diff options
| author | Dave McCowan <dmccowan@cisco.com> | 2016-02-29 13:51:11 -0500 |
|---|---|---|
| committer | Dave McCowan <dmccowan@cisco.com> | 2016-03-03 14:44:37 -0500 |
| commit | 3daded62427a1eda9998865b413c2a03210e4592 (patch) | |
| tree | db11f3d02fbac7baf41df9cf906c7584121a1655 /etc | |
| parent | a94d537aab661cc9214ed27a9cabef81444e3650 (diff) | |
| download | kolla-3daded62427a1eda9998865b413c2a03210e4592.tar.gz kolla-3daded62427a1eda9998865b413c2a03210e4592.zip | |
Add TLS protection on external API endpoints
TLS can be used to encrypt and authenticate the connection with
OpenStack endpoints. This patch provides the necessary
parameters and changes the resulting service configurations to
enable TLS for the Kolla deployed OpenStack cloud.
The new input parameters are:
kolla_enable_tls_external: "yes" or "no" (default is "no")
kolla_external_fqdn_cert: "/etc/kolla/certificates/haproxy.pem"
kolla_external_fqdn_cacert: "/etc/kolla/certificates/haproxy-ca.crt"
Implements: blueprint kolla-ssl
Change-Id: I48ef8a781c3035d58817f9bf6f36d59a488bab41
Diffstat (limited to 'etc')
| -rw-r--r-- | etc/kolla/globals.yml | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/etc/kolla/globals.yml b/etc/kolla/globals.yml index 44f72ead7..a505b3830 100644 --- a/etc/kolla/globals.yml +++ b/etc/kolla/globals.yml @@ -73,6 +73,17 @@ neutron_external_interface: "eth1" #################### +# TLS options +#################### +# To provide encryption and authentication on the kolla_external_vip_interface, +# TLS can be enabled. When TLS is enabled, certificates must be provided to +# allow clients to perform authentication. The default is TLS disabled. +# kolla_enable_tls_external: "yes" +# kolla_external_fqdn_cert: "{{ node_config_directory }}/certificates/haproxy.pem" +# kolla_external_fqdn_cacert: "{{ node_config_directory }}/certificates/haproxy-ca.crt" + + +#################### # OpenStack options #################### # Use these options to set the various log levels across all OpenStack projects |