review.pp manifest contains specific site data for SSLCertificate attributes

Bug #1319746 reported by Ricardo Carrillo Cruz
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Core Infrastructure
Fix Released
Undecided
Ricardo Carrillo Cruz

Bug Description

The review.pp manifest located at /config/modules/openstack_project/manifests containts specific site data for SSL certificate attributes:

<snip>
  class { 'openstack_project::gerrit':
    ssl_cert_file =>
      '/etc/ssl/certs/review.openstack.org.pem',
    ssl_key_file =>
      '/etc/ssl/private/review.openstack.org.key',
</snip>

Those values should parameterize, as the hostname may change in the future and forces other developers willing to use the manifest to use their own filenames that are descriptive of their own review host.

Changed in openstack-ci:
assignee: nobody → Ricardo Carrillo Cruz (rcarrillocruz)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to config (master)

Fix proposed to branch: master
Review: https://review.openstack.org/93687

Changed in openstack-ci:
status: New → In Progress
Revision history for this message
Elizabeth K. Joseph (lyz) wrote :

I don't agree with the premise of this bug. Everything under the "openstack_project" module is allowed to have openstack-specific naming and file locations, this is the whole point of having a separate module specifically for the openstack project.

Organizations wishing to consume this data should probably create their own organization_project module.

Revision history for this message
Ricardo Carrillo Cruz (rcarrillocruz) wrote :

Hi Liz

The way I see "openstack_project" manifests it's how Openstack infra servers are organized, i.e. a 'review' server would have a Gerrit, a Gerritbot, so on and so forth.
IMHO, site specific data should be either provided on site.pp or use facter wherever suitable. Host names and paths should change at some point, I think it is better if we provide those values outside of the "openstack_project" and avoid hardcoding-values for a better reuse of manifests.

This enhances the experience of developers willing to use layouts as "openstack_project" for testing or work on bugs about openstack-infra itself (I opened this bug while I was working on other openstack-infra launchpad-gerrit issue, had too many things to tweak to have a sane 'review' server in a local VM).

Revision history for this message
Elizabeth K. Joseph (lyz) wrote :

You make an interesting point that's worth further discussion with the team. I will mention that it would require a pretty massive overhaul of the manifests in the openstack_project module to fully accomplish this goal of making the module project-agnostic since it was always our intention to put non-sensitive, openstack-specific data in this module.

I've added it to the infrastructure meeting agenda this upcoming Tuesday at 1900 UTC.

Revision history for this message
Ricardo Carrillo Cruz (rcarrillocruz) wrote :

Excellent, appreciate this.
I will attend the meeting if possible, I'd be more than happy to help refactoring the manifests.

Regards

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to config (master)

Reviewed: https://review.openstack.org/93687
Committed: https://git.openstack.org/cgit/openstack-infra/config/commit/?id=5e9e30b207aa532a69bf249b6306231f0625ff94
Submitter: Jenkins
Branch: master

commit 5e9e30b207aa532a69bf249b6306231f0625ff94
Author: Ricardo Carrillo Cruz <email address hidden>
Date: Thu May 15 10:01:53 2014 +0000

    Parameterize SSL certificate attributes on review.pp manifest

    review.pp manifest contains site specific values for
    SSL certificate attributes.
    The hostname may change overtime and forces other developers
    willing to use the manifest to give SSL certificate names
    that are not descriptive of their environment.
    This change parameterize those values by adding SSL certificate
    parameters on review.pp and gerrit.pp and defining sane
    defaults for both.

    Closes-Bug: 1319746
    Change-Id: I245c3caaf267f3d354daa5c7d5897d62239dcf9e

Changed in openstack-ci:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.