From e5ac2f07e3ad01e56d4d9756629746dbae9702c1 Mon Sep 17 00:00:00 2001 From: Jimmy McCrory Date: Wed, 13 Dec 2017 17:12:14 -0800 Subject: [PATCH] Add MySQL connection SSL support When 'glance_galera_use_ssl' is True, use an encrypted connection to the database using either a self-signed or user-provided CA certificate. A new non-voting test has been added to verify that the role remains functional when enabling SSL features. Partial-Bug: 1667789 Change-Id: I18e9d47e88e61ff287e5120dead49b02cdf1f8ac Depends-On: I95cc994df5118fce7ce588fc0bff979bc283a6f3 --- defaults/main.yml | 4 +++- templates/glance-api.conf.j2 | 2 +- templates/glance-manage.conf.j2 | 2 +- templates/glance-registry.conf.j2 | 2 +- tox.ini | 11 +++++++++++ zuul.d/jobs.yaml | 7 +++++++ zuul.d/project.yaml | 2 ++ 7 files changed, 26 insertions(+), 4 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 1b5050ae..7ff3bf5f 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -102,9 +102,11 @@ glance_rabbitmq_telemetry_port: "{{ glance_rabbitmq_port }}" glance_rabbitmq_telemetry_servers: "{{ glance_rabbitmq_servers }}" glance_rabbitmq_telemetry_use_ssl: "{{ glance_rabbitmq_use_ssl }}" -## DB info +## Database info glance_galera_database: glance glance_galera_user: glance +glance_galera_use_ssl: "{{ galera_use_ssl | default(False) }}" +glance_galera_ssl_ca_cert: "{{ galera_ssl_ca_cert | default('/etc/ssl/certs/galera-ca.pem') }}" glance_role_name: admin glance_api_bind_address: 0.0.0.0 diff --git a/templates/glance-api.conf.j2 b/templates/glance-api.conf.j2 index f767a714..99e4bcaa 100644 --- a/templates/glance-api.conf.j2 +++ b/templates/glance-api.conf.j2 @@ -40,7 +40,7 @@ show_multiple_locations = {{ glance_show_multiple_locations }} task_executor = {{ glance_task_executor }} [database] -connection = mysql+pymysql://{{ glance_galera_user }}:{{ glance_container_mysql_password }}@{{ glance_galera_address }}/{{ glance_galera_database }}?charset=utf8 +connection = mysql+pymysql://{{ glance_galera_user }}:{{ glance_container_mysql_password }}@{{ glance_galera_address }}/{{ glance_galera_database }}?charset=utf8{% if glance_galera_use_ssl | bool %}&ssl_ca={{ glance_galera_ssl_ca_cert }}{% endif %} [keystone_authtoken] insecure = {{ keystone_service_internaluri_insecure | bool }} diff --git a/templates/glance-manage.conf.j2 b/templates/glance-manage.conf.j2 index 11b9d746..8876cdb4 100644 --- a/templates/glance-manage.conf.j2 +++ b/templates/glance-manage.conf.j2 @@ -6,4 +6,4 @@ log_file = /var/log/glance/glance-manage.log fatal_deprecations = {{ glance_fatal_deprecations }} [database] -connection = mysql+pymysql://{{ glance_galera_user }}:{{ glance_container_mysql_password }}@{{ glance_galera_address }}/{{ glance_galera_database }}?charset=utf8 +connection = mysql+pymysql://{{ glance_galera_user }}:{{ glance_container_mysql_password }}@{{ glance_galera_address }}/{{ glance_galera_database }}?charset=utf8{% if glance_galera_use_ssl | bool %}&ssl_ca={{ glance_galera_ssl_ca_cert }}{% endif %} diff --git a/templates/glance-registry.conf.j2 b/templates/glance-registry.conf.j2 index 71c490f9..105e8986 100644 --- a/templates/glance-registry.conf.j2 +++ b/templates/glance-registry.conf.j2 @@ -23,7 +23,7 @@ transport_url = rabbit://{% for host in glance_rabbitmq_servers.split(',') %}{{ [database] -connection = mysql+pymysql://{{ glance_galera_user }}:{{ glance_container_mysql_password }}@{{ glance_galera_address }}/{{ glance_galera_database }}?charset=utf8 +connection = mysql+pymysql://{{ glance_galera_user }}:{{ glance_container_mysql_password }}@{{ glance_galera_address }}/{{ glance_galera_database }}?charset=utf8{% if glance_galera_use_ssl | bool %}&ssl_ca={{ glance_galera_ssl_ca_cert }}{% endif %} [keystone_authtoken] insecure = {{ keystone_service_internaluri_insecure | bool }} diff --git a/tox.ini b/tox.ini index fc17d915..f9ef94fd 100644 --- a/tox.ini +++ b/tox.ini @@ -148,6 +148,17 @@ commands = bash -c "{toxinidir}/tests/common/test-ansible-functional.sh" +[testenv:ssl] +deps = + {[testenv:ansible]deps} +setenv = + {[testenv]setenv} + ANSIBLE_PARAMETERS=-vvv -e galera_use_ssl=True +commands = + bash -c "{toxinidir}/tests/tests-repo-clone.sh" + bash -c "{toxinidir}/tests/common/test-ansible-functional.sh" + + [testenv:linters] deps = {[testenv:ansible]deps} diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml index f00f32e5..0dca8ff8 100644 --- a/zuul.d/jobs.yaml +++ b/zuul.d/jobs.yaml @@ -33,3 +33,10 @@ nodeset: ubuntu-xenial vars: tox_env: nfs + +- job: + name: openstack-ansible-glance-ssl-nv + parent: openstack-ansible-functional-ubuntu-xenial + voting: false + vars: + tox_env: ssl diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml index 25de553e..657d4ce5 100644 --- a/zuul.d/project.yaml +++ b/zuul.d/project.yaml @@ -25,6 +25,7 @@ - openstack-ansible-upgrade-ubuntu-xenial - openstack-ansible-v1_api_enabled - openstack-ansible-v2_registry_enabled + - openstack-ansible-glance-ssl-nv experimental: jobs: - openstack-ansible-integrated-deploy-aio @@ -38,3 +39,4 @@ - openstack-ansible-upgrade-ubuntu-xenial - openstack-ansible-v1_api_enabled - openstack-ansible-v2_registry_enabled + - openstack-ansible-glance-ssl-nv