FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

SSL for communication between cinder and rabbitmq · openstack/puppet-cinder@308d098 · GitHub

/ puppet-cinder Public

Commit 308d098

Browse files
Spredzy
authored and
xbezdick
committed
SSL for communication between cinder and rabbitmq
Currently, Cinder can not be configured via Puppet to communicate with rabbitmq using SSL. Most other puppet component already have this feature. This commit enable this feature for Cinder. Conflicts: manifests/init.pp Change-Id: I1525bb1d36d1d49c76e4b42b37ff17f0c5c98f57 (cherry picked from commit 9d081c1)
1 parent 240b119 commit 308d098

2 files changed

Lines changed: 97 additions & 0 deletions

File tree

‎manifests/init.pp‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,28 @@
99
# Timeout when db connections should be reaped.
1010
# (Optional) Defaults to 3600.
1111
#
12+
# [*rabbit_use_ssl*]
13+
# (optional) Connect over SSL for RabbitMQ
14+
# Defaults to false
15+
#
16+
# [*kombu_ssl_ca_certs*]
17+
# (optional) SSL certification authority file (valid only if SSL enabled).
18+
# Defaults to undef
19+
#
20+
# [*kombu_ssl_certfile*]
21+
# (optional) SSL cert file (valid only if SSL enabled).
22+
# Defaults to undef
23+
#
24+
# [*kombu_ssl_keyfile*]
25+
# (optional) SSL key file (valid only if SSL enabled).
26+
# Defaults to undef
27+
#
28+
# [*kombu_ssl_version*]
29+
# (optional) SSL version to use (valid only if SSL enabled).
30+
# Valid values are TLSv1, SSLv23 and SSLv3. SSLv2 may be
31+
# available on some distributions.
32+
# Defaults to 'SSLv3'
33+
#
1234
# [amqp_durable_queues]
1335
# Use durable queues in amqp.
1436
# (Optional) Defaults to false.
@@ -63,6 +85,11 @@
6385
$rabbit_virtual_host = '/',
6486
$rabbit_userid = 'guest',
6587
$rabbit_password = false,
88+
$rabbit_use_ssl = false,
89+
$kombu_ssl_ca_certs = undef,
90+
$kombu_ssl_certfile = undef,
91+
$kombu_ssl_keyfile = undef,
92+
$kombu_ssl_version = 'SSLv3',
6693
$amqp_durable_queues = false,
6794
$qpid_hostname = 'localhost',
6895
$qpid_port = '5672',
@@ -123,6 +150,18 @@
123150
}
124151
}
125152

153+
if $rabbit_use_ssl {
154+
if !$kombu_ssl_ca_certs {
155+
fail('The kombu_ssl_ca_certs parameter is required when rabbit_use_ssl is set to true')
156+
}
157+
if !$kombu_ssl_certfile {
158+
fail('The kombu_ssl_certfile parameter is required when rabbit_use_ssl is set to true')
159+
}
160+
if !$kombu_ssl_keyfile {
161+
fail('The kombu_ssl_keyfile parameter is required when rabbit_use_ssl is set to true')
162+
}
163+
}
164+
126165
# this anchor is used to simplify the graph between cinder components by
127166
# allowing a resource to serve as a point where the configuration of cinder begins
128167
anchor { 'cinder-start': }
@@ -159,6 +198,7 @@
159198
'DEFAULT/rabbit_password': value => $rabbit_password, secret => true;
160199
'DEFAULT/rabbit_userid': value => $rabbit_userid;
161200
'DEFAULT/rabbit_virtual_host': value => $rabbit_virtual_host;
201+
'DEFAULT/rabbit_use_ssl': value => $rabbit_use_ssl;
162202
'DEFAULT/control_exchange': value => $control_exchange;
163203
'DEFAULT/amqp_durable_queues': value => $amqp_durable_queues;
164204
}
@@ -172,6 +212,23 @@
172212
cinder_config { 'DEFAULT/rabbit_hosts': value => "${rabbit_host}:${rabbit_port}" }
173213
cinder_config { 'DEFAULT/rabbit_ha_queues': value => false }
174214
}
215+
216+
if $rabbit_use_ssl {
217+
cinder_config {
218+
'DEFAULT/kombu_ssl_ca_certs': value => $kombu_ssl_ca_certs;
219+
'DEFAULT/kombu_ssl_certfile': value => $kombu_ssl_certfile;
220+
'DEFAULT/kombu_ssl_keyfile': value => $kombu_ssl_keyfile;
221+
'DEFAULT/kombu_ssl_version': value => $kombu_ssl_version;
222+
}
223+
} else {
224+
cinder_config {
225+
'DEFAULT/kombu_ssl_ca_certs': ensure => absent;
226+
'DEFAULT/kombu_ssl_certfile': ensure => absent;
227+
'DEFAULT/kombu_ssl_keyfile': ensure => absent;
228+
'DEFAULT/kombu_ssl_version': ensure => absent;
229+
}
230+
}
231+
175232
}
176233

177234
if $rpc_backend == 'cinder.openstack.common.rpc.impl_qpid' {

‎spec/classes/cinder_spec.rb‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,46 @@
178178
it { should contain_cinder_config('DEFAULT/qpid_sasl_mechanisms').with_value('DIGEST-MD5 GSSAPI PLAIN') }
179179
end
180180

181+
describe 'with SSL enabled' do
182+
let :params do
183+
req_params.merge!({
184+
:rabbit_use_ssl => true,
185+
:kombu_ssl_ca_certs => '/path/to/ssl/ca/certs',
186+
:kombu_ssl_certfile => '/path/to/ssl/cert/file',
187+
:kombu_ssl_keyfile => '/path/to/ssl/keyfile',
188+
:kombu_ssl_version => 'SSLv3'
189+
})
190+
end
191+
192+
it do
193+
should contain_cinder_config('DEFAULT/rabbit_use_ssl').with_value('true')
194+
should contain_cinder_config('DEFAULT/kombu_ssl_ca_certs').with_value('/path/to/ssl/ca/certs')
195+
should contain_cinder_config('DEFAULT/kombu_ssl_certfile').with_value('/path/to/ssl/cert/file')
196+
should contain_cinder_config('DEFAULT/kombu_ssl_keyfile').with_value('/path/to/ssl/keyfile')
197+
should contain_cinder_config('DEFAULT/kombu_ssl_version').with_value('SSLv3')
198+
end
199+
end
200+
201+
describe 'with SSL disabled' do
202+
let :params do
203+
req_params.merge!({
204+
:rabbit_use_ssl => false,
205+
:kombu_ssl_ca_certs => 'undef',
206+
:kombu_ssl_certfile => 'undef',
207+
:kombu_ssl_keyfile => 'undef',
208+
:kombu_ssl_version => 'SSLv3'
209+
})
210+
end
211+
212+
it do
213+
should contain_cinder_config('DEFAULT/rabbit_use_ssl').with_value('false')
214+
should contain_cinder_config('DEFAULT/kombu_ssl_ca_certs').with_ensure('absent')
215+
should contain_cinder_config('DEFAULT/kombu_ssl_certfile').with_ensure('absent')
216+
should contain_cinder_config('DEFAULT/kombu_ssl_keyfile').with_ensure('absent')
217+
should contain_cinder_config('DEFAULT/kombu_ssl_version').with_ensure('absent')
218+
end
219+
end
220+
181221
describe 'with syslog disabled' do
182222
let :params do
183223
req_params

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL