From be82c8690678e199e5fe95242c884f943531597b Mon Sep 17 00:00:00 2001 From: Nagasai Vinaykumar Kapalavai Date: Wed, 16 Jan 2019 13:28:13 -0500 Subject: [PATCH] Qdr: InternalTLS support. Configuration changes to provide Internal TLS support for Qdr. Change-Id: I30142db8bfa55412b8c8224aeb05916184117a86 --- files/certmonger-metrics-qdr-refresh.sh | 24 ++++++ manifests/certmonger/metrics_qdr.pp | 89 +++++++++++++++++++++++ manifests/profile/base/certmonger_user.pp | 9 +++ manifests/profile/base/metrics/qdr.pp | 15 +++- 4 files changed, 136 insertions(+), 1 deletion(-) create mode 100644 files/certmonger-metrics-qdr-refresh.sh create mode 100644 manifests/certmonger/metrics_qdr.pp diff --git a/files/certmonger-metrics-qdr-refresh.sh b/files/certmonger-metrics-qdr-refresh.sh new file mode 100644 index 000000000..2e7f9f4d7 --- /dev/null +++ b/files/certmonger-metrics-qdr-refresh.sh @@ -0,0 +1,24 @@ +#!/bin/bash + + +container_cli=$(hiera -c /etc/puppet/hiera.yaml container_cli docker) + +container_name=$($container_cli ps --format="{{.Names}}" | grep metrics_qdr) + +service_certificate="$(hiera -c /etc/puppet/hiera.yaml tripleo::metrics::qdr::service_certificate)" + +service_key="$(hiera -c /etc/puppet/hiera.yaml tripleo::metrics::qdr::service_key)" + +# Copy the new cert from the mount-point to the real path +$container_cli exec "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_certificate" "$service_certificate" + +# Copy the new key from the mount-point to the real path +$container_cli exec "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_key" "$service_key" + +# Set appropriate permissions +$container_cli exec "$container_name" chown qdrouterd:qdrouterd "$service_certificate" + +$container_cli exec "$container_name" chown qdrouterd:qdrouterd "$service_key" + +# Trigger a container restart to read the new certificates +$container_cli restart $container_name diff --git a/manifests/certmonger/metrics_qdr.pp b/manifests/certmonger/metrics_qdr.pp new file mode 100644 index 000000000..d266e716f --- /dev/null +++ b/manifests/certmonger/metrics_qdr.pp @@ -0,0 +1,89 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::certmonger::metrics_qdr +# +# Request a certificate for the MetricsQdr service and do the necessary setup. +# +# === Parameters +# +# [*hostname*] +# The hostname of the node. this will be set in the CN of the certificate. +# +# [*service_certificate*] +# The path to the certificate that will be used for TLS in this service. +# +# [*service_key*] +# The path to the key that will be used for TLS in this service. +# +# [*certmonger_ca*] +# (Optional) The CA that certmonger will use to generate the certificates. +# Defaults to hiera('certmonger_ca', 'local'). +# +# [*dnsnames*] +# (Optional) The DNS names that will be added for the SubjectAltNames entry +# in the certificate. If left unset, the value will be set to the $hostname. +# This parameter can take both a string or an array of strings. +# Defaults to $hostname +# +# [*postsave_cmd*] +# (Optional) Specifies the command to execute after requesting a certificate. +# If nothing is given, it will default to: "systemctl restart ${service name}" +# Defaults to undef. +# +# [*principal*] +# (Optional) The haproxy service principal that is set for metrics_qdr in kerberos. +# Defaults to undef +# +class tripleo::certmonger::metrics_qdr ( + $hostname, + $service_certificate, + $service_key, + $certmonger_ca = hiera('certmonger_ca', 'local'), + $postsave_cmd = undef, + $principal = undef, +) { + include ::certmonger + include ::qdr::params + + ensure_resource('file', '/usr/bin/certmonger-metrics-qdr-refresh.sh', { + source => 'puppet:///modules/tripleo/certmonger-metrics-qdr-refresh.sh', + mode => '0700', + seltype => 