SSL for metadata service

[Hari Prasad Killi]

contrail-vrouter-agent proxies for metadata service requests coming from virtual instances. Currently, SSL is not supported on the communication between vrouter-agent and nova-api. This request is to add SSL support for this.

Note: Currently available workaround for this is to use shared secret for metadata, which will generate a Hmac token and send it to the metadata server in the X-Instance-ID-Signature.

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/24565
Submitter: RAVI KIRAN (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/24565
Committed: http://github.org/Juniper/contrail-controller/commit/08378f7d667cbebf69839b1c0af121cfbc9ac381
Submitter: Zuul
Branch: master

commit 08378f7d667cbebf69839b1c0af121cfbc9ac381
Author: Ravi BK <email address hidden>
Date: Thu Sep 29 22:09:36 2016 +0530

SSL support for Agent metadata proxy service

Currently metadata requests sent by VM are proxied by agent to
nova api-server using http which is insecure. Adding ssl support
for the communication by setting required curl options to the
requests.

Change-Id: Ibad42e8ffc3e51a0c1e830e1fde2f307149c90de
Closes-bug: #1628783

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/33264
Submitter: Hari Prasad Killi (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/33264
Committed: http://github.com/Juniper/contrail-controller/commit/18b127651cf32d0679565ff4c62a6c82d6299e60
Submitter: Zuul (<email address hidden>)
Branch: master

commit 18b127651cf32d0679565ff4c62a6c82d6299e60
Author: Hari Prasad Killi <email address hidden>
Date: Wed Jun 28 19:52:14 2017 +0530

Blueprint for Metadata SSL service

Change-Id: Ibad42e8ffc3e51a0c1e830e1fde2f307149c90ea
closes-bug: #1628783

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/34590
Submitter: Kumar Harsh (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/34588
Submitter: Kumar Harsh (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/34589
Submitter: Kumar Harsh (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/34591
Submitter: Kumar Harsh (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/34592
Submitter: Kumar Harsh (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/34593
Submitter: Kumar Harsh (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/34599
Submitter: Kumar Harsh (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/34591
Submitter: Kumar Harsh (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/34600
Submitter: Kumar Harsh (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/34599
Committed: http://github.com/Juniper/contrail-ansible/commit/9df8de38eda92064521f8133d839df0d2e58f6f9
Submitter: Zuul (<email address hidden>)
Branch: R4.0

commit 9df8de38eda92064521f8133d839df0d2e58f6f9
Author: Harsh Kumar <email address hidden>
Date: Tue Aug 15 23:01:47 2017 +0530

Ansible changes for metadata ssl service
If metadata_ssl flag is enabled in inventory file
agent.conf will be updated with ssl cert file to
be used for secure communication with openstack node.

Change-Id: I26be827e6cabbf3e3a0cf386976e704830bcd3ee
Implements: blueprint metadata_ssl
closes-bug: #1628783

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/34588
Committed: http://github.com/Juniper/contrail-ansible/commit/e490ce4fee17911bc632ff4bd46bb965ef1099db
Submitter: Zuul (<email address hidden>)
Branch: master

commit e490ce4fee17911bc632ff4bd46bb965ef1099db
Author: Harsh Kumar <email address hidden>
Date: Tue Aug 15 21:19:34 2017 +0530

Ansible changes for metadata ssl service
If metadata_ssl flag is enabled in inventory file
agent.conf will be updated with ssl cert file to
be used for secure communication with openstack node.

Change-Id: I26be827e6cabbf3e3a0cf386976e704830bcd3ee
Implements: blueprint metadata_ssl
closes-bug: #1628783

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/34600
Committed: http://github.com/Juniper/contrail-controller/commit/a616888c3a667253d0cc46bf581d7ffa90613f00
Submitter: Zuul (<email address hidden>)
Branch: R4.0

commit a616888c3a667253d0cc46bf581d7ffa90613f00
Author: Kumar Harsh <email address hidden>
Date: Tue Aug 15 23:50:31 2017 +0530

Agent provisioning changes for metadata ssl service
Populate ssl configuration to be used by agent under
metadata section in agent.conf.

