Prepare nginx proxy config to be installed on controllers
When SSL is enabled nginx is used as SSL termination proxy.
It will be installed on controllers and will proxy requests to
openstack service that listens on localhost.
This patch makes sure nginx site listens only on specific IP, specified
in `nginx_proxy_openstack_api_address` parameter, by default 0.0.0.0
And allow to do flexible configuration of proxy site IP.
Change-Id: I861da305655fd1c8f5b011cef857b7818a00921b
Related-Prod: PROD-16990
diff --git a/nginx/server/proxy/openstack_api.yml b/nginx/server/proxy/openstack_api.yml
index 4b0b3f4..4f6073d 100644
--- a/nginx/server/proxy/openstack_api.yml
+++ b/nginx/server/proxy/openstack_api.yml
@@ -1,6 +1,13 @@
parameters:
_param:
nginx_proxy_openstack_api_host: ${_param:cluster_public_host}
+ nginx_proxy_openstack_api_address: 0.0.0.0
+ nginx_proxy_openstack_keystone_host: ${_param:keystone_service_host}
+ nginx_proxy_openstack_nova_host: ${_param:nova_service_host}
+ nginx_proxy_openstack_cinder_host: ${_param:cinder_service_host}
+ nginx_proxy_openstack_glance_host: ${_param:glance_service_host}
+ nginx_proxy_openstack_neutron_host: ${_param:neutron_service_host}
+ nginx_proxy_openstack_heat_host: ${_param:heat_service_host}
nginx:
server:
enabled: true
@@ -11,12 +18,13 @@
name: openstack_api_keystone
check: false
proxy:
- host: ${_param:keystone_service_host}
+ host: ${_param:nginx_proxy_openstack_keystone_host}
port: 5000
protocol: http
host:
name: ${_param:nginx_proxy_openstack_api_host}
port: 5000
+ address: ${_param:nginx_proxy_openstack_api_address}
ssl: ${_param:nginx_proxy_ssl}
nginx_proxy_openstack_api_keystone_private:
enabled: true
@@ -24,12 +32,13 @@
name: openstack_api_keystone_private
check: false
proxy:
- host: ${_param:keystone_service_host}
+ host: ${_param:nginx_proxy_openstack_keystone_host}
port: 35357
protocol: http
host:
name: ${_param:nginx_proxy_openstack_api_host}
port: 35357
+ address: ${_param:nginx_proxy_openstack_api_address}
ssl: ${_param:nginx_proxy_ssl}
nginx_proxy_openstack_api_nova:
enabled: true
@@ -37,12 +46,13 @@
name: openstack_api_nova
check: false
proxy:
- host: ${_param:nova_service_host}
+ host: ${_param:nginx_proxy_openstack_nova_host}
port: 8774
protocol: http
host:
name: ${_param:nginx_proxy_openstack_api_host}
port: 8774
+ address: ${_param:nginx_proxy_openstack_api_address}
ssl: ${_param:nginx_proxy_ssl}
nginx_proxy_openstack_api_cinder:
enabled: true
@@ -50,12 +60,13 @@
name: openstack_api_cinder
check: false
proxy:
- host: ${_param:cinder_service_host}
+ host: ${_param:nginx_proxy_openstack_cinder_host}
port: 8776
protocol: http
host:
name: ${_param:nginx_proxy_openstack_api_host}
port: 8776
+ address: ${_param:nginx_proxy_openstack_api_address}
ssl: ${_param:nginx_proxy_ssl}
nginx_proxy_openstack_api_glance:
enabled: true
@@ -64,13 +75,14 @@
check: false
underscores_in_headers: true
proxy:
- host: ${_param:glance_service_host}
+ host: ${_param:nginx_proxy_openstack_glance_host}
port: 9292
protocol: http
size: 30000m
host:
name: ${_param:nginx_proxy_openstack_api_host}
port: 9292
+ address: ${_param:nginx_proxy_openstack_api_address}
ssl: ${_param:nginx_proxy_ssl}
nginx_proxy_openstack_api_neutron:
enabled: true
@@ -78,36 +90,39 @@
name: openstack_api_neutron
check: false
proxy:
- host: ${_param:neutron_service_host}
+ host: ${_param:nginx_proxy_openstack_neutron_host}
port: 9696
protocol: http
host:
name: ${_param:nginx_proxy_openstack_api_host}
port: 9696
+ address: ${_param:nginx_proxy_openstack_api_address}
ssl: ${_param:nginx_proxy_ssl}
nginx_proxy_openstack_api_heat_cloudwatch:
enabled: true
type: nginx_proxy
name: openstack_api_heat_cloudwatch
proxy:
- host: ${_param:heat_service_host}
+ host: ${_param:nginx_proxy_openstack_heat_host}
port: 8003
protocol: http
host:
name: ${_param:nginx_proxy_openstack_api_host}
port: 8003
+ address: ${_param:nginx_proxy_openstack_api_address}
ssl: ${_param:nginx_proxy_ssl}
nginx_proxy_openstack_api_heat_cfn:
enabled: true
type: nginx_proxy
name: openstack_api_heat_cfn
proxy:
- host: ${_param:heat_service_host}
+ host: ${_param:nginx_proxy_openstack_heat_host}
port: 8000
protocol: http
host:
name: ${_param:nginx_proxy_openstack_api_host}
port: 8000
+ address: ${_param:nginx_proxy_openstack_api_address}
ssl: ${_param:nginx_proxy_ssl}
nginx_proxy_openstack_api_heat:
enabled: true
@@ -115,12 +130,13 @@
name: openstack_api_heat
check: false
proxy:
- host: ${_param:heat_service_host}
+ host: ${_param:nginx_proxy_openstack_heat_host}
port: 8004
protocol: http
host:
name: ${_param:nginx_proxy_openstack_api_host}
port: 8004
+ address: ${_param:nginx_proxy_openstack_api_address}
ssl: ${_param:nginx_proxy_ssl}
nginx_proxy_openstack_api_nova_ec2:
enabled: true
@@ -128,10 +144,11 @@
name: openstack_api_nova_ec2
check: false
proxy:
- host: ${_param:nova_service_host}
+ host: ${_param:nginx_proxy_openstack_nova_host}
port: 8773
protocol: http
host:
name: ${_param:nginx_proxy_openstack_api_host}
port: 8773
+ address: ${_param:nginx_proxy_openstack_api_address}
ssl: ${_param:nginx_proxy_ssl}