Merge lp:~vds/charms/trusty/contrail-configuration/TLS_support_for_RabbitMQ_connection into lp:~sdn-charmers/charms/trusty/contrail-configuration/trunk

[Vincenzo Di Somma]

Adding support for SSL/TLS connection to the RabittMQ connection.

Adding support for SSL/TLS connection to the RabittMQ connection.

[Robert Ayres (robert-ayres)]

Thanks for the patch!

I'm struggling to make this work in testing atm. This is using trusty + Contrail 3.2.3.

I've generated certs, keys, ca-certs for rabbitmq-server unit and am using the appropriate 'ssl_*' options. I can see RabbitMQ is listening on SSL socket (5671) and the config is pointed at the right certs + keys.

However contrail-api (on contrail-configuration unit) using option 'rabbit_use_ssl = True' won't connect to it.

RabbitMQ logs show:

=ERROR REPORT==== 22-Sep-2017::20:27:43 ===
error on AMQP connection <0.19312.0>: {ssl_upgrade_error,
                                       {certfile,{badmatch,[]}}} (unknown POSIX error)

I've tried combinations of ports (5672, 5671) and 'kombu_ssl_*' options, but nothing gets contrail-api to connect atm.

Are you able to make it work?

The other thing to note in this patch is these contrail-configuration configs should probably also be updated with 'rabbit_use_ssl' option:

contrail-device-manager.conf
contrail-svc-monitor.conf
contrail-schema.conf

review: Needs Fixing

[Vincenzo Di Somma (vds)]

I've fixed the missing parameter in all the templates. I can't see any error in the log.

[Robert Ayres (robert-ayres)]

Apologies for the delay.

review: Approve

=== modified file 'hooks/contrail_configuration_utils.py'
--- hooks/contrail_configuration_utils.py	2017-08-24 03:36:31 +0000
+++ hooks/contrail_configuration_utils.py	2017-09-25 10:09:39 +0000
@@ -96,17 +96,25 @@
 def amqp_ctx():
     ctxs = []
     servers = OrderedDict()
+    ssl = False
+    port = "5672"
     for rid in relation_ids("amqp"):
         for unit in related_units(rid):
             password = relation_get("password", unit, rid)
             if not password:
                 continue
+            ssl_port = relation_get("ssl_port")
+            if ssl_port:
+                port = ssl_port
+                ssl= True
             ctxs.append({"rabbit_user": "contrail",
                          "rabbit_password": password,
-                         "rabbit_vhost": "contrail"})
+                         "rabbit_vhost": "contrail",
+                         "rabbit_use_ssl": ssl,})
             vip = relation_get("vip", unit, rid)
+            
             server = (vip if vip \
-              else gethostbyname(relation_get("hostname", unit, rid))) + ":5672"
+              else gethostbyname(relation_get("hostname", unit, rid))) + ":" + port
             servers[server] = None
     ctx = ctxs[0] if ctxs else {}
     ctx["rabbit_servers"] = servers.keys()

=== modified file 'templates/contrail-api.conf'
--- templates/contrail-api.conf	2017-06-29 01:54:34 +0000
+++ templates/contrail-api.conf	2017-09-25 10:09:39 +0000
@@ -26,6 +26,7 @@
 rabbit_user = {{ rabbit_user }}
 rabbit_password = {{ rabbit_password }}
 rabbit_vhost = {{ rabbit_vhost }}
+rabbit_use_ssl = {{ rabbit_use_ssl }}
 
 [KEYSTONE]
 auth_host = {{ auth_host }}

=== modified file 'templates/contrail-device-manager.conf'
--- templates/contrail-device-manager.conf	2017-03-29 20:04:12 +0000
+++ templates/contrail-device-manager.conf	2017-09-25 10:09:39 +0000
@@ -17,6 +17,7 @@
 rabbit_user = {{ rabbit_user }}
 rabbit_password = {{ rabbit_password }}
 rabbit_vhost = {{ rabbit_vhost }}
+rabbit_use_ssl = {{ rabbit_use_ssl }}
 
 [KEYSTONE]
 admin_user = {{ admin_user }}

=== modified file 'templates/contrail-schema.conf'
--- templates/contrail-schema.conf	2017-03-29 20:04:12 +0000
+++ templates/contrail-schema.conf	2017-09-25 10:09:39 +0000
@@ -15,6 +15,7 @@
 rabbit_user = {{ rabbit_user }}
 rabbit_password = {{ rabbit_password }}
 rabbit_vhost = {{ rabbit_vhost }}
+rabbit_use_ssl = {{ rabbit_use_ssl }}
 {%- endif %}
 
 [KEYSTONE]

=== modified file 'templates/contrail-svc-monitor.conf'
--- templates/contrail-svc-monitor.conf	2017-03-29 20:04:12 +0000
+++ templates/contrail-svc-monitor.conf	2017-09-25 10:09:39 +0000
@@ -21,6 +21,7 @@
 rabbit_user = {{ rabbit_user }}
 rabbit_password = {{ rabbit_password }}
 rabbit_vhost = {{ rabbit_vhost }}
+rabbit_use_ssl = {{ rabbit_use_ssl }}
 
 [KEYSTONE]
 auth_host = {{ auth_host }}