diff options
| author | Mark Goddard <mark@stackhpc.com> | 2020-05-14 15:18:56 +0100 |
|---|---|---|
| committer | Mark Goddard <mark@stackhpc.com> | 2020-09-17 12:05:44 +0100 |
| commit | 761ea9a333ea50d10f64aa144eafc1ac5a3ddacf (patch) | |
| tree | 9e1743629fa6767f0a1e4afb278a2082dc62177b /etc | |
| parent | fa48cc7eaf668d614804e3ec6b0331251f4524f1 (diff) | |
| download | kolla-ansible-761ea9a333ea50d10f64aa144eafc1ac5a3ddacf.tar.gz kolla-ansible-761ea9a333ea50d10f64aa144eafc1ac5a3ddacf.zip | |
Support TLS encryption of RabbitMQ client-server traffic
This change adds support for encryption of communication between
OpenStack services and RabbitMQ. Server certificates are supported, but
currently client certificates are not.
The kolla-ansible certificates command has been updated to support
generating certificates for RabbitMQ for development and testing.
RabbitMQ TLS is enabled in the all-in-one source CI jobs, or when
The Zuul 'tls_enabled' variable is true.
Change-Id: I4f1d04150fb2b5af085b762890092f87ae6076b5
Implements: blueprint message-queue-ssl-support
Diffstat (limited to 'etc')
| -rw-r--r-- | etc/kolla/globals.yml | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/etc/kolla/globals.yml b/etc/kolla/globals.yml index 34c2ae69e..f1b5336b3 100644 --- a/etc/kolla/globals.yml +++ b/etc/kolla/globals.yml @@ -84,6 +84,10 @@ #om_rpc_port: "{{ qdrouterd_port }}" #om_rpc_group: "qdrouterd" +# Whether to enable TLS for oslo.messaging communication with RabbitMQ. +#om_enable_rabbitmq_tls: "{{ rabbitmq_enable_tls | bool }}" +# CA certificate bundle in containers using oslo.messaging with RabbitMQ TLS. +#om_rabbitmq_cacert: "{{ rabbitmq_cacert }}" ############################## # Neutron - Networking Options @@ -373,6 +377,10 @@ # These are appended to args already provided by Kolla Ansible # to configure IPv6 in RabbitMQ server. #rabbitmq_server_additional_erl_args: "" +# Whether to enable TLS encryption for RabbitMQ client-server communication. +#rabbitmq_enable_tls: "no" +# CA certificate bundle in RabbitMQ container. +#rabbitmq_cacert: "/etc/ssl/certs/{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.trust.crt' }}" ################# # MariaDB options |