Merge lp:~ivoks/charms/trusty/contrail-configuration/openstack-ssl into lp:~sdn-charmers/charms/trusty/contrail-configuration/trunk

[Ante Karamatić]

This patch allows contrail-configuration to connect to OpenStack services using TLS/SSL protocol.

It doesn't, yet, add functionality of exposing contrail-api endopint as https. This will be done in another patch.

[Robert Ayres (robert-ayres)]

Apologies for the delay. I am actively reviewing/testing some modifications to this patch.

[Robert Ayres (robert-ayres)]

review: Approve

=== modified file 'charm-helpers-sync.yaml'
--- charm-helpers-sync.yaml	2016-10-10 20:47:56 +0000
+++ charm-helpers-sync.yaml	2017-01-31 13:01:47 +0000
@@ -3,6 +3,7 @@
 include:
   - core
   - fetch
+  - contrib.hahelpers.apache
   - osplatform
   - contrib.network
   - contrib.openstack|inc=*

=== modified file 'config.yaml'
--- config.yaml	2016-11-10 15:47:28 +0000
+++ config.yaml	2017-01-31 13:01:47 +0000
@@ -56,3 +56,9 @@
     type: int
     default: 1
     description: Minimum number of units required in cassandra relation
+  ssl_ca:
+    type: string
+    default:
+    description: |
+      SSL CA used to sign certificates of OpenStack services. It should be
+      provided in base64 format.

=== added directory 'hooks/charmhelpers/contrib/hahelpers'
=== added file 'hooks/charmhelpers/contrib/hahelpers/__init__.py'
--- hooks/charmhelpers/contrib/hahelpers/__init__.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/hahelpers/__init__.py	2017-01-31 13:01:47 +0000
@@ -0,0 +1,13 @@
+# Copyright 2014-2015 Canonical Limited.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

=== added file 'hooks/charmhelpers/contrib/hahelpers/apache.py'
--- hooks/charmhelpers/contrib/hahelpers/apache.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/hahelpers/apache.py	2017-01-31 13:01:47 +0000
@@ -0,0 +1,95 @@
+# Copyright 2014-2015 Canonical Limited.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#
+# Copyright 2012 Canonical Ltd.
+#
+# This file is sourced from lp:openstack-charm-helpers
+#
+# Authors:
+#  James Page <[e-mail]>
+#  Adam Gandelman <[e-mail]>
+#
+
+import os
+import subprocess
+
+from charmhelpers.core.hookenv import (
+    config as config_get,
+    relation_get,
+    relation_ids,
+    related_units as relation_list,
+    log,
+    INFO,
+)
+
+
+def get_cert(cn=None):
+    # TODO: deal with multiple https endpoints via charm config
+    cert = config_get('ssl_cert')
+    key = config_get('ssl_key')
+    if not (cert and key):
+        log("Inspecting identity-service relations for SSL certificate.",
+            level=INFO)
+        cert = key = None
+        if cn:
+            ssl_cert_attr = 'ssl_cert_{}'.format(cn)
+            ssl_key_attr = 'ssl_key_{}'.format(cn)
+        else:
+            ssl_cert_attr = 'ssl_cert'
+            ssl_key_attr = 'ssl_key'
+        for r_id in relation_ids('identity-service'):
+            for unit in relation_list(r_id):
+                if not cert:
+                    cert = relation_get(ssl_cert_attr,
+                                        rid=r_id, unit=unit)
+                if not key:
+                    key = relation_get(ssl_key_attr,
+                                       rid=r_id, unit=unit)
+    return (cert, key)
+
+
+def get_ca_cert():
+    ca_cert = config_get('ssl_ca')
+    if ca_cert is None:
+        log("Inspecting identity-service relations for CA SSL certificate.",
+            level=INFO)
+        for r_id in relation_ids('identity-service'):
+            for unit in relation_list(r_id):
+                if ca_cert is None:
+                    ca_cert = relation_get('ca_cert',
+                                           rid=r_id, unit=unit)
+    return ca_cert
+
+
+def retrieve_ca_cert(cert_file):
+    cert = None
+    if os.path.isfile(cert_file):
+        with open(cert_file, 'r') as crt:
+            cert = crt.read()
+    return cert
+
+
+def install_ca_cert(ca_cert):
+    if ca_cert:
+        cert_file = ('/usr/local/share/ca-certificates/'
+                     'keystone_juju_ca_cert.crt')
+        old_cert = retrieve_ca_cert(cert_file)
+        if old_cert and old_cert == ca_cert:
+            log("CA cert is the same as installed version", level=INFO)
+        else:
+            log("Installing new CA cert", level=INFO)
+            with open(cert_file, 'w') as crt:
+                crt.write(ca_cert)
+            subprocess.check_call(['update-ca-certificates', '--fresh'])

