From 804c1cb669756abd512477263269def90ba3e077 Mon Sep 17 00:00:00 2001 From: Mark Goddard Date: Thu, 9 Jun 2022 15:31:22 +0100 Subject: [PATCH] docs: add information about enabling TLS to automated guide It only covers the internal API VIP, since we don't have a separate external API in the development environment. Change-Id: I28f2b43ddb8bad6097e690e766f0348b1b8a296b --- doc/source/contributor/automated.rst | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/doc/source/contributor/automated.rst b/doc/source/contributor/automated.rst index c0e7cc657..4383f0556 100644 --- a/doc/source/contributor/automated.rst +++ b/doc/source/contributor/automated.rst @@ -81,6 +81,30 @@ This can be added using the following commands:: sudo ip l set eth1 up sudo ip l set eth1 master breth1 +Configuration +------------- + +Enable TLS +^^^^^^^^^^ + +Apply the following configuration if you wish to enable TLS for the OpenStack +API: + +Set the following option in ``config/src/kayobe-config/etc/kayobe/kolla.yml``: + +.. code-block:: yaml + + kolla_enable_tls_internal: "yes" + +Set the following options in +``config/src/kayobe-config/etc/kayobe/kolla/globals.yml``: + +.. code-block:: yaml + + kolla_copy_ca_into_containers: "yes" + openstack_cacert: "{% if os_distribution == 'ubuntu' %}/etc/ssl/certs/ca-certificates.crt{% else %}/etc/pki/tls/certs/ca-bundle.crt{% endif %}" + kolla_admin_openrc_cacert: "{% if os_distribution == 'ubuntu' %}/etc/ssl/certs/ca-certificates.crt{% else %}/etc/pki/tls/certs/ca-bundle.crt{% endif %}" + Usage ----- @@ -101,6 +125,10 @@ its dependencies in a Python virtual environment:: changes will not been seen until you reinstall the package. To do this you can run ``./dev/install.sh``. +If you are using TLS and wish to generate self-signed certificates:: + + export KAYOBE_OVERCLOUD_GENERATE_CERTIFICATES=1 + Run the ``dev/overcloud-deploy.sh`` script to deploy the OpenStack control plane::