Merge lp:~ivoks/charms/trusty/neutron-contrail/openstack-ssl into lp:~sdn-charmers/charms/trusty/neutron-contrail/trunk

[Ante Karamatić]

This patch allows neutron's contrail vrouter to connect to OpenStack services using TLS/SSL protocol.

[Robert Ayres (robert-ayres)]

Apologies for the delay. I am actively reviewing/testing some modifications to this patch.

[Robert Ayres (robert-ayres)]

review: Approve

=== modified file 'charm-helpers-sync.yaml'
--- charm-helpers-sync.yaml	2016-10-10 20:55:32 +0000
+++ charm-helpers-sync.yaml	2017-01-31 13:09:17 +0000
@@ -3,4 +3,5 @@
 include:
   - core
   - fetch
+  - contrib.hahelpers.apache
   - osplatform

=== modified file 'config.yaml'
--- config.yaml	2016-10-06 04:38:30 +0000
+++ config.yaml	2017-01-31 13:09:17 +0000
@@ -69,3 +69,9 @@
   discovery-server-ip:
     type: string
     description: Specify discovery server ip manually
+  ssl_ca:
+    type: string
+    default:
+    description: |
+      SSL CA used to sign certificates of OpenStack services. It should be
+      provided in base64 format.

=== added directory 'hooks/charmhelpers/contrib'
=== added file 'hooks/charmhelpers/contrib/__init__.py'
--- hooks/charmhelpers/contrib/__init__.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/__init__.py	2017-01-31 13:09:17 +0000
@@ -0,0 +1,13 @@
+# Copyright 2014-2015 Canonical Limited.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

=== added directory 'hooks/charmhelpers/contrib/hahelpers'
=== added file 'hooks/charmhelpers/contrib/hahelpers/__init__.py'
--- hooks/charmhelpers/contrib/hahelpers/__init__.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/hahelpers/__init__.py	2017-01-31 13:09:17 +0000
@@ -0,0 +1,13 @@
+# Copyright 2014-2015 Canonical Limited.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

=== added file 'hooks/charmhelpers/contrib/hahelpers/apache.py'
--- hooks/charmhelpers/contrib/hahelpers/apache.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/hahelpers/apache.py	2017-01-31 13:09:17 +0000
@@ -0,0 +1,95 @@
+# Copyright 2014-2015 Canonical Limited.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#
+# Copyright 2012 Canonical Ltd.
+#
+# This file is sourced from lp:openstack-charm-helpers
+#
+# Authors:
+#  James Page <[e-mail]>
+#  Adam Gandelman <[e-mail]>
+#
+
+import os
+import subprocess
+
+from charmhelpers.core.hookenv import (
+    config as config_get,
+    relation_get,
+    relation_ids,
+    related_units as relation_list,
+    log,
+    INFO,
+)
+
+
+def get_cert(cn=None):
+    # TODO: deal with multiple https endpoints via charm config
+    cert = config_get('ssl_cert')
+    key = config_get('ssl_key')
+    if not (cert and key):
+        log("Inspecting identity-service relations for SSL certificate.",
+            level=INFO)
+        cert = key = None
+        if cn:
+            ssl_cert_attr = 'ssl_cert_{}'.format(cn)
+            ssl_key_attr = 'ssl_key_{}'.format(cn)
+        else:
+            ssl_cert_attr = 'ssl_cert'
+            ssl_key_attr = 'ssl_key'
+        for r_id in relation_ids('identity-service'):
+            for unit in relation_list(r_id):
+                if not cert:
+                    cert = relation_get(ssl_cert_attr,
+                                        rid=r_id, unit=unit)
+                if not key:
+                    key = relation_get(ssl_key_attr,
+                                       rid=r_id, unit=unit)
+    return (cert, key)
+
+
+def get_ca_cert():
+    ca_cert = config_get('ssl_ca')
+    if ca_cert is None:
+        log("Inspecting identity-service relations for CA SSL certificate.",
+            level=INFO)
+        for r_id in relation_ids('identity-service'):
+            for unit in relation_list(r_id):
+                if ca_cert is None:
+                    ca_cert = relation_get('ca_cert',
+                                           rid=r_id, unit=unit)
+    return ca_cert
+
+
+def retrieve_ca_cert(cert_file):
+    cert = None
+    if os.path.isfile(cert_file):
+        with open(cert_file, 'r') as crt:
+            cert = crt.read()
+    return cert
+
+
+def install_ca_cert(ca_cert):
+    if ca_cert:
+        cert_file = ('/usr/local/share/ca-certificates/'
+                     'keystone_juju_ca_cert.crt')
+        old_cert = retrieve_ca_cert(cert_file)
+        if old_cert and old_cert == ca_cert:
+            log("CA cert is the same as installed version", level=INFO)
+        else:
+            log("Installing new CA cert", level=INFO)
+            with open(cert_file, 'w') as crt:
+                crt.write(ca_cert)
+            subprocess.check_call(['update-ca-certificates', '--fresh'])

