commit c4dd2d7109fbdbc37c0bed4ef6d8234ed5e776f4
author Oleksandr Shyshko <oshyshko@mirantis.com> Thu Aug 30 18:30:59 2018 +0300
committer oshyshko <oshyshko@mirantis.com> Tue Sep 04 09:10:44 2018 +0000
tree cc930f3ef59629a12995b7422af73d07b185110e
parent 73a81e64bf27be7b7305129fc272ce90f21352eb

Implement X.509 auth for MySQL and Keystone

Change-Id: I03618376d7ba44b11b6121a611fea87c8c3dd023
Related-PROD: PROD-22748

keystone/server/cluster.yml

diff --git a/keystone/server/cluster.yml b/keystone/server/cluster.yml
index c9642bd..24840fe 100644
--- a/keystone/server/cluster.yml
+++ b/keystone/server/cluster.yml
@@ -5,10 +5,13 @@
 - system.haproxy.proxy.listen.openstack.keystone.standalone
 - system.linux.system.users.keystone
 - system.keystone.server.fernet_rotation.cluster
+- system.salt.minion.cert.mysql.clients.openstack.keystone
 parameters:
   _param:
     keystone_tokens_expiration: 3600
     openstack_node_role: primary
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
   linux:
     system:
       package:
@@ -42,6 +45,13 @@
         name: keystone
         password: ${_param:mysql_keystone_password}
         user: keystone
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_keystone_ssl_ca_file}
+          key_file: ${_param:mysql_keystone_client_ssl_key_file}
+          cert_file: ${_param:mysql_keystone_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
       tokens:
         engine: fernet
         expiration: ${_param:keystone_tokens_expiration}