Merge "Add support for LetsEncrypt-managed certs"

5 files changed, 88 insertions, 5 deletions

diff --git a/tests/deploy.sh b/tests/deploy.sh
index 7405d43a3..ca419c9df 100755
--- a/tests/deploy.sh
+++ b/tests/deploy.sh
@@ -6,18 +6,63 @@ set -o errexit
 # Enable unbuffered output for Ansible in Jenkins.
 export PYTHONUNBUFFERED=1
 
+function init_pebble {
 
-function deploy {
-    RAW_INVENTORY=/etc/kolla/inventory
+    sudo echo "[i] Pulling letsencrypt/pebble" > /tmp/logs/ansible/certificates
+    sudo docker pull letsencrypt/pebble &>> /tmp/logs/ansible/certificates
+
+    sudo echo "[i] Force removing old pebble container" &>> /tmp/logs/ansible/certificates
+    sudo docker rm -f pebble &>> /tmp/logs/ansible/certificates
+
+    sudo echo "[i] Run new pebble container" &>> /tmp/logs/ansible/certificates
+    sudo docker run --name pebble --rm -d -e "PEBBLE_VA_NOSLEEP=1" -e "PEBBLE_VA_ALWAYS_VALID=1" --net=host letsencrypt/pebble &>> /tmp/logs/ansible/certificates
+
+    sudo echo "[i] Wait for pebble container be up" &>> /tmp/logs/ansible/certificates
+    # wait until pebble starts
+    while ! sudo docker logs pebble | grep -q "Listening on"; do
+        sleep 1
+    done
+    sudo echo "[i] Wait for pebble container done" &>> /tmp/logs/ansible/certificates
+
+    sudo echo "[i] Pebble container logs" &>> /tmp/logs/ansible/certificates
+    sudo docker logs pebble &>> /tmp/logs/ansible/certificates
+}
+
+function pebble_cacert {
 
+    sudo docker cp pebble:/test/certs/pebble.minica.pem /etc/kolla/certificates/ca/pebble-root.crt
+    sudo curl -k -s -o /etc/kolla/certificates/ca/pebble.crt -v https://127.0.0.1:15000/roots/0
+}
+
+function certificates {
+
+    RAW_INVENTORY=/etc/kolla/inventory
     source $KOLLA_ANSIBLE_VENV_PATH/bin/activate
 
-    #TODO(inc0): Post-deploy complains that /etc/kolla is not writable. Probably we need to include become there
-    sudo chmod -R 777 /etc/kolla
     # generate self-signed certificates for the optional internal TLS tests
     if [[ "$TLS_ENABLED" = "True" ]]; then
         kolla-ansible -i ${RAW_INVENTORY} -vvv certificates > /tmp/logs/ansible/certificates
     fi
+    if [[ "$LE_ENABLED" = "True" ]]; then
+        init_pebble
+        pebble_cacert
+    fi
+
+    #TODO(inc0): Post-deploy complains that /etc/kolla is not writable. Probably we need to include become there
+    sudo chmod -R 777 /etc/kolla
+}
+
+
+function deploy {
+
+    RAW_INVENTORY=/etc/kolla/inventory
+    source $KOLLA_ANSIBLE_VENV_PATH/bin/activate
+
+    #TODO(inc0): Post-deploy complains that /etc/kolla is not writable. Probably we need to include become there
+    sudo chmod -R 777 /etc/kolla
+
+    certificates
+
     # Actually do the deployment
     kolla-ansible -i ${RAW_INVENTORY} -vvv prechecks &> /tmp/logs/ansible/deploy-prechecks
     kolla-ansible -i ${RAW_INVENTORY} -vvv pull &> /tmp/logs/ansible/pull
diff --git a/tests/run.yml b/tests/run.yml
index a396c8573..bf5217839 100644
--- a/tests/run.yml
+++ b/tests/run.yml
@@ -21,11 +21,12 @@
         need_build_image: "{{ kolla_build_images | default(false) }}"
         build_image_tag: "change_{{ zuul.change | default('none') }}"
         openstack_core_enabled: "{{ openstack_core_enabled }}"
-        openstack_core_tested: "{{ scenario in ['core', 'cephadm', 'zun', 'cells', 'swift', 'ovn'] }}"
+        openstack_core_tested: "{{ scenario in ['core', 'cephadm', 'zun', 'cells', 'swift', 'ovn', 'lets-encrypt'] }}"
         dashboard_enabled: "{{ openstack_core_enabled }}"
         upper_constraints_file: "{{ ansible_env.HOME }}/src/opendev.org/openstack/requirements/upper-constraints.txt"
         docker_image_tag_suffix: "{{ '-aarch64' if ansible_architecture == 'aarch64' else '' }}"
         kolla_ansible_venv_path: "{{ ansible_env.HOME }}/kolla-ansible-venv"
+        kolla_internal_fqdn: "kolla.example.com"
 