=== modified file 'hooks/neutron_contrail_hooks.py'
--- hooks/neutron_contrail_hooks.py	2017-01-28 04:00:28 +0000
+++ hooks/neutron_contrail_hooks.py	2017-01-31 13:09:17 +0000
@@ -36,6 +36,7 @@
 from neutron_contrail_utils import (
     CONTRAIL_VERSION,
     OPENSTACK_VERSION,
+    configure_kdump,
     configure_vrouter,
     disable_vrouter_vgw,
     dpkg_version,
@@ -276,6 +277,7 @@
     apt_install(PACKAGES, fatal=True)
     utils.CONTRAIL_VERSION = dpkg_version("contrail-vrouter-agent")
     if version_compare(utils.CONTRAIL_VERSION, "3.2") >= 0:
+        configure_kdump()
         apt_install(PACKAGES_VROUTER_3_2, fatal=True)
     else:
         apt_install(PACKAGES_VROUTER, fatal=True)

=== modified file 'hooks/neutron_contrail_utils.py'
--- hooks/neutron_contrail_utils.py	2016-10-21 00:15:55 +0000
+++ hooks/neutron_contrail_utils.py	2017-01-31 13:09:17 +0000
@@ -5,6 +5,8 @@
 from socket import gethostbyname, gethostname
 from subprocess import (
     CalledProcessError,
+    PIPE,
+    Popen,
     check_call,
     check_output
 )
@@ -17,6 +19,11 @@
 import netaddr
 import netifaces
 
+from charmhelpers.contrib.hahelpers.apache import (
+    get_ca_cert,
+    install_ca_cert
+)
+
 from charmhelpers.core.hookenv import (
     config,
     log,
@@ -87,6 +94,13 @@
                 raise error
     return func
 
+def configure_kdump():
+    log("Disabling kdump-tools")
+    _echo = Popen(["echo", "kdump-tools", "kdump-tools/use_kdump", "boolean",
+                   "False"], stdout=PIPE)
+    debconf = check_output(["debconf-set-selections"], stdin=_echo.stdout)
+    return _echo.wait()
+
 def configure_vrouter():
     # run external script to configure vrouter
     args = ["./create-vrouter.sh"]
@@ -219,6 +233,7 @@
 def identity_admin_ctx():
     ctxs = [ { "auth_host": gethostbyname(hostname),
                "auth_port": relation_get("service_port", unit, rid),
+               "auth_protocol": relation_get("service_protocol", unit, rid),
                "admin_user": relation_get("service_username", unit, rid),
                "admin_password": relation_get("service_password", unit, rid),
                "admin_tenant_name": relation_get("service_tenant_name", unit, rid),
@@ -227,8 +242,14 @@
              for unit, hostname in
              ((unit, relation_get("service_hostname", unit, rid)) for unit in related_units(rid))
              if hostname ]
+    install_certificates()
     return ctxs[0] if ctxs else {}
 
+def install_certificates():
+    CAcert = get_ca_cert()
+    if CAcert is not None:
+        install_ca_cert(CAcert)
+
 def ifdown(interfaces=None):
     """ifdown an interface or all interfaces"""
     log("Taking down {}".format(interfaces if interfaces else "interfaces"))

=== modified file 'templates/vnc_api_lib.ini'
--- templates/vnc_api_lib.ini	2014-10-21 12:07:30 +0000
+++ templates/vnc_api_lib.ini	2017-01-31 13:09:17 +0000
@@ -9,7 +9,7 @@
 
 [auth]
 AUTHN_TYPE = keystone
-AUTHN_PROTOCOL = http
+AUTHN_PROTOCOL = {{ auth_protocol }}
 AUTHN_SERVER = {{ auth_host }}
 AUTHN_PORT = {{ auth_port }}
 AUTHN_URL = /v2.0/tokens