9c6682effe
We don't need to use a separate CA chain for these certs, instead it is sufficient to just trust the self-signed cert. Moreover, we have been cheating by copying the same certs and keys to various directories for each service, so instead of bothering with keeping separate certs let's just formalize having a single pair. The cert will be used as its own CA and added to the system trusted certificates. The key still needs to be privately readable by certain system users, so we'll still copy that into the ssl directories for each service. Also, since we'll be changing these keys, make sure they are set up to notify the service they're supporting. Additionally, automate the trusting of our self-signed certs on the compute hosts which previously was done manually. The compute hosts need to be able to use encrypted rabbitmq and make API calls to keystone and neutron. Change-Id: Ibeea608e965e58c496a95b2f02a4bf6b13e15f0e
74 lines
1.8 KiB
Puppet
74 lines
1.8 KiB
Puppet
class infracloud::compute(
|
|
$nova_rabbit_password,
|
|
$neutron_rabbit_password,
|
|
$neutron_admin_password,
|
|
$ssl_cert_file_contents = undef, #TODO: make required
|
|
$br_name,
|
|
$controller_public_address,
|
|
$controller_management_address,
|
|
) {
|
|
|
|
### Certificate Chain ###
|
|
|
|
class { '::infracloud::cacert':
|
|
cacert_content => $ssl_cert_file_contents,
|
|
}
|
|
|
|
### Networking ###
|
|
|
|
class {'::infracloud::veth':
|
|
br_name => $br_name,
|
|
}
|
|
|
|
### Repos ###
|
|
include ::apt
|
|
|
|
class { '::openstack_extras::repo::debian::ubuntu':
|
|
release => 'kilo',
|
|
package_require => true,
|
|
}
|
|
|
|
### Nova ###
|
|
|
|
# nova.conf
|
|
class { '::nova':
|
|
rabbit_userid => 'nova',
|
|
rabbit_password => $nova_rabbit_password,
|
|
rabbit_host => $controller_management_address,
|
|
glance_api_servers => "https://${controller_public_address}:9292",
|
|
}
|
|
|
|
# nova-compute service
|
|
class { '::nova::compute':
|
|
enabled => true,
|
|
}
|
|
|
|
# nova.conf neutron credentials
|
|
class { '::nova::network::neutron':
|
|
neutron_url => "https://${controller_public_address}:9696",
|
|
neutron_admin_auth_url => "https://${controller_public_address}:35357/v2.0",
|
|
neutron_admin_password => $neutron_admin_password,
|
|
}
|
|
|
|
### Neutron ###
|
|
|
|
# neutron.conf
|
|
class { '::neutron':
|
|
rabbit_user => 'neutron',
|
|
rabbit_password => $neutron_rabbit_password,
|
|
rabbit_host => $controller_management_address,
|
|
}
|
|
|
|
# ML2
|
|
class { '::neutron::agents::ml2::linuxbridge':
|
|
physical_interface_mappings => ['provider:veth2'],
|
|
require => Class['infracloud::veth'],
|
|
}
|
|
# Fix for https://bugs.launchpad.net/ubuntu/+source/neutron/+bug/1453188
|
|
file { '/usr/bin/neutron-plugin-linuxbridge-agent':
|
|
ensure => link,
|
|
target => '/usr/bin/neutron-linuxbridge-agent',
|
|
before => Package['neutron-plugin-linuxbridge-agent'],
|
|
}
|
|
}
|