Merge lp:~tilmanbaumann/charms/trusty/contrail-control/trunk into lp:~sdn-charmers/charms/trusty/contrail-control/trunk

[Tilman Baumann]

Previously xmpp-auth was only set to true when tls certificates are set.

There is, however, no strong link between the two settings.

This change allows setting this independently as required.

It would undoubtedly be nicer to have this option only in contrail-contrail and read it via context relation from there. This is rather quick and dirty and a bit redundant.
But it is what I built so far...

[Tilman Baumann (tilmanbaumann)]

Please merge

review: Approve

Unmerged revisions

33. By Tilman Baumann on 2018-01-24

Adding xmpp_auth option

Sparating xmpp_auth_enable from tls settings
Making it switchable via xmpp_auth config option

32. By Dmitrii Shcherbakov on 2017-03-26

enable TLS for XMPP communication as of contrail 3

TLS is enabled unconditionally for contail 3.0 and above deployments to
make sure communication is secure by default.

XMPP clients are vrouter agents on compute nodes. XMPP servers are
contrail-control nodes.

Certificates are generated automatically from a PKI charm (e.g. easyrsa
with a Subject Alternative Name field containing an IP address on a
control network which is used by both contrail-control and
neutron-contrail to communicate with each other.

Using a Subject Alternative Name (SAN) with an IP address avoids a
dependency on a DNS infrastructure while keeping the communication
secure between endpoints that are related.

Client authentication by XMPP servers was not supported at the time of
writing hence there is no mention of that in the code.

As of Juju 2.x network spaces can be used if an underlying cloud
supports them. In order to facilitate that support one should bind
control-node endpoint to a specific network space. Otherwise, old
mechanisms such as unit private address are going to be used to retrieve
an ip address to be included into a certificate.

Control node address fetching mechanism has changed as well: instead of
just doing a relation-get for a private IP address of a control-node
unit a different value is taken from the relation data called
control_node_ip (available due to modifications on the contrail-control
side) - it is either an address in the network space which control-node
endpoint is bound to or a fall-back address (unit private address).

31. By Dmitrii Shcherbakov on 2017-03-19

hooks: pep8 refactoring

=== modified file 'config.yaml'
--- config.yaml	2017-03-10 12:54:47 +0000
+++ config.yaml	2018-02-28 14:49:00 +0000
@@ -14,6 +14,12 @@
       The IP address and netmask of the control network (e.g. 192.168.0.0/24).
       This network will be used for Contrail endpoints.
       If not specified, default network will be used.
+      As of Juju 2.x, use network spaces instead and bind the control-node endpoint
+      to your desired network space instead.
   ssl-ca:
     type: string
     description: PEM encoded X.509 CA certificate for use in SSL.
+  xmpp_auth:
+    type: boolean
+    default: False
+    description: Use authentication for XMPP vrouter communication

=== modified file 'hooks/contrail_control_hooks.py'
--- hooks/contrail_control_hooks.py	2017-03-10 12:54:47 +0000
+++ hooks/contrail_control_hooks.py	2018-02-28 14:49:00 +0000
@@ -12,7 +12,7 @@
     log,
     relation_get,
     relation_ids,
-    relation_set
+    relation_set,
 )
 
 from charmhelpers.core.host import (
@@ -39,46 +39,52 @@
     write_control_config,
     write_nodemgr_config,
     write_ssl_ca_certificate,
-    write_vnc_api_config
+    write_vnc_api_config,
+    write_xmpp_tls_files,
 )
 
-PACKAGES = [ "contrail-control", "contrail-utils", "contrail-nodemgr" ]
+PACKAGES = ["contrail-control", "contrail-utils", "contrail-nodemgr"]
 
 hooks = Hooks()
 config = config()
 
+
 def add_control():
     # check relation dependencies
     if not config_get("control-provisioned") \
        and config_get("contrail-api-ready") \
        and config_get("contrail-discovery-ready") \
        and config_get("contrail-ifmap-ready") \
-       and config_get("identity-admin-ready"):
+       and config_get("identity-admin-ready") \
+       and config_get("tls-certificates-ready"):
         provision_control()
         config["control-provisioned"] = True
 
+
 @hooks.hook("config-changed")
 def config_changed():
     write_config()
     configure_ssl()
     if config.get("control-provisioned"):
         configure_control_network()
-
-    settings = { "private-address": control_network_ip() }
+    settings = {"private-address": control_network_ip()}
     for rid in relation_ids("control-node"):
         relation_set(relation_id=rid, relation_settings=settings)
 
