diff options
| author |   Markos Chandras <mchandras@suse.de> | 2018-04-06 10:30:32 +0100 |
|---|---|---|
| committer | Markos Chandras <mchandras@suse.de> | 2018-04-06 12:14:59 +0100 |
| commit | 4a76c03653c6dfe8170017ac7dafd3419b2c7f52 (patch) | |
| tree | 55a933679500c720ca2542e65d2f4f8602cd7064 /xci | |
| parent | bae55b8a8d7ecbbc8da20b728951ebc290245cf9 (diff) | |
xci: kubespray: Generate and use SSL certificate for HAProxy
In the OpenStack-Ansible installers we are using the XCI ssl
certificates for the endpoints but in kubespray we are generating them
on the fly. In order to keep both setups as close as possible, we can
use the XCI certificates in kubespray as well.
Change-Id: I1ca55127fe747618205394c02b3d44bb573435f4
Signed-off-by: Markos Chandras <mchandras@suse.de>
Diffstat (limited to 'xci')
| -rw-r--r-- | xci/installer/kubespray/playbooks/configure-opnfvhost.yml | 3 | ||||
| -rw-r--r-- | xci/installer/kubespray/playbooks/configure-targethosts.yml | 2 |
2 files changed, 5 insertions, 0 deletions
diff --git a/xci/installer/kubespray/playbooks/configure-opnfvhost.yml b/xci/installer/kubespray/playbooks/configure-opnfvhost.yml index af3267ee..f4a0602d 100644 --- a/xci/installer/kubespray/playbooks/configure-opnfvhost.yml +++ b/xci/installer/kubespray/playbooks/configure-opnfvhost.yml @@ -66,5 +66,8 @@ name: ansible version: "{{ xci_kube_ansible_pip_version }}" + - name: Configure SSL certificates + include_tasks: "{{ xci_path }}/xci/playbooks/manage-ssl-certs.yml" + - name: Manage SSH keys include_tasks: "{{ xci_path }}/xci/playbooks/manage-ssh-keys.yml" diff --git a/xci/installer/kubespray/playbooks/configure-targethosts.yml b/xci/installer/kubespray/playbooks/configure-targethosts.yml index 4efe82fd..dd7024fb 100644 --- a/xci/installer/kubespray/playbooks/configure-targethosts.yml +++ b/xci/installer/kubespray/playbooks/configure-targethosts.yml @@ -23,4 +23,6 @@ when: xci_flavor == 'ha' - role: "haproxy_server" haproxy_service_configs: "{{ haproxy_default_services}}" + haproxy_user_ssl_cert: "/etc/ssl/certs/xci.crt" + haproxy_user_ssl_key: "/etc/ssl/private/xci.key" when: xci_flavor == 'ha' |