TLS Everywhere adoption

.gitignore

@@ -2,6 +2,7 @@
 /docs_build
 /Gemfile.lock
 /local
+/tests/config/base/tls_overrides.yaml
 /tests/config/tmp
 /tests/secrets.yaml
 /tests/playbooks/tmp
@@ -17,3 +18,4 @@
 .idea
 *.swp
 *.swo
+*~

docs_dev/assemblies/development_environment.adoc

@@ -135,6 +135,14 @@ cd ~/install_yamls/devsetup
 make standalone
 ----
 
+To deploy using TLS everywhere enabled, instead run:
+
+[,bash]
+---
+cd ~/install_yamls/devsetup
+TLS_ENABLED=true make standalone
+---
+
 == Install the openstack-k8s-operators (openstack-operator)
 
 [,bash]

docs_user/assemblies/assembly_planning-the-new-deployment.adoc

@@ -21,6 +21,8 @@ include::../modules/con_about-node-selector.adoc[leveloffset=+1]
 
 include::../modules/con_about-machine-configs.adoc[leveloffset=+1]
 
+include::../modules/con_tlse-description.adoc[leveloffset=+1]
+
 include::../modules/con_key-manager-service-support-for-crypto-plugins.adoc[leveloffset=+1]
 
 //include::../modules/con_identity-service-authentication.adoc[leveloffset=+1]

docs_user/main.adoc

@@ -14,6 +14,8 @@ endif::[]
 
 include::assemblies/assembly_planning-the-new-deployment.adoc[leveloffset=+1]
 
+include::modules/proc_migrating-tls-everywhere.adoc[leveloffset=+1]
+
 include::assemblies/assembly_migrating-databases-to-the-control-plane.adoc[leveloffset=+1]
 
 include::assemblies/assembly_adopting-openstack-control-plane-services.adoc[leveloffset=+1]

docs_user/modules/con_tlse-description.adoc

@@ -0,0 +1,18 @@
+[id="con_tlse-description_{context}"]
+
+= TLS Everywhere
+
+Note: The assumption is, that the new deployment will adopt the settings from the
+old deployment, so in case TLS Everywhere is disabled, it won't be enabled on
+the new deployment.
+
+If the Director deployment was deployed with TLS Everywhere, FreeIPA (IdM) is used
+to issue certificates for the OpenStack services. Certmonger, a client process which
+is installed on all hosts, interacts with FreeIPA (IdM) to request, install, track
+and renew these certificates.
+
+The new Operator based deployment uses the cert-manager operator to issue, track
+and renew the certificates.
+
+Because the same root CA is used to generate new certificates, the currently used chain
+of trust doesn't have to be modified.

docs_user/modules/proc_adopting-compute-services-to-the-data-plane.adoc

@@ -158,6 +158,20 @@ cd -
 
 . Create a `nova-compute-extra-config` service:
 +
+. If TLS Everywhere is enabled, append the following to the OpenStackDataPlaneService spec:
++
+[source,yaml]
+----
+  tlsCert:
+    contents:
+      - dnsnames
+      - ips
+    networks:
+      - ctlplane
+    issuer: osp-rootca-issuer-internal
+  caCerts: combined-ca-bundle
+----
++
 [source,yaml]
 ----
 oc apply -f - <<EOF
@@ -217,6 +231,8 @@ endif::[]
 
 . Deploy the `OpenStackDataPlaneNodeSet` CR:
 +
+. If TLS Everywhere is enabled, change spec:tlsEnabled to true
++
 [source,yaml]
 ----
 oc apply -f - <<EOF

docs_user/modules/proc_deploying-backend-services.adoc

@@ -27,6 +27,8 @@ endif::[]
 For production environments, the deployment method will likely be
 different.
 
+* If TLS Everywhere is enabled on the source environment, the `tls` root CA from the source environment must be copied over to the rootca-internal issuer.
+
 * There are free PVs available to be claimed (for MariaDB and RabbitMQ).
 ifeval::["{build}" != "downstream"]
 +
@@ -128,6 +130,33 @@ oc set data secret/osp-secret "SwiftPassword=$SWIFT_PASSWORD"
 . Deploy `OpenStackControlPlane`. Make sure to only enable DNS,
 MariaDB, Memcached, and RabbitMQ services. All other services must
 be disabled.
+
+. If the source environment enables TLS Everywhere, modify
+spec:tls section with the following override before applying it:
+
++
+[source,yaml]
+----
+apiVersion: core.openstack.org/v1beta1
+kind: OpenStackControlPlane
+metadata:
+  name: openstack
+spec:
+  tls:
+    podLevel:
+      enabled: true
+      internal:
+        ca:
+          customIssuer: rootca-internal
+      ovn:
+        ca:
+          customIssuer: rootca-internal
+    ingress:
+      ca:
+        customIssuer: rootca-internal
+      enabled: true
+----
+
 +
 [source,yaml]
 ----

docs_user/modules/proc_migrating-ovn-data.adoc

@@ -49,6 +49,17 @@ grep -rI 'ovn_[ns]b_conn' /var/lib/config-data/puppet-generated/
 ----
 oc apply -f - <<EOF
 ---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ovn-data-cert
+  namespace: openstack
+spec:
+  commonName: ovn-data-cert
+  secretName: ovn-data-cert
+  issuerRef:
+    name: rootca-internal
+---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
@@ -77,6 +88,9 @@ spec:
     volumeMounts:
     - mountPath: /backup
       name: ovn-data
+    - mountPath: /etc/pki/tls/misc
+      name: ovn-data-cert
+      readOnly: true
   securityContext:
     allowPrivilegeEscalation: false
     capabilities:
@@ -88,6 +102,9 @@ spec:
   - name: ovn-data
     persistentVolumeClaim:
       claimName: ovn-data
+  - name: ovn-data-cert
+    secret:
+      secretName: ovn-data-cert
 EOF
 ----
 