+
 def config_get(key):
     try:
         return config[key]
     except KeyError:
         return None
 
+
 def configure_control_network():
     if control_network_ip() != config["provisioned-host-ip"]:
         unprovision_control()
         provision_control()
 
+
 def configure_ssl():
     cert = config.get("ssl-ca")
     if cert:
@@ -86,6 +92,7 @@
     else:
         remove_ssl_ca_certificate()
 
+
 @hooks.hook("contrail-api-relation-changed")
 def contrail_api_changed():
     if not relation_get("port"):
@@ -95,6 +102,7 @@
     config["contrail-api-ready"] = True
     add_control()
 
+
 @hooks.hook("contrail-api-relation-departed")
 @hooks.hook("contrail-api-relation-broken")
 def contrail_api_departed():
@@ -103,6 +111,7 @@
         config["contrail-api-ready"] = False
     write_vnc_api_config()
 
+
 @hooks.hook("contrail-discovery-relation-changed")
 def contrail_discovery_changed():
     if not relation_get("port"):
@@ -112,6 +121,7 @@
     config["contrail-discovery-ready"] = True
     add_control()
 
+
 @hooks.hook("contrail-discovery-relation-departed")
 @hooks.hook("contrail-discovery-relation-broken")
 def contrail_discovery_departed():
@@ -120,13 +130,18 @@
         config["contrail-discovery-ready"] = False
     contrail_discovery_relation()
 
-@restart_on_change({"/etc/contrail/contrail-control.conf": ["contrail-control"],
-                    "/etc/contrail/control-node.conf": ["contrail-control"],
-                    "/etc/contrail/contrail-control-nodemgr.conf": ["contrail-control-nodemgr"]})
+
+@restart_on_change(
+    {
+        "/etc/contrail/contrail-control.conf": ["contrail-control"],
+        "/etc/contrail/control-node.conf": ["contrail-control"],
+        "/etc/contrail/contrail-control-nodemgr.conf":
+        ["contrail-control-nodemgr"]})
 def contrail_discovery_relation():
     write_control_config()
     write_nodemgr_config()
 
+
 @hooks.hook("contrail-ifmap-relation-changed")
 def contrail_ifmap_changed():
     creds = relation_get("creds")
@@ -138,6 +153,7 @@
     config["contrail-ifmap-ready"] = True
     add_control()
 
+
 @hooks.hook("contrail-ifmap-relation-departed")
 @hooks.hook("contrail-ifmap-relation-broken")
 def contrail_ifmap_departed():
@@ -146,16 +162,21 @@
         config["contrail-ifmap-ready"] = False
     contrail_ifmap_relation()
 
-@restart_on_change({"/etc/contrail/contrail-control.conf": ["contrail-control"],
-                    "/etc/contrail/control-node.conf": ["contrail-control"]})
+
+@restart_on_change(
+    {
+        "/etc/contrail/contrail-control.conf": ["contrail-control"],
+        "/etc/contrail/control-node.conf": ["contrail-control"]})
 def contrail_ifmap_relation():
     write_control_config()
 
+
 @hooks.hook("control-node-relation-joined")
 def control_node_joined():
-    settings = { "private-address": control_network_ip() }
+    settings = {"private-address": control_network_ip()}
     relation_set(relation_settings=settings)
 
+
 @hooks.hook("identity-admin-relation-changed")
 def identity_admin_changed():
     if not relation_get("service_hostname"):
@@ -165,6 +186,7 @@
     config["identity-admin-ready"] = True
     add_control()
 
+
 @hooks.hook("identity-admin-relation-departed")
 @hooks.hook("identity-admin-relation-broken")
 def identity_admin_departed():
@@ -173,6 +195,50 @@
         config["identity-admin-ready"] = False
     write_vnc_api_config()
 