'bin_t', + notify => Service['certmonger'] + }) + + certmonger_certificate { 'metrics_qdr' : + ensure => 'present', + certfile => $service_certificate, + keyfile => $service_key, + hostname => $hostname, + dnsname => $hostname, + principal => $principal, + postsave_cmd => $postsave_cmd, + ca => $certmonger_ca, + wait => true, + require => Class['::certmonger'], + } + + file { $service_certificate : + require => Certmonger_certificate['metrics_qdr'], + } + file { $service_key : + require => Certmonger_certificate['metrics_qdr'], + } + + File[$service_certificate] ~> Service<| title == $::qdr::params::service_name |> + File[$service_key] ~> Service<| title == $::qdr::params::service_name |> +} diff --git a/manifests/profile/base/certmonger_user.pp b/manifests/profile/base/certmonger_user.pp index 3166e811e..37a9e7edb 100644 --- a/manifests/profile/base/certmonger_user.pp +++ b/manifests/profile/base/certmonger_user.pp @@ -82,6 +82,11 @@ # certificate is renewed. # Defaults to undef # +# [*qdr_certificate_specs*] +# (Optional) The specifications to give to certmonger fot the certificate(s) +# it will create. +# Defaults to hiera('tripleo::profile::base::metrics::qdr::certificate_specs', {}). +# # [*mysql_certificate_specs*] # (Optional) The specifications to give to certmonger for the certificate(s) # it will create. @@ -150,6 +155,7 @@ class tripleo::profile::base::certmonger_user ( $libvirt_vnc_postsave_cmd = undef, $qemu_certificates_specs = hiera('qemu_certificates_specs', {}), $qemu_postsave_cmd = undef, + $qdr_certificate_specs = hiera('tripleo::profile::base::metrics::qdr::certificate_specs', {}), $mysql_certificate_specs = hiera('tripleo::profile::base::database::mysql::certificate_specs', {}), $rabbitmq_certificate_specs = hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}), $redis_certificate_specs = hiera('redis_certificate_specs', {}), @@ -217,6 +223,9 @@ class tripleo::profile::base::certmonger_user ( # existing and need to be refreshed if it changed. Tripleo::Certmonger::Haproxy<||> ~> Haproxy::Listen<||> } + unless empty($qdr_certificate_specs) { + ensure_resource('class', 'tripleo::certmonger::metrics_qdr', $qdr_certificate_specs) + } unless empty($mysql_certificate_specs) { ensure_resource('class', 'tripleo::certmonger::mysql', $mysql_certificate_specs) } diff --git a/manifests/profile/base/metrics/qdr.pp b/manifests/profile/base/metrics/qdr.pp index bf2aab567..80c6fb56f 100644 --- a/manifests/profile/base/metrics/qdr.pp +++ b/manifests/profile/base/metrics/qdr.pp @@ -35,6 +35,18 @@ # This argument must be string, even if the numeric form is used. # Defaults to '5666' # +# [*certificate_specs*] +# (optional) The specification to give to certmonger for the certificate +# it will create. Note that the certificate nickname must be 'qdr' in +# the case of this service. +# Example with hiera: +# tripleo::profile::base::metrics::qdr::certificate_specs: +# hostname: +# service_certificate: +# service_key: +# principal: "qdr/" +# Defaults to {}. +# # [*listener_require_encrypt*] # (optional) Require the connection to the peer to be encrypted # Defaults to 'no' @@ -90,6 +102,7 @@ class tripleo::profile::base::metrics::qdr ( $password = undef, $listener_addr = 'localhost', $listener_port = '5666', + $certificate_specs = {}, $listener_require_ssl = false, $listener_require_encrypt = false, $listener_sasl_mech = undef, @@ -118,7 +131,7 @@ class tripleo::profile::base::metrics::qdr ( # TO-DO(mmagr): Metrics QDRs gonna run in edge mode as soon as we will # have a newest version of qpid-dispatch-router. Until then we have to run # in interior mode - #router_mode => 'edge', + #router_mode => 'edge', router_mode => 'interior', connectors => $connectors, extra_addresses => $addresses,