Merge lp:~ivoks/charms/trusty/neutron-api-contrail/openstack-ssl into lp:~sdn-charmers/charms/trusty/neutron-api-contrail/trunk

[Ante Karamatić]

This patch allows neutron's contrail plugin to connect to OpenStack services using TLS/SSL protocol.

[Robert Ayres (robert-ayres)]

Apologies for the delay. I am actively reviewing/testing some modifications to this patch.

[Robert Ayres (robert-ayres)]

review: Approve

=== modified file 'charm-helpers-sync.yaml'
--- charm-helpers-sync.yaml	2016-10-10 21:02:44 +0000
+++ charm-helpers-sync.yaml	2017-01-31 13:15:22 +0000
@@ -3,4 +3,5 @@
 include:
   - core
   - fetch
+  - contrib.hahelpers.apache
   - osplatform

=== modified file 'config.yaml'
--- config.yaml	2015-10-05 18:23:07 +0000
+++ config.yaml	2017-01-31 13:15:22 +0000
@@ -8,3 +8,9 @@
   install-keys:
     type: string
     description: Apt keys for package install sources
+  ssl_ca:
+    type: string
+    default:
+    description: |
+      SSL CA used to sign certificates of OpenStack services. It should be
+      provided in base64 format.

=== added directory 'hooks/charmhelpers/contrib'
=== added file 'hooks/charmhelpers/contrib/__init__.py'
--- hooks/charmhelpers/contrib/__init__.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/__init__.py	2017-01-31 13:15:22 +0000
@@ -0,0 +1,13 @@
+# Copyright 2014-2015 Canonical Limited.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

=== added directory 'hooks/charmhelpers/contrib/hahelpers'
=== added file 'hooks/charmhelpers/contrib/hahelpers/__init__.py'
--- hooks/charmhelpers/contrib/hahelpers/__init__.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/hahelpers/__init__.py	2017-01-31 13:15:22 +0000
@@ -0,0 +1,13 @@
+# Copyright 2014-2015 Canonical Limited.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

=== added file 'hooks/charmhelpers/contrib/hahelpers/apache.py'
--- hooks/charmhelpers/contrib/hahelpers/apache.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/hahelpers/apache.py	2017-01-31 13:15:22 +0000
@@ -0,0 +1,95 @@
+# Copyright 2014-2015 Canonical Limited.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#
+# Copyright 2012 Canonical Ltd.
+#
+# This file is sourced from lp:openstack-charm-helpers
+#
+# Authors:
+#  James Page <[e-mail]>
+#  Adam Gandelman <[e-mail]>
+#
+
+import os
+import subprocess
+
+from charmhelpers.core.hookenv import (
+    config as config_get,
+    relation_get,
+    relation_ids,
+    related_units as relation_list,
+    log,
+    INFO,
+)
+
+
+def get_cert(cn=None):
+    # TODO: deal with multiple https endpoints via charm config
+    cert = config_get('ssl_cert')
+    key = config_get('ssl_key')
+    if not (cert and key):
+        log("Inspecting identity-service relations for SSL certificate.",
+            level=INFO)
+        cert = key = None
+        if cn:
+            ssl_cert_attr = 'ssl_cert_{}'.format(cn)
+            ssl_key_attr = 'ssl_key_{}'.format(cn)
+        else:
+            ssl_cert_attr = 'ssl_cert'
+            ssl_key_attr = 'ssl_key'
+        for r_id in relation_ids('identity-service'):
+            for unit in relation_list(r_id):
+                if not cert:
+                    cert = relation_get(ssl_cert_attr,
+                                        rid=r_id, unit=unit)
+                if not key:
+                    key = relation_get(ssl_key_attr,
+                                       rid=r_id, unit=unit)
+    return (cert, key)
+
+
+def get_ca_cert():
+    ca_cert = config_get('ssl_ca')
+    if ca_cert is None:
+        log("Inspecting identity-service relations for CA SSL certificate.",
+            level=INFO)
+        for r_id in relation_ids('identity-service'):
+            for unit in relation_list(r_id):
+                if ca_cert is None:
+                    ca_cert = relation_get('ca_cert',
+                                           rid=r_id, unit=unit)
+    return ca_cert
+
+
+def retrieve_ca_cert(cert_file):
+    cert = None
+    if os.path.isfile(cert_file):
+        with open(cert_file, 'r') as crt:
+            cert = crt.read()
+    return cert
+
+
+def install_ca_cert(ca_cert):
+    if ca_cert:
+        cert_file = ('/usr/local/share/ca-certificates/'
+                     'keystone_juju_ca_cert.crt')
+        old_cert = retrieve_ca_cert(cert_file)
+        if old_cert and old_cert == ca_cert:
+            log("CA cert is the same as installed version", level=INFO)
+        else:
+            log("Installing new CA cert", level=INFO)
+            with open(cert_file, 'w') as crt:
+                crt.write(ca_cert)
+            subprocess.check_call(['update-ca-certificates', '--fresh'])