+
[e-mail]('tls-certificates-relation-joined')
+def tls_certificates_relation_joined():
+    # a hostname could also be provided as a SAN
+    # (Subject Alternative Name) but having this one
+    # has certain implications
+    # https://tools.ietf.org/html/rfc2818#section-3.1
+    # "If a subjectAltName extension of type dNSName
+    # is present, that MUST be used as the identity"
+    # Therefore it is not used here as we don't need
+    # a DNS infrastructure dependency
+    ip_san = control_network_ip()
+    settings = {
+        'sans': json.dumps([ip_san, '127.0.0.1']),
+        'common_name': ip_san,
+        'certificate_name': local_unit().replace('/', '_')
+    }
+    relation_set(relation_settings=settings)
+
+
[e-mail]('tls-certificates-relation-changed')
+def tls_certificates_relation_changed():
+    # check that the -provides side have set the data we need
+    # and render the affected files
+    unitname = local_unit().replace('/', '_')
+    cert = '{0}.server.cert'.format(unitname)
+    key = '{0}.server.key'.format(unitname)
+    certv = relation_get(cert)
+    keyv = relation_get(key)
+    ca = relation_get('ca')
+
+    if certv and keyv and ca:
+        write_xmpp_tls_files(certv, keyv, ca)
+        config["tls-certificates-ready"] = True
+    else:
+        log('tls-certificates relation data is not fully available')
+        config["tls-certificates-ready"] = False
+
+
[e-mail]('tls-certificates-relation-departed')
+def tls_certificates_relation_departed():
+        config["tls-certificates-ready"] = False
+
+
 @hooks.hook()
 def install():
     configure_sources(True, "install-sources", "install-keys")
@@ -182,26 +248,32 @@
     fix_permissions()
     fix_nodemgr()
 
+
 def main():
     try:
         hooks.execute(sys.argv)
     except UnregisteredHookError as e:
         log("Unknown hook {} - skipping.".format(e))
 
+
 def remove_control():
     if config_get("control-provisioned"):
         unprovision_control()
         config["control-provisioned"] = False
 
+
 @hooks.hook("upgrade-charm")
 def upgrade_charm():
     write_control_config()
     write_nodemgr_config()
     service_restart("supervisor-control")
 
-@restart_on_change({"/etc/contrail/contrail-control.conf": ["contrail-control"]})
+
+@restart_on_change(
+    {"/etc/contrail/contrail-control.conf": ["contrail-control"]})
 def write_config():
     write_control_config()
 
+
 if __name__ == "__main__":
     main()

=== modified file 'hooks/contrail_control_utils.py'
--- hooks/contrail_control_utils.py	2017-03-10 12:54:47 +0000
+++ hooks/contrail_control_utils.py	2018-02-28 14:49:00 +0000
@@ -21,26 +21,32 @@
     log,
     related_units,
     relation_get,
+    relation_set,
     relation_ids,
     relation_type,
     remote_unit,
-    unit_get
+    unit_private_ip,
+    network_get_primary_address,
 )
 from charmhelpers.core.host import service_restart
 from charmhelpers.core.templating import render
 
 apt_pkg.init()
 
+
 def dpkg_version(pkg):
     try:
-        return check_output(["dpkg-query", "-f", "${Version}\\n", "-W", pkg]).rstrip()
+        return check_output(
+            ["dpkg-query", "-f", "${Version}\\n", "-W", pkg]).rstrip()
     except CalledProcessError:
         return None
 
+
 CONTRAIL_VERSION = dpkg_version("contrail-control")
 
 config = config()
 
+
 def retry(f=None, timeout=10, delay=2):
     """Retry decorator.
 
@@ -64,6 +70,7 @@
     """
     if not f:
         return functools.partial(retry, timeout=timeout, delay=delay)
+
     @functools.wraps(f)
     def func(*args, **kwargs):
         start = time()
@@ -84,29 +91,36 @@
                 raise error
     return func
 
+
 def contrail_api_ctx():
-    ctxs = [ { "api_server": gethostbyname(relation_get("private-address", unit, rid)),
-               "api_port": port }
-             for rid in relation_ids("contrail-api")
-             for unit, port in
-             ((unit, relation_get("port", unit, rid)) for unit in related_units(rid))
-             if port ]
+    ctxs = [{"api_server": gethostbyname(relation_get("private-address",
+                                                      unit, rid)),
+             "api_port": port}
+            for rid in relation_ids("contrail-api")
+            for unit, port in
+            ((unit, relation_get("port", unit, rid))
+             for unit in related_units(rid))
+            if port]
     return ctxs[0] if ctxs else {}
 
