From 1924e3ac3a04c930648dcc104853cbafa61e2132 Mon Sep 17 00:00:00 2001 From: Robert Collins Date: Fri, 18 Jul 2014 20:56:23 +1200 Subject: Fix SSL with HAProxy. The current configuration of services is that if SSL is in use (signaled by stunnel.connect_ip) we bind to 127.0.0.1 - which is great, but it breaks simultaneous non-SSL due to there being no pass-through stunnel equivalent on all the nodes. As an interim measure, teach stunnel to connect to the ctlplane address instead. We will need this flexability in future anyway to deal with mixed-mode configurations, but we don't yet have an SSL only configuration. The change will permit SSL only by altering the Deployment object only - the SSL config object should now be flexible enough to run in either mode (but as yet on an all-one-way-or-the-other basis). Change-Id: Ibac3dec1fe7b573029482fdd9ad2d2f6223fbce0 --- overcloud-source.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'overcloud-source.yaml') diff --git a/overcloud-source.yaml b/overcloud-source.yaml index a8fcb9a3..4d24b08f 100644 --- a/overcloud-source.yaml +++ b/overcloud-source.yaml @@ -670,6 +670,14 @@ Resources: server: {Ref: controller0} signal_transport: NO_SIGNAL input_values: + controller_host: + Fn::Select: + - 0 + - Fn::Select: + - ctlplane + - Fn::GetAtt: + - controller0 + - networks ssl_certificate: {Ref: SSLCertificate} ssl_key: {Ref: SSLKey} ssl_ca_certificate: {Ref: SSLCACertificate} -- cgit 1.2.3-korg