aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--ansible/module_utils/kolla_docker_worker.py4
-rw-r--r--ansible/roles/common/templates/kolla-toolbox.json.j242
-rw-r--r--ansible/roles/mariadb/tasks/copy-certs.yml10
-rw-r--r--ansible/roles/mariadb/templates/backup.my.cnf.j23
-rw-r--r--ansible/roles/mariadb/templates/mariabackup.json.j27
-rw-r--r--ansible/roles/service-uwsgi-config/defaults/main.yml1
-rw-r--r--ansible/roles/service-uwsgi-config/templates/uwsgi.ini.j23
-rw-r--r--doc/source/reference/networking/neutron.rst8
-rw-r--r--tests/kolla_container_tests/test_docker_worker.py60
-rw-r--r--tests/pre.yml11
-rw-r--r--tests/templates/globals-default.j24
11 files changed, 105 insertions, 48 deletions
diff --git a/ansible/module_utils/kolla_docker_worker.py b/ansible/module_utils/kolla_docker_worker.py
index f488bab66..db41d5599 100644
--- a/ansible/module_utils/kolla_docker_worker.py
+++ b/ansible/module_utils/kolla_docker_worker.py
@@ -41,8 +41,8 @@ class DockerWorker(ContainerWorker):
def generate_tls(self):
tls = {'verify': self.params.get('tls_verify')}
- tls_cert = self.params.get('tls_cert'),
- tls_key = self.params.get('tls_key'),
+ tls_cert = self.params.get('tls_cert')
+ tls_key = self.params.get('tls_key')
tls_cacert = self.params.get('tls_cacert')
if tls['verify']:
diff --git a/ansible/roles/common/templates/kolla-toolbox.json.j2 b/ansible/roles/common/templates/kolla-toolbox.json.j2
deleted file mode 100644
index 366e3586b..000000000
--- a/ansible/roles/common/templates/kolla-toolbox.json.j2
+++ /dev/null
@@ -1,42 +0,0 @@
-{
- "command": "kolla_toolbox",
- "config_files": [
- {
- "source": "{{ container_config_directory }}/clouds.yaml",
- "dest": "/var/lib/ansible/.config/openstack/clouds.yaml",
- "owner": "ansible",
- "perm": "0600"
- }{% if enable_rabbitmq | bool %},
- {
- "source": "{{ container_config_directory }}/rabbitmq-erlang.cookie",
- "dest": "/var/lib/rabbitmq/.erlang.cookie",
- "owner": "rabbitmq",
- "perm": "0600"
- },
- {
- "source": "{{ container_config_directory }}/rabbitmq-env.conf",
- "dest": "/etc/rabbitmq/rabbitmq-env.conf",
- "owner": "rabbitmq",
- "perm": "0600"
- },
- {
- "source": "{{ container_config_directory }}/erl_inetrc",
- "dest": "/etc/rabbitmq/erl_inetrc",
- "owner": "rabbitmq",
- "perm": "0600"
- }{% endif %}{% if kolla_copy_ca_into_containers | bool %},
- {
- "source": "{{ container_config_directory }}/ca-certificates",
- "dest": "/var/lib/kolla/share/ca-certificates",
- "owner": "root",
- "perm": "0644"
- }{% endif %}
- ],
- "permissions": [
- {
- "path": "/var/log/kolla/ansible.log",
- "perm": "0664",
- "owner": "ansible:kolla"
- }
- ]
-}
diff --git a/ansible/roles/mariadb/tasks/copy-certs.yml b/ansible/roles/mariadb/tasks/copy-certs.yml
index 1c385e6d1..368df9302 100644
--- a/ansible/roles/mariadb/tasks/copy-certs.yml
+++ b/ansible/roles/mariadb/tasks/copy-certs.yml
@@ -1,4 +1,14 @@
---
+- name: "Copy CA certificates for mariabackup"
+ become: true
+ ansible.builtin.copy:
+ src: "{{ kolla_certificates_dir }}/ca/"
+ dest: "{{ node_config_directory }}/mariabackup/ca-certificates"
+ mode: "0644"
+ when:
+ - enable_mariabackup | bool
+ - inventory_hostname == mariadb_backup_host
+
- name: "Copy certificates and keys for {{ project_name }}"
