Added hypervisors mutual authentication.
This patch adds metadata to set libvirt allowed_dn_list
option, which is set by default to match all compute
nodes in the cloud, but might be adjusted by updating
_param:nova_compute_libvirt_allowed_dn_list
For more information about libvirt_allowed_dn_list plese
see
https://libvirt.org/remote.html#Remote_TLS_client_certificates
Related-PROD: PROD-22086
Change-Id: I24a7b482154dd315d6621c568539ab1a5f1617f6
diff --git a/nova/compute/libvirt/ssl/init.yml b/nova/compute/libvirt/ssl/init.yml
index 87742e0..d9be1a5 100644
--- a/nova/compute/libvirt/ssl/init.yml
+++ b/nova/compute/libvirt/ssl/init.yml
@@ -1,6 +1,11 @@
classes:
- system.salt.minion.cert.libvirtd
parameters:
+ _param:
+ nova_compute_libvirt_allowed_dn_list:
+ all:
+ enabled: true
+ value: '*CN=cmp*.${_param:cluster_domain}*'
nova:
compute:
libvirt:
@@ -10,6 +15,7 @@
key_file: ${_param:libvirtd_server_ssl_key_file}
cert_file: ${_param:libvirtd_server_ssl_cert_file}
ca_file: ${_param:libvirtd_ssl_ca_file}
+ allowed_dn_list: ${_param:nova_compute_libvirt_allowed_dn_list}
client:
key_file: ${_param:libvirtd_client_ssl_key_file}
cert_file: ${_param:libvirtd_client_ssl_cert_file}