Skip to content

Apache webserver handles TLS on Ironic #728

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
metal3-io-bot merged 1 commit into from
Mar 17, 2021
Merged

Apache webserver handles TLS on Ironic #728

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions ironic-deployment/default/ironic_bmo_configmap.env
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,3 +8,4 @@ IRONIC_INSPECTOR_ENDPOINT=http://172.22.0.2:5050/v1/
CACHEURL=http://172.22.0.1/images
IRONIC_FAST_TRACK=true
IRONIC_KERNEL_PARAMS=console=ttyS0
INSPECTOR_REVERSE_PROXY_SETUP=false
24 changes: 9 additions & 15 deletions ironic-deployment/ironic/ironic.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,20 +42,6 @@ spec:
secretKeyRef:
name: mariadb-password
key: password
- name: ironic-httpd
image: quay.io/metal3-io/ironic
imagePullPolicy: Always
securityContext:
capabilities:
add: ["NET_ADMIN"]
command:
- /bin/runhttpd
volumeMounts:
- mountPath: /shared
name: ironic-data-volume
envFrom:
- configMapRef:
name: ironic-bmo-configmap
Comment on lines -45 to -58
Copy link
Copy Markdown
Member

@maelk maelk Mar 16, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you should not remove this. This is the webserver for IPA image and other PXE related files

Copy link
Copy Markdown
Member Author

@namnx228 namnx228 Mar 16, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@maelk I remove it because the httpd server which works as a WSGI server inside the ironic-api pod will also serve the IPA image.

- name: ironic-api
image: quay.io/metal3-io/ironic
imagePullPolicy: Always
Expand Down Expand Up @@ -104,6 +90,14 @@ spec:
envFrom:
- configMapRef:
name: ironic-bmo-configmap
- name: httpd-reverse-proxy
image: quay.io/metal3-io/ironic-inspector
Copy link
Copy Markdown
Member

@kashifest kashifest Mar 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should it be inspector image or ironic image?

Copy link
Copy Markdown
Member

@kashifest kashifest Mar 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I got the answer. It was added here metal3-io/ironic-inspector-image@7e2757d#diff-9f9f6a924db88783257f0da0c2ae75be9d01b5b1ea71d522caaafab42362392f

imagePullPolicy: Always
envFrom:
- configMapRef:
name: ironic-bmo-configmap
command:
- /bin/runhttpd
- name: ironic-inspector-log-watch
image: quay.io/metal3-io/ironic-inspector
imagePullPolicy: Always
Expand All @@ -126,4 +120,4 @@ spec:
name: ironic-data-volume
volumes:
- name: ironic-data-volume
emptyDir: {}
emptyDir: {}
1 change: 0 additions & 1 deletion tools/deploy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@ DEPLOY_IRONIC="${2,,}"
DEPLOY_TLS="${3,,}"
DEPLOY_BASIC_AUTH="${4,,}"
DEPLOY_KEEPALIVED="${5,,}"

IRONIC_HOST="${IRONIC_HOST}"
IRONIC_HOST_IP="${IRONIC_HOST_IP}"
MARIADB_HOST="${MARIADB_HOST:-"mariaDB"}"
Expand Down
4 changes: 2 additions & 2 deletions tools/remove_local_ironic.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,9 @@ set -xe
# It requires ${CONTAINER_RUNTIME} variable to be defined first

for name in ironic ironic-api ironic-conductor ironic-inspector dnsmasq httpd mariadb ipa-downloader \
ironic-endpoint-keepalived ironic-log-watch ironic-inspector-log-watch; do
ironic-endpoint-keepalived ironic-log-watch ironic-inspector-log-watch httpd-reverse-proxy ; do
sudo "${CONTAINER_RUNTIME}" ps | grep -w "$name$" && sudo "${CONTAINER_RUNTIME}" kill "$name"
sudo "${CONTAINER_RUNTIME}" ps --all | grep -w "$name$" && sudo "${CONTAINER_RUNTIME}" rm "$name" -f
done

set +xe
set +xe
26 changes: 19 additions & 7 deletions tools/run_local_ironic.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,11 @@ PROVISIONING_INTERFACE="${PROVISIONING_INTERFACE:-"ironicendpoint"}"
CLUSTER_DHCP_RANGE="${CLUSTER_DHCP_RANGE:-"172.22.0.10,172.22.0.100"}"
IRONIC_KERNEL_PARAMS="${IRONIC_KERNEL_PARAMS:-"console=ttyS0"}"


