Merge lp:~cbjchen/charms/trusty/keystone/use-ssl-config into lp:~openstack-charmers-archive/charms/trusty/keystone/next

[Edward Hope-Morley]

[uosci-testing-bot (uosci-testing-bot)]

charm_lint_check #2697 keystone-next for hopem mp253026
    LINT FAIL: lint-test failed

LINT Results (max last 2 lines):
  hooks/keystone_context.py:21:1: F811 redefinition of unused 'config' from line 6
  make: *** [lint] Error 1

Full lint test output: http://paste.ubuntu.com/10615463/
Build: http://10.245.162.77:8080/job/charm_lint_check/2697/

[uosci-testing-bot (uosci-testing-bot)]

charm_unit_test #2488 keystone-next for hopem mp253026
    UNIT OK: passed

Build: http://10.245.162.77:8080/job/charm_unit_test/2488/

[uosci-testing-bot (uosci-testing-bot)]

charm_amulet_test #2537 keystone-next for hopem mp253026
    AMULET FAIL: amulet-test failed

AMULET Results (max last 2 lines):
  ERROR subprocess encountered error code 124
  make: *** [test] Error 124

Full amulet test output: http://paste.ubuntu.com/10615602/
Build: http://10.245.162.77:8080/job/charm_amulet_test/2537/

[Edward Hope-Morley (hopem)]

This does't quite do the trick unfortunately, I'll be pushing up a new set of patches imminently.

review: Needs Fixing

[Edward Hope-Morley (hopem)]

review: Disapprove

Unmerged revisions

129. By Liang Chen <email address hidden> on 2015-03-13

Make use of key/cert/ca config

[cjbchen,r=]
Make sure the configure option ssl_key, ssl_cert, and
ssl_ca are used when provided.

=== modified file 'hooks/keystone_context.py'
--- hooks/keystone_context.py	2015-02-24 14:51:28 +0000
+++ hooks/keystone_context.py	2015-03-16 09:32:29 +0000
@@ -1,6 +1,8 @@
 import hashlib
 import os
 
+from base64 import b64decode
+
 from charmhelpers.core.hookenv import config
 
 from charmhelpers.core.host import (
@@ -17,6 +19,7 @@
 )
 
 from charmhelpers.core.hookenv import (
+    config,
     log,
     DEBUG,
     INFO,
@@ -92,8 +95,14 @@
 
         log("Creating apache ssl certs in %s" % (ssl_dir), level=INFO)
 
-        ca = get_ca(user=SSH_USER)
-        cert, key = ca.get_cert_and_key(common_name=cn)
+        cert = config('ssl_cert')
+        key = config('ssl_key')
+        if not (cert and key):
+            ca = get_ca(user=SSH_USER)
+            cert, key = ca.get_cert_and_key(common_name=cn)
+        else:
+            cert = b64decode(cert)
+            key = b64decode(key)
         write_file(path=os.path.join(ssl_dir, 'cert_{}'.format(cn)),
                    content=cert, owner=SSH_USER, group='keystone', perms=0o644)
         write_file(path=os.path.join(ssl_dir, 'key_{}'.format(cn)),
@@ -115,10 +124,14 @@
             log("Not ssl-cert-master - skipping apache ca config until "
                 "master is elected", level=INFO)
             return
-
-        ca = get_ca(user=SSH_USER)
-        install_ca_cert(ca.get_ca_bundle())
+        ca_cert = config('ssl_ca')
+        if ca_cert is None:
+            ca = get_ca(user=SSH_USER)
+            ca_cert = ca.get_ca_bundle()
+        else:
+            ca_cert = b64decode(ca_cert)
         # Ensure accessible by keystone ssh user and group (unison)
+        install_ca_cert(ca_cert)
         ensure_permissions(CA_CERT_PATH, user=SSH_USER, group='keystone',
                            perms=0o0644)