Chapter 12. Deploying TLS for public endpoints using director Operator

Procedure

1. Create a ConfigMap to store the CA certificates. The ConfigMap is the interface used to add CA certificates to the openstackclient pod, using the OpenStackControlPlane object:

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: cacerts
     namespace: openstack
   data:
    local_CA: |
       -----BEGIN CERTIFICATE-----
       …
      -----END CERTIFICATE-----
     another_CA: |
       -----BEGIN CERTIFICATE-----
       …
      -----END CERTIFICATE-----

   Copy to Clipboard Toggle word wrap

2. Create the OpenStackControlPlane and reference the ConfigMap:

   apiVersion: osp-director.openstack.org/v1beta2
   kind: OpenStackControlPlane
   metadata:
     name: <overcloud>
     namespace: openstack
   spec:
     caConfigMap: cacerts

   Copy to Clipboard Toggle word wrap
   • Replace <overcloud> with the name of your stack.

3. In the ~/custom_environment_files directory create a file called tls-certs.yaml containing the generated certificates for the deployment using SSLCertificate, SSLIntermediateCertificate, SSLKey, and CAMap parameters.

   Note

   For more information on creating a certificate file, see Enabling SSL/TLS.

4. Update the heatEnvConfigMap to add the tls-certs.yaml file:

   $ oc create configmap -n openstack heat-env-config --from-file=~/custom_environment_files/ --dry-run=client -o yaml | oc apply -f -

   Copy to Clipboard Toggle word wrap

5. Create an OpenStackConfigGenerator and add the required heatEnvs configuration files to configure TLS for public endpoint IPs:

   apiVersion: osp-director.openstack.org/v1beta1
   kind: OpenStackConfigGenerator
   …
   spec:
     …
     heatEnvs:
       - ssl/tls-endpoints-public-ip.yaml
       - ssl/enable-tls.yaml
     …
     heatEnvConfigMap: heat-env-config
     tarballConfigMap: tripleo-tarball-config

   Copy to Clipboard Toggle word wrap

6. The OpenStackConfigGenerator and a new OpenStackConfigVersion are created, run the Ansible playbooks against the overcloud using the OpenStackDeploy resource:

   • Registering the operating system of your overcloud.
   • Obtain the latest OpenStackConfig Version.
   • Applying overcloud configuration with the director Operator.

Procedure

1. Create a ConfigMap to store the CA certificates. The ConfigMap is the interface used to add additional CA certificates to the openstackclient pod, using the OpenStackControlPlane object:

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: cacerts
     namespace: openstack
   data:
    local_CA: |
       -----BEGIN CERTIFICATE-----
       …
      -----END CERTIFICATE-----
     another_CA: |
       -----BEGIN CERTIFICATE-----
       …
      -----END CERTIFICATE-----

   Copy to Clipboard Toggle word wrap

2. Create the OpenStackControlPlane and reference the ConfigMap:

   apiVersion: osp-director.openstack.org/v1beta2
   kind: OpenStackControlPlane
   metadata:
     name: <overcloud>
     namespace: openstack
   spec:
     caConfigMap: cacerts

   Copy to Clipboard Toggle word wrap
   • Replace <overcloud> with the name of your stack.

3. In the ~/custom_environment_files directory create a file called tls-certs.yaml containing the generated certificates for the deployment using SSLCertificate, SSLIntermediateCertificate, SSLKey, and CAMap parameters.

   Note

   For more information on creating a certificate file, see Enabling SSL/TLS.

4. Update the heatEnvConfigMap to add the tls-certs.yaml file:

   $ oc create configmap -n openstack heat-env-config --from-file=~/custom_environment_files/ --dry-run=client -o yaml | oc apply -f -

   Copy to Clipboard Toggle word wrap

5. Create an OpenStackConfigGenerator and add the required heatEnvs configuration files to configure TLS for public endpoint DNS names:

   apiVersion: osp-director.openstack.org/v1beta1
   kind: OpenStackConfigGenerator
   …
   spec:
     …
     heatEnvs:
       - ssl/tls-endpoints-public-dns.yaml
       - ssl/enable-tls.yaml
     …
     heatEnvConfigMap: heat-env-config
     tarballConfigMap: tripleo-tarball-config

   Copy to Clipboard Toggle word wrap

6. The OpenStackConfigGenerator and a new OpenStackConfigVersion are created, run the Ansible playbooks against the overcloud using the OpenStackDeploy resource:

   • Registering the operating system of your overcloud.
   • Obtain the latest OpenStackConfig Version.
   • Applying overcloud configuration with the director Operator.