ansible.builtin.import_role:
role: service-cert-copy
diff --git a/ansible/roles/mariadb/templates/backup.my.cnf.j2 b/ansible/roles/mariadb/templates/backup.my.cnf.j2
index 8d1ae2593..30065f4bd 100644
--- a/ansible/roles/mariadb/templates/backup.my.cnf.j2
+++ b/ansible/roles/mariadb/templates/backup.my.cnf.j2
@@ -4,3 +4,6 @@ user={{ mariadb_backup_database_user }}
password={{ mariadb_backup_database_password }}
host={{ api_interface_address }}
port={{ mariadb_port }}
+{% if database_enable_tls_backend | bool %}
+ssl_ca=/etc/mariadb/certs/root.crt
+{% endif %}
diff --git a/ansible/roles/mariadb/templates/mariabackup.json.j2 b/ansible/roles/mariadb/templates/mariabackup.json.j2
index ff32de2b6..7444364a6 100644
--- a/ansible/roles/mariadb/templates/mariabackup.json.j2
+++ b/ansible/roles/mariadb/templates/mariabackup.json.j2
@@ -7,6 +7,13 @@
"owner": "mysql",
"perm": "0600"
}
+ {% if database_enable_tls_backend | bool %},
+ {
+ "source": "{{ container_config_directory }}/ca-certificates/root.crt",
+ "dest": "/etc/mariadb/certs/root.crt",
+ "owner": "mysql",
+ "perm": "0600"
+ }{% endif %}
],
"permissions": [
{
diff --git a/ansible/roles/service-uwsgi-config/defaults/main.yml b/ansible/roles/service-uwsgi-config/defaults/main.yml
index 9c5e13ed3..e5a452dc4 100644
--- a/ansible/roles/service-uwsgi-config/defaults/main.yml
+++ b/ansible/roles/service-uwsgi-config/defaults/main.yml
@@ -7,3 +7,4 @@ service_uwsgi_config_socket_port: ""
service_uwsgi_config_tls_backend: false
service_uwsgi_config_worker_timeout: 80
service_uwsgi_config_workers: "{{ openstack_service_workers }}"
+service_uwsgi_config_env: {}
diff --git a/ansible/roles/service-uwsgi-config/templates/uwsgi.ini.j2 b/ansible/roles/service-uwsgi-config/templates/uwsgi.ini.j2
index e8873eefc..1095aa1fc 100644
--- a/ansible/roles/service-uwsgi-config/templates/uwsgi.ini.j2
+++ b/ansible/roles/service-uwsgi-config/templates/uwsgi.ini.j2
@@ -46,3 +46,6 @@ uid = {{ service_uwsgi_config_uid }}
{% endif %}
worker-reload-mercy = {{ service_uwsgi_config_worker_timeout }}
static-map = /static=/var/lib/kolla/venv/lib/python3/site-packages/static
+{% for key, value in service_uwsgi_config_env.items() %}
+env = {{ key }}={{ value }}
+{% endfor %}
diff --git a/doc/source/reference/networking/neutron.rst b/doc/source/reference/networking/neutron.rst
index b4f7a884f..46b565ba8 100644
--- a/doc/source/reference/networking/neutron.rst
+++ b/doc/source/reference/networking/neutron.rst
@@ -25,10 +25,10 @@ value is ``eth1``. These external interfaces are used by hosts in the
``network`` group. They are also used by hosts in the ``compute`` group if
``enable_neutron_provider_networks`` is set or DVR is enabled.
-The external interfaces are each plugged into a bridge (Open vSwitch or Linux
-Bridge, depending on the driver) defined by ``neutron_bridge_name``, which
-defaults to ``br-ex``. When there are multiple external interfaces,
-``neutron_bridge_name`` should be a comma-separated list of the same length.
+The external interfaces are each plugged into an Open vSwitch bridge defined by
+``neutron_bridge_name``, which defaults to ``br-ex``. When there are multiple
+external interfaces, ``neutron_bridge_name`` should be a comma-separated list
+of the same length.
