diff options
| author | James Kirsch <generalfuzz@gmail.com> | 2020-10-06 10:01:32 -0700 |
|---|---|---|
| committer | Radosław Piliszek <radoslaw.piliszek@gmail.com> | 2020-10-12 17:27:44 +0000 |
| commit | 93ad57f47e56431c36f51c6f961aa213fe89f7c9 (patch) | |
| tree | 71548fc847026887569cf99ca48ec51b31865f39 /doc/source/admin | |
| parent | 42d0b8936161015c201162c198b0df84b23ef703 (diff) | |
| download | kolla-ansible-93ad57f47e56431c36f51c6f961aa213fe89f7c9.tar.gz kolla-ansible-93ad57f47e56431c36f51c6f961aa213fe89f7c9.zip | |
Add support for encrypting backend Neutron API Server
Add TLS support for backend Neutron API Server communication using
HAProxy to perform TLS termination. When used in conjunction with
enabling TLS for service API endpoints, network communication will be
encrypted end to end, from client through HAProxy to the Neutron
service.
Change-Id: Ib333a1f1bd12491df72a9e52d961161210e2d330
Partially-Implements: blueprint add-ssl-internal-network
Diffstat (limited to 'doc/source/admin')
| -rw-r--r-- | doc/source/admin/advanced-configuration.rst | 4 | ||||
| -rw-r--r-- | doc/source/admin/tls.rst | 4 |
2 files changed, 6 insertions, 2 deletions
diff --git a/doc/source/admin/advanced-configuration.rst b/doc/source/admin/advanced-configuration.rst index 82f28654a..62298046c 100644 --- a/doc/source/admin/advanced-configuration.rst +++ b/doc/source/admin/advanced-configuration.rst @@ -264,6 +264,10 @@ If Glance TLS backend is enabled (``glance_enable_tls_backend``), the syslog facility for the ``glance_tls_proxy`` service uses ``local2`` by default. This can be set via ``syslog_glance_tls_proxy_facility``. +If Neutron TLS backend is enabled (``neutron_enable_tls_backend``), the syslog +facility for the ``neutron_tls_proxy`` service uses ``local4`` by default. +This can be set via ``syslog_neutron_tls_proxy_facility``. + Mount additional Docker volumes in containers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/doc/source/admin/tls.rst b/doc/source/admin/tls.rst index 2e619b512..2c0f7835f 100644 --- a/doc/source/admin/tls.rst +++ b/doc/source/admin/tls.rst @@ -218,8 +218,8 @@ Enabling TLS on the backend services secures communication between the HAProxy listing on the internal/external VIP and the OpenStack services. It also enables secure end-to-end communication between OpenStack services that support TLS termination. The OpenStack services that support -backend TLS termination in Ussuri are: Keystone, Glance, Heat, Placement, -Horizon, Barbican, and Cinder. +backend TLS termination in Victoria are: Nova, Ironic, Neutron, Keystone, +Glance, Heat, Placement, Horizon, Barbican, and Cinder. The configuration variables that control back-end TLS for service endpoints are: |