openstack/kolla-ansible
Code Issues Proposed changes

Add frontend database TLS for Keystone

Browse Source 
This patch enables internal TLS database
connection for Keystone.

Change-Id: I816d051e933a560629d9b9c95362f668abe4ade7
This commit is contained in:
Matus Jenca 2024-08-01 17:28:27 +02:00 committed by Michal Nasiadka
parent f76833b49a
commit 66a2f5830c
3 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ansible/roles/keystone/defaults/main.yml
View File

@ -239,3 +239,6 @@ keystone_federation_oidc_scopes: "openid email profile"
# OIDC caching
keystone_oidc_enable_memcached: "{{ enable_memcached }}"
# Database
keystone_database_enable_tls_internal: "{{ database_enable_tls_internal | bool }}"

2
ansible/roles/keystone/templates/keystone.conf.j2
View File

@ -16,7 +16,7 @@ policy_file = {{ keystone_policy_file }}
{% endif %}
[database]
connection = mysql+pymysql://{{ keystone_database_user }}:{{ keystone_database_password }}@{{ keystone_database_address }}/{{ keystone_database_name }}
connection = mysql+pymysql://{{ keystone_database_user }}:{{ keystone_database_password }}@{{ keystone_database_address }}/{{ keystone_database_name }}{{ '?ssl_ca=' ~ openstack_cacert if keystone_database_enable_tls_internal | bool }}
connection_recycle_time = {{ database_connection_recycle_time }}
max_pool_size = {{ database_max_pool_size }}
max_retries = -1

4
releasenotes/notes/proxysql-internal-tls-keystone-5e3574a356afc819.yaml Normal file
View File

@ -0,0 +1,4 @@
---
features:
- |
Implements TLS between Keystone and ProxySQL