From 1c2686a724f903b8d6d5e8026266bc160e48f6ec Mon Sep 17 00:00:00 2001 From: Alex Shatov Date: Fri, 14 Sep 2018 17:32:11 -0400 Subject: blueprint and inputs for 4.3.0 policy-handler - set up tls on policy-handler - policy-handler expecting the deployment process to mount certs at /opt/app/policy_handler/etc/tls/certs/ = cert_directory : /opt/app/policy_handler/etc/tls/certs/ = cacert : cacert.pem - new optional fields tls_ca_mode in config on consul that specify where to find the cacert.pem for tls per each https/web-socket values are: "cert_directory" - use the cacert.pem stored locally in cert_directory this is the default if cacert.pem file is found "os_ca_bundle" - use the public ca_bundle provided by linux system. this is the default if cacert.pem file not found "do_not_verify" - special hack to turn off the verification by cacert and hostname - config on consul now has 2 new fields for policy_engine = "tls_ca_mode" : "cert_directory" = "tls_wss_ca_mode" : "cert_directory" - config on consul now has 1 new field for deploy_handler = "tls_ca_mode" : "cert_directory" Change-Id: Ida2d058cad93ddd1a583e1922bc5dc33c145fcba Signed-off-by: Alex Shatov Issue-ID: DCAEGEN2-611 --- input-templates/phinputs.yaml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'input-templates/phinputs.yaml') diff --git a/input-templates/phinputs.yaml b/input-templates/phinputs.yaml index e23d051..850f935 100644 --- a/input-templates/phinputs.yaml +++ b/input-templates/phinputs.yaml @@ -56,6 +56,18 @@ application_config: Authorization : "Basic dGVzdHBkcDphbHBoYTEyMw==" Environment : "TEST" target_entity : "policy_engine" + # optional tls_ca_mode specifies where to find the cacert.pem for tls + # can be one of these: + # "cert_directory" - use the cacert.pem stored locally in cert_directory. + # this is the default if cacert.pem file is found + # + # "os_ca_bundle" - use the public ca_bundle provided by linux system. + # this is the default if cacert.pem file not found + # + # "do_not_verify" - special hack to turn off the verification by cacert and hostname + tls_ca_mode : "cert_directory" + # optional tls_wss_ca_mode specifies the same for the tls based web-socket + tls_wss_ca_mode : "cert_directory" # deploy_handler config # changed from string "deployment_handler" in 2.3.1 to structure in 2.4.0 deploy_handler : @@ -71,3 +83,13 @@ application_config: # optionally specify the tenant name for the cloudify under deployment-handler # if not specified the "default_tenant" is used by the deployment-handler cfy_tenant_name : "default_tenant" + # optional tls_ca_mode specifies where to find the cacert.pem or skip tls verification + # can be one of these: + # "cert_directory" - use the cacert.pem stored locally in cert_directory. + # this is the default if cacert.pem file is found + # + # "os_ca_bundle" - use the public ca_bundle provided by linux system. + # this is the default if cacert.pem file not found + # + # "do_not_verify" - special hack to turn off the verification by cacert and hostname + tls_ca_mode : "cert_directory" -- cgit 1.2.3-korg