Skip to content

Commit d899fa9

Browse files
MoteHueMoteHue
authored
Support and document persisting the Octavia CA (#1988)
Support and document persisting the Octavia CA
1 parent b7545b3 commit d899fa9

File tree

5 files changed

+193
-0
lines changed

5 files changed

+193
-0
lines changed

‎doc/source/operations/octavia.rst‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,151 @@ The default image path is ``/tmp/amphora-x64-haproxy.qcow2``.
6565
6666
kayobe playbook run ${KAYOBE_CONFIG_PATH}/ansible/maintenance/octavia-amphora-image-register.yml -e image_path="<path-to-amphora-image>"
6767
68+
Handling TLS certificates
69+
=========================
70+
71+
Octavia uses mutual TLS to secure communication between the amphorae and
72+
Octavia services. It uses a private CA to sign both client and server
73+
certificates. These certificates need to be generated when first deploying
74+
Octavia, and will later need to be rotated (details below). We use the
75+
kolla-ansible built-in support for generating these certificates:
76+
77+
.. code-block:: console
78+
79+
kayobe kolla ansible run octavia-certificates
80+
81+
This command will output certificates and keys in ``${KOLLA_CONFIG_PATH}/octavia-certificates``
82+
83+
Copy the relevant certificates into your kayobe-config:
84+
85+
.. code-block:: console
86+
87+
cd ${KAYOBE_CONFIG_PATH}/environments/$KAYOBE_ENVIRONMENT/kolla/config/octavia
88+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client_ca.cert.pem .
89+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client.cert-and-key.pem .
90+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.cert.pem .
91+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.key.pem .
92+
93+
Encrypt any files containing the keys:
94+
95+
.. code-block:: console
96+
97+
ansible-vault encrypt client.cert-and-key.pem --vault-password-file ~/vault
98+
ansible-vault encrypt server_ca.key.pem --vault-password-file ~/vault
99+
100+
Checking certificate expiry
101+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
102+
103+
.. code-block:: console
104+
105+
ansible-vault decrypt client.cert-and-key.pem --vault-password-file ~/vault
106+
openssl x509 -enddate -noout -in client.cert-and-key.pem
107+
108+
Backing up the octavia-certificates directory
109+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
110+
111+
In the root of your kayobe-config checkout:
112+
113+
.. code-block:: console
114+
115+
tools/backup-octavia-certificates.sh
116+
117+
This will output an encrypted backup to ``$KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar``
118+
Commit this file to store the backup.
119+
120+
.. _restoring-octavia-certificates-directory:
121+
122+
Restoring octavia-certificates directory when regenerating certificates
123+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
124+
125+
In the root of your kayobe-config checkout:
126+
127+
.. code-block:: console
128+
129+
tools/restore-octavia-certificates.sh
130+
131+
This will use the encrypted backup in ``$KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar``
132+
to restore ``${KOLLA_CONFIG_PATH}/octavia-certificates``. This will allow you
133+
to reuse the client CA.
134+
135+
Rotating client.cert-and-key.pem
136+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
137+
138+
This has a lifetime of 1 year.
139+
140+
#. Follow the steps to restore octavia-certificates so you can reuse the client
141+
CA. See :ref:`restoring-octavia-certificates-directory`.
142+
143+
#. Make sure your config allows you to regenerate a certificate with the same
144+
common name.
145+
146+
.. code-block:: console
147+
:caption: $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/index.txt.attr
148+
149+
unique_subject = no
150+
151+
#. Remove the old files relating to the client certificate:
152+
153+
.. code-block:: console
154+
155+
rm $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/{client.cert-and-key.pem,client.csr.pem,client.cert.pem}
156+
157+
#. Regenerate the certificates
158+
159+
