Add TLS support to cloudkitty backends

By overriding the variable `cloudkitty_backend_ssl: True` HTTPS will
be enabled, disabling HTTP support on the cloudkitty backend api.

The ansible-role-pki is used to generate the required TLS
certificates if this functionality is enabled.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085
Change-Id: I0566028b4737306954b544d040b52cee1fddaa1f
This commit is contained in:
Damian Dabrowski 2023-04-14 23:00:09 +02:00
parent 893db780b4
commit ba2e621a93
3 changed files with 74 additions and 0 deletions

View File

@ -111,6 +111,9 @@ cloudkitty_wsgi_threads: 1
cloudkitty_wsgi_processes_max: 16 cloudkitty_wsgi_processes_max: 16
cloudkitty_wsgi_processes: "{{ [[(ansible_facts['processor_vcpus']//ansible_facts['processor_threads_per_core'])|default(1), 1] | max * 2, cloudkitty_wsgi_processes_max] | min }}" cloudkitty_wsgi_processes: "{{ [[(ansible_facts['processor_vcpus']//ansible_facts['processor_threads_per_core'])|default(1), 1] | max * 2, cloudkitty_wsgi_processes_max] | min }}"
cloudkitty_uwsgi_bind_address: "{{ openstack_service_bind_address | default('0.0.0.0') }}" cloudkitty_uwsgi_bind_address: "{{ openstack_service_bind_address | default('0.0.0.0') }}"
cloudkitty_uwsgi_tls:
crt: "{{ cloudkitty_ssl_cert }}"
key: "{{ cloudkitty_ssl_key }}"
## Service Type and Data ## Service Type and Data
cloudkitty_service_region: "{{ service_region | default('RegionOne') }}" cloudkitty_service_region: "{{ service_region | default('RegionOne') }}"
@ -150,6 +153,7 @@ cloudkitty_services:
uwsgi_overrides: "{{ cloudkitty_api_uwsgi_overrides }}" uwsgi_overrides: "{{ cloudkitty_api_uwsgi_overrides }}"
uwsgi_port: "{{ cloudkitty_service_port }}" uwsgi_port: "{{ cloudkitty_service_port }}"
uwsgi_bind_address: "{{ cloudkitty_uwsgi_bind_address }}" uwsgi_bind_address: "{{ cloudkitty_uwsgi_bind_address }}"
uwsgi_tls: "{{ cloudkitty_backend_ssl | ternary(cloudkitty_uwsgi_tls, {}) }}"
cloudkitty-processor: cloudkitty-processor:
group: cloudkitty_all group: cloudkitty_all
service_name: cloudkitty-processor service_name: cloudkitty-processor
@ -178,3 +182,51 @@ cloudkitty_oslomsg_amqp1_enabled: "{{ cloudkitty_oslomsg_rpc_transport == 'amqp'
cloudkitty_optional_oslomsg_amqp1_pip_packages: cloudkitty_optional_oslomsg_amqp1_pip_packages:
- oslo.messaging[amqp1] - oslo.messaging[amqp1]
###
### Backend TLS
###
# Define if communication between haproxy and service backends should be
# encrypted with TLS.
cloudkitty_backend_ssl: "{{ openstack_service_backend_ssl | default(False) }}"
# Storage location for SSL certificate authority
cloudkitty_pki_dir: "{{ openstack_pki_dir | default('/etc/openstack_deploy/pki') }}"
# Delegated host for operating the certificate authority
cloudkitty_pki_setup_host: "{{ openstack_pki_setup_host | default('localhost') }}"
# cloudkitty server certificate
cloudkitty_pki_keys_path: "{{ cloudkitty_pki_dir ~ '/certs/private/' }}"
cloudkitty_pki_certs_path: "{{ cloudkitty_pki_dir ~ '/certs/certs/' }}"
cloudkitty_pki_intermediate_cert_name: "{{ openstack_pki_service_intermediate_cert_name | default('ExampleCorpIntermediate') }}"
cloudkitty_pki_regen_cert: ''
cloudkitty_pki_san: "{{ openstack_pki_san | default('DNS:' ~ ansible_facts['hostname'] ~ ',IP:' ~ management_address) }}"
cloudkitty_pki_certificates:
- name: "cloudkitty_{{ ansible_facts['hostname'] }}"
provider: ownca
cn: "{{ ansible_facts['hostname'] }}"
san: "{{ cloudkitty_pki_san }}"
signed_by: "{{ cloudkitty_pki_intermediate_cert_name }}"
# cloudkitty destination files for SSL certificates
cloudkitty_ssl_cert: /etc/cloudkitty/cloudkitty.pem
cloudkitty_ssl_key: /etc/cloudkitty/cloudkitty.key
# Installation details for SSL certificates
cloudkitty_pki_install_certificates:
- src: "{{ cloudkitty_user_ssl_cert | default(cloudkitty_pki_certs_path ~ 'cloudkitty_' ~ ansible_facts['hostname'] ~ '-chain.crt') }}"
dest: "{{ cloudkitty_ssl_cert }}"
owner: "{{ cloudkitty_system_user_name }}"
group: "{{ cloudkitty_system_user_name }}"
mode: "0644"
- src: "{{ cloudkitty_user_ssl_key | default(cloudkitty_pki_keys_path ~ 'cloudkitty_' ~ ansible_facts['hostname'] ~ '.key.pem') }}"
dest: "{{ cloudkitty_ssl_key }}"
owner: "{{ cloudkitty_system_user_name }}"
group: "{{ cloudkitty_system_user_name }}"
mode: "0600"
# Define user-provided SSL certificates
#cloudkitty_user_ssl_cert: <path to cert on ansible deployment host>
#cloudkitty_user_ssl_key: <path to cert on ansible deployment host>

View File

@ -26,6 +26,7 @@
- "Restart cloudkitty services" - "Restart cloudkitty services"
- "venv changed" - "venv changed"
- "systemd service changed" - "systemd service changed"
- "cert installed"
- name: Start services - name: Start services
systemd: systemd:
@ -40,3 +41,4 @@
- "Restart cloudkitty services" - "Restart cloudkitty services"
- "venv changed" - "venv changed"
- "systemd service changed" - "systemd service changed"
- "cert installed"

View File

@ -90,6 +90,26 @@
tags: tags:
- cloudkitty-install - cloudkitty-install
- name: Create and install SSL certificates
include_role:
name: pki
tasks_from: main_certs.yml
apply:
tags:
- cloudkitty-config
- pki
vars:
pki_setup_host: "{{ cloudkitty_pki_setup_host }}"
pki_dir: "{{ cloudkitty_pki_dir }}"
pki_create_certificates: "{{ cloudkitty_user_ssl_cert is not defined and cloudkitty_user_ssl_key is not defined }}"
pki_regen_cert: "{{ cloudkitty_pki_regen_cert }}"
pki_certificates: "{{ cloudkitty_pki_certificates }}"
pki_install_certificates: "{{ cloudkitty_pki_install_certificates }}"
when:
- cloudkitty_backend_ssl
tags:
- always
- name: Install the python venv - name: Install the python venv
import_role: import_role:
name: "python_venv_build" name: "python_venv_build"