Unnamed repository; edit this file 'description' to name the repository. https://git.platform-os.org/openstack/kolla.git/atom?h=master 2016-11-16T04:34:17+00:00 2016-11-16T04:34:17+00:00 Steven Dake stdake@cisco.com 2016-11-16T02:01:25+00:00 urn:sha1:3fcef82946f7053affcfb0b1b3ef4292beb9fa95 Change-Id: I5396e4b9927d3e65b6aa4185238a43a4765a996b 2016-03-03T19:44:37+00:00 Dave McCowan dmccowan@cisco.com 2016-02-29T18:51:11+00:00 urn:sha1:3daded62427a1eda9998865b413c2a03210e4592 TLS can be used to encrypt and authenticate the connection with OpenStack endpoints. This patch provides the necessary parameters and changes the resulting service configurations to enable TLS for the Kolla deployed OpenStack cloud. The new input parameters are: kolla_enable_tls_external: "yes" or "no" (default is "no") kolla_external_fqdn_cert: "/etc/kolla/certificates/haproxy.pem" kolla_external_fqdn_cacert: "/etc/kolla/certificates/haproxy-ca.crt" Implements: blueprint kolla-ssl Change-Id: I48ef8a781c3035d58817f9bf6f36d59a488bab41 2016-02-26T19:09:31+00:00 Dave McCowan dmccowan@cisco.com 2016-02-20T19:54:41+00:00 urn:sha1:fd2808722950d4a1bdbb8efc60d4e2b6419a72f1 Working towards the blueprint that will add TLS protection for the external endpoints, kolla needs certificates. When kolla deploys OpenStack, the external VIP will need a server side certifcate. Clients that access those endpoints will need the public CA certificate that signed that certificate. This ansible script will create these two certificates to make it easy to use TLS in a test environment. The generated certificate files are: /etc/kolla/certificates/haproxy.pem (server side certificate) /etc/kolla/certificates/haproxy-ca.pem (CA certificate) The generated certificates are not suitable for use in a production environment, but will be useful for testing and verifying operations. Partially-implements: blueprint ssl-kolla Change-Id: I208777f9e5eee3bfb06810c7b18a2727beda234d