30 Commits

Author SHA1 Message Date
Zuul
8d806277f2 Merge "docs: Add note about internal VIP when HAProxy is disabled" 2021-05-25 12:34:17 +00:00
Mark Goddard
030a9a28d7 docs: Improve policy documentation
Change-Id: Iede747ceaafa54a00186761943fe2f4ac13f9559
2021-04-19 09:39:51 +00:00
Mark Goddard
db1bc8fc7a docs: Add note about internal VIP when HAProxy is disabled
Change-Id: I08030ac88911d3594c75cb2184767067ad177139
2021-03-25 09:23:26 +00:00
James Kirsch
93ad57f47e Add support for encrypting backend Neutron API Server
Add TLS support for backend Neutron API Server communication using
HAProxy to perform TLS termination. When used in conjunction with
enabling TLS for service API endpoints, network communication will be
encrypted end to end, from client through HAProxy to the Neutron
service.

Change-Id: Ib333a1f1bd12491df72a9e52d961161210e2d330
Partially-Implements: blueprint add-ssl-internal-network
2020-10-12 17:27:44 +00:00
Mark Goddard
761ea9a333 Support TLS encryption of RabbitMQ client-server traffic
This change adds support for encryption of communication between
OpenStack services and RabbitMQ. Server certificates are supported, but
currently client certificates are not.

The kolla-ansible certificates command has been updated to support
generating certificates for RabbitMQ for development and testing.

RabbitMQ TLS is enabled in the all-in-one source CI jobs, or when
The Zuul 'tls_enabled' variable is true.

Change-Id: I4f1d04150fb2b5af085b762890092f87ae6076b5
Implements: blueprint message-queue-ssl-support
2020-09-17 12:05:44 +01:00
Mark Goddard
3870c74d0b Move TLS documentation to its own page
Moved the TLS documentation from "advanced-configuration" doc to its
own TLS document. This is in preparation for improving it.

Change-Id: I4c83f1810ef1222aaa3560174c1ba39328853c4e
Co-Authored-By: James Kirsch <generalfuzz@gmail.com>
2020-07-27 10:05:58 +00:00
Zuul
a44bba845f Merge "Update Advanced Config guide to clarify paths" 2020-05-07 11:41:54 +00:00
James Kirsch
f87814f794 Add support for encrypting Glance api
Add TLS support for Glance api using HAProxy to perform TLS termination.

Change-Id: I77051baaeb5d3f7dd9002262534e7d35f3926809
Partially-Implements: blueprint add-ssl-internal-network
2020-04-30 17:31:58 +01:00
Raimund Hook
08682243ed Update Advanced Config guide to clarify paths
This update clears up an additional path that was mentioned in the
Advanced Configuration documentation, but not actually picked up in the
playbooks.

This specifically affects Service Configuration overrides. The docs have
been cleaned up to reflect the way the playbooks pick up the override
files.

Change-Id: Id15fe139af6462217c2ac26d7d21c5eac5368e12
Closes-Bug: 1873782
Signed-off-by: Raimund Hook <openstack@sting-ray.za.net>
2020-04-20 12:24:16 +01:00
James Kirsch
b475643c11 Add support for encrypting backend Keystone HAProxy traffic
This patch introduces an optional backend encryption for Keystone
service. When used in conjunction with enabling TLS for service API
endpoints, network communcation will be encrypted end to end, from
client through HAProxy to the Keystone service.

Change-Id: I6351147ddaff8b2ae629179a9bc3bae2ebac9519
Partially-Implements: blueprint add-ssl-internal-network
2020-04-09 09:22:55 +00:00
James Kirsch
d100904f2c Generate self signed TLS certificates
Generate both internal and external self signed TLS certificates.
Duplicate the certificate if internal and external VIPs are the same.

Change-Id: I16b345c0b29ff13e042eed8798efe644e0ad2c74
Partially-Implements: blueprint custom-cacerts
2020-01-28 14:03:33 -08:00
James Kirsch
511ba9f6a2 Copy CA into containers.
When kolla_copy_ca_into_containers is set to "yes", the Certificate
Authority in /etc/kolla/certificates will be copied into service
containers to enable trust for that CA. This is especially useful when
the CA is self signed, and would not be trusted by default.

Partially-Implements: blueprint custom-cacerts

Change-Id: I4368f8994147580460ebe7533850cf63a419d0b4
2020-01-28 14:03:32 -08:00
Zuul
b432431b24 Merge "Typo fix in docs" 2019-10-22 15:12:26 +00:00
Zuul
41c20eaca8 Merge "Update documentation on overriding config files" 2019-10-22 11:16:22 +00:00
Doug Szumski
25dd068834 Typo fix in docs
Change-Id: I80b4fb4addf4c633172f1c1a99cdf6a6feac3145
2019-10-22 11:00:42 +00:00
Doug Szumski
98bed6c2bf Update documentation on overriding config files
The main motivation here is to document a mechanism which can be
used to configure Nova cells on a per-cell basis without introducing
a myriad of additional locations to put config files. The
following changes are made:

- Remove the note about only ini files being supported because
  merge_yaml is now used
- Expand on supported config file locations
- Add a section on using conditionals in the config file

Partially Implements: blueprint support-nova-cells
Change-Id: I92599e501506fdacaf3adb94cc6fffcf6fea2af3
2019-09-17 18:08:43 +01:00
Krzysztof Klimonda
b0ecd8b67c Implement TLS encryption for internal endpoints
This review is the first one in a series of patches and it introduces an
optional encryption for internal openstack endpoints, implementing part
of the add-ssl-internal-network spec.

Change-Id: I6589751626486279bf24725f22e71da8cd7f0a43
2019-08-22 16:39:21 -07:00
binhong.hua
12ff28a693 Make kolla-ansible support extra volumes
When integrating 3rd party component into openstack with kolla-ansible,
maybe have to mount some extra volumes to container.

Change-Id: I69108209320edad4c4ffa37dabadff62d7340939
Implements: blueprint support-extra-volumes
2019-05-17 11:55:04 +08:00
Zuul
568fd4dcfd Merge "Use correct variable for default certificate paths" 2018-12-02 09:25:42 +00:00
jacky06
377222bb00 Add YAML format into docs for policy file
kolla-ansible support yaml format for policy file[1] too, but the
docs missing it, this ps to add it.

[1]: https://github.com/openstack/kolla-ansible/blob/master/ansible/group_vars/all.yml#L393
Closes-Bug: #1804455

Change-Id: I44eb1d64f9299ccaf99972c8b5354683a3501f6b
2018-11-21 08:34:12 -05:00
caoyuan
9223deeecd Use correct variable for default certificate paths
The variable {{ node_config_directory }} is used for the configuration
directory on the remote hosts, and should not be used for paths on the
deploy host (localhost).

This changes the default value of the TLS certificate and CA file to
reference {{ CONFIG_DIR }}, in line with the directory used for
admin-openrc.sh (as of I0709482ead4b7a67e82796e17f85bde151e71bc0).

This change also introduces a variable, {{ node_config }}, that
references {{ CONFIG_DIR | default('/etc/kolla') }}, to remove
duplication.

Change-Id: Ibd82ac78630ebfff5824c329d7399e1e900c0ee0
Closes-Bug: #1804025
2018-11-19 16:25:28 +00:00
chenxing
eaa9815ad2 Remove '.. end' comments
Following by https://review.openstack.org/#/c/605097/
These were used by now-dead tooling. We can remove them.

Change-Id: I0953751044f038a3fdd1acd49b3d2b053ac4bec8
2018-09-28 10:15:37 +08:00
Zuul
353e20b926 Merge "Following the new PTI for document build" 2018-06-04 11:17:49 +00:00
chenxing
38d5ee66cb Remove duplicated content
Change-Id: I0e8b4b443a0659e75a80de1dd1f6418ff2793d2f
Closes-Bug: #1771257
2018-05-25 15:10:34 +08:00
confi-surya
dbf754655f Following the new PTI for document build
For compliance with the Project Testing Interface [1]
as described in [2]

[1]
https://governance.openstack.org/tc/reference/project-testing-interface.html
[2]
http://lists.openstack.org/pipermail/openstack-dev/2017-December/125710.html

doc8 command is dropped from docs tox envs.
So this affect nothing and run in PEP8.

Related-Bug: #1765348

Depends-On: Icc7fe3a8f9716281de88825e9d5b2fd84de3d00a
Change-Id: Idf9a16111479ccc64004eac9508da575822a3df5
2018-05-21 10:51:59 +01:00
chenxing
73f2bce552 Upgrade the rst convention of the Admin Guide
We upgrade the rst convention by following Documentation Contributor
Guide[1].

[1] https://docs.openstack.org/doc-contrib-guide

Change-Id: I89e437b83b0e6a7c1bbfbf4a02a530be072eca91
Partially-Implements: blueprint optimize-the-documentation-format
2018-01-26 19:34:51 +08:00
Zuul
884b82bdab Merge "add official default cpu allocation ratio." 2017-12-13 15:48:20 +00:00
Dai Dang Van
392bf3710c Add note about overwriting policy.json file
Change-Id: I133bd7ed5ac62b9614dece70ceb8016398c138f6
Co-authored-By: Duong Ha-Quang <duonghq@vn.fujitsu.com>
Closes-Bug: #1722744
2017-12-06 02:37:01 +00:00
yanpeifei
5b266b5d58 add official default cpu allocation ratio.
Everyone know how to override default cpu allocation ratio via it.

Change-Id: I059f5167be170b617a440e2e06b421f9062843a6
2017-10-31 16:25:18 +08:00
Surya Prakash Singh
04fd12b945 Restructured the doc of kolla-ansible
Created the admin directory, remove some files from
user dir and placed into admin and contributor.

For more detail, see the doc migration spec.
http://specs.openstack.org/openstack/docs-specs/specs/pike/os-manuals-migration.html

Change-Id: I84c565d7d14a4d90270a53e14ab93a10f7ffb9b7
Partially-Implements: blueprint ka-queens-doc-restructure
2017-10-05 03:23:23 +00:00