X-Git-Url: https://gerrit.opnfv.org/gerrit/gitweb?a=blobdiff_plain;f=puppet%2Fservices%2Fhaproxy.yaml;h=6b2d028f2c2858ee03c5f8ef373b08def3dde389;hb=refs%2Fheads%2Fmaster;hp=0af132e743d1f9c21a7470fba450df77f1133e67;hpb=271f3b52a8056b4e29291e11818c3558962098d8;p=apex-tripleo-heat-templates.git

diff --git a/puppet/services/haproxy.yaml b/puppet/services/haproxy.yaml
index 0af132e7..6b2d028f 100644
--- a/puppet/services/haproxy.yaml
+++ b/puppet/services/haproxy.yaml
@@ -51,12 +51,22 @@ parameters:
     description: Whether or not to enable the HAProxy stats interface.
     type: boolean
   RedisPassword:
-    description: The password for Redis
+    description: The password for the redis service account.
     type: string
     hidden: true
   MonitoringSubscriptionHaproxy:
     default: 'overcloud-haproxy'
     type: string
+  SSLCertificate:
+    default: ''
+    description: >
+      The content of the SSL certificate (without Key) in PEM format.
+    type: string
+  DeployedSSLCertificatePath:
+    default: '/etc/pki/tls/private/overcloud_endpoint.pem'
+    description: >
+        The filepath of the certificate as it will be stored in the controller.
+    type: string
   InternalTLSCAFile:
     default: '/etc/ipa/ca.crt'
     type: string
@@ -68,6 +78,14 @@ parameters:
     description: Specifies the default CRL PEM file to use for revocation if
                  TLS is used for services in the internal network.
 
+conditions:
+
+  public_tls_enabled:
+    not:
+      equals:
+      - {get_param: SSLCertificate}
+      - ""
+
 resources:
 
   HAProxyPublicTLS:
@@ -98,8 +116,6 @@ outputs:
       monitoring_subscription: {get_param: MonitoringSubscriptionHaproxy}
       config_settings:
         map_merge:
-          - get_attr: [HAProxyPublicTLS, role_data, config_settings]
-          - get_attr: [HAProxyInternalTLS, role_data, config_settings]
           - tripleo.haproxy.firewall_rules:
               '107 haproxy stats':
                 dport: 1993
@@ -115,6 +131,12 @@ outputs:
               map_merge:
                 - get_attr: [HAProxyPublicTLS, role_data, certificates_specs]
                 - get_attr: [HAProxyInternalTLS, role_data, certificates_specs]
+          - if:
+              - public_tls_enabled
+              - tripleo::haproxy::service_certificate: {get_param: DeployedSSLCertificatePath}
+              - {}
+          - get_attr: [HAProxyPublicTLS, role_data, config_settings]
+          - get_attr: [HAProxyInternalTLS, role_data, config_settings]
       step_config: |
         include ::tripleo::profile::base::haproxy
       upgrade_tasks: