Unnamed repository; edit this file 'description' to name the repository. https://git.platform-os.org/openstack/kolla-ansible.git/atom?h=stable%2F2026.1 2025-12-05T06:07:50+00:00 2025-12-05T06:07:50+00:00 Michal Nasiadka mnasiadka@gmail.com 2025-12-04T15:41:20+00:00 urn:sha1:04defb5e5d0cd7984d9a57a18e7e903bd897c9f2 Change-Id: I82310a2ebfa326a01424c7469d4eb9d440dc9b9c Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> 2022-02-03T14:32:38+00:00 Mark Goddard mark@stackhpc.com 2022-01-26T16:27:33+00:00 urn:sha1:33e93ab323a570d9140168c967a37c311e0052d6 Adds support to the 'kolla-ansible certificates' command for generating certificates for libvirt TLS, when libvirt_tls is true. The same certificate and key are used for the libvirt client and server. The certificates use the same root CA as the other generated certificates, and are written to {{ node_custom_config }}/nova/nova-libvirt/, ready to be picked up by nova-libvirt and nova-compute. Change-Id: I1bde9fa018f66037aec82dc74c61ad1f477a7c12 2020-09-17T11:05:44+00:00 Mark Goddard mark@stackhpc.com 2020-05-14T14:18:56+00:00 urn:sha1:761ea9a333ea50d10f64aa144eafc1ac5a3ddacf This change adds support for encryption of communication between OpenStack services and RabbitMQ. Server certificates are supported, but currently client certificates are not. The kolla-ansible certificates command has been updated to support generating certificates for RabbitMQ for development and testing. RabbitMQ TLS is enabled in the all-in-one source CI jobs, or when The Zuul 'tls_enabled' variable is true. Change-Id: I4f1d04150fb2b5af085b762890092f87ae6076b5 Implements: blueprint message-queue-ssl-support 2020-04-09T09:22:55+00:00 James Kirsch generalfuzz@gmail.com 2020-03-19T21:25:07+00:00 urn:sha1:b475643c112f49701db2fb3d1493987888c97c8a This patch introduces an optional backend encryption for Keystone service. When used in conjunction with enabling TLS for service API endpoints, network communcation will be encrypted end to end, from client through HAProxy to the Keystone service. Change-Id: I6351147ddaff8b2ae629179a9bc3bae2ebac9519 Partially-Implements: blueprint add-ssl-internal-network 2018-03-20T11:57:30+00:00 caoyuan cao.yuan@99cloud.net 2018-03-19T06:40:32+00:00 urn:sha1:82725deebf3eda7536c51615d061af4ebaa449cf when run command "kolla-ansible -i multinode certificates", the certificates file will generated in all nodes, it is unnecessary, this ps to make it in deploy node. Change-Id: I3e98ab498eeec3e6b8f170dd29c95f7ff9dbd6c0 2016-12-05T15:40:56+00:00 Christian Berendt berendt@betacloud-solutions.de 2016-11-30T15:23:36+00:00 urn:sha1:4c39f2e9fc08d29a1acdee80f8130c46680db33c Change-Id: I44c2668a8ebb6dd3201a6eb4e47284871380e6d7 2016-02-26T19:09:31+00:00 Dave McCowan dmccowan@cisco.com 2016-02-20T19:54:41+00:00 urn:sha1:fd2808722950d4a1bdbb8efc60d4e2b6419a72f1 Working towards the blueprint that will add TLS protection for the external endpoints, kolla needs certificates. When kolla deploys OpenStack, the external VIP will need a server side certifcate. Clients that access those endpoints will need the public CA certificate that signed that certificate. This ansible script will create these two certificates to make it easy to use TLS in a test environment. The generated certificate files are: /etc/kolla/certificates/haproxy.pem (server side certificate) /etc/kolla/certificates/haproxy-ca.pem (CA certificate) The generated certificates are not suitable for use in a production environment, but will be useful for testing and verifying operations. Partially-implements: blueprint ssl-kolla Change-Id: I208777f9e5eee3bfb06810c7b18a2727beda234d