Merge lp:~openstack-charmers/charms/precise/cinder/ssl-everywhere into lp:~openstack-charmers-archive/charms/precise/cinder/trunk

[Kapil Thangavelu]

SSL client support for mysql and rabbitmq

Sync of charm helpers and config template changes

https://codereview.appspot.com/68100043/

=== modified file 'charm-helpers.yaml'
--- charm-helpers.yaml	2013-10-17 21:48:08 +0000
+++ charm-helpers.yaml	2014-03-04 16:53:59 +0000
@@ -1,4 +1,4 @@
-branch: lp:charm-helpers
+branch: lp:~openstack-charmers/charm-helpers/ssl-everywhere
 destination: hooks/charmhelpers
 include:
     - core

=== modified file 'config.yaml'
--- config.yaml	2014-02-03 10:44:24 +0000
+++ config.yaml	2014-03-04 16:53:59 +0000
@@ -121,6 +121,11 @@
     ssl_key:
         type: string
         description: SSL key to use with certificate specified as ssl_cert.
+    ssl_ca:
+        type: string
+        description: |
+          SSL CA to use with the certificate and key provided - this is only
+          required if you are providing a privately signed ssl_cert and ssl_key.
     config-flags:
         type: string
         description: Comma separated list of key=value config flags to be set in cinder.conf.

=== modified file 'hooks/charmhelpers/contrib/hahelpers/apache.py'
--- hooks/charmhelpers/contrib/hahelpers/apache.py	2013-10-17 21:48:08 +0000
+++ hooks/charmhelpers/contrib/hahelpers/apache.py	2014-03-04 16:53:59 +0000
@@ -39,14 +39,15 @@
 
 
 def get_ca_cert():
-    ca_cert = None
-    log("Inspecting identity-service relations for CA SSL certificate.",
-        level=INFO)
-    for r_id in relation_ids('identity-service'):
-        for unit in relation_list(r_id):
-            if not ca_cert:
-                ca_cert = relation_get('ca_cert',
-                                       rid=r_id, unit=unit)
+    ca_cert = config_get('ssl_ca')
+    if ca_cert is None:
+        log("Inspecting identity-service relations for CA SSL certificate.",
+            level=INFO)
+        for r_id in relation_ids('identity-service'):
+            for unit in relation_list(r_id):
+                if ca_cert is None:
+                    ca_cert = relation_get('ca_cert',
+                                           rid=r_id, unit=unit)
     return ca_cert
 
 

=== modified file 'hooks/charmhelpers/contrib/openstack/context.py'
--- hooks/charmhelpers/contrib/openstack/context.py	2014-02-19 10:44:30 +0000
+++ hooks/charmhelpers/contrib/openstack/context.py	2014-03-04 16:53:59 +0000
@@ -1,5 +1,6 @@
 import json
 import os
+import time
 
 from base64 import b64decode
 
@@ -29,6 +30,7 @@
     determine_apache_port,
     determine_api_port,
     https,
+    is_clustered
 )
 
 from charmhelpers.contrib.hahelpers.apache import (
@@ -112,7 +114,8 @@
 class SharedDBContext(OSContextGenerator):
     interfaces = ['shared-db']
 
-    def __init__(self, database=None, user=None, relation_prefix=None):
+    def __init__(self,
+                 database=None, user=None, relation_prefix=None, ssl_dir=None):
         '''
         Allows inspecting relation for settings prefixed with relation_prefix.
         This is useful for parsing access for multiple databases returned via
@@ -121,6 +124,7 @@
         self.relation_prefix = relation_prefix
         self.database = database
         self.user = user
+        self.ssl_dir = ssl_dir
 
     def __call__(self):
         self.database = self.database or config('database')
@@ -138,19 +142,44 @@
 
         for rid in relation_ids('shared-db'):
             for unit in related_units(rid):
-                passwd = relation_get(password_setting, rid=rid, unit=unit)
+                rdata = relation_get(rid=rid, unit=unit)
                 ctxt = {
-                    'database_host': relation_get('db_host', rid=rid,
-                                                  unit=unit),
+                    'database_host': rdata.get('db_host'),
                     'database': self.database,
                     'database_user': self.user,
-                    'database_password': passwd,
+                    'database_password': rdata.get(password_setting)
                 }
                 if context_complete(ctxt):
+                    db_ssl(rdata, ctxt, self.ssl_dir)
                     return ctxt
         return {}
 
 
+def db_ssl(rdata, ctxt, ssl_dir):
+    if 'ssl_ca' in rdata and ssl_dir:
+        ca_path = os.path.join(ssl_dir, 'db-client.ca')
+        with open(ca_path, 'w') as fh:
+            fh.write(b64decode(rdata['ssl_ca']))
+        ctxt['database_ssl_ca'] = ca_path
+    elif 'ssl_ca' in rdata:
+        log("Charm not setup for ssl support but ssl ca found")
+        return ctxt
+    if 'ssl_cert' in rdata:
+        cert_path = os.path.join(
+            ssl_dir, 'db-client.cert')
+        if not os.path.exists(cert_path):
+            log("Waiting 1m for ssl client cert validity")
+            time.sleep(60)
+        with open(cert_path, 'w') as fh:
+            fh.write(b64decode(rdata['ssl_cert']))
+        ctxt['database_ssl_cert'] = cert_path
+        key_path = os.path.join(ssl_dir, 'db-client.key')
+        with open(key_path, 'w') as fh:
+            fh.write(b64decode(rdata['ssl_key']))
+        ctxt['database_ssl_key'] = key_path
+    return ctxt
+
+
 class IdentityServiceContext(OSContextGenerator):
     interfaces = ['identity-service']
 
@@ -160,22 +189,19 @@
 
         for rid in relation_ids('identity-service'):
             for unit in related_units(rid):
+                rdata = relation_get(rid=rid, unit=unit)
                 ctxt = {
-                    'service_port': relation_get('service_port', rid=rid,
-                                                 unit=unit),
-                    'service_host': relation_get('service_host', rid=rid,
-                                                 unit=unit),
-                    'auth_host': relation_get('auth_host', rid=rid, unit=unit),
-                    'auth_port': relation_get('auth_port', rid=rid, unit=unit),
-                    'admin_tenant_name': relation_get('service_tenant',
-                                                      rid=rid, unit=unit),
-                    'admin_user': relation_get('service_username', rid=rid,
-                                               unit=unit),
-                    'admin_password': relation_get('service_password', rid=rid,
-                                                   unit=unit),
-                    # XXX: Hard-coded http.
-                    'service_protocol': 'http',
-                    'auth_protocol': 'http',
+                    'service_port': rdata.get('service_port'),
+                    'service_host': rdata.get('service_host'),
+                    'auth_host': rdata.get('auth_host'),
+                    'auth_port': rdata.get('auth_port'),
+                    'admin_tenant_name': rdata.get('service_tenant'),
+                    'admin_user': rdata.get('service_username'),
+                    'admin_password': rdata.get('service_password'),
+                    'service_protocol':
+                    rdata.get('service_protocol') or 'http',
+                    'auth_protocol':
+                    rdata.get('auth_protocol') or 'http',
                 }
                 if context_complete(ctxt):
                     return ctxt
@@ -185,6 +211,9 @@
 class AMQPContext(OSContextGenerator):
     interfaces = ['amqp']
 
