diff options
| author | Matus Jenca <matus.jenca@dnation.cloud> | 2024-08-01 17:28:27 +0200 |
|---|---|---|
| committer | Michal Nasiadka <mnasiadka@gmail.com> | 2024-10-26 07:12:17 +0000 |
| commit | 66a2f5830cc2618ba2add2c66cb31d1a19524462 (patch) | |
| tree | b94699b062e8750cd69a1f87690d814ad738e0e9 | |
| parent | f76833b49acab7394dfa361c0b95770074bca242 (diff) | |
| download | kolla-ansible-66a2f5830cc2618ba2add2c66cb31d1a19524462.tar.gz kolla-ansible-66a2f5830cc2618ba2add2c66cb31d1a19524462.zip | |
Add frontend database TLS for Keystone
This patch enables internal TLS database
connection for Keystone.
Change-Id: I816d051e933a560629d9b9c95362f668abe4ade7
| -rw-r--r-- | ansible/roles/keystone/defaults/main.yml | 3 | ||||
| -rw-r--r-- | ansible/roles/keystone/templates/keystone.conf.j2 | 2 | ||||
| -rw-r--r-- | releasenotes/notes/proxysql-internal-tls-keystone-5e3574a356afc819.yaml | 4 |
3 files changed, 8 insertions, 1 deletions
diff --git a/ansible/roles/keystone/defaults/main.yml b/ansible/roles/keystone/defaults/main.yml index 1945142c4..a6843774c 100644 --- a/ansible/roles/keystone/defaults/main.yml +++ b/ansible/roles/keystone/defaults/main.yml @@ -239,3 +239,6 @@ keystone_federation_oidc_scopes: "openid email profile" # OIDC caching keystone_oidc_enable_memcached: "{{ enable_memcached }}" + +# Database +keystone_database_enable_tls_internal: "{{ database_enable_tls_internal | bool }}" diff --git a/ansible/roles/keystone/templates/keystone.conf.j2 b/ansible/roles/keystone/templates/keystone.conf.j2 index ffccd4abe..614a9eab0 100644 --- a/ansible/roles/keystone/templates/keystone.conf.j2 +++ b/ansible/roles/keystone/templates/keystone.conf.j2 @@ -16,7 +16,7 @@ policy_file = {{ keystone_policy_file }} {% endif %} [database] -connection = mysql+pymysql://{{ keystone_database_user }}:{{ keystone_database_password }}@{{ keystone_database_address }}/{{ keystone_database_name }} +connection = mysql+pymysql://{{ keystone_database_user }}:{{ keystone_database_password }}@{{ keystone_database_address }}/{{ keystone_database_name }}{{ '?ssl_ca=' ~ openstack_cacert if keystone_database_enable_tls_internal | bool }} connection_recycle_time = {{ database_connection_recycle_time }} max_pool_size = {{ database_max_pool_size }} max_retries = -1 diff --git a/releasenotes/notes/proxysql-internal-tls-keystone-5e3574a356afc819.yaml b/releasenotes/notes/proxysql-internal-tls-keystone-5e3574a356afc819.yaml new file mode 100644 index 000000000..b385a6e8a --- /dev/null +++ b/releasenotes/notes/proxysql-internal-tls-keystone-5e3574a356afc819.yaml @@ -0,0 +1,4 @@ +--- +features: + - | + Implements TLS between Keystone and ProxySQL |