aboutsummaryrefslogtreecommitdiff
path: root/doc/source/admin/tls.rst
diff options
context:
space:
mode:
authorZuul <zuul@review.opendev.org>2026-04-16 14:54:58 +0000
committerGerrit Code Review <review@openstack.org>2026-04-16 14:54:58 +0000
commite9203400df3f2e5968a9c4ae9b412f4b2b8d898a (patch)
tree111476b1a63b278677a7017de9321afab7fb0226 /doc/source/admin/tls.rst
parent88aecb6009d2ef6e543849cd9930d1bd80cfca2f (diff)
parent54cd57ee2640728a9153adacc474e35da4ff3210 (diff)
downloadkolla-ansible-e9203400df3f2e5968a9c4ae9b412f4b2b8d898a.tar.gz
kolla-ansible-e9203400df3f2e5968a9c4ae9b412f4b2b8d898a.zip
Merge "Fix: Update outdated documentation"
Diffstat (limited to 'doc/source/admin/tls.rst')
-rw-r--r--doc/source/admin/tls.rst34
1 files changed, 22 insertions, 12 deletions
diff --git a/doc/source/admin/tls.rst b/doc/source/admin/tls.rst
index 3183c45e8..a78f4c599 100644
--- a/doc/source/admin/tls.rst
+++ b/doc/source/admin/tls.rst
@@ -48,10 +48,10 @@ APIs, configure the following in ``globals.yml``:
.. code-block:: yaml
- kolla_enable_tls_internal: "yes"
- kolla_enable_tls_external: "yes"
- kolla_enable_tls_backend: "yes"
- kolla_copy_ca_into_containers: "yes"
+ kolla_enable_tls_internal: true
+ kolla_enable_tls_external: true
+ kolla_enable_tls_backend: true
+ kolla_copy_ca_into_containers: true
If deploying on Debian or Ubuntu:
@@ -100,13 +100,13 @@ encryption:
.. code-block:: yaml
- kolla_enable_tls_external: "yes"
+ kolla_enable_tls_external: true
To enable internal TLS encryption:
.. code-block:: yaml
- kolla_enable_tls_internal: "yes"
+ kolla_enable_tls_internal: true
Two certificate files are required to use TLS securely with authentication,
which will be provided by your Certificate Authority:
@@ -218,8 +218,18 @@ Enabling TLS on the backend services secures communication between the
HAProxy listing on the internal/external VIP and the OpenStack
services. It also enables secure end-to-end communication between OpenStack
services that support TLS termination. The OpenStack services that support
-backend TLS termination in Victoria are: Nova, Ironic, Neutron, Keystone,
-Glance, Heat, Placement, Horizon, Barbican, and Cinder.
+backend TLS termination are:
+
+* Barbican
+* Cinder
+* Glance
+* Heat
+* Horizon
+* Ironic
+* Keystone
+* Neutron
+* Nova
+* Placement
The configuration variables that control back-end TLS for service endpoints
are:
@@ -235,11 +245,11 @@ communication:
.. code-block:: yaml
- kolla_enable_tls_backend: "yes"
+ kolla_enable_tls_backend: true
It is also possible to enable back-end TLS on a per-service basis. For example,
to enable back-end TLS for Keystone, set ``keystone_enable_tls_backend`` to
-``yes``.
+``true``.
The default values for ``haproxy_backend_cacert`` and
``haproxy_backend_cacert_dir`` should suffice if the certificate is in the
@@ -284,7 +294,7 @@ disable verification of the backend certificate:
.. code-block:: yaml
- kolla_verify_tls_backend: "no"
+ kolla_verify_tls_backend: false
Generating TLS certificates with Let's Encrypt
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -297,7 +307,7 @@ must be configured in ``globals.yml``:
.. code-block:: yaml
- enable_letsencrypt: "yes"
+ enable_letsencrypt: true
letsencrypt_email: "<The email used for registration and recovery contact>"
The Let's Encrypt container will attempt to renew your certificates every 12