From 2696eadaa0f2453b118d3012d8a5494842eb791a Mon Sep 17 00:00:00 2001
From: Juan Antonio Osorio Robles <jaosorior@redhat.com>
Date: Tue, 22 Aug 2017 18:19:23 +0000
Subject: Docker: Enable TLS in the internal network for libvirt

Bind mounts the necessary certs and keys to enable live migrations
using TLS.

bp tls-via-certmonger-containers

Depends-On: I26a7748b37059ea37f460d8c70ef684cc41b16d3
Change-Id: I81efa85d916823f740bf320c88a248403743a45b
---
 docker/services/nova-libvirt.yaml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

(limited to 'docker')

diff --git a/docker/services/nova-libvirt.yaml b/docker/services/nova-libvirt.yaml
index 47414083..8f151cfe 100644
--- a/docker/services/nova-libvirt.yaml
+++ b/docker/services/nova-libvirt.yaml
@@ -113,7 +113,10 @@ outputs:
     value:
       service_name: {get_attr: [NovaLibvirtBase, role_data, service_name]}
       config_settings:
-        get_attr: [NovaLibvirtBase, role_data, config_settings]
+        map_merge:
+          - get_attr: [NovaLibvirtBase, role_data, config_settings]
+          - tripleo::profile::base::certmonger_user::libvirt_postsave_cmd: "true" # TODO: restart the libvirt container here
+
       step_config: &step_config
         list_join:
           - "\n"
@@ -201,6 +204,16 @@ outputs:
                   - /var/lib/libvirt:/var/lib/libvirt
                   - /var/log/libvirt/qemu:/var/log/libvirt/qemu:ro
                   - /var/log/containers/nova:/var/log/nova
+                -
+                  if:
+                    - use_tls_for_live_migration
+                    -
+                      - /etc/ipa/ca.crt:/etc/pki/CA/cacert.pem:ro
+                      - /etc/pki/libvirt/servercert.pem:/etc/pki/libvirt/servercert.pem:ro
+                      - /etc/pki/libvirt/private/serverkey.pem:/etc/pki/libvirt/private/serverkey.pem:ro
+                      - /etc/pki/libvirt/clientcert.pem:/etc/pki/libvirt/clientcert.pem:ro
+                      - /etc/pki/libvirt/private/clientkey.pem:/etc/pki/libvirt/private/clientkey.pem:ro
+                    - null
             environment:
               - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
         step_4:
@@ -256,6 +269,8 @@ outputs:
             - libvirtd.service
             - virtlogd.socket
           when: libvirt_installed.rc == 0
+      metadata_settings:
+        get_attr: [NovaLibvirtBase, role_data, metadata_settings]
       upgrade_tasks:
         - name: Stop and disable libvirtd service
           tags: step2
-- 
cgit 1.2.3-korg