Skip to content

Commit 4362c8e

Browse files
MoteHueMoteHue
committed
Support and document persisting the Octavia CA
1 parent 5707bb2 commit 4362c8e

File tree

3 files changed

+188
-0
lines changed

3 files changed

+188
-0
lines changed

‎doc/source/operations/octavia.rst‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,151 @@ The default image path is ``/tmp/amphora-x64-haproxy.qcow2``.
6565
6666
kayobe playbook run ${KAYOBE_CONFIG_PATH}/ansible/maintenance/octavia-amphora-image-register.yml -e image_path="<path-to-amphora-image>"
6767
68+
Handling TLS certificates
69+
=========================
70+
71+
Octavia uses mutual TLS to secure communication between the amphorae and
72+
Octavia services. It uses a private CA to sign both client and server
73+
certificates. We use the kolla-ansible built-in support for generating these
74+
certificates:
75+
76+
.. code-block:: console
77+
78+
kayobe kolla ansible run octavia-certificates
79+
80+
This command will output certificates and keys in ``${KOLLA_CONFIG_PATH}/octavia-certificates``
81+
82+
Copy the relevant certificates into your kayobe-config:
83+
84+
.. code-block:: console
85+
86+
cd ${KAYOBE_CONFIG_PATH}/environments/$KAYOBE_ENVIRONMENT/kolla/config/octavia
87+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client_ca.cert.pem .
88+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client.cert-and-key.pem .
89+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.cert.pem .
90+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.key.pem .
91+
92+
Encrypt any files containing the keys:
93+
94+
.. code-block:: console
95+
96+
ansible-vault encrypt client.cert-and-key.pem --vault-password-file ~/vault
97+
ansible-vault encrypt server_ca.key.pem --vault-password-file ~/vault
98+
99+
Checking certificate expiry
100+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
101+
102+
.. code-block:: console
103+
104+
ansible-vault decrypt client.cert-and-key.pem --vault-password-file ~/vault
105+
openssl x509 -enddate -noout -in client.cert-and-key.pem
106+
notAfter=Aug 12 10:45:35 2022 GMT
107+
108+
Backing up the octavia-certificates directory
109+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
110+
111+
In the root of your kayobe-config checkout:
112+
113+
.. code-block:: console
114+
115+
tools/backup-octavia-certificates.sh
116+
117+
This will output an encrypted backup to ``$KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar``
118+
Commit this file to store the backup.
119+
120+
Restoring octavia-certificates directory when regenerating certificates
121+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
122+
123+
In the root of your kayobe-config checkout:
124+
125+
.. code-block:: console
126+
127+
tools/restore-octavia-certificates.sh
128+
129+
This will use the encrypted backup in ``$KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar``
130+
to restore ``${KOLLA_CONFIG_PATH}/octavia-certificates``. This will allow you
131+
to reuse the client CA.
132+
133+
Rotating client.cert-and-key.pem
134+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
135+
136+
This has a life time of 1 year.
137+
138+
1) Follow the steps to restore octavia-certificates so you can reuse the client
139+
CA.
140+
141+
3) Make sure your config allows you to regenerate a certificate with the same
142+
common name.
143+
144+
.. code-block:: console
145+
:caption: $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/index.txt.attr
146+
147+
unique_subject = no
148+
149+
5) Remove the old files relating to the client certificate:
150+
151+
.. code-block:: console
152+
153+
kayobe# rm $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/{client.cert-and-key.pem,client.csr.pem,client.cert.pem}
154+
155+
6) Regenerate the certificates
156+
