Fixes ODL OVS to add certs to every node
Certificates were only being added to the VIP, which means only one node
would get the add certificate request. This would work if there was a
highly available trust store, however MD-SAL lacks support in OpenFlow
Plugin and therefore we have to use a file based trust store. Since we
are using a file based trust store, the certificate needs to be pushed
to every OpenDaylight node.
Also includes minor fix where tcp was only being force-modified to ssl
for the first ODL OVSDB URI.
Closes-Bug: 1766989
Change-Id: Ifd8401e2facdad07ccda4ec6f885a82bc0a16421
Signed-off-by: Tim Rozet <trozet@redhat.com>
(cherry picked from commit 7c7a39da80)
This commit is contained in:
Tim Rozet
parent
78a3933512
commit
43ce982fda
|
|
@ -138,7 +138,7 @@ class neutron::plugins::ovs::opendaylight (
|
|||
|
||||
if $odl_ovsdb_iface =~ /^tcp/ {
|
||||
warning('TLS enabled but odl_ovsdb_iface set to tcp. Will override to ssl')
|
||||
$odl_ovsdb_iface_parsed = regsubst($odl_ovsdb_iface, '^tcp', 'ssl')
|
||||
$odl_ovsdb_iface_parsed = regsubst($odl_ovsdb_iface, 'tcp:', 'ssl:', 'G')
|
||||
} else {
|
||||
$odl_ovsdb_iface_parsed = $odl_ovsdb_iface
|
||||
}
|
||||
|
|
@ -166,17 +166,9 @@ class neutron::plugins::ovs::opendaylight (
|
|||
}\
|
||||
}
|
||||
|-END
|
||||
$odl_url_prefix = $odl_check_url_parsed ? {
|
||||
/^(https:\/\/.*?)\// => $1,
|
||||
default => undef
|
||||
}
|
||||
if $odl_url_prefix == undef {
|
||||
fail("Unable to parse URL prefix from ${odl_check_url_parsed}")
|
||||
}
|
||||
|
||||
$curl_post = "curl -k -X POST -o /dev/null --fail --silent -H 'Content-Type: application/json' -H 'Cache-Control: no-cache'"
|
||||
$curl_get = "curl -k -X POST --fail --silent -H 'Content-Type: application/json' -H 'Cache-Control: no-cache'"
|
||||
$cert_rest_url = "${odl_url_prefix}/restconf/operations/aaa-cert-rpc:setNodeCertifcate"
|
||||
$cert_rest_get = "${odl_url_prefix}/restconf/operations/aaa-cert-rpc:getNodeCertifcate"
|
||||
$rest_get_data = @("END":json/L)
|
||||
{\
|
||||
"aaa-cert-rpc:input": {\
|
||||
|
|
@ -184,14 +176,24 @@ class neutron::plugins::ovs::opendaylight (
|
|||
}\
|
||||
}
|
||||
|-END
|
||||
exec { "Add trusted cert: ${tls_cert_file}":
|
||||
command => "${curl_post} -u ${odl_username}:${odl_password} -d '${rest_data}' ${cert_rest_url}",
|
||||
tries => 5,
|
||||
try_sleep => 30,
|
||||
unless => "${curl_get} -u ${odl_username}:${odl_password} -d '${rest_get_data}' ${cert_rest_get} | grep -q ${cert_data}",
|
||||
path => '/usr/sbin:/usr/bin:/sbin:/bin',
|
||||
before => Exec['Set OVS Manager to OpenDaylight'],
|
||||
require => Exec['Wait for NetVirt OVSDB to come up']
|
||||
|
||||
$ovsdb_arr = split($odl_ovsdb_iface_parsed, ' ')
|
||||
$odl_rest_port = regsubst($odl_check_url_parsed, '^.*:([0-9]+)/.*$', '\1')
|
||||
$ovsdb_arr.each |$ovsdb_uri| {
|
||||
|
||||
$odl_ip = regsubst($ovsdb_uri, 'ssl:(.+):[0-9]+', '\1')
|
||||
$odl_url_prefix = "https://${odl_ip}:${odl_rest_port}"
|
||||
$cert_rest_url = "${odl_url_prefix}/restconf/operations/aaa-cert-rpc:setNodeCertifcate"
|
||||
$cert_rest_get = "${odl_url_prefix}/restconf/operations/aaa-cert-rpc:getNodeCertifcate"
|
||||
exec { "Add trusted cert: ${tls_cert_file} to ${odl_url_prefix}":
|
||||
command => "${curl_post} -u ${odl_username}:${odl_password} -d '${rest_data}' ${cert_rest_url}",
|
||||
tries => 5,
|
||||
try_sleep => 30,
|
||||
unless => "${curl_get} -u ${odl_username}:${odl_password} -d '${rest_get_data}' ${cert_rest_get} | grep -q ${cert_data}",
|
||||
path => '/usr/sbin:/usr/bin:/sbin:/bin',
|
||||
before => Exec['Set OVS Manager to OpenDaylight'],
|
||||
require => Exec['Wait for NetVirt OVSDB to come up']
|
||||
}
|
||||
}
|
||||
|
||||
} else {
|
||||
|
|
|
|||
|
|
@ -0,0 +1,5 @@
|
|||
---
|
||||
fixes:
|
||||
- |
|
||||
OVS SSL/TLS certificates are now pushed to every OpenDaylight instance.