=== modified file 'hooks/contrail_configuration_utils.py'
--- hooks/contrail_configuration_utils.py	2016-10-20 23:59:42 +0000
+++ hooks/contrail_configuration_utils.py	2017-01-31 13:01:47 +0000
@@ -16,6 +16,11 @@
 import json
 import urllib2
 
+from charmhelpers.contrib.hahelpers.apache import (
+    get_ca_cert,
+    install_ca_cert
+)
+
 from charmhelpers.contrib.network.ip import get_address_in_network
 
 from charmhelpers.core.hookenv import (
@@ -311,6 +316,7 @@
 def identity_admin_ctx():
     ctxs = [ { "auth_host": gethostbyname(hostname),
                "auth_port": relation_get("service_port", unit, rid),
+               "auth_protocol": relation_get("service_protocol", unit, rid),
                "admin_user": relation_get("service_username", unit, rid),
                "admin_password": relation_get("service_password", unit, rid),
                "admin_tenant_name": relation_get("service_tenant_name", unit, rid),
@@ -319,8 +325,14 @@
              for unit, hostname in
              ((unit, relation_get("service_hostname", unit, rid)) for unit in related_units(rid))
              if hostname ]
+    install_certificates()
     return ctxs[0] if ctxs else {}
 
+def install_certificates():
+    CAcert = get_ca_cert()
+    if CAcert is not None:
+        install_ca_cert(CAcert)
+
 def is_container():
     """Return boolean determining if inside container"""
     try:

=== modified file 'templates/contrail-api.conf'
--- templates/contrail-api.conf	2016-04-19 21:10:36 +0000
+++ templates/contrail-api.conf	2017-01-31 13:01:47 +0000
@@ -22,7 +22,7 @@
 [KEYSTONE]
 auth_host = {{ auth_host }}
 auth_port = {{ auth_port }}
-auth_protocol = http
+auth_protocol = {{ auth_protocol }}
 admin_user = {{ admin_user }}
 admin_password = {{ admin_password }}
 admin_token = 

=== modified file 'templates/contrail-lbaas-auth.conf'
--- templates/contrail-lbaas-auth.conf	2016-07-01 11:12:27 +0000
+++ templates/contrail-lbaas-auth.conf	2017-01-31 13:01:47 +0000
@@ -4,7 +4,7 @@
 ###############################################################################
 
 [BARBICAN]
-auth_url = http://{{ auth_host }}:{{ auth_port }}/v2.0
+auth_url = {{ auth_protocol }}://{{ auth_host }}:{{ auth_port }}/v2.0
 auth_version = 2
 admin_user = {{ admin_user }}
 admin_password = {{ admin_password }}

=== modified file 'templates/vnc_api_lib.ini'
--- templates/vnc_api_lib.ini	2014-10-20 15:02:13 +0000
+++ templates/vnc_api_lib.ini	2017-01-31 13:01:47 +0000
@@ -9,7 +9,7 @@
 
 [auth]
 AUTHN_TYPE = keystone
-AUTHN_PROTOCOL = http
+AUTHN_PROTOCOL = {{ auth_protocol }}
 AUTHN_SERVER = {{ auth_host }}
 AUTHN_PORT = {{ auth_port }}
 AUTHN_URL = /v2.0/tokens