Add TLS support to swift backends

By overriding the variable `swift_backend_ssl: True` HTTPS will
be enabled, disabling HTTP support on the swift backend api.

The ansible-role-pki is used to generate the required TLS
certificates if this functionality is enabled.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085
Change-Id: Idb7882775a90ada9bb9e1450168916c73bf8ae4b

defaults/main.yml

@@ -520,3 +520,54 @@ swift_object_server_conf_overrides: {}
 swift_object_expirer_conf_overrides: {}
 swift_object_server_replicator_conf_overrides: {}
 swift_memcache_conf_overrides: {}
+
+###
+### Backend TLS
+###
+
+# Define if communication between haproxy and service backends should be
+# encrypted with TLS.
+# `openstack_service_backend_ssl` is not taken into account
+# because TLS in swift-proxy is only for testing purposes:
+# https://opendev.org/openstack/swift/src/commit/c78a5962b5f6c9e75f154cac924a226815236e98/etc/proxy-server.conf-sample
+swift_backend_ssl: False
+
+# Storage location for SSL certificate authority
+swift_pki_dir: "{{ openstack_pki_dir | default('/etc/openstack_deploy/pki') }}"
+
+# Delegated host for operating the certificate authority
+swift_pki_setup_host: "{{ openstack_pki_setup_host | default('localhost') }}"
+
+# swift server certificate
+swift_pki_keys_path: "{{ swift_pki_dir ~ '/certs/private/' }}"
+swift_pki_certs_path: "{{ swift_pki_dir ~ '/certs/certs/' }}"
+swift_pki_intermediate_cert_name: "{{ openstack_pki_service_intermediate_cert_name | default('ExampleCorpIntermediate') }}"
+swift_pki_regen_cert: ''
+swift_pki_san: "{{ openstack_pki_san | default('DNS:' ~ ansible_facts['hostname'] ~ ',IP:' ~ management_address) }}"
+swift_pki_certificates:
+  - name: "swift_{{ ansible_facts['hostname'] }}"
+    provider: ownca
+    cn: "{{ ansible_facts['hostname'] }}"
+    san: "{{ swift_pki_san }}"
+    signed_by: "{{ swift_pki_intermediate_cert_name }}"
+
+# swift destination files for SSL certificates
+swift_ssl_cert: /etc/swift/swift.pem
+swift_ssl_key: /etc/swift/swift.key
+
+# Installation details for SSL certificates
+swift_pki_install_certificates:
+  - src: "{{ swift_user_ssl_cert | default(swift_pki_certs_path ~ 'swift_' ~ ansible_facts['hostname'] ~ '-chain.crt') }}"
+    dest: "{{ swift_ssl_cert }}"
+    owner: "{{ swift_system_user_name }}"
+    group: "{{ swift_system_user_name }}"
+    mode: "0644"
+  - src: "{{ swift_user_ssl_key | default(swift_pki_keys_path ~ 'swift_' ~ ansible_facts['hostname'] ~ '.key.pem') }}"
+    dest: "{{ swift_ssl_key }}"
+    owner: "{{ swift_system_user_name }}"
+    group: "{{ swift_system_user_name }}"
+    mode: "0600"
+
+# Define user-provided SSL certificates
+#swift_user_ssl_cert: <path to cert on ansible deployment host>
+#swift_user_ssl_key: <path to cert on ansible deployment host>

handlers/main.yml

@@ -23,6 +23,7 @@
   listen:
     - "venv changed"
     - "systemd service changed"
+    - "cert installed"
 
 - name: Restart rsync service
   service:

tasks/swift_proxy_hosts.yml

@@ -13,6 +13,26 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+- name: Create and install SSL certificates
+  include_role:
+    name: pki
+    tasks_from: main_certs.yml
+    apply:
+      tags:
+        - swift-config
+        - pki
+  vars:
+    pki_setup_host: "{{ swift_pki_setup_host }}"
+    pki_dir: "{{ swift_pki_dir }}"
+    pki_create_certificates: "{{ swift_user_ssl_cert is not defined and placement_user_ssl_key is not defined }}"
+    pki_regen_cert: "{{ swift_pki_regen_cert }}"
+    pki_certificates: "{{ swift_pki_certificates }}"
+    pki_install_certificates: "{{ swift_pki_install_certificates }}"
+  when:
+    - swift_backend_ssl
+  tags:
+    - always
+
 - name: swift proxy server configuration
   openstack.config_template.config_template:
     src: "proxy-server.conf.j2"

templates/proxy-server.conf.j2

@@ -6,6 +6,10 @@ use_stderr = False
 bind_ip = {{ swift_proxy_bind_address }}
 bind_port = {{ swift_proxy_port }}
 workers = {{ swift_proxy_server_workers }}
+{% if swift_backend_ssl | bool %}
+cert_file = {{ swift_ssl_cert }}
+key_file = {{ swift_ssl_key }}
+{% endif %}
 
 user = {{ swift_system_user_name }}