From 0e9a81fdca4e94048b731bc4c79da8b397437365 Mon Sep 17 00:00:00 2001 From: ramboman Date: Mon, 6 Jul 2020 16:37:52 +0800 Subject: [PATCH] Fix Barbican client (Castellan) with TLS The Castellan (Barbican client) has different parameters to control the used CA file. This patch uses them. Moreover, this aligns Barbican with other services by defaulting its client config to the internal endpoint. See also [1]. [1] https://bugs.launchpad.net/castellan/+bug/1876102 Closes-Bug: #1886615 Change-Id: I6a174468bd91d214c08477b93c88032a45c137be --- ansible/roles/cinder/templates/cinder.conf.j2 | 2 ++ ansible/roles/glance/templates/glance-api.conf.j2 | 7 +++++++ ansible/roles/nova/templates/nova.conf.j2 | 3 ++- releasenotes/notes/bug-1886615-640e817dfdb93b8a.yaml | 5 +++++ 4 files changed, 16 insertions(+), 1 deletion(-) create mode 100644 releasenotes/notes/bug-1886615-640e817dfdb93b8a.yaml diff --git a/ansible/roles/cinder/templates/cinder.conf.j2 b/ansible/roles/cinder/templates/cinder.conf.j2 index 7cc75926fd..2066c4db92 100644 --- a/ansible/roles/cinder/templates/cinder.conf.j2 +++ b/ansible/roles/cinder/templates/cinder.conf.j2 @@ -206,6 +206,8 @@ connection_string = {{ osprofiler_backend_connection_string }} {% if enable_barbican | bool %} [barbican] auth_endpoint = {{ keystone_internal_url }} +barbican_endpoint_type = internal +verify_ssl_path = {{ openstack_cacert }} {% endif %} [coordination] diff --git a/ansible/roles/glance/templates/glance-api.conf.j2 b/ansible/roles/glance/templates/glance-api.conf.j2 index 2964503029..50a47bf28c 100644 --- a/ansible/roles/glance/templates/glance-api.conf.j2 +++ b/ansible/roles/glance/templates/glance-api.conf.j2 @@ -124,3 +124,10 @@ trace_sqlalchemy = true hmac_keys = {{ osprofiler_secret }} connection_string = {{ osprofiler_backend_connection_string }} {% endif %} + +{% if enable_barbican | bool %} +[barbican] +auth_endpoint = {{ keystone_internal_url }} +barbican_endpoint_type = internal +verify_ssl_path = {{ openstack_cacert }} +{% endif %} diff --git a/ansible/roles/nova/templates/nova.conf.j2 b/ansible/roles/nova/templates/nova.conf.j2 index 447a5c0aa6..16ef6db36e 100644 --- a/ansible/roles/nova/templates/nova.conf.j2 +++ b/ansible/roles/nova/templates/nova.conf.j2 @@ -196,5 +196,6 @@ connection_string = {{ osprofiler_backend_connection_string }} {% if enable_barbican | bool %} [barbican] auth_endpoint = {{ keystone_internal_url }} -cafile = {{ openstack_cacert }} +barbican_endpoint_type = internal +verify_ssl_path = {{ openstack_cacert }} {% endif %} diff --git a/releasenotes/notes/bug-1886615-640e817dfdb93b8a.yaml b/releasenotes/notes/bug-1886615-640e817dfdb93b8a.yaml new file mode 100644 index 0000000000..2b1436f15e --- /dev/null +++ b/releasenotes/notes/bug-1886615-640e817dfdb93b8a.yaml @@ -0,0 +1,5 @@ +--- +fixes: + - | + Fix Castellan (Barbican client) when used with enabled TLS. + `LP#1886615 `__