Skip to content

Commit 13a9424

Browse files
xbezdickparamite
xbezdick
authored and
paramite
committed
Refactor horizon ssl setup to use puppet-horizon
We still need to refactor whole ssl handling but we are definetly better off with using puppet-horizon to setup ssl for horizon. Conflicts: packstack/puppet/templates/https.pp Change-Id: I266b4fc4e7c1c366f814ddb0a5622b8b4e1236bc Closes-Bug: rhbz#1104226
1 parent fc8695f commit 13a9424

6 files changed

Lines changed: 81 additions & 104 deletions

File tree

‎docs/packstack.rst‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,9 @@ OpenStack Horizon Config parameters
265265
**CONFIG_SSL_KEY**
266266
Keyfile corresponding to the certificate if one was entered.
267267

268+
**CONFIG_SSL_CACHAIN**
269+
PEM encoded CA certificates from which the certificate chain of the server certificate can be assembled.
270+
268271
OpenStack Swift Config parameters
269272
---------------------------------
270273

‎packstack/plugins/dashboard_500.py‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,21 @@ def initConfig(controller):
7979
"USE_DEFAULT": False,
8080
"NEED_CONFIRM": False,
8181
"CONDITION": False},
82+
83+
{"CMD_OPTION": "os-ssl-cachain",
84+
"USAGE": ("PEM encoded CA certificates from which the certificate "
85+
"chain of the server certificate can be assembled."),
86+
"PROMPT": ("Enter the CA cahin file corresponding to the certificate "
87+
"if one was entered"),
88+
"OPTION_LIST": [],
89+
"VALIDATORS": [],
90+
"DEFAULT_VALUE": "",
91+
"MASK_INPUT": False,
92+
"LOOSE_VALIDATION": True,
93+
"CONF_NAME": "CONFIG_SSL_CACHAIN",
94+
"USE_DEFAULT": False,
95+
"NEED_CONFIRM": False,
96+
"CONDITION": False},
8297
]
8398
group = {"GROUP_NAME": "OSSSL",
8499
"DESCRIPTION": "SSL Config parameters",
@@ -111,37 +126,43 @@ def create_manifest(config, messages):
111126
config["CONFIG_HORIZON_PORT"] = "'80'"
112127
sslmanifestdata = ''
113128
if config["CONFIG_HORIZON_SSL"] == 'y':
129+
config["CONFIG_HORIZON_SSL"] = 'true'
114130
config["CONFIG_HORIZON_PORT"] = "'443'"
115131
proto = "https"
116-
sslmanifestdata += getManifestTemplate("https.pp")
117132

118133
# Are we using the users cert/key files
119134
if config["CONFIG_SSL_CERT"]:
120135
ssl_cert = config["CONFIG_SSL_CERT"]
121136
ssl_key = config["CONFIG_SSL_KEY"]
137+
ssl_chain = config["CONFIG_SSL_CACHAIN"]
122138

123139
if not os.path.exists(ssl_cert):
124140
raise exceptions.ParamValidationError(
125141
"The file %s doesn't exist" % ssl_cert)
126142

127-
if ssl_key and not os.path.exists(ssl_key):
143+
if not os.path.exists(ssl_key):
128144
raise exceptions.ParamValidationError(
129145
"The file %s doesn't exist" % ssl_key)
130146

147+
if not os.path.exists(ssl_chain):
148+
raise exceptions.ParamValidationError(
149+
"The file %s doesn't exist" % ssl_chain)
150+
131151
resources = config.setdefault('RESOURCES', {})
132152
host_resources = resources.setdefault(horizon_host, [])
133153
host_resources.append((ssl_cert, 'ssl_ps_server.crt'))
134-
if ssl_key:
135-
host_resources.append(ssl_key, 'ssl_ps_server.key')
154+
host_resources.append(ssl_key, 'ssl_ps_server.key')
155+
host_resources.append((ssl_chain, 'ssl_ps_chain.crt'))
136156
else:
137157
messages.append(
138158
"%sNOTE%s : A certificate was generated to be used for ssl, "
139159
"You should change the ssl certificate configured in "
140160
"/etc/httpd/conf.d/ssl.conf on %s to use a CA signed cert."
141161
% (utils.COLORS['red'], utils.COLORS['nocolor'], horizon_host))
162+
else:
163+
config["CONFIG_HORIZON_SSL"] = 'false'
142164

143165
manifestdata = getManifestTemplate("horizon.pp")
144-
manifestdata += sslmanifestdata
145166
appendManifestFile(manifestfile, manifestdata)
146167