+
 def contrail_ctx():
-    return { "host_ip": control_network_ip() }
+    return {"host_ip": control_network_ip()}
+
 
 def contrail_discovery_ctx():
-    ctxs = [ { "discovery_server": vip if vip \
-                 else gethostbyname(relation_get("private-address", unit, rid)),
-               "discovery_port": port }
-             for rid in relation_ids("contrail-discovery")
-             for unit, port, vip in
-             ((unit, relation_get("port", unit, rid), relation_get("vip", unit, rid))
-              for unit in related_units(rid))
-             if port ]
+    ctxs = [{"discovery_server": vip if vip
+             else gethostbyname(relation_get("private-address", unit, rid)),
+             "discovery_port": port}
+            for rid in relation_ids("contrail-discovery")
+            for unit, port, vip in
+            ((unit, relation_get("port", unit, rid),
+              relation_get("vip", unit, rid))
+             for unit in related_units(rid))
+            if port]
     return ctxs[0] if ctxs else {}
 
+
 def contrail_ifmap_ctx():
     ctxs = []
     unit = local_unit()
@@ -123,6 +137,7 @@
                     ctxs.append(ctx)
     return ctxs[0] if ctxs else {}
 
+
 @retry(timeout=300)
 def contrail_provision_control(hostname, ip, router_asn, api_ip, api_port, op,
                                user, password, tenant):
@@ -137,19 +152,42 @@
                 "--admin_password", password,
                 "--admin_tenant_name", tenant])
 
+
 def control_network_ip():
-    fallback = gethostbyname(unit_get("private-address"))
-    network = config.get("control-network")
-    if network:
-        return get_address_in_network(network, fallback)
-    else:
-        return fallback
+    '''
+    With Juju 2.x, uses an endpoint (relation)
+    network space binding if unspecified will use a "unit private address"
+    which is far less explicit if you look at the Juju implementation.
+    If you use Juju 2.x and above - bind the control-node endpoint to a network
+    space to get a proper address in this function.
+
+    If network-get throws an exception (juju 1.x or spaces are not supported)
+    will try to fall back to the control-network parameter or a private-address
+    as returned by Juju.
+    '''
+    try:
+        address = network_get_primary_address('control-node')
+    except NotImplementedError:
+        log('Network spaces are not implemented - falling back to'
+            ' getting a private address')
+        address = None
+
+    if not address:
+        fallback = gethostbyname(unit_private_ip())
+        network = config.get("control-network")
+        if network:
+            address = get_address_in_network(network, fallback)
+        else:
+            address = fallback
+
+    return address
+
 
 def fix_nodemgr():
     # add files missing from contrail-nodemgr package
     dest = "/etc/contrail/supervisord_control_files/" \
-           + ("contrail-control-nodemgr.ini" \
-              if version_compare(CONTRAIL_VERSION, "3.1") >= 0 \
+           + ("contrail-control-nodemgr.ini"
+              if version_compare(CONTRAIL_VERSION, "3.1") >= 0
               else "contrail-nodemgr-control.ini")
     shutil.copy("files/contrail-nodemgr-control.ini", dest)
     pw = pwd.getpwnam("contrail")
@@ -159,7 +197,7 @@
           if version_compare(CONTRAIL_VERSION, "3.1") >= 0 \
           else "files/contrail-control-nodemgr"
     shutil.copy(src, "/etc/init.d/contrail-control-nodemgr")
-    os.chmod("/etc/init.d/contrail-control-nodemgr", 0755)
+    os.chmod("/etc/init.d/contrail-control-nodemgr", 0o755)
 
     # fake ntp status when inside a container
     if is_container():
@@ -167,20 +205,24 @@
 
     service_restart("supervisor-control")
 
+
 def fix_permissions():
-    os.chmod("/etc/contrail", 0755)
+    os.chmod("/etc/contrail", 0o755)
     os.chown("/etc/contrail", 0, 0)
 
+
 def identity_admin_ctx():
-    ctxs = [ { "auth_host": gethostbyname(hostname),
-               "auth_port": relation_get("service_port", unit, rid),
-               "auth_protocol": relation_get("service_protocol", unit, rid) }
-             for rid in relation_ids("identity-admin")
-             for unit, hostname in
-             ((unit, relation_get("service_hostname", unit, rid)) for unit in related_units(rid))
-             if hostname ]
+    ctxs = [{"auth_host": gethostbyname(hostname),
+             "auth_port": relation_get("service_port", unit, rid),
+             "auth_protocol": relation_get("service_protocol", unit, rid)}
+            for rid in relation_ids("identity-admin")
+            for unit, hostname in
+            ((unit, relation_get("service_hostname", unit, rid))
+             for unit in related_units(rid))
+            if hostname]
     return ctxs[0] if ctxs else {}
 