=== modified file 'hooks/neutron_api_contrail_hooks.py'
--- hooks/neutron_api_contrail_hooks.py	2016-09-05 15:25:29 +0000
+++ hooks/neutron_api_contrail_hooks.py	2017-01-31 13:15:22 +0000
@@ -28,7 +28,8 @@
 from neutron_api_contrail_utils import (
     CONTRAIL_VERSION,
     OPENSTACK_VERSION,
-    write_plugin_config
+    write_plugin_config,
+    write_vnc_api_config
 )
 
 PACKAGES = [ "neutron-plugin-contrail" ]
@@ -62,9 +63,11 @@
 
 @hooks.hook("identity-admin-relation-departed")
 @hooks.hook("identity-admin-relation-broken")
-@restart_on_change({"/etc/neutron/plugins/opencontrail/ContrailPlugin.ini": ["neutron-server"]})
+@restart_on_change({"/etc/neutron/plugins/opencontrail/ContrailPlugin.ini": ["neutron-server"],
+                    "/etc/contrail/vnc_api_lib.ini": ["contrail-topology"]})
 def identity_admin_relation():
     write_plugin_config()
+    write_vnc_api_config()
 
 @hooks.hook()
 def install():
@@ -114,6 +117,7 @@
 @hooks.hook("upgrade-charm")
 def upgrade_charm():
     write_plugin_config()
+    write_vnc_api_config()
     service_restart("neutron-server")
 
 if __name__ == "__main__":

=== modified file 'hooks/neutron_api_contrail_utils.py'
--- hooks/neutron_api_contrail_utils.py	2016-09-05 15:25:29 +0000
+++ hooks/neutron_api_contrail_utils.py	2017-01-31 13:15:22 +0000
@@ -4,6 +4,12 @@
 import apt_pkg
 from apt_pkg import version_compare
 
+from charmhelpers.contrib.hahelpers.apache import (
+    get_ca_cert,
+    install_ca_cert
+)
+
+
 from charmhelpers.core.hookenv import (
     related_units,
     relation_get,
@@ -37,6 +43,7 @@
 def identity_admin_ctx():
     ctxs = [ { "auth_host": gethostbyname(hostname),
                "auth_port": relation_get("service_port", unit, rid),
+               "auth_protocol": relation_get("service_protocol", unit, rid),
                "admin_user": relation_get("service_username", unit, rid),
                "admin_password": relation_get("service_password", unit, rid),
                "admin_tenant_name": relation_get("service_tenant_name", unit, rid) }
@@ -44,8 +51,14 @@
              for unit, hostname in
              ((unit, relation_get("service_hostname", unit, rid)) for unit in related_units(rid))
              if hostname ]
+    install_certificates()
     return ctxs[0] if ctxs else {}
 
+def install_certificates():
+    CAcert = get_ca_cert()
+    if CAcert is not None:
+        install_ca_cert(CAcert)
+
 def write_plugin_config():
     ctx = {}
     ctx.update(contrail_api_ctx())
@@ -57,3 +70,8 @@
     render("ContrailPlugin.ini",
            "/etc/neutron/plugins/opencontrail/ContrailPlugin.ini",
            ctx, "root", "neutron", 0440)
+
+def write_vnc_api_config():
+    ctx = {}
+    ctx.update(identity_admin_ctx())
+    render("vnc_api_lib.ini", "/etc/contrail/vnc_api_lib.ini", ctx)

=== modified file 'templates/ContrailPlugin.ini'
--- templates/ContrailPlugin.ini	2016-05-07 02:33:48 +0000
+++ templates/ContrailPlugin.ini	2017-01-31 13:15:22 +0000
@@ -12,14 +12,14 @@
 admin_user = {{ admin_user }}
 admin_password = {{ admin_password }}
 admin_tenant_name = {{ admin_tenant_name }}
-auth_url = http://{{ auth_host }}:{{ auth_port }}/v2.0
+auth_url = {{ auth_protocol }}://{{ auth_host }}:{{ auth_port }}/v2.0
 
 {%- if authtoken %}
 
 [keystone_authtoken]
 auth_host = {{ auth_host }}
 auth_port = {{ auth_port }}
-auth_protocol = http
+auth_protocol = {{ auth_protocol }}
 {%- if authtoken_creds %}
 admin_user = {{ admin_user }}
 admin_password = {{ admin_password }}

=== added file 'templates/vnc_api_lib.ini'
--- templates/vnc_api_lib.ini	1970-01-01 00:00:00 +0000
+++ templates/vnc_api_lib.ini	2017-01-31 13:15:22 +0000
@@ -0,0 +1,16 @@
+###############################################################################
+# [ WARNING ]
+# Configuration file maintained by Juju. Local changes may be overwritten.
+###############################################################################
+
+[global]
+WEB_SERVER = 127.0.0.1
+WEB_PORT = 8082
+BASE_URL = /
+
+[auth]
+AUTHN_TYPE = keystone
+AUTHN_PROTOCOL = {{ auth_protocol }}
+AUTHN_SERVER = {{ auth_host }}
+AUTHN_PORT = {{ auth_port }}
+AUTHN_URL = /v2.0/tokens