The default Neutron physical network is ``physnet1``, or ``physnet1`` to
``physnetN`` when there are multiple external network interfaces. This may be
diff --git a/tests/kolla_container_tests/test_docker_worker.py b/tests/kolla_container_tests/test_docker_worker.py
index e32da66cb..90f1a2d41 100644
--- a/tests/kolla_container_tests/test_docker_worker.py
+++ b/tests/kolla_container_tests/test_docker_worker.py
@@ -1161,6 +1161,66 @@ class TestVolume(base.BaseTestCase):
)
+class TestTLS(base.BaseTestCase):
+
+ @mock.patch('docker.tls.TLSConfig')
+ def test_tls_disabled_by_default(self, mock_tls_config):
+ self.dw = get_DockerWorker({'name': 'test_container'})
+ self.dw.generate_tls()
+ mock_tls_config.assert_called_once_with(verify=None)
+
+ @mock.patch('docker.tls.TLSConfig')
+ def test_tls_verify_enabled_no_certs(self, mock_tls_config):
+ self.dw = get_DockerWorker({
+ 'name': 'test_container',
+ 'tls_verify': True})
+ self.dw.generate_tls()
+ mock_tls_config.assert_called_once_with(verify=True)
+
+ @mock.patch('os.path.isfile', return_value=True)
+ @mock.patch('os.access', return_value=True)
+ @mock.patch('docker.tls.TLSConfig')
+ def test_tls_verify_with_client_cert_and_key(self, mock_tls_config,
+ mock_access, mock_isfile):
+ self.dw = get_DockerWorker({
+ 'name': 'test_container',
+ 'tls_verify': True,
+ 'tls_cert': '/path/to/cert.pem',
+ 'tls_key': '/path/to/key.pem'})
+ self.dw.generate_tls()
+ mock_tls_config.assert_called_once_with(
+ verify=True,
+ client_cert=('/path/to/cert.pem', '/path/to/key.pem'))
+
+ @mock.patch('os.path.isfile', return_value=True)
+ @mock.patch('os.access', return_value=True)
+ @mock.patch('docker.tls.TLSConfig')
+ def test_tls_verify_with_cacert(self, mock_tls_config,
+ mock_access, mock_isfile):
+ self.dw = get_DockerWorker({
+ 'name': 'test_container',
+ 'tls_verify': True,
+ 'tls_cacert': '/path/to/ca.pem'})
+ self.dw.generate_tls()
+ mock_tls_config.assert_called_once_with(
+ verify='/path/to/ca.pem')
+
+ @mock.patch('os.path.isfile', return_value=False)
+ @mock.patch('os.access', return_value=True)
+ @mock.patch('docker.tls.TLSConfig')
+ def test_tls_verify_cert_file_missing_fails(self, mock_tls_config,
+ mock_access, mock_isfile):
+ self.dw = get_DockerWorker({
+ 'name': 'test_container',
+ 'tls_verify': True,
+ 'tls_cert': '/missing/cert.pem',
+ 'tls_key': '/missing/key.pem'})
+ self.dw.generate_tls()
+ self.dw.module.fail_json.assert_any_call(
+ failed=True,
+ msg='There is no file at "/missing/cert.pem"')
+
+
class TestAttrComp(base.BaseTestCase):
def setUp(self):
diff --git a/tests/pre.yml b/tests/pre.yml
index a8c17bbcd..be8df89b9 100644
--- a/tests/pre.yml
+++ b/tests/pre.yml
@@ -65,6 +65,17 @@
state: present
when: ansible_facts.distribution == "Rocky"
+ # TODO(mnasiadka): prefer IPv4 over IPv6 in getaddrinfo() to avoid
+ # slow/failing AAAA lookups against hosts without real IPv6
+ # connectivity. Remove once IPv6 in VexxHost ca-ymq-1 is reliable.
+ - name: Prefer IPv4 over IPv6 for name resolution
+ become: true
+ ansible.builtin.lineinfile:
+ path: /etc/gai.conf
+ line: "precedence ::ffff:0:0/96 100"
+ create: true
+ when: nodepool.region == 'ca-ymq-1'
+
# NOTE(yoctozepto): we use gawk to add time to each logged line
# outside of Ansible (e.g. for init-runonce)
- name: Install gawk and required Python modules
diff --git a/tests/templates/globals-default.j2 b/tests/templates/globals-default.j2
index 1a0d1a01c..867b67aba 100644
--- a/tests/templates/globals-default.j2
+++ b/tests/templates/globals-default.j2
@@ -11,8 +11,12 @@ network_address_family: "{{ address_family }}"
kolla_container_engine: "{{ container_engine }}"
docker_restart_policy: "no"
+# TODO(bbezak): Drop the condition once the mirror in VexxHost ca-ymq-1 is
+# reliable.
+{% if nodepool.region != 'ca-ymq-1' %}
docker_apt_url: "http://{{ zuul_site_mirror_fqdn }}:8080/docker/{{ ansible_facts.distribution | lower }}"
docker_yum_url: "http://{{ zuul_site_mirror_fqdn }}:8080/docker/centos"
+{% endif %}
{% if container_engine == 'podman' %}
podman_debug: true
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 14:54:18 +0000