Merge ~brettmilford/stsstack-bundles:master into stsstack-bundles:master

[Brett Milford]

[Edward Hope-Morley (hopem)]

Hi Brett, just want to check but I think you might need to also add keystone-ssl-ca for kubernetes-master [1]

[1] https://api.jujucharms.com/charmstore/v5/~containers/kubernetes-master-955/archive/config.yaml

[Brett Milford (brettmilford)]

Ah yes, you're right.
An additional overlay is there now.

diff --git a/kubernetes/pipeline/02configure b/kubernetes/pipeline/02configure
index 3ecc5f4..a2efb7a 100644
--- a/kubernetes/pipeline/02configure
+++ b/kubernetes/pipeline/02configure
@@ -217,6 +217,18 @@ do
             fi
             MOD_MSGS[grafana.0]="need to manually relate telegraf to any services you want to monitor"
             ;;
+        --ssl)
+            (cd ssl; . ./create_ca_cert.sh $MOD_SSL_STATE_DIR;)
+            ssl_results="ssl/$MOD_SSL_STATE_DIR/results"
+            MOD_PARAMS[__SSL_CA__]=`base64 ${ssl_results}/cacert.pem| tr -d '\n'`
+            MOD_PARAMS[__SSL_CERT__]=`base64 ${ssl_results}/servercert.pem| tr -d '\n'`
+            MOD_PARAMS[__SSL_KEY__]=`base64 ${ssl_results}/serverkey.pem| tr -d '\n'`
+            MOD_OVERLAYS+=( "k8s-master-keystone-ssl.yaml" )
+            # Make everything HA with 1 unit (unless --ha has already been set)
+            if ! has_opt '--keystone-ha[:0-9]*$'; then
+                set -- $@ --keystone-ha:1 && cache $@
+            fi
+            ;;
         *)
             echo "ERROR: invalid input '$1'"
             _usage
diff --git a/kubernetes/ssl b/kubernetes/ssl
new file mode 120000
index 0000000..99a5266
--- /dev/null
+++ b/kubernetes/ssl
@@ -0,0 +1 @@
+../ssl
\ No newline at end of file
diff --git a/overlays/k8s-master-keystone-ssl.yaml b/overlays/k8s-master-keystone-ssl.yaml
new file mode 100644
index 0000000..a42c526
--- /dev/null
+++ b/overlays/k8s-master-keystone-ssl.yaml
@@ -0,0 +1,6 @@
+ssl_ca:                     &ssl_ca                    __SSL_CA__
+
+applications:
+  kubernetes-master:
+    options:
+      keystone-ssl-ca: *ssl_ca