X-Git-Url: https://gerrit.opnfv.org/gerrit/gitweb?a=blobdiff_plain;f=sample-env-generator%2Fssl.yaml;h=a3b5f24ab255ea070aa43231aebf3ebc654f7297;hb=e283f1c6f5a0a72fc941a97b385bf927248fe8e8;hp=2f379f30fb605fc85b2f11c8b0877a1a831761c0;hpb=f503d1b0e7fb9fe77e6fd1e71e08ca2d43427578;p=apex-tripleo-heat-templates.git

diff --git a/sample-env-generator/ssl.yaml b/sample-env-generator/ssl.yaml
index 2f379f30..a3b5f24a 100644
--- a/sample-env-generator/ssl.yaml
+++ b/sample-env-generator/ssl.yaml
@@ -22,6 +22,73 @@ environments:
             The contents of the private key go here
     resource_registry:
       OS::TripleO::NodeTLSData: ../../puppet/extraconfig/tls/tls-cert-inject.yaml
+  -
+    name: ssl/enable-internal-tls
+    title: Enable SSL on OpenStack Internal Endpoints
+    description: |
+      A Heat environment file which can be used to enable TLS for the internal
+      network via certmonger
+    files:
+      puppet/all-nodes-config.yaml:
+        parameters:
+          - EnableInternalTLS
+      puppet/services/nova-base.yaml:
+        parameters:
+          - RabbitClientUseSSL
+      overcloud.yaml:
+        parameters:
+          - ServerMetadata
+    static:
+      - EnableInternalTLS
+      - RabbitClientUseSSL
+      - ServerMetadata
+    sample_values:
+      EnableInternalTLS: True
+      RabbitClientUseSSL: True
+      ServerMetadata: |-2
+
+            ipa_enroll: True
+    resource_registry:
+      OS::TripleO::Services::CertmongerUser: ../puppet/services/certmonger-user.yaml
+      OS::TripleO::Services::HAProxyInternalTLS: ../puppet/services/haproxy-internal-tls-certmonger.yaml
+      # We use apache as a TLS proxy
+      OS::TripleO::Services::TLSProxyBase: ../puppet/services/apache.yaml
+      # Creates nova metadata that will create the extra service principals per
+      # node.
+      OS::TripleO::ServiceServerMetadataHook: ../extraconfig/nova_metadata/krb-service-principals.yaml
+  - name: ssl/inject-trust-anchor
+    title: Inject SSL Trust Anchor on Overcloud Nodes
+    description: |
+      When using an SSL certificate signed by a CA that is not in the default
+      list of CAs, this environment allows adding a custom CA certificate to
+      the overcloud nodes.
+    files:
+      puppet/extraconfig/tls/ca-inject.yaml:
+        parameters:
+          - SSLRootCertificate
+    sample_values:
+      SSLRootCertificate: |-
+        |
+            The contents of your certificate go here
+    resource_registry:
+      OS::TripleO::NodeTLSCAData: ../../puppet/extraconfig/tls/ca-inject.yaml
+    children:
+      - name: ssl/inject-trust-anchor-hiera
+        files:
+          puppet/services/ca-certs.yaml:
+            parameters:
+              - CAMap
+        # Need to clear this so we don't inherit the parent registry
+        resource_registry: {}
+        sample_values:
+          CAMap:  |-2
+
+                first-ca-name:
+                  content: |
+                    The content of the CA cert goes here
+                second-ca-name:
+                  content: |
+                    The content of the CA cert goes here
   -
     name: ssl/tls-endpoints-public-ip
     title: Deploy Public SSL Endpoints as IP Addresses
@@ -58,39 +125,6 @@ environments:
             CongressAdmin: {protocol: 'http', port: '1789', host: 'IP_ADDRESS'}
             CongressInternal: {protocol: 'http', port: '1789', host: 'IP_ADDRESS'}
             CongressPublic: {protocol: 'https', port: '13789', host: 'IP_ADDRESS'}
-            ContrailAnalyticsApiAdmin: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'}
-            ContrailAnalyticsApiInternal: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'}
-            ContrailAnalyticsApiPublic: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorHttpAdmin: {protocol: 'http', port: '8089',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorHttpInternal: {protocol: 'http', port: '8089',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorHttpPublic: {protocol: 'http', port: '8089',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorSandeshAdmin: {protocol: 'http', port: '8086',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorSandeshInternal: {protocol: 'http', port: '8086',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorSandeshPublic: {protocol: 'http', port: '8086',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsHttpAdmin: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'}
-            ContrailAnalyticsHttpInternal: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'}
-            ContrailAnalyticsHttpPublic: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'}
-            ContrailAnalyticsRedisAdmin: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'}
-            ContrailAnalyticsRedisInternal: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'}
-            ContrailAnalyticsRedisPublic: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'}
