Chapter 15. Enabling SSL/TLS on internal and public endpoints with Identity Management

1. Configure the /etc/resolv.conf file:

   Set the appropriate search domains and the nameserver on the undercloud in /etc/resolv.conf. For example, if the deployment domain is example.com, and the domain of the FreeIPA server is bigcorp.com, then add the following lines to /etc/resolv.conf:

   search example.com bigcorp.com
   nameserver $IDM_SERVER_IP_ADDR

2. Install required software:

   sudo dnf install -y python3-ipalib python3-ipaclient krb5-devel

3. Export environmental variables with values specific to your environment.:

   export IPA_DOMAIN=bigcorp.com
   export IPA_REALM=BIGCORP.COM
   export IPA_ADMIN_USER=$IPA_USER 1
   export IPA_ADMIN_PASSWORD=$IPA_PASSWORD 2
   export IPA_SERVER_HOSTNAME=ipa.bigcorp.com
   export UNDERCLOUD_FQDN=undercloud.example.com 3
   export USER=stack
   export CLOUD_DOMAIN=example.com

   1 2

   The IdM user credentials are an administrative user that can add new hosts and services.

   3

   The value of the UNDERCLOUD_FQDN parameter matches the first hostname-to-IP address mapping in /etc/hosts.

4. Run the undercloud-ipa-install.yaml ansible playbook on the undercloud:

   ansible-playbook \
   --ssh-extra-args "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" \
   /usr/share/ansible/tripleo-playbooks/undercloud-ipa-install.yaml

5. Add the following parameters to undercloud.conf

   undercloud_nameservers = $IDM_SERVER_IP_ADDR
   overcloud_domain_name = example.com

6. [Optional] If your IPA realm does not match your IPA domain, set the value of the certmonger_krb_realm parameter:

   1. Set the value of the certmonger_krb_realm in /home/stack/hiera_override.yaml:

      parameter_defaults:
        certmonger_krb_realm: EXAMPLE.COMPANY.COM

   2. Set the value of the custom_env_files parameter in undercloud.conf to /home/stack/hiera_override.yaml:

      custom_env_files = /home/stack/hiera_override.yaml

7. Deploy the undercloud:

   openstack undercloud install

1. List the hosts in IdM:

   $ kinit admin
   $ ipa host-find

2. Confirm that /etc/novajoin/krb5.keytab exists on the undercloud.

   ls /etc/novajoin/krb5.keytab

1. Before deploying the overcloud, create a YAML file tls-parameters.yaml with contents similar to the following. The values you select will be specific for your environment:

   parameter_defaults:
       DnsSearchDomains: ["example.com"]
       DnsServers: ["192.168.1.13"]
       CloudDomain: example.com
       CloudName: overcloud.example.com
       CloudNameInternal: overcloud.internalapi.example.com
       CloudNameStorage: overcloud.storage.example.com
       CloudNameStorageManagement: overcloud.storagemgmt.example.com
       CloudNameCtlplane: overcloud.ctlplane.example.com
       IdMServer: freeipa-0.redhat.local
       IdMDomain: redhat.local
       IdMInstallClientPackages: False
   
   resource_registry:
         OS::TripleO::Services::IpaClient: /usr/share/openstack-tripleo-heat-templates/deployment/ipa/ipaservices-baremetal-ansible.yaml

   • The shown value of the OS::TripleO::Services::IpaClient parameter overrides the default setting in the enable-internal-tls.yaml file. You must ensure the tls-parameters.yaml file follows enable-internal-tls.yaml in the openstack overcloud deploy command.

