allow an operator to provide a CA Cert for Trove Controller: support self-signed certificates on the openstack controller

[Amrith Kumar]

Currently there's no way to provide the cacert to trove controller (and guest) so that self-signed certificates can be used.

[Amrith Kumar (amrith)]

Consider a scenario where an operator uses a self-signed certificate for their Nova, Cinder, Swift, Glance, ... service end points.

Then, if a client wants to connect to them on https:// and verify the identity etc as SSL requires, then they would need a CA Cert. Currently Trove controller has no way to use this, and it isn't just the 3 trove services but also the guest.

A blueprint on this will be forthcoming.

[György Szombathelyi (gyurco)]

I did something similar for cinder (keystoneclient in this case, but other clients have the cacert option, too):
https://review.openstack.org/#/c/272437/

[Amrith Kumar (amrith)]

@György there's a little bit more complexity in Trove because of the guest agent. Hence the BP.

[György Szombathelyi (gyurco)]

Yes, you're right, I forgot about it.