summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--environments/inject-trust-anchor-hiera.yaml8
-rw-r--r--overcloud-resource-registry-puppet.yaml1
-rw-r--r--overcloud.yaml5
-rw-r--r--puppet/services/ca-certs.yaml35
4 files changed, 49 insertions, 0 deletions
diff --git a/environments/inject-trust-anchor-hiera.yaml b/environments/inject-trust-anchor-hiera.yaml
new file mode 100644
index 00000000..b4908c1b
--- /dev/null
+++ b/environments/inject-trust-anchor-hiera.yaml
@@ -0,0 +1,8 @@
+parameter_defaults:
+ CAMap:
+ first-ca-name:
+ content: |
+ The content of the CA cert goes here
+ second-ca-name:
+ content: |
+ The content of the CA cert goes here
diff --git a/overcloud-resource-registry-puppet.yaml b/overcloud-resource-registry-puppet.yaml
index ab4d249f..008f42f7 100644
--- a/overcloud-resource-registry-puppet.yaml
+++ b/overcloud-resource-registry-puppet.yaml
@@ -130,6 +130,7 @@ resource_registry:
# services
OS::TripleO::Services: puppet/services/services.yaml
+ OS::TripleO::Services::CACerts: puppet/services/ca-certs.yaml
OS::TripleO::Services::CephMon: OS::Heat::None
OS::TripleO::Services::CephOSD: OS::Heat::None
OS::TripleO::Services::CephClient: OS::Heat::None
diff --git a/overcloud.yaml b/overcloud.yaml
index 93150555..b534deb9 100644
--- a/overcloud.yaml
+++ b/overcloud.yaml
@@ -134,6 +134,7 @@ parameters:
ControllerServices:
default:
+ - OS::TripleO::Services::CACerts
- OS::TripleO::Services::CephMon
- OS::TripleO::Services::CephExternal
- OS::TripleO::Services::CinderApi
@@ -204,6 +205,7 @@ parameters:
ComputeServices:
default:
+ - OS::TripleO::Services::CACerts
- OS::TripleO::Services::CephClient
- OS::TripleO::Services::CephExternal
- OS::TripleO::Services::Timezone
@@ -237,6 +239,7 @@ parameters:
type: json
BlockStorageServices:
default:
+ - OS::TripleO::Services::CACerts
- OS::TripleO::Services::CinderVolume
- OS::TripleO::Services::Kernel
- OS::TripleO::Services::Ntp
@@ -261,6 +264,7 @@ parameters:
type: json
ObjectStorageServices:
default:
+ - OS::TripleO::Services::CACerts
- OS::TripleO::Services::Kernel
- OS::TripleO::Services::Ntp
- OS::TripleO::Services::SwiftStorage
@@ -288,6 +292,7 @@ parameters:
type: json
CephStorageServices:
default:
+ - OS::TripleO::Services::CACerts
- OS::TripleO::Services::CephOSD
- OS::TripleO::Services::Kernel
- OS::TripleO::Services::Ntp
diff --git a/puppet/services/ca-certs.yaml b/puppet/services/ca-certs.yaml
new file mode 100644
index 00000000..1a534156
--- /dev/null
+++ b/puppet/services/ca-certs.yaml
@@ -0,0 +1,35 @@
+heat_template_version: 2016-04-08
+
+description: >
+ HAproxy service configured with Puppet
+
+parameters:
+ ServiceNetMap:
+ default: {}
+ description: Mapping of service_name -> network name. Typically set
+ via parameter_defaults in the resource registry. This
+ mapping overrides those in ServiceNetMapDefaults.
+ type: json
+ DefaultPasswords:
+ default: {}
+ type: json
+ EndpointMap:
+ default: {}
+ description: Mapping of service endpoint -> protocol. Typically set
+ via parameter_defaults in the resource registry.
+ type: json
+ CAMap:
+ description: >
+ Map containing the CA certs and information needed for deploying them.
+ default: {}
+ type: json
+
+outputs:
+ role_data:
+ description: Role data for injecting CA certificates.
+ value:
+ service_name: ca_certs
+ config_settings:
+ tripleo::trusted_cas::ca_map: {get_param: CAMap}
+ step_config: |
+ include ::tripleo::trusted_cas