Skip to content

Commit 9958a80

Browse files
MoteHueMoteHue
committed
Support and document persisting the Octavia CA
1 parent 5707bb2 commit 9958a80

File tree

4 files changed

+187
-0
lines changed

4 files changed

+187
-0
lines changed

‎doc/source/operations/octavia.rst‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,147 @@ The default image path is ``/tmp/amphora-x64-haproxy.qcow2``.
6565
6666
kayobe playbook run ${KAYOBE_CONFIG_PATH}/ansible/maintenance/octavia-amphora-image-register.yml -e image_path="<path-to-amphora-image>"
6767
68+
Handling TLS certificates
69+
=========================
70+
71+
Octavia uses mutual TLS to secure communication between the amphorae and
72+
Octavia services. It uses a private CA to sign both client and server
73+
certificates. We use the kolla-ansible built-in support for generating these
74+
certificates:
75+
76+
.. code-block:: console
77+
78+
kayobe kolla ansible run octavia-certificates
79+
80+
This command will output certificates and keys in ``${KOLLA_CONFIG_PATH}/octavia-certificates``
81+
82+
Copy the relevant certificates into your kayobe-config:
83+
84+
.. code-block:: console
85+
86+
cd ${KAYOBE_CONFIG_PATH}/environments/$KAYOBE_ENVIRONMENT/kolla/config/octavia
87+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client_ca.cert.pem .
88+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client.cert-and-key.pem .
89+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.cert.pem .
90+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.key.pem .
91+
92+
Encrypt any files containing the keys:
93+
94+
.. code-block:: console
95+
96+
ansible-vault encrypt client.cert-and-key.pem --vault-password-file ~/vault
97+
ansible-vault encrypt server_ca.key.pem --vault-password-file ~/vault
98+
99+
Checking certificate expiry
100+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
101+
102+
.. code-block:: console
103+
104+
ansible-vault decrypt client.cert-and-key.pem --vault-password-file ~/vault
105+
openssl x509 -enddate -noout -in client.cert-and-key.pem
106+
107+
Backing up the octavia-certificates directory
108+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
109+
110+
In the root of your kayobe-config checkout:
111+
112+
.. code-block:: console
113+
114+
tools/backup-octavia-certificates.sh
115+
116+
This will output an encrypted backup to ``$KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar``
117+
Commit this file to store the backup.
118+
119+
Restoring octavia-certificates directory when regenerating certificates
120+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
121+
122+
In the root of your kayobe-config checkout:
123+
124+
.. code-block:: console
125+
126+
tools/restore-octavia-certificates.sh
127+
128+
This will use the encrypted backup in ``$KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar``
129+
to restore ``${KOLLA_CONFIG_PATH}/octavia-certificates``. This will allow you
130+
to reuse the client CA.
131+
132+
Rotating client.cert-and-key.pem
133+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
134+
135+
This has a lifetime of 1 year.
136+
137+
1) Follow the steps to restore octavia-certificates so you can reuse the client
138+
CA.
139+
140+
2) Make sure your config allows you to regenerate a certificate with the same
141+
common name.
142+
143+
.. code-block:: console
144+
:caption: $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/index.txt.attr
145+
146+
unique_subject = no
147+
148+
3) Remove the old files relating to the client certificate:
149+
150+
.. code-block:: console
151+
152+
rm $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/{client.cert-and-key.pem,client.csr.pem,client.cert.pem}
153+
154+
4) Regenerate the certificates
155+
156+
.. code-block:: console
157+
158+
kayobe kolla ansible run octavia-certificates
159+
160+
5) Backup your octavia-certificates directory (see previous section).
161+
162+
6) Copy your new certificate to the correct location:
163+
164+
.. code-block:: console
165+
166+
cd ${KAYOBE_CONFIG_PATH}/environments/$KAYOBE_ENVIRONMENT/kolla/config/octavia
167+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client_ca.cert.pem .
168+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client.cert-and-key.pem .
169+
ansible-vault encrypt client.cert-and-key.pem --vault-password-file ~/vault
170+
171+
7) Reconfigure octavia
172+
173+
.. code-block:: console
174+
175+
kayobe overcloud service reconfigure -kt octavia
176+
177+
8) Run tempest with the `octavia` test list to check it is working.
178+
179+
9) Commit and push any changes.
180+
181+
Rotating the CAs
182+
~~~~~~~~~~~~~~~~
183+
184+
The CAs have a 10 year lifetime. Simply delete the relevant directory under
185+
``$KOLLA_CONFIG_PATH/octavia-certificates/`` and regenerate it with:
186+
187+
.. code-block:: console
188+
189+
kayobe kolla ansible run octavia-certificates
190+
191+
Copy the relevant certificates into your kayobe-config.
192+
193+
.. code-block:: console
194+
195+
cd ${KAYOBE_CONFIG_PATH}/environments/$KAYOBE_ENVIRONMENT/kolla/config/octavia
196+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client_ca.cert.pem .
197+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client.cert-and-key.pem .
198+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.cert.pem .
199+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.key.pem .
200+
201+
Encrypt any files containing the keys.
202+
203+
.. code-block:: console
204+
205+
ansible-vault encrypt client.cert-and-key.pem --vault-password-file ~/vault
206+
ansible-vault encrypt server_ca.key.pem --vault-password-file ~/vault
207+
208+
Follow any instructions in the `upstream docs <https://docs.openstack.org/octavia/latest/admin/guides/operator-maintenance.html>`_.
68209

69210
Manually deleting broken load balancers
70211
=======================================

‎tools/backup-octavia-certificates.sh‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/bash
2+
3+
set -eu
4+
5+
if [ -z ${KAYOBE_CONFIG_PATH:+x} ]; then
6+
1>&2 echo 'Please source kayobe-env'
7+
exit 1
8+
fi
9+
10+
if [ -z ${KAYOBE_VAULT_PASSWORD:+x} ]; then
11+
1>&2 echo 'Please set Kayobe vault password'
12+
exit 1
13+
fi
14+
15+
if [ ! -d $KOLLA_CONFIG_PATH/octavia-certificates ]; then
16+
1>&2 echo 'Certificates missing'
17+
exit 1
18+
fi
19+
20+
pushd $KOLLA_CONFIG_PATH
21+
ls octavia-certificates
22+
tar -c -f - octavia-certificates | ansible-vault encrypt --vault-password-file $KAYOBE_CONFIG_PATH/../../tools/vault-helper > $KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar 2>/dev/null
23+
popd

‎tools/restore-octavia-certificates.sh‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
3+
set -eu
4+
5+
if [ -z ${KAYOBE_CONFIG_PATH:+x} ]; then
6+
1>&2 echo 'Please source kayobe-env'
7+
exit -1
8+
fi
9+
10+
if [ -z ${KAYOBE_VAULT_PASSWORD:+x} ]; then
11+
1>&2 echo 'Please set Kayobe vault password'
12+
exit -1
13+
fi
14+
15+
if [ -d $KOLLA_CONFIG_PATH/octavia-certificates ]; then
16+
1>&2 echo 'Certificates exists. Please remove if you wish to restore.'
17+
exit -1
18+
fi
19+
20+
cat $KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar | ansible-vault decrypt --vault-password-file $KAYOBE_CONFIG_PATH/../../tools/vault-helper 2>/dev/null | tar -xvf - -C $KOLLA_CONFIG_PATH

‎tools/vault-helper.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/bash
2+
3+
echo "$KAYOBE_VAULT_PASSWORD"

0 commit comments

Comments
 (0)