diff options
| author | Seunghun Lee <seunghun@stackhpc.com> | 2025-08-12 14:47:36 +0100 |
|---|---|---|
| committer | Seunghun Lee <seunghun@stackhpc.com> | 2025-08-13 14:16:53 +0100 |
| commit | 15dc0d0ede49dcfbb3b0ce04e6e0d1f25abdf28e (patch) | |
| tree | 07c803ca84e362fb1edaf11b0f66c5817746673f /doc/source/admin | |
| parent | ce798ce680302f2d6f5a1796d99c4ee5a1549d6f (diff) | |
| download | kolla-ansible-15dc0d0ede49dcfbb3b0ce04e6e0d1f25abdf28e.tar.gz kolla-ansible-15dc0d0ede49dcfbb3b0ce04e6e0d1f25abdf28e.zip | |
Set default external Let's Encrypt cert server
Currently, unless users set either external or internal cert server by
themselves, enabling Let's Encrypt with ``enable_letsencrypt`` does
nothing.
This change makes the external certificate get managed by Let's Encrypt
by default when Let's Encrypt is enabled.
The server address is default Let's Encrypt ACME server [1]
which was the former default before change [2].
[1] https://acme-v02.api.letsencrypt.org/directory
[2] https://review.opendev.org/c/openstack/kolla-ansible/+/925971
Closes-bug: #2120451
Change-Id: I10e800aede5966e030ed8e661e2eb45b126ff678
Signed-off-by: Seunghun Lee <seunghun@stackhpc.com>
Diffstat (limited to 'doc/source/admin')
| -rw-r--r-- | doc/source/admin/tls.rst | 33 |
1 files changed, 20 insertions, 13 deletions
diff --git a/doc/source/admin/tls.rst b/doc/source/admin/tls.rst index b9e779f4b..3183c45e8 100644 --- a/doc/source/admin/tls.rst +++ b/doc/source/admin/tls.rst @@ -316,19 +316,26 @@ to the HAProxy containers using SSH. with HAProxy. You can configure separate ACME servers for internal and external -certificate requests. - -.. code-block:: yaml - - letsencrypt_external_cert_server: "<ACME server URL for external cert>" - letsencrypt_internal_cert_server: "<ACME server URL for internal cert>" - -.. note:: - - The ``letsencrypt_external_cert_server`` has a default value of - ``https://acme-v02.api.letsencrypt.org/directory``. Ensure that - ``letsencrypt_internal_cert_server`` is reachable from the controller - if you configure it for internal certificate requests. +certificate requests by setting server URL on +``letsencrypt_internal_cert_server`` and +``letsencrypt_external_cert_server`` respectively. +The default is external certificate ACME server set to +``https://acme-v02.api.letsencrypt.org/directory``. + +.. list-table:: Let's Encrypt management + :widths: 28 72 + :header-rows: 1 + + * - Desired outcome + - Settings + * - External only (default) + - Enable Let's Encrypt; no further changes. + * - External + internal + - Set ``letsencrypt_internal_cert_server`` and ensure it is reachable + from the controller. + * - Internal only + - Set ``letsencrypt_external_cert_server: ""`` and set + ``letsencrypt_internal_cert_server``. .. _admin-tls-generating-a-private-ca: |