Implement SSL+x509 for mysql/rabbitmq with octavia
Add metadata to create SSL certs for mysql/rabbitmq communication and
octavia.
Change-Id: I94573c38a7050452f7597065263c64adc300abc3
Related-Prod: PROD-26938
(cherry picked from commit 27c33dddee91d98db314cc17a2ab29f097faf39a)
diff --git a/octavia/manager/single.yml b/octavia/manager/single.yml
index 6071764..73c2ffe 100644
--- a/octavia/manager/single.yml
+++ b/octavia/manager/single.yml
@@ -1,8 +1,13 @@
classes:
- service.octavia.manager.single
+- system.salt.minion.cert.mysql.clients.openstack.octavia
+- system.salt.minion.cert.rabbitmq.clients.openstack.octavia
+
parameters:
_param:
- internal_protocol: 'http'
+ # Require for proper rabbitmq ssl key rendering
+ cluster_local_address: ${_param:single_address}
+
octavia:
manager:
enabled: true
@@ -13,8 +18,22 @@
group: octavia
database:
host: ${_param:openstack_database_address}
+ x509:
+ enabled: ${_param:openstack_mysql_x509_enabled}
+ ca_file: ${_param:mysql_octavia_ssl_ca_file}
+ key_file: ${_param:mysql_octavia_client_ssl_key_file}
+ cert_file: ${_param:mysql_octavia_client_ssl_cert_file}
+ ssl:
+ enabled: ${_param:galera_ssl_enabled}
identity:
region: ${_param:openstack_region}
- protocol: ${_param:internal_protocol}
+ protocol: ${_param:cluster_internal_protocol}
message_queue:
host: ${_param:openstack_message_queue_address}
+ x509:
+ enabled: ${_param:openstack_rabbitmq_x509_enabled}
+ ca_file: ${_param:rabbitmq_octavia_ssl_ca_file}
+ key_file: ${_param:rabbitmq_octavia_client_ssl_key_file}
+ cert_file: ${_param:rabbitmq_octavia_client_ssl_cert_file}
+ ssl:
+ enabled: ${_param:rabbitmq_ssl_enabled}