From 2adb2b6f57e031b70cb49cf3586fb204e6919d33 Mon Sep 17 00:00:00 2001 From: Tim Rozet Date: Thu, 1 Feb 2018 17:06:10 -0500 Subject: [PATCH] Fixes missing SSL configuration for Neutron DHCP agent Currently when deploying with TLS for internal API traffic, Neutron is not configured to securely communicate with OVSDB. In regular OVS agent deployments OVS listens on ptcp and accepts any incoming connection. In ODL deployments OVS is configured to only listen for pssl connections. To allow Neutron agents to communicate with OVSDB in pssl, Neutron needs to be configured with SSL key/certificate in order to connect to OVS. This patch adds key/certificate generation for NeutronBase service to be consumed by any agent. The only agent required with ODL is DHCP, so this patch only addresses configuring SSL there. However, a future patch could enable SSL for default ML2/OVS agent deployments as well by building off of this change. Note, by default OVSDB listens on port 6640. This does not work in ODL deployments when ODL is on the control node because ODL also listens on port 6640. Therefore from the ODL service, the ovsdb_connection setting for DHCP agent is modified when ODL is deployed. Depends-On: I82281eefa1aa81207ccd8ea565cffc6ca0ec48de Depends-On: I4bbaf00f0776cab0be34d814a541fb2fd1e64326 Closes-Bug: 1746762 Change-Id: I97352027d7f750d0820610fb9e06f82b47e77056 Signed-off-by: Tim Rozet --- docker/services/neutron-dhcp.yaml | 29 +++++++++++++++++++ puppet/services/neutron-base.yaml | 29 +++++++++++++++++++ puppet/services/neutron-dhcp.yaml | 17 +++++++++++ puppet/services/opendaylight-api.yaml | 6 ++++ ...fix-neutron-dhcp-tls-d62383530419f0bd.yaml | 6 ++++ 5 files changed, 87 insertions(+) create mode 100644 releasenotes/notes/fix-neutron-dhcp-tls-d62383530419f0bd.yaml diff --git a/docker/services/neutron-dhcp.yaml b/docker/services/neutron-dhcp.yaml index 790ae5ac8b..62ac9d5e67 100644 --- a/docker/services/neutron-dhcp.yaml +++ b/docker/services/neutron-dhcp.yaml @@ -36,6 +36,18 @@ parameters: default: {} description: Parameters specific to the role type: json + EnableInternalTLS: + type: boolean + default: false + InternalTLSCAFile: + default: '/etc/ipa/ca.crt' + type: string + description: Specifies the default CA cert to use if TLS is used for + services in the internal network. + +conditions: + + internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]} resources: @@ -64,6 +76,10 @@ outputs: map_merge: - get_attr: [NeutronBase, role_data, config_settings] - get_attr: [NeutronLogging, config_settings] + - if: + - internal_tls_enabled + - tripleo::certmonger::neutron::postsave_cmd: "true" # TODO: restart the container here + - {} logging_source: {get_attr: [NeutronBase, role_data, logging_source]} logging_groups: {get_attr: [NeutronBase, role_data, logging_groups]} service_config_settings: {get_attr: [NeutronBase, role_data, service_config_settings]} @@ -110,8 +126,21 @@ outputs: - /lib/modules:/lib/modules:ro - /run/openvswitch:/run/openvswitch - /var/lib/neutron:/var/lib/neutron + - + if: + - internal_tls_enabled + - - /etc/pki/tls/certs/neutron.crt:/etc/pki/tls/certs/neutron.crt:ro + - /etc/pki/tls/private/neutron.key:/etc/pki/tls/private/neutron.key:ro + - list_join: + - ':' + - - {get_param: InternalTLSCAFile} + - {get_param: InternalTLSCAFile} + - 'ro' + - null environment: - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS + metadata_settings: + get_attr: [NeutronBase, role_data, metadata_settings] host_prep_tasks: list_concat: - {get_attr: [NeutronLogging, host_prep_tasks]} diff --git a/puppet/services/neutron-base.yaml b/puppet/services/neutron-base.yaml index e8515c5389..c92dfc0ec3 100644 --- a/puppet/services/neutron-base.yaml +++ b/puppet/services/neutron-base.yaml @@ -113,10 +113,14 @@ parameters: description: Driver or drivers to handle sending notifications. constraints: - allowed_values: [ 'messagingv2', 'noop' ] + EnableInternalTLS: + type: boolean + default: false conditions: dhcp_agents_zero: {equals : [{get_param: NeutronDhcpAgentsPerNetwork}, 0]} service_debug_unset: {equals : [{get_param: NeutronDebug}, '']} + internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]} outputs: role_data: @@ -152,3 +156,28 @@ outputs: - dhcp_agents_zero - {} - tripleo::profile::base::neutron::dhcp_agents_per_network: {get_param: NeutronDhcpAgentsPerNetwork} + - if: + - internal_tls_enabled + - generate_service_certificates: true + tripleo::profile::base::neutron::certificate_specs: + service_certificate: '/etc/pki/tls/certs/neutron.crt' + service_key: '/etc/pki/tls/private/neutron.key' + hostname: + str_replace: + template: "%{hiera('fqdn_NETWORK')}" + params: + NETWORK: {get_param: [ServiceNetMap, NeutronApiNetwork]} + principal: + str_replace: + template: "neutron/%{hiera('fqdn_NETWORK')}" + params: + NETWORK: {get_param: [ServiceNetMap, NeutronApiNetwork]} + - null + metadata_settings: + if: + - internal_tls_enabled + - + - service: neutron + network: {get_param: [ServiceNetMap, NeutronApiNetwork]} + type: node + - null diff --git a/puppet/services/neutron-dhcp.yaml b/puppet/services/neutron-dhcp.yaml index 3cd910b6ae..7f2e28e015 100644 --- a/puppet/services/neutron-dhcp.yaml +++ b/puppet/services/neutron-dhcp.yaml @@ -69,9 +69,18 @@ parameters: default: 'neutron.agent.linux.interface.OVSInterfaceDriver' description: Neutron DHCP Agent interface driver type: string + EnableInternalTLS: + type: boolean + default: false + InternalTLSCAFile: + default: '/etc/ipa/ca.crt' + type: string + description: Specifies the default CA cert to use if TLS is used for + services in the internal network. conditions: service_debug_unset: {equals: [{get_param: NeutronDhcpAgentDebug}, '']} + internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]} resources: @@ -112,6 +121,12 @@ outputs: proto: 'udp' chain: 'OUTPUT' dport: 68 + - if: + - internal_tls_enabled + - neutron::agents::dhcp::ovsdb_agent_ssl_key_file: '/etc/pki/tls/private/neutron.key' + neutron::agents::dhcp::ovsdb_agent_ssl_cert_file: '/etc/pki/tls/certs/neutron.crt' + neutron::agents::dhcp::ovsdb_agent_ssl_ca_file: {get_param: InternalTLSCAFile} + - {} service_config_settings: fluentd: tripleo_fluentd_groups_neutron_dhcp: @@ -137,3 +152,5 @@ outputs: - step|int == 1 - neutron_dhcp_agent_enabled.rc == 0 service: name=neutron-dhcp-agent state=stopped + metadata_settings: + get_attr: [NeutronBase, role_data, metadata_settings] diff --git a/puppet/services/opendaylight-api.yaml b/puppet/services/opendaylight-api.yaml index 8a7d2cf661..af27aab5f3 100644 --- a/puppet/services/opendaylight-api.yaml +++ b/puppet/services/opendaylight-api.yaml @@ -160,6 +160,12 @@ outputs: opendaylight::tls_ca_cert_file: {get_param: InternalTLSCAFile} opendaylight::tls_keystore_password: {get_param: OpenDaylightTLSKeystorePassword} - {} + service_config_settings: + neutron_dhcp: + if: + - internal_tls_enabled + - neutron::agents::dhcp::ovsdb_connection: 'ssl:127.0.0.1:6639' + - neutron::agents::dhcp::ovsdb_connection: 'tcp:127.0.0.1:6639' step_config: | include tripleo::profile::base::neutron::opendaylight upgrade_tasks: diff --git a/releasenotes/notes/fix-neutron-dhcp-tls-d62383530419f0bd.yaml b/releasenotes/notes/fix-neutron-dhcp-tls-d62383530419f0bd.yaml new file mode 100644 index 0000000000..c2f7c532f0 --- /dev/null +++ b/releasenotes/notes/fix-neutron-dhcp-tls-d62383530419f0bd.yaml @@ -0,0 +1,6 @@ +--- +fixes: + - | + Fixes issue in OpenDaylight deployments where SSL between Neutron DHCP + agent with OVS did not work due to missing SSL certificate/key + configuration.