27c4d562c8
Openstack-helm provides the option to terminate TLS at the services. However, at Starlingx TLS termination is done at the reverse proxy (ingress) and therefore is unecessary for the OpenStack itself be HTTPS and terminate tls a second time. Furthermore, it is not possible to have https enabled on openstack services with the current centos based containers that we have, openstack-helm only supports tls using debian based containers. Manually working arroud this creates a cumbersome override file, so to diminish this overrides this patch 0020 and 0013(osh-i) disables https at the backend, thus maitaining the same behaviour as stx 5.0 Mariadb and RabbitMQ tls does not seem to be working very well within Starlingx, so we also disable TLS for them. I am not confident that current openstack-helm and openstack-helm-infra supports production level openstack with mariadb in TLS mode. Furthermore, from the way everything is redirected in StarlingX I do see too many performance and stability issues using both of them with tls enabled. Disclaimer I did not test with either only mairiadb tls or rabbitmq activated, but with both of them on the system is not usable. Test Plan: PASS: Openstack is Applied. (https disabled) PASS: enable https. Opensatck is Applied (WITHOUT service.conf overrides) Signed-off-by: Lucas Cavalcante <lucasmedeiros.cavalcante@windriver.com> Change-Id: Ifb7946e9a289234047934b52d200b951a59c1a3f Partial-bug: 1960354 Related-to: https://review.opendev.org/c/starlingx/helm-charts/+/828815
137 lines
3.7 KiB
Diff
137 lines
3.7 KiB
Diff
From d7d223ef40ab11e5c9a00b4b30000f6905885c04 Mon Sep 17 00:00:00 2001
|
|
From: Lucas Cavalcante <lucasmedeiros.cavalcante@windriver.com>
|
|
Date: Wed, 19 Jan 2022 11:54:38 -0300
|
|
Subject: [PATCH] Fix Support for TLS in openstack-helm-infra
|
|
|
|
WIP
|
|
|
|
Signed-off-by: Lucas Cavalcante <lucasmedeiros.cavalcante@windriver.com>
|
|
Change-Id: I382e0fc68c9a92c6a9570097db2c6a959525059d
|
|
---
|
|
.../templates/manifests/_secret-tls.yaml.tpl | 97 +++++++------------
|
|
1 file changed, 33 insertions(+), 64 deletions(-)
|
|
|
|
diff --git a/helm-toolkit/templates/manifests/_secret-tls.yaml.tpl b/helm-toolkit/templates/manifests/_secret-tls.yaml.tpl
|
|
index 24a70450..f34ac527 100644
|
|
--- a/helm-toolkit/templates/manifests/_secret-tls.yaml.tpl
|
|
+++ b/helm-toolkit/templates/manifests/_secret-tls.yaml.tpl
|
|
@@ -15,66 +15,36 @@ limitations under the License.
|
|
{{/*
|
|
abstract: |
|
|
Creates a manifest for a services public tls secret
|
|
-examples:
|
|
- - values: |
|
|
- secrets:
|
|
- tls:
|
|
- key_manager:
|
|
- api:
|
|
- public: barbican-tls-public
|
|
- endpoints:
|
|
- key_manager:
|
|
- host_fqdn_override:
|
|
- public:
|
|
- tls:
|
|
- crt: |
|
|
- FOO-CRT
|
|
- key: |
|
|
- FOO-KEY
|
|
- ca: |
|
|
- FOO-CA_CRT
|
|
- usage: |
|
|
- {{- include "helm-toolkit.manifests.secret_ingress_tls" ( dict "envAll" . "backendServiceType" "key-manager" ) -}}
|
|
- return: |
|
|
- ---
|
|
- apiVersion: v1
|
|
- kind: Secret
|
|
- metadata:
|
|
- name: barbican-tls-public
|
|
- type: kubernetes.io/tls
|
|
- data:
|
|
- tls.key: Rk9PLUtFWQo=
|
|
- tls.crt: Rk9PLUNSVAoKRk9PLUNBX0NSVAo=
|
|
-
|
|
- - values: |
|
|
- secrets:
|
|
- tls:
|
|
- key_manager:
|
|
- api:
|
|
- public: barbican-tls-public
|
|
- endpoints:
|
|
- key_manager:
|
|
- host_fqdn_override:
|
|
- public:
|
|
- tls:
|
|
- crt: |
|
|
- FOO-CRT
|
|
- FOO-INTERMEDIATE_CRT
|
|
- FOO-CA_CRT
|
|
- key: |
|
|
- FOO-KEY
|
|
- usage: |
|
|
- {{- include "helm-toolkit.manifests.secret_ingress_tls" ( dict "envAll" . "backendServiceType" "key-manager" ) -}}
|
|
- return: |
|
|
- ---
|
|
- apiVersion: v1
|
|
- kind: Secret
|
|
- metadata:
|
|
- name: barbican-tls-public
|
|
- type: kubernetes.io/tls
|
|
- data:
|
|
- tls.key: Rk9PLUtFWQo=
|
|
- tls.crt: Rk9PLUNSVApGT08tSU5URVJNRURJQVRFX0NSVApGT08tQ0FfQ1JUCg==
|
|
+values: |
|
|
+ secrets:
|
|
+ tls:
|
|
+ key_manager:
|
|
+ api:
|
|
+ public: barbican-tls-public
|
|
+ endpoints:
|
|
+ key_manager:
|
|
+ host_fqdn_override:
|
|
+ public:
|
|
+ tls:
|
|
+ crt: |
|
|
+ FOO-CRT
|
|
+ key: |
|
|
+ FOO-KEY
|
|
+ ca: |
|
|
+ FOO-CA_CRT
|
|
+usage: |
|
|
+ {{- include "helm-toolkit.manifests.secret_ingress_tls" ( dict "envAll" . "backendServiceType" "key-manager" ) -}}
|
|
+return: |
|
|
+ ---
|
|
+ apiVersion: v1
|
|
+ kind: Secret
|
|
+ metadata:
|
|
+ name: barbican-tls-public
|
|
+ type: kubernetes.io/tls
|
|
+ data:
|
|
+ tls.crt: Rk9PLUNSVAo=
|
|
+ tls.key: Rk9PLUtFWQo=
|
|
+ ca.crt: Rk9PLUNBX0NSVAo=
|
|
*/}}
|
|
|
|
{{- define "helm-toolkit.manifests.secret_ingress_tls" }}
|
|
@@ -95,14 +65,13 @@ metadata:
|
|
name: {{ index $envAll.Values.secrets.tls ( $backendServiceType | replace "-" "_" ) $backendService $endpoint }}
|
|
type: kubernetes.io/tls
|
|
data:
|
|
+ tls.crt: {{ $endpointHost.tls.crt | b64enc }}
|
|
tls.key: {{ $endpointHost.tls.key | b64enc }}
|
|
{{- if $endpointHost.tls.ca }}
|
|
- tls.crt: {{ list $endpointHost.tls.crt $endpointHost.tls.ca | join "\n" | b64enc }}
|
|
-{{- else }}
|
|
- tls.crt: {{ $endpointHost.tls.crt | b64enc }}
|
|
-{{- end }}
|
|
+ ca.crt: {{ $endpointHost.tls.ca | b64enc }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
+{{- end }}
|
|
\ No newline at end of file
|
|
--
|
|
2.17.1
|
|
|