aboutsummaryrefslogtreecommitdiffstats
path: root/mcp
diff options
context:
space:
mode:
authorDelia Popescu <delia.popescu@enea.com>2018-08-07 11:43:11 +0300
committerDelia Popescu <delia.popescu@enea.com>2018-08-07 10:32:01 +0000
commita1635b63db18d1a5388ca4f4d9a21cbcdb7fc4c4 (patch)
tree48ac791812eb1b41cba1fa96a034af09daf6712e /mcp
parent7fe07e31a3aca294b4093ba238ce648fa4cb0f38 (diff)
Enable barbican itegration on compute nodes
Configure barbican for cinder-volumes and nova-compute to use encrypted volumes Disable default glance image signature verification with barbican enabled JIRA: FUNCTEST-981 Change-Id: I35660234526780a2277e459f3fa21a67d96ce7d7 Signed-off-by: Delia Popescu <delia.popescu@enea.com>
Diffstat (limited to 'mcp')
-rw-r--r--mcp/patches/0016-Disable-glance-signature-verification.patch36
-rw-r--r--mcp/patches/patches.list1
-rw-r--r--mcp/reclass/classes/cluster/mcp-common-noha/openstack_compute.yml1
3 files changed, 38 insertions, 0 deletions
diff --git a/mcp/patches/0016-Disable-glance-signature-verification.patch b/mcp/patches/0016-Disable-glance-signature-verification.patch
new file mode 100644
index 000000000..55f641800
--- /dev/null
+++ b/mcp/patches/0016-Disable-glance-signature-verification.patch
@@ -0,0 +1,36 @@
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+: Copyright (c) 2018 Mirantis Inc., Enea AB and others.
+:
+: All rights reserved. This program and the accompanying materials
+: are made available under the terms of the Apache License, Version 2.0
+: which accompanies this distribution, and is available at
+: http://www.apache.org/licenses/LICENSE-2.0
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+From: Delia Popescu <delia.popescu@enea.com>
+Date: Mon, 6 Aug 2018 17:09:14 +0300
+Subject: [PATCH] Disable glance signature verification
+
+Disable glance signature verification if barbican
+integration is enabled on compute nodes
+
+Signed-off-by: Delia Popescu <delia.popescu@enea.com>
+---
+ nova/files/queens/nova-compute.conf.Debian | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/nova/files/queens/nova-compute.conf.Debian b/nova/files/queens/nova-compute.conf.Debian
+index d471a264..47a4e890 100644
+--- a/nova/files/queens/nova-compute.conf.Debian
++++ b/nova/files/queens/nova-compute.conf.Debian
+@@ -5447,9 +5447,9 @@ api_servers = {{ compute.image.get('protocol', 'http') }}://{{ compute.image.hos
+ # below depend on this option being enabled.
+ # (boolean value)
+ {%- if compute.get('barbican', {}).get('enabled', False) %}
+-verify_glance_signatures=true
++#verify_glance_signatures=true
+ {%- else %}
+-#verify_glance_signatures=false
++verify_glance_signatures=false
+ {%- endif %}
+
+ # DEPRECATED:
diff --git a/mcp/patches/patches.list b/mcp/patches/patches.list
index baa15d79d..2f9107156 100644
--- a/mcp/patches/patches.list
+++ b/mcp/patches/patches.list
@@ -10,3 +10,4 @@
/usr/share/salt-formulas/env: 0010-maas-region-allow-timeout-override.patch
/usr/share/salt-formulas/env: 0011-system.repo-Debian-Add-keyserver-proxy-support.patch
/usr/share/salt-formulas/env: 0015-Set-ovs-bridges-as-L3-interfaces.patch
+/usr/share/salt-formulas/env: 0016-Disable-glance-signature-verification.patch
diff --git a/mcp/reclass/classes/cluster/mcp-common-noha/openstack_compute.yml b/mcp/reclass/classes/cluster/mcp-common-noha/openstack_compute.yml
index a027113ae..359ca131d 100644
--- a/mcp/reclass/classes/cluster/mcp-common-noha/openstack_compute.yml
+++ b/mcp/reclass/classes/cluster/mcp-common-noha/openstack_compute.yml
@@ -22,6 +22,7 @@ parameters:
_param:
interface_mtu: 9000
linux_system_codename: xenial
+ barbican_integration_enabled: true
nova:
compute:
libvirt_service: libvirtd