147168
msg = ("To access the OpenStack Dashboard browse to %s://%s/dashboard .\n"

‎packstack/puppet/modules/packstack/templates/ssl/generate_ssl_certs.sh.erb‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,23 @@ fi
77

88
SSLKEY=/etc/pki/tls/private/ssl_ps_server.key
99
SSLCERT=/etc/pki/tls/certs/ssl_ps_server.crt
10+
SSLCHAIN=/etc/pki/tls/certs/ssl_ps_chain.crt
1011

1112
# If packstack dropped a cert in the resources directory then we
1213
# use that instead of generating one
1314
if [ -f $PACKSTACK_VAR_DIR/resources/ssl_ps_server.crt ] ; then
1415
cp $PACKSTACK_VAR_DIR/resources/ssl_ps_server.crt $SSLCERT
1516
cp $PACKSTACK_VAR_DIR/resources/ssl_ps_server.key $SSLKEY
17+
cp $PACKSTACK_VAR_DIR/resources/ssl_ps_chain.crt $SSLCHAIN
1618
exit 0
1719
fi
1820

21+
# If we already generated a cert then we
22+
# use that instead of generating one
23+
if [ -f $SSLCERT ] ; then
24+
exit 0
25+
fi
26+
1927
umask 277
2028

2129
answers() {
@@ -30,8 +38,16 @@ answers() {
3038
echo
3139
}
3240

41+
echo 10 > /etc/pki/CA/serial
42+
touch /etc/pki/CA/index.txt
3343

3444
# gen key and self signed host cert
35-
openssl genrsa 2048 > $SSLKEY 2> /dev/null
36-
answers $FQDN | openssl req -new -x509 -days 1096 -key $SSLKEY -text -out $SSLCERT
45+
openssl genrsa 2048 > /etc/pki/CA/private/cakey.pem 2> /dev/null
3746

47+
answers $FQDN | openssl req -new -x509 -days 3650 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem
48+
49+
cp /etc/pki/CA/cacert.pem $SSLCHAIN
50+
51+
openssl genrsa 2048 > $SSLKEY 2> /dev/null
52+
answers $FQDN | openssl req -new -nodes -key $SSLKEY -out ${SSLCERT}.req
53+
yes | openssl ca -in ${SSLCERT}.req -out ${SSLCERT}

‎packstack/puppet/templates/horizon.pp‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,35 @@
1515
can_set_mount_point => 'False',
1616
help_url =>'http://docs.openstack.org',
1717
django_debug => %(CONFIG_DEBUG_MODE)s ? {true => 'True', false => 'False'},
18+
listen_ssl => %(CONFIG_HORIZON_SSL)s,
19+
horizon_cert => '/etc/pki/tls/certs/ssl_ps_server.crt',
20+
horizon_key => '/etc/pki/tls/private/ssl_ps_server.key',
21+
horizon_ca => '/etc/pki/tls/certs/ssl_ps_chain.crt',
22+
}
23+
24+
if %(CONFIG_HORIZON_SSL)s {
25+
file {'/etc/pki/tls/certs/ps_generate_ssl_certs.ssh':
26+
content => template('packstack/ssl/generate_ssl_certs.sh.erb'),
27+
ensure => present,
28+
mode => '755',
29+
}
30+
31+
exec {'/etc/pki/tls/certs/ps_generate_ssl_certs.ssh':
32+
require => File['/etc/pki/tls/certs/ps_generate_ssl_certs.ssh'],
33+
notify => Service['httpd'],
34+
before => Class['horizon'],
35+
}
36+
37+
apache::listen { '443': }
38+
39+
# little bit of hatred as we'll have to patch upstream puppet-horizon
40+
file_line {'horizon_ssl_wsgi_fix':
41+
path => '/etc/httpd/conf.d/15-horizon_ssl_vhost.conf',
42+
match => 'WSGIProcessGroup.*',
43+
line => ' WSGIProcessGroup horizon-ssl',
44+
require => File['15-horizon_ssl_vhost.conf'],
45+
notify => Service['httpd'],
46+
}
1847
}
1948

2049
class {'memcached':}

‎packstack/puppet/templates/https.pp‎

Lines changed: 0 additions & 97 deletions
This file was deleted.

‎packstack/puppet/templates/nagios_server.pp‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,3 +81,8 @@
8181
dport => ['80'],
8282
action => 'accept',
8383
}
84+
85+
# ensure that we won't stop listening on 443 if horizon has ssl enabled
86+
if %(CONFIG_HORIZON_SSL)s {
87+
apache::listen { '443': }
88+
}

0 commit comments

Comments
 (0)