@@ -97,13 +114,20 @@ EOF
 oc wait --for=condition=Ready pod/ovn-copy-data --timeout=30s
 ----
 
-. Backup OVN databases.
+. Backup OVN databases on an environment without TLS everywhere.
 +
 ----
 oc exec ovn-copy-data -- bash -c "ovsdb-client backup tcp:$SOURCE_OVSDB_IP:6641 > /backup/ovs-nb.db"
 oc exec ovn-copy-data -- bash -c "ovsdb-client backup tcp:$SOURCE_OVSDB_IP:6642 > /backup/ovs-sb.db"
 ----
 
+. Backup OVN databases on a TLS everywhere environment.
++
+----
+oc exec ovn-copy-data -- bash -c "ovsdb-client backup --ca-cert=/etc/pki/tls/misc/ca.crt --private-key=/etc/pki/tls/misc/tls.key --certificate=/etc/pki/tls/misc/tls.crt ssl:$SOURCE_OVSDB_IP:6641 > /backup/ovs-nb.db"
+oc exec ovn-copy-data -- bash -c "ovsdb-client backup --ca-cert=/etc/pki/tls/misc/ca.crt --private-key=/etc/pki/tls/misc/tls.key --certificate=/etc/pki/tls/misc/tls.crt ssl:$SOURCE_OVSDB_IP:6642 > /backup/ovs-sb.db"
+----
+
 . Start the control plane OVN database services prior to import, keeping `northd/ovn-controller` stopped.
 +
 [source,yaml]
@@ -145,20 +169,34 @@ PODIFIED_OVSDB_NB_IP=$(oc get svc --selector "statefulset.kubernetes.io/pod-name
 PODIFIED_OVSDB_SB_IP=$(oc get svc --selector "statefulset.kubernetes.io/pod-name=ovsdbserver-sb-0" -ojsonpath='{.items[0].spec.clusterIP}')
 ----
 
-. Upgrade database schema for the backup files.
+. Upgrade database schema for the backup files on an environment without TLS everywhere.
 +
 ----
 oc exec ovn-copy-data -- bash -c "ovsdb-client get-schema tcp:$PODIFIED_OVSDB_NB_IP:6641 > /backup/ovs-nb.ovsschema && ovsdb-tool convert /backup/ovs-nb.db /backup/ovs-nb.ovsschema"
 oc exec ovn-copy-data -- bash -c "ovsdb-client get-schema tcp:$PODIFIED_OVSDB_SB_IP:6642 > /backup/ovs-sb.ovsschema && ovsdb-tool convert /backup/ovs-sb.db /backup/ovs-sb.ovsschema"
 ----
 
-. Restore database backup to the control plane OVN database servers.
+. Upgrade database schema for the backup files on a TLS everywhere environment.
++
+----
+oc exec ovn-copy-data -- bash -c "ovsdb-client get-schema --ca-cert=/etc/pki/tls/misc/ca.crt --private-key=/etc/pki/tls/misc/tls.key --certificate=/etc/pki/tls/misc/tls.crt ssl:$PODIFIED_OVSDB_NB_IP:6641 > /backup/ovs-nb.ovsschema && ovsdb-tool convert /backup/ovs-nb.db /backup/ovs-nb.ovsschema"
+oc exec ovn-copy-data -- bash -c "ovsdb-client get-schema --ca-cert=/etc/pki/tls/misc/ca.crt --private-key=/etc/pki/tls/misc/tls.key --certificate=/etc/pki/tls/misc/tls.crt ssl:$PODIFIED_OVSDB_SB_IP:6642 > /backup/ovs-sb.ovsschema && ovsdb-tool convert /backup/ovs-sb.db /backup/ovs-sb.ovsschema"
+----
+
+. Restore database backup to the control plane OVN database servers on an environment without TLS everywhere.
 +
 ----
 oc exec ovn-copy-data -- bash -c "ovsdb-client restore tcp:$PODIFIED_OVSDB_NB_IP:6641 < /backup/ovs-nb.db"
 oc exec ovn-copy-data -- bash -c "ovsdb-client restore tcp:$PODIFIED_OVSDB_SB_IP:6642 < /backup/ovs-sb.db"
 ----
 
+. Restore database backup to podified OVN database servers on a TLS everywhere environment.
++
+----
+oc exec ovn-copy-data -- bash -c "ovsdb-client restore --ca-cert=/etc/pki/tls/misc/ca.crt --private-key=/etc/pki/tls/misc/tls.key --certificate=/etc/pki/tls/misc/tls.crt ssl:$PODIFIED_OVSDB_NB_IP:6641 < /backup/ovs-nb.db"
+oc exec ovn-copy-data -- bash -c "ovsdb-client restore --ca-cert=/etc/pki/tls/misc/ca.crt --private-key=/etc/pki/tls/misc/tls.key --certificate=/etc/pki/tls/misc/tls.crt ssl:$PODIFIED_OVSDB_SB_IP:6642 < /backup/ovs-sb.db"
+----
+
 . Check that the control plane OVN databases contain objects from backup, for example:
 +
 ----