| Oleksandr Shyshko | ab68fe5 | 2018-06-15 18:30:14 +0300 | [diff] [blame] | 1 | parameters: |
| 2 | _param: |
| 3 | qemu_vnc_ca_common_name: QEMU VNC CA |
| 4 | qemu_vnc_ca_country: cz |
| 5 | qemu_vnc_ca_locality: Prague |
| 6 | qemu_vnc_ca_organization: Mirantis |
| 7 | qemu_vnc_ca_days_valid_authority: 3650 |
| 8 | qemu_vnc_ca_days_valid_certificate: 365 |
| Oleksandr Shyshko | e66f7d7 | 2019-06-24 13:28:51 +0300 | [diff] [blame] | 9 | qemu_vnc_ca_signing_policy_cert_client_minions: 'ctl*' |
| Oleksandr Shyshko | ab68fe5 | 2018-06-15 18:30:14 +0300 | [diff] [blame] | 10 | salt: |
| 11 | minion: |
| 12 | ca: |
| 13 | qemu_vnc_ca: |
| 14 | # We recommend using a dedicated certificate authority solely for the VNC service. |
| 15 | # This authority may be a child of the master certificate authority used for the OpenStack deployment. |
| 16 | # This is because libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. |
| 17 | # https://docs.openstack.org/nova/queens/admin/remote-console-access.html |
| 18 | common_name: ${_param:qemu_vnc_ca_common_name} |
| 19 | country: ${_param:qemu_vnc_ca_country} |
| 20 | locality: ${_param:qemu_vnc_ca_locality} |
| 21 | organization: ${_param:qemu_vnc_ca_organization} |
| 22 | signing_policy: |
| 23 | cert_server: |
| 24 | type: v3_edge_cert_server |
| Oleksandr Shyshko | 2b88373 | 2018-07-11 18:00:58 +0300 | [diff] [blame] | 25 | minions: '*' |
| Oleksandr Shyshko | ab68fe5 | 2018-06-15 18:30:14 +0300 | [diff] [blame] | 26 | cert_client: |
| 27 | type: v3_edge_cert_client |
| Oleksandr Shyshko | e66f7d7 | 2019-06-24 13:28:51 +0300 | [diff] [blame] | 28 | minions: ${_param:qemu_vnc_ca_signing_policy_cert_client_minions} |
| Oleksandr Shyshko | ab68fe5 | 2018-06-15 18:30:14 +0300 | [diff] [blame] | 29 | days_valid: |
| 30 | authority: ${_param:qemu_vnc_ca_days_valid_authority} |
| 31 | certificate: ${_param:qemu_vnc_ca_days_valid_certificate} |