openstack/openstack-ansible-os_horizon
Code Issues Proposed changes

Enable all services to use Keystone 'insecurely'

Browse Source 
This patch introduces an insecure flag for the Keystone internal
 and admin endpoints:

* keystone_service_adminuri_insecure
* keystone_service_internaluri_insecure

Both values default to false. If you have setup SSL endpoints
for Keystone using an untrusted certificate then you should
set the appropriate flag to true in your user_variables.

This patch is used to enable testing and development with
Keystone SSL endpoints without having to make use of SSL
certificates signed by a trusted, public CA.

The patch introduces a new optional argument (insecure) to the
keystone, glance and neutron Ansible libraries. This is a
boolean value which, when true, enables these libraries to
access Keystone endpoints 'insecurely'. When these libraries
are used in plays, the appropriate value is set automatically
as per the above conditions.

Implements: blueprint keystone-federation
Change-Id: Ia07e7e201f901042dd06a86efe5c6f6725e9ce13
This commit is contained in:
Jesse Pretorius 2015-07-07 21:01:20 +00:00
parent 221e525fe1
commit 1078a4e806
1 changed files with 1 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
templates/horizon_local_settings.py.j2
View File

@ -197,11 +197,7 @@ OPENSTACK_KEYSTONE_DEFAULT_ROLE = "_member_"
# ("saml2", _("Security Assertion Markup Language")))
# Disable SSL certificate checks (useful for self-signed certificates):
{% if horizon_self_signed == true %}
OPENSTACK_SSL_NO_VERIFY = True
{% else %}
OPENSTACK_SSL_NO_VERIFY = False
{% endif %}
OPENSTACK_SSL_NO_VERIFY = {{ keystone_service_internaluri_insecure | bool }}
{% if horizon_cacert_pem is defined %}
# The CA certificate to use to verify SSL connections