.. code-block:: console
160+
161+
kayobe kolla ansible run octavia-certificates
162+
163+
#. Backup your octavia-certificates directory (see previous section).
164+
165+
#. Copy your new certificate to the correct location:
166+
167+
.. code-block:: console
168+
169+
cd ${KAYOBE_CONFIG_PATH}/environments/$KAYOBE_ENVIRONMENT/kolla/config/octavia
170+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client_ca.cert.pem .
171+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client.cert-and-key.pem .
172+
ansible-vault encrypt client.cert-and-key.pem --vault-password-file ~/vault
173+
174+
#. Reconfigure Octavia
175+
176+
.. code-block:: console
177+
178+
kayobe overcloud service reconfigure -kt octavia
179+
180+
#. Run Tempest with the `octavia` test list to check it is working. See
181+
:ref:`running_tempest_with_kayobe_automation`.
182+
183+
#. Commit and push any changes.
184+
185+
Rotating the CAs
186+
~~~~~~~~~~~~~~~~
187+
188+
The CAs have a 10 year lifetime. Simply delete the relevant directory under
189+
``$KOLLA_CONFIG_PATH/octavia-certificates/`` and regenerate it with:
190+
191+
.. code-block:: console
192+
193+
kayobe kolla ansible run octavia-certificates
194+
195+
Copy the relevant certificates into your kayobe-config.
196+
197+
.. code-block:: console
198+
199+
cd ${KAYOBE_CONFIG_PATH}/environments/$KAYOBE_ENVIRONMENT/kolla/config/octavia
200+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client_ca.cert.pem .
201+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/client.cert-and-key.pem .
202+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.cert.pem .
203+
cp $KOLLA_CONFIG_PATH/octavia-certificates/client_ca/server_ca.key.pem .
204+
205+
Encrypt any files containing the keys.
206+
207+
.. code-block:: console
208+
209+
ansible-vault encrypt client.cert-and-key.pem --vault-password-file ~/vault
210+
ansible-vault encrypt server_ca.key.pem --vault-password-file ~/vault
211+
212+
Follow any instructions in the `upstream docs <https://docs.openstack.org/octavia/latest/admin/guides/operator-maintenance.html>`_.
68213

69214
Manually deleting broken load balancers
70215
=======================================

‎doc/source/operations/tempest.rst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
.. _running_tempest_with_kayobe_automation:
2+
13
======================================
24
Running Tempest with Kayobe Automation
35
======================================

‎tools/backup-octavia-certificates.sh‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/bash
2+
3+
set -eu
4+
5+
if [ -z ${KAYOBE_CONFIG_PATH:+x} ]; then
6+
1>&2 echo 'Please source kayobe-env'
7+
exit 1
8+
fi
9+
10+
if [ -z ${KAYOBE_VAULT_PASSWORD:+x} ]; then
11+
1>&2 echo 'Please set Kayobe vault password'
12+
exit 1
13+
fi
14+
15+
if [ ! -d $KOLLA_CONFIG_PATH/octavia-certificates ]; then
16+
1>&2 echo 'Certificates missing'
17+
exit 1
18+
fi
19+
20+
pushd $KOLLA_CONFIG_PATH
21+
ls octavia-certificates
22+
tar -c -f - octavia-certificates | ansible-vault encrypt --vault-password-file $KAYOBE_CONFIG_PATH/../../tools/vault-helper.sh > $KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar 2>/dev/null
23+
popd

‎tools/restore-octavia-certificates.sh‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
3+
set -eu
4+
5+
if [ -z ${KAYOBE_CONFIG_PATH:+x} ]; then
6+
1>&2 echo 'Please source kayobe-env'
7+
exit 1
8+
fi
9+
10+
if [ -z ${KAYOBE_VAULT_PASSWORD:+x} ]; then
11+
1>&2 echo 'Please set Kayobe vault password'
12+
exit 1
13+
fi
14+
15+
if [ -d $KOLLA_CONFIG_PATH/octavia-certificates ]; then
16+
1>&2 echo 'Certificates exists. Please remove if you wish to restore.'
17+
exit -1
18+
fi
19+
20+
cat $KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/octavia-certificates-backup.tar | ansible-vault decrypt --vault-password-file $KAYOBE_CONFIG_PATH/../../tools/vault-helper.sh 2>/dev/null | tar -xvf - -C $KOLLA_CONFIG_PATH

‎tools/vault-helper.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/bash
2+
3+
echo "$KAYOBE_VAULT_PASSWORD"

0 commit comments

Comments
 (0)