Implement SSL+x509 for mysql/rabbitmq with octavia
Add metadata to create SSL certs for mysql/rabbitmq communication and
octavia.
Change-Id: I94573c38a7050452f7597065263c64adc300abc3
Related-Prod: PROD-26938
diff --git a/octavia/manager/cluster.yml b/octavia/manager/cluster.yml
index 4422871..0e71b5c 100644
--- a/octavia/manager/cluster.yml
+++ b/octavia/manager/cluster.yml
@@ -1,6 +1,7 @@
classes:
- service.octavia.manager.cluster
-
+- system.salt.minion.cert.mysql.clients.openstack.octavia
+- system.salt.minion.cert.rabbitmq.clients.openstack.octavia
parameters:
octavia:
manager:
@@ -12,8 +13,22 @@
group: octavia
database:
host: ${_param:openstack_database_address}
+ x509:
+ enabled: ${_param:openstack_mysql_x509_enabled}
+ ca_file: ${_param:mysql_octavia_ssl_ca_file}
+ key_file: ${_param:mysql_octavia_client_ssl_key_file}
+ cert_file: ${_param:mysql_octavia_client_ssl_cert_file}
+ ssl:
+ enabled: ${_param:galera_ssl_enabled}
identity:
region: ${_param:openstack_region}
protocol: ${_param:cluster_internal_protocol}
message_queue:
host: ${_param:openstack_message_queue_address}
+ x509:
+ enabled: ${_param:openstack_rabbitmq_x509_enabled}
+ ca_file: ${_param:rabbitmq_octavia_ssl_ca_file}
+ key_file: ${_param:rabbitmq_octavia_client_ssl_key_file}
+ cert_file: ${_param:rabbitmq_octavia_client_ssl_cert_file}
+ ssl:
+ enabled: ${_param:rabbitmq_ssl_enabled}