Added libvirt_vnc server and novnc-proxy client certificate templates
cluster:config
- system.salt.minion.ca.qemu-vnc_ca
cluster:compute
- system.nova.compute.libvirt.ssl.vnc
cluster:control
- system.nova.control.novncproxy
haproxy:
proxy:
listen:
nova_novnc:
type: None
cluster:proxy
nginx:
server:
site:
nginx_proxy_novnc:
proxy:
protocol: https
Related-Prod: PROD-19979
Change-Id: I60ec258cd048100a73d99b92ef87be771dc393b0
diff --git a/salt/minion/cert/libvirtd/vnc_server.yml b/salt/minion/cert/libvirtd/vnc_server.yml
new file mode 100644
index 0000000..c49852e
--- /dev/null
+++ b/salt/minion/cert/libvirtd/vnc_server.yml
@@ -0,0 +1,27 @@
+parameters:
+ _param:
+ qemu_vnc_server_ssl_key_file: /etc/pki/libvirt-vnc/server-key.pem
+ qemu_vnc_server_ssl_cert_file: /etc/pki/libvirt-vnc/server-cert.pem
+ qemu_vnc_ssl_ca_file: /etc/pki/libvirt-vnc/ca-cert.pem
+ salt_minion_ca_host: cfg01.${_param:cluster_domain}
+ qemu_vnc_ca_authority: qemu_vnc_ca
+ salt:
+ minion:
+ cert:
+ qemu_vnc_server:
+ host: ${_param:salt_minion_ca_host}
+ authority: ${_param:qemu_vnc_ca_authority}
+ common_name: ${linux:system:name}.${_param:cluster_domain}
+ signing_policy: cert_server
+ alternative_names: >
+ IP:${_param:cluster_local_address},
+ DNS:${_param:cluster_local_address},
+ DNS:${linux:system:name},
+ DNS:${linux:network:fqdn}
+ key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+ key_file: ${_param:qemu_vnc_server_ssl_key_file}
+ cert_file: ${_param:qemu_vnc_server_ssl_cert_file}
+ ca_file: ${_param:qemu_vnc_ssl_ca_file}
+ user: libvirt-qemu
+ group: libvirt-qemu
+ mode: 640