2. [Optional] If your IPA realm does not match your IPA domain, you must also include value of the CertmongerKerberosRealm parameter in the tls-parameters.yaml file:

       CertmongerKerberosRealm: EXAMPLE.COMPANY.COM

3. Deploy the overcloud. You will need to include the tls-parameters.yaml in the deployment command:

   DEFAULT_TEMPLATES=/usr/share/openstack-tripleo-heat-templates/
   CUSTOM_TEMPLATES=/home/stack/templates
   
   openstack overcloud deploy \
   -e ${DEFAULT_TEMPLATES}/environments/ssl/tls-everywhere-endpoints-dns.yaml \
   -e ${DEFAULT_TEMPLATES}/environments/services/haproxy-public-tls-certmonger.yaml \
   -e ${DEFAULT_TEMPLATES}/environments/ssl/enable-internal-tls.yaml \
   -e ${CUSTOM_TEMPLATES}/tls-parameters.yaml \
   ...

4. Confirm each endpoint is using HTTPS by querying keystone for a list of endpoints:

   openstack endpoint list

1. Adding the undercloud node to the certificate authority (CA)
2. Adding the undercloud node to IdM
3. Optional: Setting the IdM server as the DNS server for the overcloud
4. Preparing the environment files and deploying the overcloud
5. Testing the overcloud enrollment in IdM and in RHOSP
6. Optional: Adding DNS entries for novajoin in IdM

Procedure

1. On the undercloud node, install the python3-novajoin package:

   $ sudo dnf install python3-novajoin

2. On the undercloud node, run the novajoin-ipa-setup script, and adjust the values to suit your deployment:

   $ sudo /usr/libexec/novajoin-ipa-setup \
       --principal admin \
       --password <IdM admin password> \
       --server <IdM server hostname> \
       --realm <realm> \
       --domain <overcloud cloud domain> \
       --hostname <undercloud hostname> \
       --precreate

   Use the resulting One-Time Password (OTP) to enroll the undercloud.

Procedure

1. Enable the novajoin service:

   [DEFAULT]
   enable_novajoin = true

2. Set a One-Time Password (OTP) so that you can register the undercloud node with IdM:

   ipa_otp = <otp>

3. Set the overcloud’s domain name to be served by neutron’s DHCP server:

   overcloud_domain_name = <domain>

4. Set the hostname for the undercloud:

   undercloud_hostname = <undercloud FQDN>

5. Set IdM as the nameserver for the undercloud:

   undercloud_nameservers = <IdM IP>

6. For larger environments, review the novajoin connection timeout values. In the undercloud.conf file, add a reference to a new file called undercloud-timeout.yaml:

   hieradata_override = /home/stack/undercloud-timeout.yaml

   Add the following options to undercloud-timeout.yaml. You can specify the timeout value in seconds, for example, 5:

   nova::api::vendordata_dynamic_connect_timeout: <timeout value>
   nova::api::vendordata_dynamic_read_timeout: <timeout value>

7. Optional: If you want the local openSSL certificate authority to generate the SSL certificates for the public endpoints in director, set the generate_service_certificate parameter to true:

   generate_service_certificate = true

8. Save the undercloud.conf file.

9. Run the undercloud deployment command to apply the changes to your existing undercloud:

   $ openstack undercloud install

1. List the hosts in IdM:

   $ kinit admin
   $ ipa host-find

2. Confirm that /etc/novajoin/krb5.keytab exists on the undercloud.

   ls /etc/novajoin/krb5.keytab

Procedure

1. Connect to your undercloud:

   $ source ~/stackrc

2. Configure the control plane subnet to use IdM as the DNS name server:

   $ openstack subnet set ctlplane-subnet --dns-nameserver  <idm_server_address>

3. Set the DnsServers parameter in an environment file to use your IdM server:

   parameter_defaults:
     DnsServers: ["<idm_server_address>"]

   This parameter is usually defined in a custom network-environment.yaml file.

