Enable MTLS memcached auth #982
Conversation
lmiccini
force-pushed
the
mtls
branch
4 times, most recently
from
036a025 to
b20588a
Compare
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/8033b0e7210d47b5b21e38fb27ea0d24 ✔️ openstack-meta-content-provider SUCCESS in 3h 51m 23s |
|
recheck |
|
LGTM. |
There was a problem hiding this comment.
Could you please add test coverage, here and for the other controllers well, for the new cert mounting logic as well as the new config options generation?
There was a problem hiding this comment.
Hey Gibi can you please have a look at the test that I added to novaapi and see if it is something that would work for the rest of the controllers? thanks!
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: lmiccini The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
lmiccini
force-pushed
the
mtls
branch
4 times, most recently
from
1ebf767 to
432a5eb
Compare
This commit allows operators to use mtls as an authentication method against Memcached. Nova controllers will detect the presence of a purposely-created mtls certificate (authCertSecret) and use this to configure the [keystone_authtoken] section accordingly. Additional volumes/volumemounts will be appended to each pod. Note that this commit switches from MemcachedServersWithInet to MemcachedServers since keystone-middleware now uses pymemcache when tls=true and there is no need to use "[]" to enclose the list of memcached servers even for ipv6.
This commit allows operators to use mtls as an authentication method against Memcached.
Nova controllers will detect the presence of a purposely-created mtls certificate (authCertSecret) and use this to configure the [cache] and [keystone_authtoken] sections accordingly.
Additional volumes/volumemounts will be appended to each pod.
Note that this commit switches from MemcachedServersWithInet to MemcachedServers since keystone-middleware now uses pymemcache when tls=true and there is no need to use "[]" to enclose the list of memcached servers even for ipv6.