-09-06 15:03:28 +0000 |
---|---|---|
committer | Gerrit Code Review <review@openstack.org> | 2017-09-06 15:03:28 +0000 |
commit | 21be02962dbb03c4df9818f6b4be8f697cc98094 (patch) | |
tree | 745cbeb7b456e15e3fa27ae9482d4900e7c51274 /puppet/services/database/redis-base.yaml | |
parent | 0fd2fdaa9035d2af09b3eddd88b60c8f1a0e54f6 (diff) | |
parent | dc646db94395ce4ad29d430107f6cb19e7a44d31 (diff) |
Merge "TLS proxy for redis" into stable/pike
Diffstat (limited to 'puppet/services/database/redis-base.yaml')
-rw-r--r-- | puppet/services/database/redis-base.yaml | 20 |
1 files changed, 18 insertions, 2 deletions
diff --git a/puppet/services/database/redis-base.yaml b/puppet/services/database/redis-base.yaml index 2a6a89e9..8436062a 100644 --- a/puppet/services/database/redis-base.yaml +++ b/puppet/services/database/redis-base.yaml @@ -38,6 +38,12 @@ parameters: description: Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry. type: json + EnableInternalTLS: + type: boolean + default: false + +conditions: + use_tls_proxy: {equals : [{get_param: EnableInternalTLS}, true]} outputs: role_data: @@ -53,10 +59,20 @@ outputs: # internal_api -> IP # internal_api_uri -> [IP] # internal_api_subnet - > IP/CIDR - redis::bind: {get_param: [ServiceNetMap, RedisNetwork]} + # Bind to localhost if internal TLS is enabled, since we put a TLs + # proxy in front. + redis::bind: + if: + - use_tls_proxy + - 'localhost' + - {get_param: [ServiceNetMap, RedisNetwork]} redis::port: 6379 redis::sentinel::master_name: "%{hiera('bootstrap_nodeid')}" redis::sentinel::redis_host: "%{hiera('bootstrap_nodeid_ip')}" redis::sentinel::notification_script: '/usr/local/bin/redis-notifications.sh' - redis::sentinel::sentinel_bind: {get_param: [ServiceNetMap, RedisNetwork]} + redis::sentinel::sentinel_bind: + if: + - use_tls_proxy + - 'localhost' + - {get_param: [ServiceNetMap, RedisNetwork]} redis::ulimit: {get_param: RedisFDLimit} |