-            ContrailConfigAdmin: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'}
-            ContrailConfigInternal: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'}
-            ContrailConfigPublic: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'}
-            ContrailDiscoveryAdmin: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'}
-            ContrailDiscoveryInternal: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'}
-            ContrailDiscoveryPublic: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpAdmin: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpInternal: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpPublic: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpsAdmin: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpsInternal: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpsPublic: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'}
             Ec2ApiAdmin: {protocol: 'http', port: '8788', host: 'IP_ADDRESS'}
             Ec2ApiInternal: {protocol: 'http', port: '8788', host: 'IP_ADDRESS'}
             Ec2ApiPublic: {protocol: 'https', port: '13788', host: 'IP_ADDRESS'}
@@ -138,9 +172,9 @@ environments:
             OctaviaAdmin: {protocol: 'http', port: '9876', host: 'IP_ADDRESS'}
             OctaviaInternal: {protocol: 'http', port: '9876', host: 'IP_ADDRESS'}
             OctaviaPublic: {protocol: 'https', port: '13876', host: 'IP_ADDRESS'}
-            PankoAdmin: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'}
-            PankoInternal: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'}
-            PankoPublic: {protocol: 'https', port: '13779', host: 'IP_ADDRESS'}
+            PankoAdmin: {protocol: 'http', port: '8977', host: 'IP_ADDRESS'}
+            PankoInternal: {protocol: 'http', port: '8977', host: 'IP_ADDRESS'}
+            PankoPublic: {protocol: 'https', port: '13977', host: 'IP_ADDRESS'}
             SaharaAdmin: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'}
             SaharaInternal: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'}
             SaharaPublic: {protocol: 'https', port: '13386', host: 'IP_ADDRESS'}
@@ -192,39 +226,6 @@ environments:
             CongressAdmin: {protocol: 'http', port: '1789', host: 'IP_ADDRESS'}
             CongressInternal: {protocol: 'http', port: '1789', host: 'IP_ADDRESS'}
             CongressPublic: {protocol: 'https', port: '13789', host: 'CLOUDNAME'}
-            ContrailAnalyticsApiAdmin: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'}
-            ContrailAnalyticsApiInternal: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'}
-            ContrailAnalyticsApiPublic: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorHttpAdmin: {protocol: 'http', port: '8089',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorHttpInternal: {protocol: 'http', port: '8089',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorHttpPublic: {protocol: 'http', port: '8089',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorSandeshAdmin: {protocol: 'http', port: '8086',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorSandeshInternal: {protocol: 'http', port: '8086',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorSandeshPublic: {protocol: 'http', port: '8086',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsHttpAdmin: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'}
-            ContrailAnalyticsHttpInternal: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'}
-            ContrailAnalyticsHttpPublic: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'}
-            ContrailAnalyticsRedisAdmin: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'}
-            ContrailAnalyticsRedisInternal: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'}
-            ContrailAnalyticsRedisPublic: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'}
-            ContrailConfigAdmin: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'}
-            ContrailConfigInternal: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'}
-            ContrailConfigPublic: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'}
-            ContrailDiscoveryAdmin: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'}
-            ContrailDiscoveryInternal: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'}
-            ContrailDiscoveryPublic: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpAdmin: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpInternal: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpPublic: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpsAdmin: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpsInternal: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpsPublic: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'}
             Ec2ApiAdmin: {protocol: 'http', port: '8788', host: 'IP_ADDRESS'}
             Ec2ApiInternal: {protocol: 'http', port: '8788', host: 'IP_ADDRESS'}
             Ec2ApiPublic: {protocol: 'https', port: '13788', host: 'CLOUDNAME'}
