Add support for CA authentication in Keystone

Change-Id: Ida2240b5217509cbd4116b4d468848760354be18 Fixes: bug #1194046
openstack · Aug 1, 2013 · ede3cc0 · ede3cc0
1 parent f6e8b8a
commit ede3cc0
Show file tree

Hide file tree

Showing 6 changed files with 10 additions and 0 deletions.
diff --git a/ceilometer/alarm/service.py b/ceilometer/alarm/service.py
@@ -83,6 +83,7 @@ def _client():
             os_tenant_name=auth_config.os_tenant_name,
             os_password=auth_config.os_password,
             os_username=auth_config.os_username,
+            cacert=auth_config.os_cacert,
             endpoint_type=auth_config.os_endpoint_type,
         )
         return ceiloclient.get_client(2, **creds)

diff --git a/ceilometer/alarm/threshold_evaluation.py b/ceilometer/alarm/threshold_evaluation.py
@@ -72,6 +72,7 @@ def _client(self):
                 os_tenant_name=auth_config.os_tenant_name,
                 os_password=auth_config.os_password,
                 os_username=auth_config.os_username,
+                cacert=auth_config.os_cacert,
                 endpoint_type=auth_config.os_endpoint_type,
             )
             self.api_client = ceiloclient.get_client(2, **creds)

diff --git a/ceilometer/central/manager.py b/ceilometer/central/manager.py
@@ -71,6 +71,7 @@ def interval_task(self, task):
             password=cfg.CONF.service_credentials.os_password,
             tenant_id=cfg.CONF.service_credentials.os_tenant_id,
             tenant_name=cfg.CONF.service_credentials.os_tenant_name,
+            cacert=cfg.CONF.service_credentials.os_cacert,
             auth_url=cfg.CONF.service_credentials.os_auth_url)
 
         super(AgentManager, self).interval_task(task)

diff --git a/ceilometer/nova_client.py b/ceilometer/nova_client.py
@@ -52,6 +52,7 @@ def __init__(self):
             project_id=tenant,
             auth_url=cfg.CONF.service_credentials.os_auth_url,
             endpoint_type=cfg.CONF.service_credentials.os_endpoint_type,
+            cacert=cfg.CONF.service_credentials.os_cacert,
             no_cache=True)
 
     def _with_flavor_and_image(self, instances):

diff --git a/ceilometer/service.py b/ceilometer/service.py
@@ -57,6 +57,9 @@
                deprecated_group="DEFAULT",
                default=os.environ.get('OS_TENANT_NAME', 'admin'),
                help='Tenant name to use for openstack service access'),
+    cfg.StrOpt('os-cacert',
+               default=os.environ.get('OS_CACERT', None),
+               help='Certificate chain for SSL validation'),
     cfg.StrOpt('os-auth-url',
                deprecated_group="DEFAULT",
                default=os.environ.get('OS_AUTH_URL',

diff --git a/etc/ceilometer/ceilometer.conf.sample b/etc/ceilometer/ceilometer.conf.sample
@@ -639,6 +639,9 @@
 # value)
 #os_tenant_name=admin
 
+# Certificate chain for SSL validation (string value)
+#os_cacert=<None>
+
 # Auth URL to use for openstack service access (string value)
 #os_auth_url=http://localhost:5000/v2.0