     - name: Install dig for Designate testing
       become: true
@@ -46,6 +47,18 @@
       vars:
         disk_type: "{{ 'ceph-lvm' if scenario in ['cephadm'] else scenario }}"
 
+    - name: Update /etc/hosts with internal API FQDN
+      blockinfile:
+        dest: /etc/hosts
+        marker: "# {mark} ANSIBLE GENERATED INTERNAL API FQDN"
+        block: |
+          {{ kolla_internal_vip_address }} {{ kolla_internal_fqdn }}
+          192.0.2.1 pebble
+      become: True
+      when:
+        - scenario == "lets-encrypt"
+
+
 - hosts: primary
   any_errors_fatal: true
   vars:
@@ -397,6 +410,7 @@
             chdir: "{{ kolla_ansible_src_dir }}"
           environment:
             TLS_ENABLED: "{{ tls_enabled }}"
+            LE_ENABLED: "{{ le_enabled }}"
             KOLLA_ANSIBLE_VENV_PATH: "{{ kolla_ansible_venv_path }}"
             HAS_UPGRADE: "{{ is_upgrade | bool | ternary('yes', 'no') }}"
 
@@ -410,6 +424,7 @@
             chdir: "{{ kolla_ansible_src_dir }}"
           environment:
             TLS_ENABLED: "{{ tls_enabled }}"
+            LE_ENABLED: "{{ le_enabled }}"
           when: dashboard_enabled
 
         - name: Run init-core-openstack.sh script
diff --git a/tests/setup_gate.sh b/tests/setup_gate.sh
index 5ace11236..7dc9c92a9 100755
--- a/tests/setup_gate.sh
+++ b/tests/setup_gate.sh
@@ -94,6 +94,10 @@ function prepare_images {
         GATE_IMAGES="^cron,^fluentd,^haproxy,^keepalived,^kolla-toolbox,^mariadb"
     fi
 
+    if [[ $SCENARIO == "lets-encrypt" ]]; then
+        GATE_IMAGES+=",^letsencrypt,^haproxy"
+    fi
+
     if [[ $SCENARIO == "prometheus-opensearch" ]]; then
         GATE_IMAGES="^cron,^fluentd,^grafana,^haproxy,^keepalived,^kolla-toolbox,^mariadb,^memcached,^opensearch,^prometheus,^rabbitmq"
     fi
diff --git a/tests/templates/globals-default.j2 b/tests/templates/globals-default.j2
index 09f3806d9..86cdb67f4 100644
--- a/tests/templates/globals-default.j2
+++ b/tests/templates/globals-default.j2
@@ -208,3 +208,13 @@ keepalived_track_script_enabled: "no"
 neutron_modules_extra:
   - name: 'nf_conntrack_tftp'
   - name: 'nf_nat_tftp'
+
+{% if scenario == "lets-encrypt" %}
+enable_letsencrypt: "yes"
+rabbitmq_enable_tls: "yes"
+letsencrypt_email: "usero@openstack.test"
+letsencrypt_cert_server: "https://pebble:14000/dir"
+kolla_internal_fqdn: "{{ kolla_internal_fqdn }}"
+kolla_enable_tls_backend: "no"
+kolla_admin_openrc_cacert: "{% raw %}{{ kolla_certificates_dir }}{% endraw %}/ca/pebble.crt"
+{% endif %}
diff --git a/tests/templates/inventory.j2 b/tests/templates/inventory.j2
index 468e09562..e4c33c08c 100644
--- a/tests/templates/inventory.j2
+++ b/tests/templates/inventory.j2
@@ -258,6 +258,9 @@ control
 [venus:children]
 monitoring
 
+[letsencrypt:children]
+loadbalancer
+
 # Additional control implemented here. These groups allow you to control which
 # services run on which hosts at a per-service level.
 #
@@ -749,3 +752,9 @@ venus
 
 [venus-manager:children]
 venus
+
+[letsencrypt-webserver:children]
+letsencrypt
+
+[letsencrypt-lego:children]
+letsencrypt