+    def __init__(self, ssl_dir=None):
+        self.ssl_dir = ssl_dir
+
     def __call__(self):
         log('Generating template context for amqp')
         conf = config()
@@ -195,7 +224,6 @@
             log('Could not generate shared_db context. '
                 'Missing required charm config options: %s.' % e)
             raise OSContextError
-
         ctxt = {}
         for rid in relation_ids('amqp'):
             for unit in related_units(rid):
@@ -212,7 +240,24 @@
                                                       unit=unit),
                     'rabbitmq_virtual_host': vhost,
                 })
+                ssl_port = relation_get('ssl_port', rid=rid, unit=unit)
+                if ssl_port:
+                    ctxt['rabbit_ssl_port'] = ssl_port
+                ssl_ca = relation_get('ssl_ca', rid=rid, unit=unit)
+                if ssl_ca:
+                    ctxt['rabbit_ssl_ca'] = ssl_ca
+
                 if context_complete(ctxt):
+                    if 'rabbit_ssl_ca' in ctxt:
+                        if not self.ssl_dir:
+                            log(("Charm not setup for ssl support "
+                                 "but ssl ca found"))
+                            break
+                        ca_path = os.path.join(
+                            self.ssl_dir, 'rabbit-client-ca.pem')
+                        with open(ca_path, 'w') as fh:
+                            fh.write(b64decode(ctxt['rabbit_ssl_ca']))
+                            ctxt['rabbit_ssl_ca'] = ca_path
                     # Sufficient information found = break out!
                     break
             # Used for active/active rabbitmq >= grizzly
@@ -240,10 +285,13 @@
         '''This generates context for /etc/ceph/ceph.conf templates'''
         if not relation_ids('ceph'):
             return {}
+
         log('Generating template context for ceph')
+
         mon_hosts = []
         auth = None
         key = None
+        use_syslog = str(config('use-syslog')).lower()
         for rid in relation_ids('ceph'):
             for unit in related_units(rid):
                 mon_hosts.append(relation_get('private-address', rid=rid,
@@ -255,6 +303,7 @@
             'mon_hosts': ' '.join(mon_hosts),
             'auth': auth,
             'key': key,
+            'use_syslog': use_syslog
         }
 
         if not os.path.isdir('/etc/ceph'):
@@ -391,7 +440,7 @@
         return ctxt
 
 
-class NeutronContext(object):
+class NeutronContext(OSContextGenerator):
     interfaces = []
 
     @property
@@ -452,6 +501,22 @@
 
         return nvp_ctxt
 
+    def neutron_ctxt(self):
+        if https():
+            proto = 'https'
+        else:
+            proto = 'http'
+        if is_clustered():
+            host = config('vip')
+        else:
+            host = unit_get('private-address')
+        url = '%s://%s:%s' % (proto, host, '9292')
+        ctxt = {
+            'network_manager': self.network_manager,
+            'neutron_url': url,
+        }
+        return ctxt
+
     def __call__(self):
         self._ensure_packages()
 
@@ -461,7 +526,7 @@
         if not self.plugin:
             return {}
 
-        ctxt = {'network_manager': self.network_manager}
+        ctxt = self.neutron_ctxt()
 
         if self.plugin == 'ovs':
             ctxt.update(self.ovs_ctxt())

=== modified file 'hooks/charmhelpers/contrib/openstack/templates/ceph.conf'
--- hooks/charmhelpers/contrib/openstack/templates/ceph.conf	2013-10-17 21:48:08 +0000
+++ hooks/charmhelpers/contrib/openstack/templates/ceph.conf	2014-03-04 16:53:59 +0000
@@ -9,3 +9,6 @@
  keyring = /etc/ceph/$cluster.$name.keyring
  mon host = {{ mon_hosts }}
 {% endif -%}
+log to syslog = {{ use_syslog }}
+err to syslog = {{ use_syslog }}
+clog to syslog = {{ use_syslog }}

=== modified file 'hooks/charmhelpers/contrib/storage/linux/ceph.py'
--- hooks/charmhelpers/contrib/storage/linux/ceph.py	2013-11-06 03:53:17 +0000
+++ hooks/charmhelpers/contrib/storage/linux/ceph.py	2014-03-04 16:53:59 +0000
@@ -49,6 +49,9 @@
  auth supported = {auth}
  keyring = {keyring}
  mon host = {mon_hosts}
+ log to syslog = {use_syslog}
+ err to syslog = {use_syslog}
+ clog to syslog = {use_syslog}
 """
 
