Placing certificate on keystone containers does not work

[Jake Briggs]

I am trying to place my tls certificate on the keystone container for further protection. This should work, but does not. I have set the following variables. Which looks like it should work, but then it does not.

/etc/openstack_deploy/user_variables.yml

keystone_ssl: True
ssl_protocol: 'SSLv2 SSLv3'
keystone_service_internaluri_proto: https
keystone_service_proto: https
keystone_user_ssl_cert: /etc/letsencrypt/live/jake-aio.jakelab.info/cert.pem
keystone_user_ssl_ca_cert: /etc/letsencrypt/live/jake-aio.jakelab.info/chain.pem
keystone_user_ssl_key: /etc/letsencrypt/live/jake-aio.jakelab.info/privkey.pem

haproxy_user_ssl_cert: /etc/letsencrypt/live/jake-aio.jakelab.info/cert.pem
haproxy_user_ssl_ca_cert: /etc/letsencrypt/live/jake-aio.jakelab.info/chain.pem
haproxy_user_ssl_key: /etc/letsencrypt/live/jake-aio.jakelab.info/privkey.pem

/opt/openstack-ansible/group_vars/all/haproxy.yml

  - service:
      haproxy_service_name: keystone_service
      haproxy_backend_nodes: "{{ groups['keystone_all'] | default([]) }}"
      haproxy_port: 5000
      haproxy_ssl: False
      haproxy_balance_type: tcp
      haproxy_backend_options:
        - "httpchk HEAD /"
  - service:
      haproxy_service_name: keystone_admin
      haproxy_backend_nodes: "{{ groups['keystone_all'] | default([]) }}"
      haproxy_port: 35357
      haproxy_ssl: False
      haproxy_balance_type: tcp
      haproxy_backend_options:
        - "httpchk HEAD /"
      haproxy_whitelist_networks: "{{ haproxy_keystone_admin_whitelist_networks }}"

Also there appears to be do documentation on how to configure this correctly.

[Jean-Philippe Evrard (jean-philippe-evrard)]

There is documentation here: https://docs.openstack.org/openstack-ansible/latest/user/security/index.html

Could you tell us what's missing?

[Jean-Philippe Evrard (jean-philippe-evrard)]

COuld you also explain what you're trying to achieve? Do you want https between haproxy and keystone, or is https termination in haproxy + http in the (considered internal) management network enough?

[Jake Briggs (jake-briggs)]

I am trying to place the ssl certificate on the container. HAPROXY should perform pass-through. That way there is no way to sniff the network and glean passwords from it.

[Jake Briggs (jake-briggs)]

The documentation provided does not work. If you follow it exactly. You will get a broken environment. Weather it is for rabbit or for Keystone.

[Jonathan Rosser (jrosser)]

Currently supported versions of openstack-ansible support SSL between haproxy and all the backend services.