Skip to content

Commit 8aa76ba

Browse files
MoteHueMoteHue
committed
Support and document persisting the Octavia CA
1 parent 5707bb2 commit 8aa76ba

File tree

4 files changed

+188
-0
lines changed

4 files changed

+188
-0
lines changed

‎doc/source/operations/octavia.rst‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,148 @@ The default image path is ``/tmp/amphora-x64-haproxy.qcow2``.
6565
6666
kayobe playbook run ${KAYOBE_CONFIG_PATH}/ansible/maintenance/octavia-amphora-image-register.yml -e image_path="<path-to-amphora-image>"
6767
68+
Handling TLS certificates
69+
=========================
70+
71+
Octavia uses mutual TLS to secure communication between the amphorae and
72+
Octavia services. It uses a private CA to sign both client and server
73+
certificates. We use the kolla-ansible built-in support for generating these
74+
certificates:
75+
76+
.. code-block:: console
77+
78+
kayobe kolla ansible run octavia-certificates
79+
80+
This command will output certificates and keys in ``${KOLLA_CONFIG_PATH}/octavia-certificates``
81+
82+
Copy the relevant certificates into your kayobe-config:
83+
84+
.. code-block:: console
85+
86+
cd ${KAYOBE_CONFIG_PATH}/environments/$KAYOBE_ENVIRONMENT/kolla/config/octavia
87+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client_ca.cert.pem .
88+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client.cert-and-key.pem .
89+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.cert.pem .
90+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.key.pem .
91+
92+
Encrypt any files containing the keys:
93+
94+
.. code-block:: console
95+
96+
ansible-vault encrypt client.cert-and-key.pem --vault-password-file ~/vault
97+
ansible-vault encrypt server_ca.key.pem --vault-password-file ~/vault
98+
99+
Checking certificate expiry
100+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
101+
102+
.. code-block:: console
103+
104+
ansible-vault decrypt client.cert-and-key.pem --vault-password-file ~/vault
105+
openssl x509 -enddate -noout -in client.cert-and-key.pem
106+
notAfter=Aug 12 10:45:35 2022 GMT
107+
108+
Backing up the octavia-certificates directory
109+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
110+
111+
In the root of your kayobe-config checkout:
112+
113+
.. code-block:: console
114+
115+
tools/backup-octavia-certificates.sh
116+
117+
This will output an encrypted backup to ``$KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar``
118+
Commit this file to store the backup.
119+
120+
Restoring octavia-certificates directory when regenerating certificates
121+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
122+
123+
In the root of your kayobe-config checkout:
124+
125+
.. code-block:: console
126+
127+
tools/restore-octavia-certificates.sh
128+
129+
This will use the encrypted backup in ``$KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar``
130+
to restore ``${KOLLA_CONFIG_PATH}/octavia-certificates``. This will allow you
131+
to reuse the client CA.
132+
133+
Rotating client.cert-and-key.pem
134+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
135+
136+
This has a lifetime of 1 year.
137+
138+
1) Follow the steps to restore octavia-certificates so you can reuse the client
139+
CA.
140+
141+
2) Make sure your config allows you to regenerate a certificate with the same
142+
common name.
143+
144+
.. code-block:: console
145+
:caption: $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/index.txt.attr
146+
147+
unique_subject = no
148+
149+
3) Remove the old files relating to the client certificate:
150+
151+
.. code-block:: console
152+
153+
rm $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/{client.cert-and-key.pem,client.csr.pem,client.cert.pem}
154+
155+
4) Regenerate the certificates
156+
157+
.. code-block:: console
158+
159+
kayobe kolla ansible run octavia-certificates
160+
161+
5) Backup your octavia-certificates directory (see previous section).
162+
163+
6) Copy your new certificate to the correct location:
164+
165+
.. code-block:: console
166+
167+
cd ${KAYOBE_CONFIG_PATH}/environments/$KAYOBE_ENVIRONMENT/kolla/config/octavia
168+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client_ca.cert.pem .
169+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client.cert-and-key.pem .
170+
ansible-vault encrypt client.cert-and-key.pem --vault-password-file ~/vault
171+
172+
7) Reconfigure octavia
173+
174+
.. code-block:: console
175+
176+
kayobe overcloud service reconfigure -kt octavia
177+
178+
8) Run tempest with the `octavia` test list to check it is working.
179+
180+
9) Commit and push any changes.
181+
182+
Rotating the CAs
183+
~~~~~~~~~~~~~~~~
184+
185+
The CAs have a 10 year lifetime. Simply delete the relevant directory under
186+
``$KOLLA_CONFIG_PATH/octavia-certificates/`` and regenerate it with:
187+
188+
.. code-block:: console
189+
190+
kayobe kolla ansible run octavia-certificates
191+
192+
Copy the relevant certificates into your kayobe-config.
193+
194+
.. code-block:: console
195+
196+
cd ${KAYOBE_CONFIG_PATH}/environments/$KAYOBE_ENVIRONMENT/kolla/config/octavia
197+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client_ca.cert.pem .
198+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client.cert-and-key.pem .
199+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.cert.pem .
200+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.key.pem .
201+
202+
Encrypt any files containing the keys.
203+
204+
.. code-block:: console
205+
206+
ansible-vault encrypt client.cert-and-key.pem --vault-password-file ~/vault
207+
ansible-vault encrypt server_ca.key.pem --vault-password-file ~/vault
208+
209+
Follow any instructions in the `upstream docs <https://docs.openstack.org/octavia/latest/admin/guides/operator-maintenance.html>`_.
68210

69211
Manually deleting broken load balancers
70212
=======================================

‎tools/backup-octavia-certificates.sh‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/bash
2+
3+
set -eu
4+
5+
if [ -z ${KAYOBE_CONFIG_PATH:+x} ]; then
6+
1>&2 echo 'Please source kayobe-env'
7+
exit 1
8+
fi
9+
10+
if [ -z ${KAYOBE_VAULT_PASSWORD:+x} ]; then
11+
1>&2 echo 'Please set Kayobe vault password'
12+
exit 1
13+
fi
14+
15+
if [ ! -d $KOLLA_CONFIG_PATH/octavia-certificates ]; then
16+
1>&2 echo 'Certificates missing'
17+
exit 1
18+
fi
19+
20+
pushd $KOLLA_CONFIG_PATH
21+
ls octavia-certificates
22+
tar -c -f - octavia-certificates | ansible-vault encrypt --vault-password-file $KAYOBE_CONFIG_PATH/../../tools/vault-helper > $KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar 2>/dev/null
23+
popd

‎tools/restore-octavia-certificates.sh‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
3+
set -eu
4+
5+
if [ -z ${KAYOBE_CONFIG_PATH:+x} ]; then
6+
1>&2 echo 'Please source kayobe-env'
7+
exit -1
8+
fi
9+
10+
if [ -z ${KAYOBE_VAULT_PASSWORD:+x} ]; then
11+
1>&2 echo 'Please set Kayobe vault password'
12+
exit -1
13+
fi
14+
15+
if [ -d $KOLLA_CONFIG_PATH/octavia-certificates ]; then
16+
1>&2 echo 'Certificates exists. Please remove if you wish to restore.'
17+
exit -1
18+
fi
19+
20+
cat $KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar | ansible-vault decrypt --vault-password-file $KAYOBE_CONFIG_PATH/../../tools/vault-helper 2>/dev/null | tar -xvf - -C $KOLLA_CONFIG_PATH

‎tools/vault-helper.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/bash
2+
3+
echo "$KAYOBE_VAULT_PASSWORD"

0 commit comments

Comments
 (0)