+
 def is_container():
     """Return boolean determining if inside container"""
     try:
@@ -189,26 +231,36 @@
     except CalledProcessError:
         return False
 
+
 def provision_control():
     hostname = gethostname()
     ip = control_network_ip()
-    api_ip, api_port = [ (gethostbyname(relation_get("private-address", unit, rid)),
-                          port)
-                         for rid in relation_ids("contrail-api")
-                         for unit, port in
-                         ((unit, relation_get("port", unit, rid)) for unit in related_units(rid))
-                         if port ][0]
-    user, password, tenant = [ (relation_get("service_username", unit, rid),
-                                relation_get("service_password", unit, rid),
-                                relation_get("service_tenant_name", unit, rid))
-                               for rid in relation_ids("identity-admin")
-                               for unit in related_units(rid)
-                               if relation_get("service_hostname", unit, rid) ][0]
+    api_ip, api_port = [(gethostbyname(relation_get("private-address",
+                                                    unit, rid)), port)
+                        for rid in relation_ids("contrail-api")
+                        for unit, port in
+                        ((unit, relation_get("port", unit, rid))
+                         for unit in related_units(rid))
+                        if port][0]
+    user, password, tenant = [(relation_get("service_username", unit, rid),
+                               relation_get("service_password", unit, rid),
+                               relation_get("service_tenant_name", unit, rid))
+                              for rid in relation_ids("identity-admin")
+                              for unit in related_units(rid)
+                              if relation_get("service_hostname",
+                                              unit, rid)][0]
     log("Provisioning control {}".format(ip))
     contrail_provision_control(hostname, ip, 64512, api_ip, api_port, "add",
                                user, password, tenant)
+
+    # support for network spaces
+    # see control_network_ip implementation
+    for rid in relation_ids("control-node"):
+        relation_set(rid, {'control_node_ip': ip})
+
     config["provisioned-host-ip"] = ip
 
+
 def remove_ssl_ca_certificate():
     if os.path.exists("/usr/local/share/ca-certificates/contrail-juju.crt"):
         os.remove("/usr/local/share/ca-certificates/contrail-juju.crt")
@@ -217,10 +269,12 @@
     else:
         return False
 
+
 def units(relation):
     """Return a list of units for the specified relation"""
-    return [ unit for rid in relation_ids(relation)
-                  for unit in related_units(rid) ]
+    return [unit for rid in relation_ids(relation)
+            for unit in related_units(rid)]
+
 
 def unprovision_control():
     relation = relation_type()
@@ -234,10 +288,11 @@
         api_ip = gethostbyname(relation_get("private-address"))
         api_port = relation_get("port")
     else:
-        api_ip, api_port = [ (gethostbyname(relation_get("private-address", unit, rid)),
-                              relation_get("port", unit, rid))
-                             for rid in relation_ids("contrail-api")
-                             for unit in related_units(rid) ][0]
+        api_ip, api_port = [(gethostbyname(relation_get("private-address",
+                                                        unit, rid)),
+                             relation_get("port", unit, rid))
+                            for rid in relation_ids("contrail-api")
+                            for unit in related_units(rid)][0]
     user = None
     password = None
     tenant = None
@@ -246,37 +301,58 @@
         password = relation_get("service_password")
         tenant = relation_get("service_tenant_name")
     else:
-        user, password, tenant = [ (relation_get("service_username", unit, rid),
-                                    relation_get("service_password", unit, rid),
-                                    relation_get("service_tenant_name", unit, rid))
-                                   for rid in relation_ids("identity-admin")
-                                   for unit in related_units(rid) ][0]
+        user, password, tenant = [(relation_get("service_username", unit, rid),
+                                   relation_get("service_password", unit, rid),
+                                   relation_get("service_tenant_name",
+                                                unit, rid))
+                                  for rid in relation_ids("identity-admin")
+                                  for unit in related_units(rid)][0]
     log("Unprovisioning control {}".format(ip))
     try:
-        contrail_provision_control(hostname, ip, 64512, api_ip, api_port, "del",
-                                   user, password, tenant)
+        contrail_provision_control(
+            hostname,
+            ip,
+            64512,
+            api_ip,
+            api_port,
+            "del",
+            user,
+            password,
+            tenant)
     except CalledProcessError:
         pass
     del config["provisioned-host-ip"]
 
