diff options
| author | Piotr Milewski <vurmil@gmail.com> | 2026-03-25 14:30:16 +0100 |
|---|---|---|
| committer | Piotr Milewski <vurmil@gmail.com> | 2026-04-12 15:31:35 +0000 |
| commit | 54cd57ee2640728a9153adacc474e35da4ff3210 (patch) | |
| tree | 1ce76da792a664bc156a37e32c3d9ce3211f80f0 /doc/source/admin/tls.rst | |
| parent | 2c70177a933c4e3edf380f7b384c81ea85971ceb (diff) | |
| download | kolla-ansible-54cd57ee2640728a9153adacc474e35da4ff3210.tar.gz kolla-ansible-54cd57ee2640728a9153adacc474e35da4ff3210.zip | |
Fix: Update outdated documentation
Change-Id: I5dc53f74afd9a5b565201dc9d3039d82cb65dabc
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
Diffstat (limited to 'doc/source/admin/tls.rst')
| -rw-r--r-- | doc/source/admin/tls.rst | 34 |
1 files changed, 22 insertions, 12 deletions
diff --git a/doc/source/admin/tls.rst b/doc/source/admin/tls.rst index 3183c45e8..a78f4c599 100644 --- a/doc/source/admin/tls.rst +++ b/doc/source/admin/tls.rst @@ -48,10 +48,10 @@ APIs, configure the following in ``globals.yml``: .. code-block:: yaml - kolla_enable_tls_internal: "yes" - kolla_enable_tls_external: "yes" - kolla_enable_tls_backend: "yes" - kolla_copy_ca_into_containers: "yes" + kolla_enable_tls_internal: true + kolla_enable_tls_external: true + kolla_enable_tls_backend: true + kolla_copy_ca_into_containers: true If deploying on Debian or Ubuntu: @@ -100,13 +100,13 @@ encryption: .. code-block:: yaml - kolla_enable_tls_external: "yes" + kolla_enable_tls_external: true To enable internal TLS encryption: .. code-block:: yaml - kolla_enable_tls_internal: "yes" + kolla_enable_tls_internal: true Two certificate files are required to use TLS securely with authentication, which will be provided by your Certificate Authority: @@ -218,8 +218,18 @@ Enabling TLS on the backend services secures communication between the HAProxy listing on the internal/external VIP and the OpenStack services. It also enables secure end-to-end communication between OpenStack services that support TLS termination. The OpenStack services that support -backend TLS termination in Victoria are: Nova, Ironic, Neutron, Keystone, -Glance, Heat, Placement, Horizon, Barbican, and Cinder. +backend TLS termination are: + +* Barbican +* Cinder +* Glance +* Heat +* Horizon +* Ironic +* Keystone +* Neutron +* Nova +* Placement The configuration variables that control back-end TLS for service endpoints are: @@ -235,11 +245,11 @@ communication: .. code-block:: yaml - kolla_enable_tls_backend: "yes" + kolla_enable_tls_backend: true It is also possible to enable back-end TLS on a per-service basis. For example, to enable back-end TLS for Keystone, set ``keystone_enable_tls_backend`` to -``yes``. +``true``. The default values for ``haproxy_backend_cacert`` and ``haproxy_backend_cacert_dir`` should suffice if the certificate is in the @@ -284,7 +294,7 @@ disable verification of the backend certificate: .. code-block:: yaml - kolla_verify_tls_backend: "no" + kolla_verify_tls_backend: false Generating TLS certificates with Let's Encrypt ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -297,7 +307,7 @@ must be configured in ``globals.yml``: .. code-block:: yaml - enable_letsencrypt: "yes" + enable_letsencrypt: true letsencrypt_email: "<The email used for registration and recovery contact>" The Let's Encrypt container will attempt to renew your certificates every 12 |
