Add SSL configuration metadata for overclouds.

This passes SSL keys in via Heat which places a high cost on heat
compromises or the use of a non-SSL heat to do deploys. We'll want
to ensure that that is documented clearly.

Change-Id: I14d441460116fda91fbd1d2097c5598b57155a6d

diff --git a/Makefile b/Makefile
index a11a108..6d5c8b7 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -10,8 +10,8 @@ overcloud_source_deps = nova-compute-instance.yaml
 
 all: $(generated_templates)
 
-overcloud.yaml: overcloud-source.yaml swift-source.yaml $(overcloud_source_deps)
-       python ./tripleo_heat_merge/merge.py overcloud-source.yaml swift-source.yaml > $@.tmp
+overcloud.yaml: overcloud-source.yaml swift-source.yaml ssl-source.yaml $(overcloud_source_deps)
+       python ./tripleo_heat_merge/merge.py overcloud-source.yaml swift-source.yaml ssl-source.yaml > $@.tmp
        mv $@.tmp $@
 
 undercloud-vm.yaml: undercloud-source.yaml undercloud-vm-source.yaml

diff --git a/ssl-source.yaml b/ssl-source.yaml
new file mode 100644 (file)
index 0000000..9127555
--- /dev/null
+++ b/ssl-source.yaml
@@ -0,0 +1,43 @@
+Description: 'ssl-source: SSL endpoint metadata for openstack'
+Parameters:
+  SSLCertificate:
+    Default: ''
+    Description: If set, the contents of an SSL certificate .crt file for encrypting SSL endpoints.
+    Type: String
+    NoEcho: true
+  SSLKey:
+    Default: ''
+    Description: If set, the contents of an SSL certificate .key file for encrypting SSL endpoints.
+    Type: String
+    NoEcho: true
+Resources:
+  notcomputeConfig:
+    Type: AWS::AutoScaling::LaunchConfiguration
+    Metadata:
+      stunnel:
+        cert:
+          Ref: SSLCertificate
+        key:
+          Ref: SSLKey
+        ports:
+         - name: 'ec2'
+           accept: 13773
+           connect: 8773
+         - name: 'image'
+           accept: 13292
+           connect: 9292
+         - name: 'identity'
+           accept: 13000
+           connect: 5000
+         - name: 'network'
+           accept: 13696
+           connect: 9696
+         - name: 'compute'
+           accept: 13774
+           connect: 8774
+         - name: 'swift-proxy'
+           accept: 13080
+           connect: 8080
+         - name: 'cinder'
+           accept: 13776
+           connect: 8776