Comment thread
namnx228 marked this conversation as resolved.
IRONIC_CACERT_FILE="${IRONIC_CACERT_FILE:-}"
IRONIC_CERT_FILE="${IRONIC_CERT_FILE:-}"
IRONIC_KEY_FILE="${IRONIC_KEY_FILE:-}"
IRONIC_TLS_SETUP=${IRONIC_TLS_SETUP:-"true"}

IRONIC_INSPECTOR_CACERT_FILE="${IRONIC_INSPECTOR_CACERT_FILE:-}"
IRONIC_INSPECTOR_CERT_FILE="${IRONIC_INSPECTOR_CERT_FILE:-}"
Expand Down Expand Up @@ -50,6 +52,11 @@ IRONIC_ENDPOINT="${IRONIC_ENDPOINT:-"${IRONIC_BASE_URL}:6385/v1/"}"
IRONIC_INSPECTOR_ENDPOINT="${IRONIC_INSPECTOR_ENDPOINT:-"${IRONIC_BASE_URL}:5050/v1/"}"
CACHEURL="${CACHEURL:-"http://${PROVISIONING_IP}/images"}"
IRONIC_FAST_TRACK="${IRONIC_FAST_TRACK:-"true"}"
INSPECTOR_REVERSE_PROXY_SETUP=${INSPECTOR_REVERSE_PROXY_SETUP:-"true"}
if [[ $IRONIC_TLS_SETUP == *false* ]]
then
INSPECTOR_REVERSE_PROXY_SETUP="false" # No Revese proxy for Ironic inspector if TLS is not used
fi

sudo mkdir -p "${IRONIC_DATA_DIR}"
sudo mkdir -p "${IRONIC_DATA_DIR}/auth"
Expand All @@ -66,6 +73,7 @@ IRONIC_INSPECTOR_ENDPOINT=${IRONIC_INSPECTOR_ENDPOINT}
CACHEURL=${CACHEURL}
IRONIC_FAST_TRACK=${IRONIC_FAST_TRACK}
IRONIC_KERNEL_PARAMS=${IRONIC_KERNEL_PARAMS}
INSPECTOR_REVERSE_PROXY_SETUP=${INSPECTOR_REVERSE_PROXY_SETUP}
EOF

sudo "${CONTAINER_RUNTIME}" pull "$IRONIC_IMAGE"
Expand Down Expand Up @@ -166,13 +174,6 @@ sudo "${CONTAINER_RUNTIME}" run -d --net host --privileged --name dnsmasq \
${POD} --env-file "${IRONIC_DATA_DIR}/ironic-vars.env" \
-v "$IRONIC_DATA_DIR:/shared" --entrypoint /bin/rundnsmasq "${IRONIC_IMAGE}"

# For available env vars, see:
# https://github.com/metal3-io/ironic/blob/master/runhttpd.sh
# shellcheck disable=SC2086
sudo "${CONTAINER_RUNTIME}" run -d --net host --privileged --name httpd \
${POD} --env-file "${IRONIC_DATA_DIR}/ironic-vars.env" \
-v "$IRONIC_DATA_DIR:/shared" --entrypoint /bin/runhttpd "${IRONIC_IMAGE}"

# https://github.com/metal3-io/ironic/blob/master/runmariadb.sh
# shellcheck disable=SC2086
sudo "${CONTAINER_RUNTIME}" run -d --net host --privileged --name mariadb \
Expand Down Expand Up @@ -219,6 +220,17 @@ sudo "${CONTAINER_RUNTIME}" run -d --net host --privileged --name ironic-inspect
--env-file "${IRONIC_DATA_DIR}/ironic-vars.env" \
-v "$IRONIC_DATA_DIR:/shared" "${IRONIC_INSPECTOR_IMAGE}"

# Start httpd reverse proxy for Ironic Inspector
# shellcheck disable=SC2086
if [[ $INSPECTOR_REVERSE_PROXY_SETUP == "true" ]]
then
sudo "${CONTAINER_RUNTIME}" run -d --net host --privileged --name httpd-reverse-proxy \
${POD} ${CERTS_MOUNTS} ${BASIC_AUTH_MOUNTS} ${IRONIC_INSPECTOR_HTPASSWD} \
--env-file "${IRONIC_DATA_DIR}/ironic-vars.env" \
--entrypoint /bin/runhttpd \
-v "$IRONIC_DATA_DIR:/shared" "${IRONIC_INSPECTOR_IMAGE}"
fi

# Start ironic-inspector-log-watch
# shellcheck disable=SC2086
sudo "${CONTAINER_RUNTIME}" run -d --net host --privileged --name ironic-inspector-log-watch \
Expand Down