Chapter 12. Deploying TLS for public endpoints using director Operator Deploy the overcloud using TLS to create public endpoint IPs or DNS names for RHOSP Director Operator. Prerequisites Your OpenShift Container Platform cluster is operational. You have installed director Operator correctly. You have installed the oc command line tool on your workstation. 12.1. TLS for public endpoint IP addresses To reference public endpoint IP addresses, add certificates to the openstackclient pod. Prerequisites Create the certificate authority, key, and certificate using the procedure: Enabling SSL/TLS on overcloud public endpoints . Procedure Create a ConfigMap to store the CA certificates. The ConfigMap is the interface used to add CA certificates to the openstackclient pod, using the OpenStackControlPlane object: Create the OpenStackControlPlane and reference the ConfigMap : Replace <overcloud> with the name of your stack. In the ~/custom_environment_files directory create a file called tls-certs.yaml containing the generated certificates for the deployment using SSLCertificate , SSLIntermediateCertificate , SSLKey , and CAMap parameters. Note For more information on creating a certificate file, see Enabling SSL/TLS . Update the heatEnvConfigMap to add the tls-certs.yaml file: Create an OpenStackConfigGenerator and add the required heatEnvs configuration files to configure TLS for public endpoint IPs: The OpenStackConfigGenerator and a new OpenStackConfigVersion are created, run the Ansible playbooks against the overcloud using the OpenStackDeploy resource: Registering the operating system of your overcloud . Obtain the latest OpenStackConfig Version . Applying overcloud configuration with the director Operator . Additional Resources Enabling SSL/TLS on overcloud public endpoints . 12.2. TLS for public endpoint DNS names To reference public endpoint DNS names add certificates to the openstackclient pod. Prerequisites Create the certificate authority, key, and certificate following the procedure in, Enabling SSL/TLS on overcloud public endpoints . Procedure Create a ConfigMap to store the CA certificates. The ConfigMap is the interface used to add additional CA certificates to the openstackclient pod, using the OpenStackControlPlane object: Create the OpenStackControlPlane and reference the ConfigMap : Replace <overcloud> with the name of your stack. In the ~/custom_environment_files directory create a file called tls-certs.yaml containing the generated certificates for the deployment using SSLCertificate , SSLIntermediateCertificate , SSLKey , and CAMap parameters. Note For more information on creating a certificate file, see Enabling SSL/TLS . Update the heatEnvConfigMap to add the tls-certs.yaml file: Create an OpenStackConfigGenerator and add the required heatEnvs configuration files to configure TLS for public endpoint DNS names: The OpenStackConfigGenerator and a new OpenStackConfigVersion are created, run the Ansible playbooks against the overcloud using the OpenStackDeploy resource: Registering the operating system of your overcloud . Obtain the latest OpenStackConfig Version . Applying overcloud configuration with the director Operator . Additional Resources Enabling SSL/TLS on overcloud public endpoints .

Commands:
apiVersion: v1 kind: ConfigMap metadata: name: cacerts namespace: openstack data: local_CA: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- another_CA: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----
apiVersion: osp-director.openstack.org/v1beta2 kind: OpenStackControlPlane metadata: name: <overcloud> namespace: openstack spec: caConfigMap: cacerts
oc create configmap -n openstack heat-env-config --from-file=~/custom_environment_files/ --dry-run=client -o yaml | oc apply -f -
apiVersion: osp-director.openstack.org/v1beta1 kind: OpenStackConfigGenerator ... spec: ... heatEnvs: - ssl/tls-endpoints-public-ip.yaml - ssl/enable-tls.yaml ... heatEnvConfigMap: heat-env-config tarballConfigMap: tripleo-tarball-config
apiVersion: v1 kind: ConfigMap metadata: name: cacerts namespace: openstack data: local_CA: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- another_CA: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----
apiVersion: osp-director.openstack.org/v1beta2 kind: OpenStackControlPlane metadata: name: <overcloud> namespace: openstack spec: caConfigMap: cacerts
oc create configmap -n openstack heat-env-config --from-file=~/custom_environment_files/ --dry-run=client -o yaml | oc apply -f -
apiVersion: osp-director.openstack.org/v1beta1 kind: OpenStackConfigGenerator ... spec: ... heatEnvs: - ssl/tls-endpoints-public-dns.yaml - ssl/enable-tls.yaml ... heatEnvConfigMap: heat-env-config tarballConfigMap: tripleo-tarball-config