f8cfccb99e
To securely support live migration between computenodes we should enable tls, with cert auth, instead of TCP with no auth support. Implements: blueprint libvirt-tls Change-Id: I22ea6233933c840b853fdcc8e03400b2bf577271
60 lines
2.0 KiB
Django/Jinja
60 lines
2.0 KiB
Django/Jinja
{
|
|
"command": "/usr/sbin/libvirtd --listen",
|
|
"config_files": [
|
|
{
|
|
"source": "{{ container_config_directory }}/libvirtd.conf",
|
|
"dest": "/etc/libvirt/libvirtd.conf",
|
|
"owner": "root",
|
|
"perm": "0600"
|
|
},
|
|
{
|
|
"source": "{{ container_config_directory }}/qemu.conf",
|
|
"dest": "/etc/libvirt/qemu.conf",
|
|
"owner": "root",
|
|
"perm": "0600"
|
|
}{% if libvirt_tls | bool %},
|
|
{
|
|
"source": "{{ container_config_directory }}/serverkey.pem",
|
|
"dest": "/etc/pki/libvirt/private/serverkey.pem",
|
|
"owner": "root",
|
|
"perm": "0600"
|
|
},
|
|
{
|
|
"source": "{{ container_config_directory }}/servercert.pem",
|
|
"dest": "/etc/pki/libvirt/servercert.pem",
|
|
"owner": "root",
|
|
"perm": "0600"
|
|
},
|
|
{
|
|
"source": "{{ container_config_directory }}/clientkey.pem",
|
|
"dest": "/etc/pki/libvirt/private/clientkey.pem",
|
|
"owner": "root",
|
|
"perm": "0600"
|
|
},
|
|
{
|
|
"source": "{{ container_config_directory }}/clientcert.pem",
|
|
"dest": "/etc/pki/libvirt/clientcert.pem",
|
|
"owner": "root",
|
|
"perm": "0600"
|
|
},
|
|
{
|
|
"source": "{{ container_config_directory }}/cacert.pem",
|
|
"dest": "/etc/pki/CA/cacert.pem",
|
|
"owner": "root",
|
|
"perm": "0600"
|
|
}{% endif %}{% if nova_backend == "rbd" or cinder_backend_ceph | bool %},
|
|
{
|
|
"source": "{{ container_config_directory }}/secrets",
|
|
"dest": "/etc/libvirt/secrets",
|
|
"owner": "root",
|
|
"perm": "0600"
|
|
}{% endif %}{% if nova_backend == "rbd" %},
|
|
{
|
|
"source": "{{ container_config_directory }}/ceph.conf",
|
|
"dest": "/etc/ceph/ceph.conf",
|
|
"owner": "root",
|
|
"perm": "0600"
|
|
}{% endif %}
|
|
]
|
|
}
|