REFACTOR Added libvirt_vnc server and novnc-proxy client certificate templates
Related-Prod: PROD-19979
Change-Id: I2e69908e8604ec78b632df5259398c28603e2e65
diff --git a/salt/minion/cert/vnc/novncproxy_client.yml b/salt/minion/cert/vnc/novncproxy_client.yml
index 7f695eb..9641611 100644
--- a/salt/minion/cert/vnc/novncproxy_client.yml
+++ b/salt/minion/cert/vnc/novncproxy_client.yml
@@ -5,11 +5,10 @@
novncproxy_client_ssl_key_file: /etc/pki/nova-novncproxy/client-key.pem
novncproxy_client_ssl_cert_file: /etc/pki/nova-novncproxy/client-cert.pem
novncproxy_ssl_ca_file: /etc/pki/nova-novncproxy/ca-cert.pem
- nova_websocketproxy_ssl_all_file: /var/lib/nova/self.pem
salt:
minion:
cert:
- libvirt_novnc_client:
+ novncproxy_novnc_client:
host: ${_param:salt_minion_ca_host}
authority: ${_param:qemu_vnc_ca_authority}
common_name: ${linux:system:name}.${_param:cluster_domain}
@@ -23,7 +22,6 @@
key_file: ${_param:novncproxy_client_ssl_key_file}
cert_file: ${_param:novncproxy_client_ssl_cert_file}
ca_file: ${_param:novncproxy_ssl_ca_file}
- all_file: ${_param:nova_websocketproxy_ssl_all_file}
user: nova
group: nova
mode: 640
diff --git a/salt/minion/cert/vnc/novncproxy_server.yml b/salt/minion/cert/vnc/novncproxy_server.yml
new file mode 100644
index 0000000..20c24e2
--- /dev/null
+++ b/salt/minion/cert/vnc/novncproxy_server.yml
@@ -0,0 +1,29 @@
+classes:
+- system.salt.minion.cert.vnc
+parameters:
+ _param:
+ novncproxy_server_ssl_key_file: /etc/pki/nova-novncproxy/server-key.pem
+ novncproxy_server_ssl_cert_file: /etc/pki/nova-novncproxy/server-cert.pem
+ novncproxy_ssl_ca_file: /etc/pki/nova-novncproxy/ca-cert.pem
+ salt:
+ minion:
+ cert:
+ novncproxy_novnc_server:
+ host: ${_param:salt_minion_ca_host}
+ authority: ${_param:qemu_vnc_ca_authority}
+ common_name: ${linux:system:name}.${_param:cluster_domain}
+ signing_policy: cert_server
+ alternative_names: >
+ IP:${_param:cluster_local_address},
+ IP:${_param:cluster_vip_address},
+ DNS:${_param:cluster_local_address},
+ DNS:${linux:system:name},
+ DNS:${_param:cluster_vip_address},
+ DNS:${linux:network:fqdn}
+ key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+ key_file: ${_param:novncproxy_server_ssl_key_file}
+ cert_file: ${_param:novncproxy_server_ssl_cert_file}
+ ca_file: ${_param:novncproxy_ssl_ca_file}
+ user: nova
+ group: nova
+ mode: 640