Private TLS keys are stored in astute.yaml and as part of certificate bundle on all nodes when selective SSL is used

[Andrey Bubyr]

Selective TLS expects PEM bundles with certificates chain and private key for each endpoint that should be secured with TLS. Private keys are really needed only on nodes where HAProxy is running. All other nodes should have only certificate chain to establish HAProxy server certs identity

The main problem is that by default astute.yaml contains all data including private keys passed in 'use_ssl' hash. Some mechanism is needed to selectively adjust astute.yaml removing private keys from it if node role is not that role which deploys HAProxy.

[Bug Checker Bot (bug-checker)]

(This check performed automatically)
Please, make sure that bug description contains the following sections filled in with the appropriate data related to the bug you are describing:

actual result

version

expected result

steps to reproduce

For more detailed information on the contents of each of the listed sections see https://wiki.openstack.org/wiki/Fuel/How_to_contribute#Here_is_how_you_file_a_bug

[Stanislaw Bogatkin (sbogatkin)]

I believe that it is a bad idea to cut out private keys from astute.yaml by nailgun. It is pretty much should be smarter way - for example:

1. In case of self-signed certs generated by master node do not copy keys to nodes w/o haproxy.
2. In case of user certs - do not store them in nailgun db at all. We must store them in master node FS some way and then copy them to needed nodes as described in clause 1.

So, I believe that it should be not a bug, but a blueprint. Moved to 10.0.

[Dmitry Pyzhov (dpyzhov)]

According to the log this bug is assigned to fuel-ui. I have no idea why it is assigned to 'Registry Administrators' team. Moving it back.

[Adam Heczko (aheczko-mirantis)]

Why is this bug marked as Invalid for Mitaka / MOS 9.0?