 
@@ -194,7 +197,7 @@
     return hosts
 
 
-def configure(service, key, auth):
+def configure(service, key, auth, use_syslog):
     ''' Perform basic configuration of Ceph '''
     create_keyring(service, key)
     create_key_file(service, key)
@@ -202,7 +205,8 @@
     with open('/etc/ceph/ceph.conf', 'w') as ceph_conf:
         ceph_conf.write(CEPH_CONF.format(auth=auth,
                                          keyring=_keyring_path(service),
-                                         mon_hosts=",".join(map(str, hosts))))
+                                         mon_hosts=",".join(map(str, hosts)),
+                                         use_syslog=use_syslog))
     modprobe('rbd')
 
 

=== modified file 'hooks/cinder_utils.py'
--- hooks/cinder_utils.py	2014-02-17 07:53:12 +0000
+++ hooks/cinder_utils.py	2014-03-04 16:53:59 +0000
@@ -83,8 +83,9 @@
 class CinderCharmError(Exception):
     pass
 
-CINDER_CONF = '/etc/cinder/cinder.conf'
-CINDER_API_CONF = '/etc/cinder/api-paste.ini'
+CINDER_CONF_DIR = "/etc/cinder"
+CINDER_CONF = '%s/cinder.conf' % CINDER_CONF_DIR
+CINDER_API_CONF = '%s/api-paste.ini' % CINDER_CONF_DIR
 CEPH_CONF = '/etc/ceph/ceph.conf'
 HAPROXY_CONF = '/etc/haproxy/haproxy.cfg'
 APACHE_SITE_CONF = '/etc/apache2/sites-available/openstack_https_frontend'
@@ -96,8 +97,8 @@
 # with file in restart_on_changes()'s service map.
 CONFIG_FILES = OrderedDict([
     (CINDER_CONF, {
-        'hook_contexts': [context.SharedDBContext(),
-                          context.AMQPContext(),
+        'hook_contexts': [context.SharedDBContext(ssl_dir=CINDER_CONF_DIR),
+                          context.AMQPContext(ssl_dir=CINDER_CONF_DIR),
                           context.ImageServiceContext(),
                           context.OSConfigFlagContext(),
                           context.SyslogContext(),

=== modified file 'templates/cinder.conf'
--- templates/cinder.conf	2014-02-03 10:44:24 +0000
+++ templates/cinder.conf	2014-03-04 16:53:59 +0000
@@ -16,11 +16,18 @@
 lock_path = /var/lock/cinder
 volumes_dir = /var/lib/cinder/volumes
 {% if database_host -%}
-sql_connection = mysql://{{ database_user }}:{{ database_password }}@{{ database_host }}/{{ database }}
-{% endif -%}
-{% if rabbitmq_host -%}
+sql_connection = mysql://{{ database_user }}:{{ database_password }}@{{ database_host }}/{{ database }}{% if database_ssl_ca %}?ssl_ca={{ database_ssl_ca }}{% if database_ssl_cert %}&ssl_cert={{ database_ssl_cert }}&ssl_key={{ database_ssl_key }}{% endif %}{% endif %}
+{% endif %}
+{% if rabbitmq_host %}
 notification_driver = cinder.openstack.common.notifier.rabbit_notifier
 control_exchange = cinder
+{% if rabbit_ssl_port %}
+rabbit_use_ssl=True
+rabbit_port={{ rabbit_ssl_port }}
+{% if rabbit_ssl_ca %}
+kombu_ssl_ca_certs={{rabbit_ssl_ca}}
+{% endif %}
+{% endif %}
 rabbit_host = {{ rabbitmq_host }}
 rabbit_userid = {{ rabbitmq_user }}
 rabbit_password = {{ rabbitmq_password }}

=== modified file 'templates/havana/api-paste.ini'
--- templates/havana/api-paste.ini	2013-10-17 21:48:08 +0000
+++ templates/havana/api-paste.ini	2014-03-04 16:53:59 +0000
@@ -58,6 +58,9 @@
 [filter:authtoken]
 paste.filter_factory = keystoneclient.middleware.auth_token:filter_factory
 {% if service_host -%}
+service_protocol = {{ service_protocol }}
+service_host = {{ service_host }}
+service_port = {{ service_port }}
 auth_host =  {{ auth_host }}
 auth_port = {{ auth_port }}
 auth_protocol = {{ auth_protocol }}