Procedure

1. Create a copy of the /usr/share/openstack-tripleo-heat-templates/environments/predictable-placement/custom-domain.yaml environment file:

   $ cp /usr/share/openstack-tripleo-heat-templates/environments/predictable-placement/custom-domain.yaml \
     /home/stack/templates/custom-domain.yaml

2. Edit the /home/stack/templates/custom-domain.yaml environment file and set the CloudDomain and CloudName* values to suit your deployment:

   parameter_defaults:
     CloudDomain: lab.local
     CloudName: overcloud.lab.local
     CloudNameInternal: overcloud.internalapi.lab.local
     CloudNameStorage: overcloud.storage.lab.local
     CloudNameStorageManagement: overcloud.storagemgmt.lab.local
     CloudNameCtlplane: overcloud.ctlplane.lab.local

3. Choose the implementation of TLS appropriate for your environment:

   • Use the enable-tls.yaml environment file to protect external endpoints with your custom certificate:

     1. Copy /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-tls.yaml to /home/stack/templates.
     2. Modify the /home/stack/enable-tls.yaml environment file to include your custom certificate and key.

     3. Include the following environment files in your deployment to protect internal and external endpoints:

        • enable-internal-tls.yaml
        • tls-every-endpoints-dns.yaml
        • custom-domain.yaml

        • enable-tls.yaml

          openstack overcloud deploy \
            --templates \
            -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml \
            -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-everywhere-endpoints-dns.yaml \
            -e /home/stack/templates/custom-domain.yaml \
            -e /home/stack/templates/enable-tls.yaml

   • Use the haproxy-public-tls-certmonger.yaml environment file to protect external endpoints with an IdM issued certificate. For this implementation, you must create DNS entries for the VIP endpoints used by novajoin:

     1. You must create DNS entries for the VIP endpoints used by novajoin. Identify the overcloud networks located in your custom network-environment.yaml file in `/home/stack/templates:

        parameter_defaults:
            ControlPlaneDefaultRoute: 192.168.24.1
            ExternalAllocationPools:
            -   end: 10.0.0.149
                start: 10.0.0.101
            InternalApiAllocationPools:
            -   end: 172.17.1.149
                start: 172.17.1.10
            StorageAllocationPools:
            -   end: 172.17.3.149
                start: 172.17.3.10
            StorageMgmtAllocationPools:
            -   end: 172.17.4.149
                start: 172.17.4.10

     2. Create a list of virtual IP addresses for each overcloud network in a heat template, for example, /home/stack/public_vip.yaml.

        parameter_defaults:
            ControlFixedIPs: [{'ip_address':'192.168.24.101'}]
            PublicVirtualFixedIPs: [{'ip_address':'10.0.0.101'}]
            InternalApiVirtualFixedIPs: [{'ip_address':'172.17.1.101'}]
            StorageVirtualFixedIPs: [{'ip_address':'172.17.3.101'}]
            StorageMgmtVirtualFixedIPs: [{'ip_address':'172.17.4.101'}]
            RedisVirtualFixedIPs: [{'ip_address':'172.17.1.102'}]

     3. Add DNS entries to the IdM for each of the VIPs, and zones as needed:

        ipa dnsrecord-add lab.local overcloud --a-rec 10.0.0.101
        ipa dnszone-add ctlplane.lab.local
        ipa dnsrecord-add ctlplane.lab.local overcloud --a-rec 192.168.24.101
        ipa dnszone-add internalapi.lab.local
        ipa dnsrecord-add internalapi.lab.local overcloud --a-rec 172.17.1.101
        ipa dnszone-add storage.lab.local
        ipa dnsrecord-add storage.lab.local overcloud --a-rec 172.17.3.101
        ipa dnszone-add storagemgmt.lab.local
        ipa dnsrecord-add storagemgmt.lab.local overcloud --a-rec 172.17.4.101

     4. Include the following environment files in your deployment to protect internal and external endpoints:

        • enable-internal-tls.yaml
        • tls-everywhere-endpoints-dns.yaml
        • haproxy-public-tls-certmonger.yaml
        • custom-domain.yaml

        • public_vip.yaml

          openstack overcloud deploy \
            --templates \
             -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml \
             -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-everywhere-endpoints-dns.yaml \
             -e /usr/share/openstack-tripleo-heat-templates/environments/services/haproxy-public-tls-certmonger.yaml \
             -e /home/stack/templates/custom-domain.yaml \
             -e /home/stack/templates/public-vip.yaml