Change-Id: Ic16128c50179899f803c0eaa5d72aafdc5bc8229
Implements: blueprint metadata_ssl
closes-bug: #1628783

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/34592
Committed: http://github.com/Juniper/contrail-ansible-internal/commit/abb1f60bfe452f2452d6a96bfca53432de00bed5
Submitter: Zuul (<email address hidden>)
Branch: R4.0

commit abb1f60bfe452f2452d6a96bfca53432de00bed5
Author: Harsh Kumar <email address hidden>
Date: Tue Aug 15 21:26:25 2017 +0530

Ansible internal changes for metadata ssl service.
For agent running in container enabling metadata_ssl_enable
in inventory file will update agent.conf with ssl certs and
related configuration .

Change-Id: Ie9ad91caa9478f0594d07c6fa25459c99944bef3
Implements: blueprint metadata_ssl
closes-bug: #1628783

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/34590
Submitter: Kumar Harsh (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/34593
Submitter: Kumar Harsh (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/34590
Committed: http://github.com/Juniper/contrail-docker/commit/e35933d77713d370ca4daf9d3ea70a2c9a2c56ad
Submitter: Zuul (<email address hidden>)
Branch: master

commit e35933d77713d370ca4daf9d3ea70a2c9a2c56ad
Author: Harsh Kumar <email address hidden>
Date: Tue Aug 15 21:30:04 2017 +0530

Add metadata_ssl_enable to agent contrailctl schema

Change-Id: I6b592e8a7f9f38271c14f51f318143c3e2cef8c9
Implements: Blueprint for Metadata SSL service
closes-bug: #1628783

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/34593
Committed: http://github.com/Juniper/contrail-docker/commit/8630f09ac2a51a66cf6759600ddd27f55ed381e5
Submitter: Zuul (<email address hidden>)
Branch: R4.0

commit 8630f09ac2a51a66cf6759600ddd27f55ed381e5
Author: Harsh Kumar <email address hidden>
Date: Tue Aug 15 21:30:04 2017 +0530

Add metadata_ssl_enable to agent contrailctl schema

Change-Id: I6b592e8a7f9f38271c14f51f318143c3e2cef8c9
Implements: Blueprint for Metadata SSL service
closes-bug: #1628783

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/34591
Committed: http://github.com/Juniper/contrail-controller/commit/bd1f48a4a22d9be80fba2e88dac1ecb775f2d908
Submitter: Zuul (<email address hidden>)
Branch: master

commit bd1f48a4a22d9be80fba2e88dac1ecb775f2d908
Author: Kumar Harsh <email address hidden>
Date: Tue Aug 15 23:38:52 2017 +0530

Agent provisioning changes for metadata ssl service
Populate ssl configuration to be used by agent under
metadata section in agent.conf.

Change-Id: I01140e1b588b0d410f3d7c77086e67e6163803c0
Implements: blueprint metadata_ssl
closes-bug: #1628783

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/34589
Committed: http://github.com/Juniper/contrail-ansible-internal/commit/9ab2a1c7a7098c0c032d6d1d0ecde77e7d5a52fc
Submitter: Zuul (<email address hidden>)
Branch: master

commit 9ab2a1c7a7098c0c032d6d1d0ecde77e7d5a52fc
Author: Harsh Kumar <email address hidden>
Date: Tue Aug 15 21:26:25 2017 +0530

Ansible internal changes for metadata ssl service.
For agent running in container enabling metadata_ssl_enable
in inventory file will update agent.conf with ssl certs and
related configuration .

Change-Id: Ie9ad91caa9478f0594d07c6fa25459c99944bef3
Implements: blueprint metadata_ssl
closes-bug: #1628783