Implement SSL+x509 for mysql/rabbitmq with octavia
Add metadata to create SSL certs for mysql/rabbitmq communication and
octavia.
Change-Id: I94573c38a7050452f7597065263c64adc300abc3
Related-Prod: PROD-26938
(cherry picked from commit 27c33dddee91d98db314cc17a2ab29f097faf39a)
diff --git a/octavia/api/cluster.yml b/octavia/api/cluster.yml
index 5b0f0ca..66622e3 100644
--- a/octavia/api/cluster.yml
+++ b/octavia/api/cluster.yml
@@ -1,5 +1,7 @@
classes:
- service.octavia.api.cluster
+- system.salt.minion.cert.mysql.clients.openstack.octavia
+- system.salt.minion.cert.rabbitmq.clients.openstack.octavia
- system.haproxy.proxy.listen.openstack.octavia
parameters:
octavia:
@@ -10,8 +12,22 @@
address: ${_param:cluster_local_address}
database:
host: ${_param:openstack_database_address}
+ x509:
+ enabled: ${_param:openstack_mysql_x509_enabled}
+ ca_file: ${_param:mysql_octavia_ssl_ca_file}
+ key_file: ${_param:mysql_octavia_client_ssl_key_file}
+ cert_file: ${_param:mysql_octavia_client_ssl_cert_file}
+ ssl:
+ enabled: ${_param:galera_ssl_enabled}
identity:
region: ${_param:openstack_region}
protocol: ${_param:cluster_internal_protocol}
message_queue:
host: ${_param:openstack_message_queue_address}
+ x509:
+ enabled: ${_param:openstack_rabbitmq_x509_enabled}
+ ca_file: ${_param:rabbitmq_octavia_ssl_ca_file}
+ key_file: ${_param:rabbitmq_octavia_client_ssl_key_file}
+ cert_file: ${_param:rabbitmq_octavia_client_ssl_cert_file}
+ ssl:
+ enabled: ${_param:rabbitmq_ssl_enabled}