@@ -272,9 +273,9 @@ environments:
             OctaviaAdmin: {protocol: 'http', port: '9876', host: 'IP_ADDRESS'}
             OctaviaInternal: {protocol: 'http', port: '9876', host: 'IP_ADDRESS'}
             OctaviaPublic: {protocol: 'https', port: '13876', host: 'CLOUDNAME'}
-            PankoAdmin: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'}
-            PankoInternal: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'}
-            PankoPublic: {protocol: 'https', port: '13779', host: 'CLOUDNAME'}
+            PankoAdmin: {protocol: 'http', port: '8977', host: 'IP_ADDRESS'}
+            PankoInternal: {protocol: 'http', port: '8977', host: 'IP_ADDRESS'}
+            PankoPublic: {protocol: 'https', port: '13977', host: 'CLOUDNAME'}
             SaharaAdmin: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'}
             SaharaInternal: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'}
             SaharaPublic: {protocol: 'https', port: '13386', host: 'CLOUDNAME'}
@@ -326,39 +327,6 @@ environments:
             CongressAdmin: {protocol: 'https', port: '1789', host: 'CLOUDNAME'}
             CongressInternal: {protocol: 'https', port: '1789', host: 'CLOUDNAME'}
             CongressPublic: {protocol: 'https', port: '13789', host: 'CLOUDNAME'}
-            ContrailAnalyticsApiAdmin: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'}
-            ContrailAnalyticsApiInternal: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'}
-            ContrailAnalyticsApiPublic: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorHttpAdmin: {protocol: 'http', port: '8089',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorHttpInternal: {protocol: 'http', port: '8089',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorHttpPublic: {protocol: 'http', port: '8089',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorSandeshAdmin: {protocol: 'http', port: '8086',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorSandeshInternal: {protocol: 'http', port: '8086',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsCollectorSandeshPublic: {protocol: 'http', port: '8086',
-            host: 'IP_ADDRESS'}
-            ContrailAnalyticsHttpAdmin: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'}
-            ContrailAnalyticsHttpInternal: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'}
-            ContrailAnalyticsHttpPublic: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'}
-            ContrailAnalyticsRedisAdmin: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'}
-            ContrailAnalyticsRedisInternal: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'}
-            ContrailAnalyticsRedisPublic: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'}
-            ContrailConfigAdmin: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'}
-            ContrailConfigInternal: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'}
-            ContrailConfigPublic: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'}
-            ContrailDiscoveryAdmin: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'}
-            ContrailDiscoveryInternal: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'}
-            ContrailDiscoveryPublic: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpAdmin: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpInternal: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpPublic: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpsAdmin: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpsInternal: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'}
-            ContrailWebuiHttpsPublic: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'}
             Ec2ApiAdmin: {protocol: 'https', port: '8788', host: 'CLOUDNAME'}
             Ec2ApiInternal: {protocol: 'https', port: '8788', host: 'CLOUDNAME'}
             Ec2ApiPublic: {protocol: 'https', port: '13788', host: 'CLOUDNAME'}
@@ -406,9 +374,9 @@ environments:
             OctaviaAdmin: {protocol: 'https', port: '9876', host: 'IP_ADDRESS'}
             OctaviaInternal: {protocol: 'https', port: '9876', host: 'IP_ADDRESS'}
             OctaviaPublic: {protocol: 'https', port: '13876', host: 'CLOUDNAME'}
-            PankoAdmin: {protocol: 'https', port: '8779', host: 'CLOUDNAME'}
-            PankoInternal: {protocol: 'https', port: '8779', host: 'CLOUDNAME'}
-            PankoPublic: {protocol: 'https', port: '13779', host: 'CLOUDNAME'}
+            PankoAdmin: {protocol: 'https', port: '8977', host: 'CLOUDNAME'}
+            PankoInternal: {protocol: 'https', port: '8977', host: 'CLOUDNAME'}
+            PankoPublic: {protocol: 'https', port: '13977', host: 'CLOUDNAME'}
             SaharaAdmin: {protocol: 'https', port: '8386', host: 'CLOUDNAME'}
             SaharaInternal: {protocol: 'https', port: '8386', host: 'CLOUDNAME'}
             SaharaPublic: {protocol: 'https', port: '13386', host: 'CLOUDNAME'}