6bc6929d09
Supports two scenarios: 1) variables defined in defaults/main.yml are sufficient to create a root/intermediate CA certificate for mariadb when this role is used outside openstack-ansible. 2) when: openstack_pki_dir openstack_pki_setup_host openstack_pki_authorities openstack_pki_service_intermediate_cert_name are defined, an external CA already created on the deploy host with a previous run of ansible-role-pki will be used as the CA. Server certificates for the galera instances are created from the data in galera_pki_certificates in both situations Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/807771 Change-Id: I72738e4f8bd2233dedbed4428baafd4436de84b5
35 lines
1003 B
YAML
35 lines
1003 B
YAML
---
|
|
features:
|
|
- |
|
|
Galera role now leverages PKI role for creation and distribution of the
|
|
certificates and certificate authorities.
|
|
This introduces bunch of new variables which controls CA and certificates
|
|
generation details.
|
|
If user SSL certificates are provided - they would be used instead of
|
|
the generated ones.
|
|
|
|
The following new variables were introduced:
|
|
|
|
- galera_ssl_verify
|
|
- galera_pki_dir
|
|
- galera_pki_create_ca
|
|
- galera_pki_regen_ca
|
|
- galera_pki_certificates
|
|
- galera_pki_regen_cert
|
|
- galera_pki_authorities
|
|
- galera_pki_install_ca
|
|
- galera_pki_keys_path
|
|
- galera_pki_certs_path
|
|
- galera_pki_intermediate_cert_name
|
|
- galera_pki_intermediate_cert_path
|
|
- galera_pki_install_certificates
|
|
|
|
deprecations:
|
|
- |
|
|
Following variables were removed in favor of PKI ones
|
|
and have no effect anymore:
|
|
|
|
- galera_ssl_self_signed_regen
|
|
- galera_ssl_self_signed_subject
|
|
- galera_ssl_ca_self_signed_subject
|