Add MySQL connection SSL support

When 'glance_galera_use_ssl' is True, use an encrypted connection to
the database using either a self-signed or user-provided CA certificate.

A new non-voting test has been added to verify that the role remains
functional when enabling SSL features.

Partial-Bug: 1667789

Change-Id: I18e9d47e88e61ff287e5120dead49b02cdf1f8ac
Depends-On: I95cc994df5118fce7ce588fc0bff979bc283a6f3
This commit is contained in:
Jimmy McCrory 2017-12-13 17:12:14 -08:00
parent 477d44cab9
commit e5ac2f07e3
7 changed files with 26 additions and 4 deletions

View File

@ -102,9 +102,11 @@ glance_rabbitmq_telemetry_port: "{{ glance_rabbitmq_port }}"
glance_rabbitmq_telemetry_servers: "{{ glance_rabbitmq_servers }}"
glance_rabbitmq_telemetry_use_ssl: "{{ glance_rabbitmq_use_ssl }}"
## DB info
## Database info
glance_galera_database: glance
glance_galera_user: glance
glance_galera_use_ssl: "{{ galera_use_ssl | default(False) }}"
glance_galera_ssl_ca_cert: "{{ galera_ssl_ca_cert | default('/etc/ssl/certs/galera-ca.pem') }}"
glance_role_name: admin
glance_api_bind_address: 0.0.0.0

View File

@ -40,7 +40,7 @@ show_multiple_locations = {{ glance_show_multiple_locations }}
task_executor = {{ glance_task_executor }}
[database]
connection = mysql+pymysql://{{ glance_galera_user }}:{{ glance_container_mysql_password }}@{{ glance_galera_address }}/{{ glance_galera_database }}?charset=utf8
connection = mysql+pymysql://{{ glance_galera_user }}:{{ glance_container_mysql_password }}@{{ glance_galera_address }}/{{ glance_galera_database }}?charset=utf8{% if glance_galera_use_ssl | bool %}&ssl_ca={{ glance_galera_ssl_ca_cert }}{% endif %}
[keystone_authtoken]
insecure = {{ keystone_service_internaluri_insecure | bool }}

View File

@ -6,4 +6,4 @@ log_file = /var/log/glance/glance-manage.log
fatal_deprecations = {{ glance_fatal_deprecations }}
[database]
connection = mysql+pymysql://{{ glance_galera_user }}:{{ glance_container_mysql_password }}@{{ glance_galera_address }}/{{ glance_galera_database }}?charset=utf8
connection = mysql+pymysql://{{ glance_galera_user }}:{{ glance_container_mysql_password }}@{{ glance_galera_address }}/{{ glance_galera_database }}?charset=utf8{% if glance_galera_use_ssl | bool %}&ssl_ca={{ glance_galera_ssl_ca_cert }}{% endif %}

View File

@ -23,7 +23,7 @@ transport_url = rabbit://{% for host in glance_rabbitmq_servers.split(',') %}{{
[database]
connection = mysql+pymysql://{{ glance_galera_user }}:{{ glance_container_mysql_password }}@{{ glance_galera_address }}/{{ glance_galera_database }}?charset=utf8
connection = mysql+pymysql://{{ glance_galera_user }}:{{ glance_container_mysql_password }}@{{ glance_galera_address }}/{{ glance_galera_database }}?charset=utf8{% if glance_galera_use_ssl | bool %}&ssl_ca={{ glance_galera_ssl_ca_cert }}{% endif %}
[keystone_authtoken]
insecure = {{ keystone_service_internaluri_insecure | bool }}

11
tox.ini
View File

@ -148,6 +148,17 @@ commands =
bash -c "{toxinidir}/tests/common/test-ansible-functional.sh"
[testenv:ssl]
deps =
{[testenv:ansible]deps}
setenv =
{[testenv]setenv}
ANSIBLE_PARAMETERS=-vvv -e galera_use_ssl=True
commands =
bash -c "{toxinidir}/tests/tests-repo-clone.sh"
bash -c "{toxinidir}/tests/common/test-ansible-functional.sh"
[testenv:linters]
deps =
{[testenv:ansible]deps}

View File

@ -33,3 +33,10 @@
nodeset: ubuntu-xenial
vars:
tox_env: nfs
- job:
name: openstack-ansible-glance-ssl-nv
parent: openstack-ansible-functional-ubuntu-xenial
voting: false
vars:
tox_env: ssl

View File

@ -25,6 +25,7 @@
- openstack-ansible-upgrade-ubuntu-xenial
- openstack-ansible-v1_api_enabled
- openstack-ansible-v2_registry_enabled
- openstack-ansible-glance-ssl-nv
experimental:
jobs:
- openstack-ansible-integrated-deploy-aio
@ -38,3 +39,4 @@
- openstack-ansible-upgrade-ubuntu-xenial
- openstack-ansible-v1_api_enabled
- openstack-ansible-v2_registry_enabled
- openstack-ansible-glance-ssl-nv