X-Git-Url: https://gerrit.opnfv.org/gerrit/gitweb?a=blobdiff_plain;f=docker%2Fservices%2Frabbitmq.yaml;h=237995b99694999a16f6ccc46f19899be6628cca;hb=af040d1e9418e6f266cfe8e2d1111ac80aaa7b94;hp=418c60d23000aaa37a6c35f6dc9afdd406f763c4;hpb=017f8b9b478e6e8a72cfb88cba54ce90b77e6532;p=apex-tripleo-heat-templates.git

diff --git a/docker/services/rabbitmq.yaml b/docker/services/rabbitmq.yaml
index 418c60d2..237995b9 100644
--- a/docker/services/rabbitmq.yaml
+++ b/docker/services/rabbitmq.yaml
@@ -40,6 +40,18 @@ parameters:
     type: string
     default: ''
     hidden: true
+  EnableInternalTLS:
+    type: boolean
+    default: false
+  InternalTLSCAFile:
+    default: '/etc/ipa/ca.crt'
+    type: string
+    description: Specifies the default CA cert to use if TLS is used for
+                 services in the internal network.
+
+conditions:
+
+  internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]}
 
 resources:
 
@@ -66,6 +78,12 @@ outputs:
         map_merge:
           - {get_attr: [RabbitmqBase, role_data, config_settings]}
           - rabbitmq::admin_enable: false
+          - if:
+            - internal_tls_enabled
+            - tripleo::certmonger::rabbitmq::postsave_cmd: "true" # TODO: restart the rabbitmq container here
+            - {}
+      logging_source: {get_attr: [RabbitmqBase, role_data, logging_source]}
+      logging_groups: {get_attr: [RabbitmqBase, role_data, logging_groups]}
       step_config: &step_config
         list_join:
           - "\n"
@@ -85,10 +103,21 @@ outputs:
               dest: "/"
               merge: true
               preserve_properties: true
+            - source: "/var/lib/kolla/config_files/src-tls/*"
+              dest: "/"
+              merge: true
+              preserve_properties: true
+              optional: true
           permissions:
             - path: /var/lib/rabbitmq
               owner: rabbitmq:rabbitmq
               recurse: true
+            - path: /etc/pki/tls/certs/rabbitmq.crt
+              owner: rabbitmq:rabbitmq
+              optional: true
+            - path: /etc/pki/tls/private/rabbitmq.key
+              owner: rabbitmq:rabbitmq
+              optional: true
       docker_config:
         # Kolla_bootstrap runs before permissions set by kolla_config
         step_1:
@@ -115,6 +144,17 @@ outputs:
                   - /var/lib/config-data/puppet-generated/rabbitmq/:/var/lib/kolla/config_files/src:ro
                   - /var/lib/rabbitmq:/var/lib/rabbitmq
                   - /var/log/containers/rabbitmq:/var/log/rabbitmq
+                - if:
+                  - internal_tls_enabled
+                  - 
+                    - list_join:
+                      - ':'
+                      - - {get_param: InternalTLSCAFile}
+                        - {get_param: InternalTLSCAFile}
+                        - 'ro'
+                    - /etc/pki/tls/certs/rabbitmq.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/rabbitmq.crt:ro
+                    - /etc/pki/tls/private/rabbitmq.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/rabbitmq.key:ro
+                  - null 
             environment:
               - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
               - KOLLA_BOOTSTRAP=True
@@ -143,6 +183,17 @@ outputs:
                   - /var/lib/config-data/puppet-generated/rabbitmq/:/var/lib/kolla/config_files/src:ro
                   - /var/lib/rabbitmq:/var/lib/rabbitmq
                   - /var/log/containers/rabbitmq:/var/log/rabbitmq
+                - if:
+                  - internal_tls_enabled
+                  - 
+                    - list_join:
+                      - ':'
+                      - - {get_param: InternalTLSCAFile}
+                        - {get_param: InternalTLSCAFile}
+                        - 'ro'
+                    - /etc/pki/tls/certs/rabbitmq.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/rabbitmq.crt:ro
+                    - /etc/pki/tls/private/rabbitmq.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/rabbitmq.key:ro
+                  - null 
             environment:
               - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
       docker_puppet_tasks:
@@ -155,6 +206,8 @@ outputs:
           volumes:
             - /var/lib/config-data/rabbitmq/etc/rabbitmq/:/etc/rabbitmq/:ro
             - /var/lib/rabbitmq:/var/lib/rabbitmq:ro
+      metadata_settings:
+        get_attr: [RabbitmqBase, role_data, metadata_settings]
       host_prep_tasks:
         - name: create persistent directories
           file:
@@ -167,3 +220,9 @@ outputs:
         - name: Stop and disable rabbitmq service
           tags: step2
           service: name=rabbitmq-server state=stopped enabled=no
+      update_tasks:
+        # TODO: Are we sure we want to support this.  Rolling update
+        # without pacemaker may fail.  Do we test this ?  In any case,
+        # this is under paunch control so the latest image should be
+        # pulled in by the deploy steps.  Same question for other
+        # usually managed by pacemaker container.