jsomara/astapor — pull request #45 by rcritten (2013-10-03 15:31:42+00:00)
Title: Add options to configure some services with SSL

This consists of two patches. The first switches to using FQDNs rather than IP addresses to refer to Openstack hosts. FQDNs are required for SSL and will eventually be required for Kerberos.

The second patch utilizes new features available in puppet-openstack and puppet-qpid upstreams to configure qpid and mysql for SSL. It adds two new parameters to the controller hostgroup: freeipa and ssl. freeipa is subordinate to ssl and should only be applicable if ssl is enabled.

If ssl is true and freeipa is true, then the controller node will use certmonger to request SSL certificates on behalf of the host. Currently this requires the node be pre-enrolled as an IPA client, and the services (qpid and mysql) are pre-created for the host.

If ssl is true and freeipa is false, then the SSL certificates for qpid and mysql need to be pre-positioned in the filesystem in the paths provided in the configuration.

The compute node can also be configured to enable SSL to communicate with qpid/mysql on a remote controller node.

This does not currently disable the non-SSL capabilities.