[RFE] Add LBaaSv2 TLS re-encryption to backend members

[Kobi Samoray]

Most of the load balancers allow termination of TLS connections. A load balancer may run a TLS connection on the client side while running an unencrypted connection at the server side - which is called offloading and is currently supported by the LBaaSv2 API.
Another common practice is terminating the TLS connection at the load balancer - in order to allow L7 decision making or header manipulation, and running a TLS session on the server side. This is not supported by the current implementation.

This involves two items:
- Allowing a protocol of HTTPS for members.
- Toggling the bits in the haproxy config file that connect via tls to members, instead of cleartext.

[Brandon Logan (brandon-logan)]

I believe I understand this as TLS re-encryption (or thats my own terrible name for it). Basically all traffic into the LB and out of the LB will be encrypted, but the LB will decrypt to make L7 decisions and then re-encrypt. Do I understand this correctly? If so sounds like this will be another API change and as such will need an RFE tag.

[Henry Gessau (gessau)]

Consider rewording the title to describe the feature/enhancement you want.

[Armando Migliaccio (armando-migliaccio)]

Let's have comment #2 addressed and have more clarity on the goal of the effort.

[Armando Migliaccio (armando-migliaccio)]

@Doug: what is your recommendation for feature submission? Spec or no spec?

[Armando Migliaccio (armando-migliaccio)]

Was the lack of TLS support a design oversight or an explicit decision?

[Armando Migliaccio (armando-migliaccio)]

Anyone?

[Baptiste Assmann (bassmann)]

A couple of useful HAProxy settings for this feature:

1. ' ssl-server-verify' in the global section or 'verify' on the server line
 http://cbonte.github.io/haproxy-dconv/snapshot/configuration-1.6.html#3.1-ssl-server-verify
 http://cbonte.github.io/haproxy-dconv/snapshot/configuration-1.6.html#verify%20%28Server%20and%20default-server%20options%29

=> may be used to avoid or force validation of certificate sent by the server (self-signed certificates, etc...)

2. you may want to set a client certificate on the server side, so when connecting, HAProxy can send it and both HAProxy and the server can mutually identify themselves:
 http://cbonte.github.io/haproxy-dconv/snapshot/configuration-1.6.html#crt%20%28Server%20and%20default-server%20options%29

[Armando Migliaccio (armando-migliaccio)]

This lost momentum.

[Armando Migliaccio (armando-migliaccio)]

No code, no follow-up.

https://review.openstack.org/#/q/owner:ksamoray%2540vmware.com+status:open

[Armando Migliaccio (armando-migliaccio)]

Status update:

http://eavesdrop.openstack.org/meetings/neutron_drivers/2016/neutron_drivers.2016-02-11-22.00.log.html#l-180

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]