Add backend TLS between MariaDB and ProxySQL

This commit adds TLS connection between ProxySQL and MariaDB.
Frontend TLS ( between services and ProxySQL) will be
added in another commit.

Parialy Implements: mariadb-ssl-support

Change-Id: I154cbb096469c5515c9d8156c2c1c5dd07b95849
Signed-off-by: Matus Jenca <matus.jenca@dnation.cloud>

3 files changed, 68 insertions, 0 deletions

diff --git a/tests/j2lint.py b/tests/j2lint.py
index d9cc6e8bf..b3981af24 100755
--- a/tests/j2lint.py
+++ b/tests/j2lint.py
@@ -33,6 +33,10 @@ from jinja2 import TemplateNotFound
 from kolla_ansible import kolla_address
 from kolla_ansible import put_address_in_context
 import os.path
+try:
+    from ansible_collections.ansible.utils.plugins.filter import ipwrap
+except ImportError:
+    from ansible_collections.ansible.netcommon.plugins.filter import ipwrap
 
 
 class AbsolutePathLoader(BaseLoader):
@@ -57,6 +61,7 @@ def check(template, out, err, env=Environment(loader=AbsolutePathLoader(),
         env.filters['password_hash'] = get_encrypted_password
         env.filters['kolla_address'] = kolla_address
         env.filters['put_address_in_context'] = put_address_in_context
+        env.filters['ipwrap'] = ipwrap
         env.get_template(template)
         out.write("%s: Syntax OK\n" % template)
         return 0
diff --git a/tests/run.yml b/tests/run.yml
index a32cec0c4..a93917f53 100644
--- a/tests/run.yml
+++ b/tests/run.yml
@@ -555,6 +555,16 @@
             KOLLA_ANSIBLE_VENV_PATH: "{{ kolla_ansible_venv_path }}"
             CONTAINER_ENGINE: "{{ container_engine }}"
 
+        - name: Run test-proxysql.sh script
+          script:
+            cmd: test-proxysql.sh
+            executable: /bin/bash
+            chdir: "{{ kolla_ansible_src_dir }}"
+          when: scenario == "cells"
+          environment:
+            VIP: "{{ kolla_internal_vip_address }}"
+            TLS_ENABLED: "{{ tls_enabled }}"
+
         - name: Run test-prometheus-opensearch.sh script
           script:
             cmd: test-prometheus-opensearch.sh
diff --git a/tests/test-proxysql.sh b/tests/test-proxysql.sh
new file mode 100755
index 000000000..122048f9d
--- /dev/null
+++ b/tests/test-proxysql.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+set -o xtrace
+set -o pipefail
+
+
+function test_proxysql_connection_logged {
+    mariadb -h $VIP -P$DATABASE_PORT -u$DATABASE_USER -p$DATABASE_PASSWORD -e 'SHOW TABLES'
+}
+
+function test_proxysql {
+    test_proxysql_connection_logged > /tmp/logs/ansible/test-proxysql 2>&1
+    result=$?
+    echo $result
+    if [[ $result != 0 ]]; then
+        echo "Testing ProxySQL failed. See ansible/test-proxysql for details"
+    else
+        echo "Successfully tested ProxySQL. See ansible/test-proxysql for details"
+    fi
+    return $result
+}
+function test_proxysql_ssl_connection {
+    query="SELECT SUBSTRING_INDEX(variable_value, ',', -1) AS '' FROM information_schema.session_status WHERE variable_name = 'Ssl_cipher' LIMIT 1;"
+    result=$(mariadb -h $VIP -P$DATABASE_PORT -u$DATABASE_USER -p$DATABASE_PASSWORD -e "$query" --silent)
+    echo $result
+    if [[ "$result" =~ ^[[:space:]]*$ || -z "${result}" ]]; then
+        echo "ERROR: SSL is not utilized in ProxySQL"
+        return 1
+    else
+        echo "SSL connection is working properly in proxysql"
+        return 0
+    fi
+
+}
+
+DATABASE_PORT="${DATABASE_PORT:-3306}"
+DATABASE_USER="${DATABASE_USER:-root_shard_0}"
+TLS_ENABLED="${TLS_ENABLED:-false}"
+if [[ -z "${VIP}"  ]]; then
+    echo "VIP  not set"
+    exit 1
+fi
+
+if [[ -z "${DATABASE_PASSWORD}"  ]]; then
+    DATABASE_PASSWORD=$(grep ^database_password /etc/kolla/passwords.yml | cut -d" " -f2)
+fi
+
+test_proxysql
+if [ "$TLS_ENABLED" = true ]; then
+    test_proxysql_ssl_connection
+fi
+
+
+