diff options
| author | James Kirsch <generalfuzz@gmail.com> | 2020-03-19 14:25:07 -0700 |
|---|---|---|
| committer | Mark Goddard <mark@stackhpc.com> | 2020-04-09 09:22:55 +0000 |
| commit | b475643c112f49701db2fb3d1493987888c97c8a (patch) | |
| tree | ac00ccadab129639de8097238d2bc1abe52d572d /etc | |
| parent | 9643dd54e26760d6249eed2ecb2712da28b05882 (diff) | |
| download | kolla-ansible-b475643c112f49701db2fb3d1493987888c97c8a.tar.gz kolla-ansible-b475643c112f49701db2fb3d1493987888c97c8a.zip | |
Add support for encrypting backend Keystone HAProxy traffic
This patch introduces an optional backend encryption for Keystone
service. When used in conjunction with enabling TLS for service API
endpoints, network communcation will be encrypted end to end, from
client through HAProxy to the Keystone service.
Change-Id: I6351147ddaff8b2ae629179a9bc3bae2ebac9519
Partially-Implements: blueprint add-ssl-internal-network
Diffstat (limited to 'etc')
| -rw-r--r-- | etc/kolla/globals.yml | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/etc/kolla/globals.yml b/etc/kolla/globals.yml index 524edaa24..f40fe35c0 100644 --- a/etc/kolla/globals.yml +++ b/etc/kolla/globals.yml @@ -182,11 +182,18 @@ # allow clients to perform authentication. #kolla_enable_tls_internal: "no" #kolla_enable_tls_external: "{{ kolla_enable_tls_internal if kolla_same_external_internal_vip | bool else 'no' }}" -#kolla_external_fqdn_cert: "{{ node_config }}/certificates/haproxy.pem" -#kolla_internal_fqdn_cert: "{{ node_config }}/certificates/haproxy-internal.pem" -#kolla_external_fqdn_cacert: "{{ node_config }}/certificates/ca/haproxy.crt" -#kolla_internal_fqdn_cacert: "{{ node_config }}/certificates/ca/haproxy-internal.crt" +#kolla_certificates_dir: "{{ node_config }}/certificates" +#kolla_external_fqdn_cert: "{{ kolla_certificates_dir }}/haproxy.pem" +#kolla_internal_fqdn_cert: "{{ kolla_certificates_dir }}/haproxy-internal.pem" +#kolla_external_fqdn_cacert: "{{ kolla_certificates_dir }}/ca/haproxy.crt" +#kolla_internal_fqdn_cacert: "{{ kolla_certificates_dir }}/ca/haproxy-internal.crt" #kolla_copy_ca_into_containers: "no" +#kolla_verify_tls_backend: "yes" +#haproxy_backend_cacert: "{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.trust.crt' }}" +#haproxy_backend_cacert_dir: "/etc/ssl/certs" +#kolla_enable_tls_backend: "no" +#kolla_tls_backend_cert: "{{ kolla_certificates_dir }}/backend-cert.pem" +#kolla_tls_backend_key: "{{ kolla_certificates_dir }}/backend-key.pem" ################ # Region options |