diff options
Diffstat (limited to 'ansible')
4 files changed, 35 insertions, 1 deletions
diff --git a/ansible/roles/certificates/tasks/generate.yml b/ansible/roles/certificates/tasks/generate.yml index 7715487f3..3b130b473 100644 --- a/ansible/roles/certificates/tasks/generate.yml +++ b/ansible/roles/certificates/tasks/generate.yml @@ -59,6 +59,14 @@ - letsencrypt_managed_certs == 'internal' or letsencrypt_managed_certs == '' - kolla_enable_tls_external | bool +# ProxySQL frontend TLS (database internal TLS) needs separate CA file +- name: Copy CA certificate for ProxySQL + ansible.builtin.copy: + src: "{{ certificates_root_dir }}/root.crt" + dest: "{{ kolla_certificates_dir }}/proxysql-ca.pem" + mode: "0660" + when: database_enable_tls_internal | bool + - name: Copy external certificates for ProxySQL when: - database_enable_tls_internal | bool diff --git a/ansible/roles/loadbalancer/tasks/config.yml b/ansible/roles/loadbalancer/tasks/config.yml index cf1840478..543bea860 100644 --- a/ansible/roles/loadbalancer/tasks/config.yml +++ b/ansible/roles/loadbalancer/tasks/config.yml @@ -48,6 +48,18 @@ become: true when: service | service_enabled_and_mapped_to_host +- name: Check if separate database internal TLS CA certificate (proxysql-ca.pem) exists + vars: + service: "{{ loadbalancer_services['proxysql'] }}" + ansible.builtin.stat: + path: "{{ kolla_certificates_dir }}/proxysql-ca.pem" + delegate_to: localhost + register: proxysql_ca_file + changed_when: false + run_once: true + when: + - service | service_enabled_and_mapped_to_host + - name: Remove mariadb.cfg if proxysql enabled vars: service: "{{ loadbalancer_services['keepalived'] }}" diff --git a/ansible/roles/loadbalancer/tasks/copy-certs.yml b/ansible/roles/loadbalancer/tasks/copy-certs.yml index 0bf3307f7..501e4ec05 100644 --- a/ansible/roles/loadbalancer/tasks/copy-certs.yml +++ b/ansible/roles/loadbalancer/tasks/copy-certs.yml @@ -31,6 +31,20 @@ with_items: - "haproxy-internal.pem" +- name: Copying over proxysql-ca.pem + vars: + service: "{{ loadbalancer_services['proxysql'] }}" + ansible.builtin.copy: + src: "{{ kolla_certificates_dir }}/proxysql-ca.pem" + dest: "{{ node_config_directory }}/proxysql/proxysql-ca.pem" + mode: "0660" + become: true + when: + - database_enable_tls_internal | bool + - service | service_enabled_and_mapped_to_host + - proxysql_ca_file.stat.exists + - not kolla_externally_managed_cert | bool + - name: Copying over proxysql-cert.pem vars: service: "{{ loadbalancer_services['proxysql'] }}" diff --git a/ansible/roles/loadbalancer/templates/proxysql/proxysql.json.j2 b/ansible/roles/loadbalancer/templates/proxysql/proxysql.json.j2 index f720f18e0..2dfcccc8d 100644 --- a/ansible/roles/loadbalancer/templates/proxysql/proxysql.json.j2 +++ b/ansible/roles/loadbalancer/templates/proxysql/proxysql.json.j2 @@ -52,7 +52,7 @@ }{% endif %} {% if database_enable_tls_internal | bool %}, { - "source": "{{ container_config_directory }}/ca-certificates/root.crt", + "source": "{{ container_config_directory }}/{{ 'proxysql-ca.pem' if proxysql_ca_file.stat.exists else 'ca-certificates/root.crt' }}", "dest": "/var/lib/proxysql/proxysql-ca.pem", "owner": "proxysql", "perm": "0600" |