From 1078a4e806a2d230ddb1fcb80ac4641c0e2a6479 Mon Sep 17 00:00:00 2001 From: Jesse Pretorius Date: Tue, 7 Jul 2015 21:01:20 +0000 Subject: [PATCH] Enable all services to use Keystone 'insecurely' This patch introduces an insecure flag for the Keystone internal and admin endpoints: * keystone_service_adminuri_insecure * keystone_service_internaluri_insecure Both values default to false. If you have setup SSL endpoints for Keystone using an untrusted certificate then you should set the appropriate flag to true in your user_variables. This patch is used to enable testing and development with Keystone SSL endpoints without having to make use of SSL certificates signed by a trusted, public CA. The patch introduces a new optional argument (insecure) to the keystone, glance and neutron Ansible libraries. This is a boolean value which, when true, enables these libraries to access Keystone endpoints 'insecurely'. When these libraries are used in plays, the appropriate value is set automatically as per the above conditions. Implements: blueprint keystone-federation Change-Id: Ia07e7e201f901042dd06a86efe5c6f6725e9ce13 --- templates/horizon_local_settings.py.j2 | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/templates/horizon_local_settings.py.j2 b/templates/horizon_local_settings.py.j2 index 99a4947e..eb57f4df 100644 --- a/templates/horizon_local_settings.py.j2 +++ b/templates/horizon_local_settings.py.j2 @@ -197,11 +197,7 @@ OPENSTACK_KEYSTONE_DEFAULT_ROLE = "_member_" # ("saml2", _("Security Assertion Markup Language"))) # Disable SSL certificate checks (useful for self-signed certificates): -{% if horizon_self_signed == true %} -OPENSTACK_SSL_NO_VERIFY = True -{% else %} -OPENSTACK_SSL_NO_VERIFY = False -{% endif %} +OPENSTACK_SSL_NO_VERIFY = {{ keystone_service_internaluri_insecure | bool }} {% if horizon_cacert_pem is defined %} # The CA certificate to use to verify SSL connections