aboutsummaryrefslogtreecommitdiff
path: root/doc/source/admin/tls.rst
diff options
context:
space:
mode:
authorPiotr Milewski <vurmil@gmail.com>2026-03-25 14:30:16 +0100
committerPiotr Milewski <vurmil@gmail.com>2026-04-12 15:31:35 +0000
commit54cd57ee2640728a9153adacc474e35da4ff3210 (patch)
tree1ce76da792a664bc156a37e32c3d9ce3211f80f0 /doc/source/admin/tls.rst
parent2c70177a933c4e3edf380f7b384c81ea85971ceb (diff)
downloadkolla-ansible-54cd57ee2640728a9153adacc474e35da4ff3210.tar.gz
kolla-ansible-54cd57ee2640728a9153adacc474e35da4ff3210.zip
Fix: Update outdated documentation
Change-Id: I5dc53f74afd9a5b565201dc9d3039d82cb65dabc Signed-off-by: Piotr Milewski <vurmil@gmail.com>
Diffstat (limited to 'doc/source/admin/tls.rst')
-rw-r--r--doc/source/admin/tls.rst34
1 files changed, 22 insertions, 12 deletions
diff --git a/doc/source/admin/tls.rst b/doc/source/admin/tls.rst
index 3183c45e8..a78f4c599 100644
--- a/doc/source/admin/tls.rst
+++ b/doc/source/admin/tls.rst
@@ -48,10 +48,10 @@ APIs, configure the following in ``globals.yml``:
.. code-block:: yaml
- kolla_enable_tls_internal: "yes"
- kolla_enable_tls_external: "yes"
- kolla_enable_tls_backend: "yes"
- kolla_copy_ca_into_containers: "yes"
+ kolla_enable_tls_internal: true
+ kolla_enable_tls_external: true
+ kolla_enable_tls_backend: true
+ kolla_copy_ca_into_containers: true
If deploying on Debian or Ubuntu:
@@ -100,13 +100,13 @@ encryption:
.. code-block:: yaml
- kolla_enable_tls_external: "yes"
+ kolla_enable_tls_external: true
To enable internal TLS encryption:
.. code-block:: yaml
- kolla_enable_tls_internal: "yes"
+ kolla_enable_tls_internal: true
Two certificate files are required to use TLS securely with authentication,
which will be provided by your Certificate Authority:
@@ -218,8 +218,18 @@ Enabling TLS on the backend services secures communication between the
HAProxy listing on the internal/external VIP and the OpenStack
services. It also enables secure end-to-end communication between OpenStack
services that support TLS termination. The OpenStack services that support
-backend TLS termination in Victoria are: Nova, Ironic, Neutron, Keystone,
-Glance, Heat, Placement, Horizon, Barbican, and Cinder.
+backend TLS termination are:
+
+* Barbican
+* Cinder
+* Glance
+* Heat
+* Horizon
+* Ironic
+* Keystone
+* Neutron
+* Nova
+* Placement
The configuration variables that control back-end TLS for service endpoints
are:
@@ -235,11 +245,11 @@ communication:
.. code-block:: yaml
- kolla_enable_tls_backend: "yes"
+ kolla_enable_tls_backend: true
It is also possible to enable back-end TLS on a per-service basis. For example,
to enable back-end TLS for Keystone, set ``keystone_enable_tls_backend`` to
-``yes``.
+``true``.
The default values for ``haproxy_backend_cacert`` and
``haproxy_backend_cacert_dir`` should suffice if the certificate is in the
@@ -284,7 +294,7 @@ disable verification of the backend certificate:
.. code-block:: yaml
- kolla_verify_tls_backend: "no"
+ kolla_verify_tls_backend: false
Generating TLS certificates with Let's Encrypt
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -297,7 +307,7 @@ must be configured in ``globals.yml``:
.. code-block:: yaml
- enable_letsencrypt: "yes"
+ enable_letsencrypt: true
letsencrypt_email: "<The email used for registration and recovery contact>"
The Let's Encrypt container will attempt to renew your certificates every 12