openstack
/
tripleo-heat-templates
Code Issues Proposed changes

Request certificate for using host service principals 

This removes the usage of the VIP service principals for requesting the
certificate, and uses the host instead.

Closes-Bug: #1818513
Depends-On: I245516257da280b91779313ffb18f84c8a4e3635
Change-Id: Ie2c3eb8e863184ffd943dd5b4a003790032542a4
This commit is contained in:
Juan Antonio Osorio Robles 2019-03-04 18:52:08 +02:00
parent 9799dd549e
commit b53f6bacde
3 changed files with 28 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
deployment/database/mysql-base.yaml
View File

@ -137,7 +137,7 @@ outputs:
service_key: '/etc/pki/tls/private/mysql.key'
hostname:
str_replace:
template: "%{hiera('cloud_name_NETWORK')}"
template: "%{hiera('fqdn_NETWORK')}"
params:
NETWORK: {get_param: [ServiceNetMap, MysqlNetwork]}
dnsnames:
@ -147,12 +147,12 @@ outputs:
NETWORK: {get_param: [ServiceNetMap, MysqlNetwork]}
- str_replace:
template:
"%{hiera('fqdn_$NETWORK')}"
"%{hiera('fqdn_NETWORK')}"
params:
$NETWORK: {get_param: [ServiceNetMap, MysqlNetwork]}
NETWORK: {get_param: [ServiceNetMap, MysqlNetwork]}
principal:
str_replace:
template: "mysql/%{hiera('cloud_name_NETWORK')}"
template: "mysql/%{hiera('fqdn_NETWORK')}"
params:
NETWORK: {get_param: [ServiceNetMap, MysqlNetwork]}
- {}

19
deployment/database/redis-container-puppet.yaml
View File

@ -94,12 +94,22 @@ outputs:
service_key: '/etc/pki/tls/private/redis.key'
hostname:
str_replace:
template: "%{hiera('cloud_name_NETWORK')}"
template: "%{hiera('fqdn_NETWORK')}"
params:
NETWORK: {get_param: [ServiceNetMap, RedisNetwork]}
dnsnames:
- str_replace:
template: "%{hiera('cloud_name_NETWORK')}"
params:
NETWORK: {get_param: [ServiceNetMap, RedisNetwork]}
- str_replace:
template:
"%{hiera('fqdn_NETWORK')}"
params:
NETWORK: {get_param: [ServiceNetMap, RedisNetwork]}
principal:
str_replace:
template: "redis/%{hiera('cloud_name_NETWORK')}"
template: "redis/%{hiera('fqdn_NETWORK')}"
params:
NETWORK: {get_param: [ServiceNetMap, RedisNetwork]}
postsave_cmd: "/usr/bin/certmonger-redis-refresh.sh"
@ -197,8 +207,11 @@ outputs:
- internal_tls_enabled
-
- service: redis
network: {get_param: [ServiceNetMap, RabbitmqNetwork]}
network: {get_param: [ServiceNetMap, RedisNetwork]}
type: vip
- service: redis
network: {get_param: [ServiceNetMap, RedisNetwork]}
type: node
- null
host_prep_tasks:
- name: create persistent directories

10
deployment/haproxy/haproxy-internal-tls-certmonger.j2.yaml
View File

@ -86,8 +86,11 @@ outputs:
- ''
- - {get_param: HAProxyInternalTLSKeysDirectory}
- '/overcloud-haproxy-NETWORK.key'
hostname: "%{hiera('cloud_name_NETWORK')}"
principal: "haproxy/%{hiera('cloud_name_NETWORK')}"
hostname: "%{hiera('fqdn_NETWORK')}"
dnsnames:
- "%{hiera('cloud_name_NETWORK')}"
- "%{hiera('fqdn_NETWORK')}"
principal: "haproxy/%{hiera('fqdn_NETWORK')}"
postsave_cmd: "/usr/bin/certmonger-haproxy-refresh.sh reload NETWORK"
for_each:
NETWORK: {get_attr: [HAProxyNetworks, value]}
@ -97,5 +100,8 @@ outputs:
- service: haproxy
network: $NETWORK
type: vip
- service: haproxy
network: $NETWORK
type: node
for_each:
$NETWORK: {get_attr: [HAProxyNetworks, value]}