osuosl-cookbooks/osl-openstack — pull request #12 by ramereth (2014-10-06 06:22:40+00:00)
Title: SSL proxy for API endpoints

This will enable https on both the regular (port 5000) and admin (port 35357) API endpoints and use mod_proxy to point to the http native api. For now this relies on both of the other endpoints to listen on localhost only so there is no port conflict. I didn't include an attribute to set that in here but it would be good to have feedback on that.

I did some basic testing using curl using the following command. You can test it locally inside of the vm by pointing to the local ip for it:

``` bash
curl -i --insecure -H "Content-Type: application/json" -d '
{ "auth": {
"identity": {
"methods": ["password"],
"password": {
"user": {
"name": "admin",
"domain": { "id": "default" },
"password": "admin"
}
}
}
}
}' https://:5000/v3/auth/tokens
```

I haven't tested this on a full cluster to see whether or not there are bad problems with the various services talking SSL. I imagine there will be an issue with that. One way to work around it is to use a virtual ip for the https and keep the regular port http but lock it down via a firewall rule.

It's also debatable whether or not to make this feature optional on some clusters and whether or not I should move this code to its own recipe (probably an underscore recipe).

Anyways, this is a work in progress and can use some input from others.