[tlse] internal TLS support for keystone #621
Conversation
|
Merge Failed. This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset. |
|
needs to be rebased when #620 landed. only last commit is relevant for this PR |
stuggi
requested review from
olliewalsh and
Deydra71
and removed request for
lewisdenny and
frenzyfriday
stuggi
force-pushed
the
tlse_keystone
branch
2 times, most recently
from
b3c577d to
c7b408b
Compare
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/1e073cc361644f658996a1e0222fe8e1 ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 02m 44s |
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/0f294f07044c48c49e95dc67f9b076df ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 19m 34s |
|
recheck |
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/c28a0bf8b41a4164a1830080dcd7fa7d ✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 02m 07s |
Creates certs for k8s service of the service operator when
spec.tls.endpoint.internal.enabled: true
For services which at this point don't support TLS, cert validation
could be disabled using customService config like e.g.:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
~~~
For a service like nova which talks to multiple service internal
endpoints, this has to be set for each of them for, like:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
[placement]
insecure = true
[neutron]
insecure = true
[glance]
insecure = true
[cinder]
insecure = true
~~~
Depends-On: openstack-k8s-operators/lib-common#428
Depends-On: openstack-k8s-operators#620
Depends-On: openstack-k8s-operators/keystone-operator#348
Jira: OSPRH-2183
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/28f966dac9944fef90a0efb126eedeac ✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 40m 32s |
|
/retest |
|
/retest |
|
recheck |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: olliewalsh, stuggi The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
bot
merged commit dc24492
into
openstack-k8s-operators:main
Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true
For services which at this point don't support TLS, cert validation could be disabled using customService config like e.g.:
For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like:
Depends-On: openstack-k8s-operators/lib-common#428
Depends-On: #620
Depends-On: openstack-k8s-operators/keystone-operator#348
Jira: OSPRH-2183