Role os_keystone for OpenStack-Ansible
63682ef211
In I4456bc1a0056da051947977a26dd6d57c549e421 we hardened Keystone's Apache SSL settings. In order to keep all Apache SSL settings uniformly configured, we also need to update Horizon's settings and centralize where we define the cipher suite that the server supports and the preferred protocol versions. We also explicitly disable SSLCompression even though we tend to only test against versions of Apache that have this off by default. If someone uses a version after 2.2.24 or uses 2.4.3, they would otherwise have to explicitly turn this off. Preferring security by default, we disable it explicitly to prevent insecure installations anywhere. We also document how users can override specific service SSL settings in the event one service needs to support older clients that require certain protocols or ciphers. For example, it's very plausible that an organization may need to enable RC4 and SSLv3 for Horizon since their users are still using XP and an old version of Internet Explorer. Related-Bug: 1437481 Change-Id: I85843452935710083253847d6e11f85e9d6d2e84 |
||
|---|---|---|
| defaults | ||
| files | ||
| handlers | ||
| meta | ||
| tasks | ||
| templates | ||
| CONTRIBUTING.rst | ||
| LICENSE | ||
| README.rst | ||
OpenStack keystone
- tags
-
openstack, keystone, cloud, ansible
- category
-
*nix
Role to install keystone. This will install keystone using apache.
- This role will install the following:
-
- keystone
- apache2
- name: Installation and setup of Keystone
hosts: keystone_all
user: root
roles:
- { role: "os_keystone", tags: [ "os-keystone" ] }
vars:
external_lb_vip_address: 172.16.24.1
internal_lb_vip_address: 192.168.0.1
galera_address: "{{ internal_lb_vip_address }}"