157+
.. code-block:: console
158+
159+
kayobe# kayobe kolla ansible run octavia-certificates
160+
161+
7) Backup your octavia-certificates directory (see previous section).
162+
163+
8) Copy your new certificate to the correct location:
164+
165+
.. code-block:: console
166+
167+
cd ${KAYOBE_CONFIG_PATH}/environments/$KAYOBE_ENVIRONMENT/kolla/config/octavia
168+
kayobe# cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client_ca.cert.pem .
169+
kayobe# cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client.cert-and-key.pem .
170+
kayobe# ansible-vault encrypt client.cert-and-key.pem --vault-password-file ~/vault
171+
Encryption successful
172+
173+
9) Reconfigure octavia
174+
175+
.. code-block:: console
176+
177+
kayobe# kayobe overcloud service reconfigure -kt octavia
178+
179+
10) Run tempest with the `octavia` test list to check it is working.
180+
181+
11) Commit and push any changes.
182+
183+
Rotating the CAs
184+
~~~~~~~~~~~~~~~~
185+
186+
The CAs have a 10 year lifetime. Simply delete the relevant directory under
187+
``$KOLLA_CONFIG_PATH/octavia-certificates/`` and regenerate it with:
188+
189+
.. code-block:: console
190+
191+
kayobe# kayobe kolla ansible run octavia-certificates
192+
193+
Copy the relevant certificates into your kayobe-config.
194+
195+
.. code-block:: console
196+
197+
kayobe# cd ${KAYOBE_CONFIG_PATH}/environments/$KAYOBE_ENVIRONMENT/kolla/config/octavia
198+
kayobe# cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client_ca.cert.pem .
199+
kayobe# cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client.cert-and-key.pem .
200+
kayobe# cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.cert.pem .
201+
kayobe# cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.key.pem .
202+
203+
Encrypt any files containing the keys.
204+
205+
.. code-block:: console
206+
207+
kayobe# ansible-vault encrypt client.cert-and-key.pem --vault-password-file ~/vault
208+
Encryption successful
209+
kayobe# ansible-vault encrypt server_ca.key.pem --vault-password-file ~/vault
210+
Encryption successful
211+
212+
Follow any instructions in the `upstream docs <https://docs.openstack.org/octavia/latest/admin/guides/operator-maintenance.html>`_.
68213

69214
Manually deleting broken load balancers
70215
=======================================

‎tools/backup-octavia-certificates.sh‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/bash
2+
3+
set -eu
4+
5+
if [ -z ${KAYOBE_CONFIG_PATH:+x} ]; then
6+
1>&2 echo 'Please source kayobe-env'
7+
exit -1
8+
fi
9+
10+
if [ -z ${KAYOBE_VAULT_PASSWORD:+x} ]; then
11+
1>&2 echo 'Please set Kayobe vault password'
12+
exit -1
13+
fi
14+
15+
if [ ! -d $KOLLA_CONFIG_PATH/octavia-certificates ]; then
16+
1>&2 echo 'Certificates missing'
17+
exit -1
18+
fi
19+
20+
pushd $KOLLA_CONFIG_PATH
21+
ls octavia-certificates
22+
tar -c -f - octavia-certificates | ansible-vault encrypt --vault-password-file $KAYOBE_CONFIG_PATH/../../tools/vault-helper > $KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar 2>/dev/null
23+
popd

‎tools/restore-octavia-certificates.sh‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
3+
set -eu
4+
5+
if [ -z ${KAYOBE_CONFIG_PATH:+x} ]; then
6+
1>&2 echo 'Please source kayobe-env'
7+
exit -1
8+
fi
9+
10+
if [ -z ${KAYOBE_VAULT_PASSWORD:+x} ]; then
11+
1>&2 echo 'Please set Kayobe vault password'
12+
exit -1
13+
fi
14+
15+
if [ -d $KOLLA_CONFIG_PATH/octavia-certificates ]; then
16+
1>&2 echo 'Certificates exists. Please remove if you wish to restore.'
17+
exit -1
18+
fi
19+
20+
cat $KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar | ansible-vault decrypt --vault-password-file $KAYOBE_CONFIG_PATH/../../tools/vault-helper 2>/dev/null | tar -xvf - -C $KOLLA_CONFIG_PATH

0 commit comments

Comments
 (0)