+
 def write_control_config():
     ctx = {}
     ctx.update(contrail_ctx())
     ctx.update(contrail_discovery_ctx())
     ctx.update(contrail_ifmap_ctx())
+
+    xmpp_auth_enable = config.get('xmpp_auth')
+    ctx.update({"xmpp_auth_enable": xmpp_auth_enable})
+
+    # a tls-certificates guard here is for the upgrade scenario
+    tls_implemented = version_compare(CONTRAIL_VERSION, "3.0") >= 0 and\
+        config.get("tls-certificates-ready")
+    ctx.update({'tls_implemented': tls_implemented})
     target = "/etc/contrail/contrail-control.conf" \
              if version_compare(CONTRAIL_VERSION, "2.0") >= 0 \
              else "/etc/contrail/control-node.conf"
-    render("control-node.conf", target, ctx, "root", "contrail", 0440)
+    render("control-node.conf", target, ctx, "root", "contrail", 0o440)
+
 
 def write_nodemgr_config():
     ctx = contrail_discovery_ctx()
     render("contrail-control-nodemgr.conf",
            "/etc/contrail/contrail-control-nodemgr.conf", ctx)
 
+
 def write_ssl_ca_certificate(cert):
     if os.path.exists("/usr/local/share/ca-certificates/contrail-juju.crt"):
-        with open("/usr/local/share/ca-certificates/contrail-juju.crt", "r") as f:
+        with open("/usr/local/share/ca-certificates/contrail-juju.crt", "r") \
+                as f:
             c = f.read()
         if c == cert:
             return False
@@ -285,6 +361,30 @@
     check_call(["update-ca-certificates"])
     return True
 
+
+def write_xmpp_tls_files(serv_cert, priv_key, ca):
+    prefix = '/etc/contrail/ssl'
+    certs = os.path.join(prefix, 'certs')
+    private = os.path.join(prefix, 'private')
+
+    entry = pwd.getpwnam('contrail')
+    for p in [prefix, certs, private]:
+        if not os.path.exists(p):
+            os.makedirs(p, 0o750)
+            os.chown(p, entry.pw_uid, entry.pw_gid)
+
+    fcontent = {
+        os.path.join(certs, 'server.pem'): serv_cert,
+        os.path.join(private, 'server-privkey.pem'): priv_key,
+        os.path.join(certs, 'ca-cert.pem'): ca,
+    }
+
+    for filepath, content in fcontent.iteritems():
+        with open(filepath, 'w+') as f:
+            f.truncate(0)
+            f.write(content)
+
+
 def write_vnc_api_config():
     ctx = {}
     ctx.update(contrail_api_ctx())

=== added symlink 'hooks/tls-certificates-relation-changed'
=== target is u'contrail_control_hooks.py'
=== added symlink 'hooks/tls-certificates-relation-departed'
=== target is u'contrail_control_hooks.py'
=== added symlink 'hooks/tls-certificates-relation-joined'
=== target is u'contrail_control_hooks.py'
=== modified file 'metadata.yaml'
--- metadata.yaml	2015-09-17 21:09:59 +0000
+++ metadata.yaml	2018-02-28 14:49:00 +0000
@@ -20,3 +20,5 @@
     interface: contrail-ifmap
   identity-admin:
     interface: keystone-admin
+  tls-certificates:
+    interface: tls-certificates

=== modified file 'templates/control-node.conf'
--- templates/control-node.conf	2015-10-01 12:29:04 +0000
+++ templates/control-node.conf	2018-02-28 14:49:00 +0000
@@ -6,6 +6,16 @@
 [DEFAULT]
 hostip = {{ host_ip }}
 
+{% if xmpp_auth_enable -%}
+xmpp_auth_enable=true
+{% endif -%}
+
+{% if tls_implemented -%}
+xmpp_server_cert=/etc/contrail/ssl/certs/server.pem
+xmpp_server_key=/etc/contrail/ssl/private/server-privkey.pem
+xmpp_ca_cert=/etc/contrail/ssl/certs/ca-cert.pem
+{% endif -%}
+
 [DISCOVERY]
 server = {{ discovery_server }}
 port = {{ discovery_port }}
@@ -13,4 +23,3 @@
 [IFMAP]
 user = {{ ifmap_user }}
 password = {{ ifmap_password }}
-