openstack/openstack-helm
Code Issues Proposed changes

Support TLS endpoints in neutron

Browse Source 
This allows neutron to consume TLS openstack endpoints.
Jobs consume openstack endpoints, typically identity endpoints.
And neutron itself interact with other openstack services via
endpoints.

Change-Id: I204b8a1a5a1fb253ea4207f5f5d76d47fac41bef
This commit is contained in:
josebb 2021-12-02 19:27:56 +02:00
parent ced30abead
commit 753e43072d
9 changed files with 32 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
neutron/Chart.yaml
View File

@ -14,7 +14,7 @@ apiVersion: v1
appVersion: v1.0.0
description: OpenStack-Helm Neutron
name: neutron
version: 0.2.24
version: 0.2.25
home: https://docs.openstack.org/neutron/latest/
icon: https://www.openstack.org/themes/openstack/images/project-mascots/Neutron/OpenStack_Project_Neutron_vertical.png
sources:

9
neutron/templates/deployment-server.yaml
View File

@ -153,6 +153,11 @@ spec:
command:
- /tmp/neutron-server.sh
- start
{{- if or .Values.manifests.certificates .Values.tls.identity }}
env:
- name: REQUESTS_CA_BUNDLE
value: "/etc/neutron/certs/ca.crt"
{{- end }}
lifecycle:
preStop:
exec:
@ -241,7 +246,7 @@ spec:
subPath: policy.yaml
readOnly: true
{{- dict "enabled" .Values.manifests.certificates "name" .Values.endpoints.oslo_db.auth.admin.secret.tls.internal "path" "/etc/mysql/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
{{- dict "enabled" .Values.manifests.certificates "name" .Values.secrets.tls.network.server.internal "path" "/etc/neutron/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
{{- dict "enabled" (or .Values.manifests.certificates .Values.tls.identity) "name" .Values.secrets.tls.network.server.internal "path" "/etc/neutron/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
{{- dict "enabled" $envAll.Values.manifests.certificates "name" $envAll.Values.endpoints.oslo_messaging.auth.admin.secret.tls.internal "path" "/etc/rabbitmq/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
{{ if $mounts_neutron_server.volumeMounts }}{{ toYaml $mounts_neutron_server.volumeMounts | indent 12 }}{{ end }}
volumes:
@ -266,7 +271,7 @@ spec:
emptyDir: {}
{{- end }}
{{- dict "enabled" .Values.manifests.certificates "name" .Values.endpoints.oslo_db.auth.admin.secret.tls.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
{{- dict "enabled" .Values.manifests.certificates "name" .Values.secrets.tls.network.server.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
{{- dict "enabled" (or .Values.manifests.certificates .Values.tls.identity) "name" .Values.secrets.tls.network.server.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
{{- dict "enabled" $envAll.Values.manifests.certificates "name" $envAll.Values.endpoints.oslo_messaging.auth.admin.secret.tls.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
{{ if $mounts_neutron_server.volumes }}{{ toYaml $mounts_neutron_server.volumes | indent 8 }}{{ end }}
{{- end }}

2
neutron/templates/job-bootstrap.yaml
View File

@ -19,7 +19,7 @@ helm.sh/hook-weight: "5"
{{- if and .Values.manifests.job_bootstrap .Values.bootstrap.enabled }}
{{- $bootstrapJob := dict "envAll" . "serviceName" "neutron" "keystoneUser" .Values.bootstrap.ks_user "logConfigFile" .Values.conf.neutron.DEFAULT.log_config_append -}}
{{- if .Values.manifests.certificates -}}
{{- if or .Values.manifests.certificates .Values.tls.identity -}}
{{- $_ := set $bootstrapJob "tlsSecret" .Values.secrets.tls.network.server.internal -}}
{{- end -}}
{{- if .Values.helm3_hook }}

2
neutron/templates/job-ks-endpoints.yaml
View File

@ -19,7 +19,7 @@ helm.sh/hook-weight: "-2"
{{- if .Values.manifests.job_ks_endpoints }}
{{- $ksEndpointsJob := dict "envAll" . "serviceName" "neutron" "serviceTypes" ( tuple "network" ) -}}
{{- if .Values.manifests.certificates -}}
{{- if or .Values.manifests.certificates .Values.tls.identity -}}
{{- $_ := set $ksEndpointsJob "tlsSecret" .Values.secrets.tls.network.server.internal -}}
{{- end -}}
{{- if .Values.helm3_hook }}

2
neutron/templates/job-ks-service.yaml
View File

@ -19,7 +19,7 @@ helm.sh/hook-weight: "-3"
{{- if .Values.manifests.job_ks_service }}
{{- $ksServiceJob := dict "envAll" . "serviceName" "neutron" "serviceTypes" ( tuple "network" ) -}}
{{- if .Values.manifests.certificates -}}
{{- if or .Values.manifests.certificates .Values.tls.identity -}}
{{- $_ := set $ksServiceJob "tlsSecret" .Values.secrets.tls.network.server.internal -}}
{{- end -}}
{{- if .Values.helm3_hook }}

2
neutron/templates/job-ks-user.yaml
View File

@ -19,7 +19,7 @@ helm.sh/hook-weight: "-1"
{{- if .Values.manifests.job_ks_user }}
{{- $ksUserJob := dict "envAll" . "serviceName" "neutron" -}}
{{- if .Values.manifests.certificates -}}
{{- if or .Values.manifests.certificates .Values.tls.identity -}}
{{- $_ := set $ksUserJob "tlsSecret" .Values.secrets.tls.network.server.internal -}}
{{- end -}}
{{- if .Values.helm3_hook }}

5
neutron/values.yaml
View File

@ -2544,6 +2544,11 @@ health_probe:
logging:
level: ERROR
tls:
identity: false
oslo_messaging: false
oslo_db: false
manifests:
certificates: false
configmap_bin: true

14
neutron/values_overrides/tls-offloading.yaml Normal file
View File

@ -0,0 +1,14 @@
---
endpoints:
identity:
auth:
admin:
cacert: /etc/ssl/certs/openstack-helm.crt
neutron:
cacert: /etc/ssl/certs/openstack-helm.crt
test:
cacert: /etc/ssl/certs/openstack-helm.crt
tls:
identity: true
...

1
releasenotes/notes/neutron.yaml
View File

@ -38,4 +38,5 @@ neutron:
- 0.2.22 Fix /run/xtables.lock may be a directory
- 0.2.23 Add neutron_netns_cleanup_cron release image override, so that the respective release image is used
- 0.2.24 Added OCI registry authentication
- 0.2.25 Support TLS endpoints
...