|
||||
See https://bugs.launchpad.net/puppet-neutron/+bug/1766989
|
||||
|
|
@ -108,6 +108,25 @@ describe 'neutron::plugins::ovs::opendaylight' do
|
|||
'before' => 'Exec[Set OVS Manager to OpenDaylight]'
|
||||
)}
|
||||
end
|
||||
context 'with TLS and multiple ODLs' do
|
||||
before do
|
||||
File.stubs(:file?).returns(true)
|
||||
File.stubs(:readlines).returns(["MIIFGjCCBAKgAwIBAgICA"])
|
||||
params.merge!({
|
||||
:enable_tls => true,
|
||||
:tls_key_file => 'dummy.pem',
|
||||
:tls_cert_file => 'dummy.crt',
|
||||
:odl_ovsdb_iface => 'tcp:127.0.0.1:6640 tcp:172.0.0.1:6640'})
|
||||
end
|
||||
it_configures 'with TLS and ODL HA'
|
||||
it {is_expected.to contain_vs_ssl('system').with(
|
||||
'ensure' => 'present',
|
||||
'key_file' => 'dummy.pem',
|
||||
'cert_file' => 'dummy.crt',
|
||||
'bootstrap' => true,
|
||||
'before' => 'Exec[Set OVS Manager to OpenDaylight]'
|
||||
)}
|
||||
end
|
||||
end
|
||||
|
||||
shared_examples_for 'with default parameters' do
|
||||
|
|
@ -149,7 +168,7 @@ describe 'neutron::plugins::ovs::opendaylight' do
|
|||
|
||||
shared_examples_for 'with TLS enabled' do
|
||||
it 'configures OVS for ODL' do
|
||||
is_expected.to contain_exec('Add trusted cert: dummy.crt')
|
||||
is_expected.to contain_exec('Add trusted cert: dummy.crt to https://127.0.0.1:8080')
|
||||
is_expected.to contain_exec('Set OVS Manager to OpenDaylight').with(
|
||||
:command => "ovs-vsctl set-manager pssl:6639:127.0.0.1 ssl:127.0.0.1:6640"
|
||||
)
|
||||
|
|
@ -160,6 +179,20 @@ describe 'neutron::plugins::ovs::opendaylight' do
|
|||
end
|
||||
end
|
||||
|
||||
shared_examples_for 'with TLS and ODL HA' do
|
||||
it 'configures OVS for ODL' do
|
||||
is_expected.to contain_exec('Add trusted cert: dummy.crt to https://172.0.0.1:8080')
|
||||
is_expected.to contain_exec('Add trusted cert: dummy.crt to https://127.0.0.1:8080')
|
||||
is_expected.to contain_exec('Set OVS Manager to OpenDaylight').with(
|
||||
:command => "ovs-vsctl set-manager pssl:6639:127.0.0.1 ssl:127.0.0.1:6640 ssl:172.0.0.1:6640"
|
||||
)
|
||||
is_expected.to contain_vs_config('other_config:local_ip')
|
||||
is_expected.not_to contain_vs_config('other_config:provider_mappings')
|
||||
is_expected.to contain_vs_config('external_ids:odl_os_hostconfig_hostid')
|
||||
is_expected.to contain_vs_config('external_ids:odl_os_hostconfig_config_odl_l2')
|
||||
end
|
||||
end
|
||||
|
||||
context 'on RedHat platforms' do
|
||||
let :facts do
|
||||
@default_facts.merge(test_facts.merge({
|
||||
|
|
|
|||
Loading…
Reference in New Issue