From ada4dcf39b9c340e5e9b627e9e374da93a569a78 Mon Sep 17 00:00:00 2001 From: Dmitriy Rabotyagov Date: Tue, 21 Sep 2021 14:28:54 +0300 Subject: [PATCH] Refactor galera_use_ssl behaviour With PKI role in place in most cases you don't need to explicitly provide path to the CA file because PKI role ensures that CA is trusted by the system overall. In the meanwhile in PyMySQL [1] you must either provide CA file or cert/key or enable verify. Since current behaviour is to provide path to the custom CA we expect certificate being trusted overall. Thus we enable cert verification when galera_use_ssl is True. [1] https://github.com/PyMySQL/PyMySQL/blob/78f0cf99e5d5351df0821442e4dc35c49a6390c6/pymysql/connections.py#L267 Change-Id: Ic5b072d983c6d553d996a0a3bd708eec4c2137e5 --- defaults/main.yml | 2 +- templates/designate.conf.j2 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 78cebe2..63e6da9 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -66,7 +66,7 @@ designate_galera_address: "{{ galera_address | default('127.0.0.1') }}" designate_galera_user: designate designate_galera_database: designate designate_galera_use_ssl: "{{ galera_use_ssl | default(False) }}" -designate_galera_ssl_ca_cert: "{{ galera_ssl_ca_cert | default('/etc/ssl/certs/galera-ca.pem') }}" +designate_galera_ssl_ca_cert: "{{ galera_ssl_ca_cert | default('') }}" designate_galera_port: "{{ galera_port | default('3306') }}" ## Oslo Messaging diff --git a/templates/designate.conf.j2 b/templates/designate.conf.j2 index 8944da3..af3d4d1 100644 --- a/templates/designate.conf.j2 +++ b/templates/designate.conf.j2 @@ -373,7 +373,7 @@ endpoint_type = internalURL # SQLAlchemy Storage #----------------------- [storage:sqlalchemy] -connection = mysql+pymysql://{{ designate_galera_user }}:{{ designate_galera_password }}@{{ designate_galera_address }}/{{ designate_galera_database }}?charset=utf8{% if designate_galera_use_ssl | bool %}&ssl_ca={{ designate_galera_ssl_ca_cert }}{% endif %} +connection = mysql+pymysql://{{ designate_galera_user }}:{{ designate_galera_password }}@{{ designate_galera_address }}/{{ designate_galera_database }}?charset=utf8{% if designate_galera_use_ssl | bool %}&ssl_verify_cert=true{% if designate_galera_ssl_ca_cert | length > 0 %}&ssl_ca={{ designate_galera_ssl_ca_cert }}{% endif %}{% endif %} #connection_debug = 0 #connection_trace = False