Skip to content

Commit

Permalink
libvirt: support SASL authentication
Browse files Browse the repository at this point in the history
Adds support for SASL authentication of libvirt TCP and TLS connections
when using a compute host libvirt daemon.

In line with the dependent Kolla Ansible patch, we enable SASL by
default, and use DIGEST-MD5 with TCP and SCRAM-SHA-256 with TLS.

Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/833022
Depends-On: stackhpc/ansible-role-libvirt-host#52

Story: 2009858
Task: 44735

Change-Id: Id3972c24022aeb6421494c3cccdc8e7cbce802e6
  • Loading branch information
markgoddard committed Mar 24, 2022
1 parent c4b74f4 commit f4493e4
Show file tree
Hide file tree
Showing 10 changed files with 65 additions and 4 deletions.
3 changes: 3 additions & 0 deletions ansible/compute-libvirt-host.yml
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,9 @@
vars:
libvirt_host_libvirtd_conf: "{{ compute_libvirt_conf }}"
libvirt_host_qemu_conf: "{{ compute_qemu_conf }}"
libvirt_host_enable_sasl_support: "{{ compute_libvirt_enable_sasl | bool }}"
libvirt_host_sasl_authname: nova
libvirt_host_sasl_password: "{{ compute_libvirt_sasl_password }}"
libvirt_host_tcp_listen: "{{ not compute_libvirt_enable_tls | bool }}"
libvirt_host_tcp_listen_address: "{{ internal_net_name | net_ip }}:16509"
libvirt_host_tls_listen: "{{ compute_libvirt_enable_tls | bool }}"
Expand Down
9 changes: 8 additions & 1 deletion ansible/group_vars/all/compute
Original file line number Diff line number Diff line change
Expand Up @@ -172,7 +172,8 @@ compute_libvirt_enabled: "{{ kolla_enable_nova | bool and not kolla_enable_nova_
# A dict of default configuration options to write to
# /etc/libvirt/libvirtd.conf.
compute_libvirt_conf_default:
auth_tcp: "none"
auth_tcp: "{{ 'sasl' if compute_libvirt_enable_sasl | bool else 'none' }}"
auth_tls: "{{ 'sasl' if compute_libvirt_enable_sasl | bool else 'none' }}"
log_level: "{{ compute_libvirtd_log_level }}"

# A dict of additional configuration options to write to
Expand Down Expand Up @@ -202,6 +203,12 @@ compute_qemu_conf_extra: {}
# compute_qemu_conf_extra.
compute_qemu_conf: "{{ compute_qemu_conf_default | combine(compute_qemu_conf_extra) }}"

# Whether to enable libvirt SASL authentication. Default is true.
compute_libvirt_enable_sasl: true

# libvirt SASL password. Default is unset.
compute_libvirt_sasl_password:

# Whether to enable a libvirt TLS listener. Default is false.
compute_libvirt_enable_tls: false

Expand Down
17 changes: 15 additions & 2 deletions ansible/group_vars/all/kolla
Original file line number Diff line number Diff line change
Expand Up @@ -580,9 +580,9 @@ kolla_enable_zun: "no"
###############################################################################
# Passwords and credentials.

# Dictionary containing default custom passwords to add or override in the
# Dictionary containing base custom passwords to add or override in the
# Kolla passwords file.
kolla_ansible_default_custom_passwords:
kolla_ansible_base_custom_passwords:
# SSH key authorized in hosts deployed by Bifrost.
bifrost_ssh_key:
private_key: "{{ lookup('file', ssh_private_key_path) }}"
Expand All @@ -593,6 +593,19 @@ kolla_ansible_default_custom_passwords:
public_key: "{{ lookup('file', ssh_public_key_path) }}"
docker_registry_password: "{{ kolla_docker_registry_password }}"

# Dictionary containing libvirt custom passwords to add or override in the
# Kolla passwords file.
kolla_ansible_libvirt_custom_passwords:
libvirt_sasl_password: "{{ compute_libvirt_sasl_password }}"

# Dictionary containing default custom passwords to add or override in the
# Kolla passwords file.
kolla_ansible_default_custom_passwords: >-
{{ kolla_ansible_base_custom_passwords |
combine(kolla_ansible_libvirt_custom_passwords
if compute_libvirt_enabled | bool and compute_libvirt_enable_sasl | bool
else {}) }}

# Dictionary containing custom passwords to add or override in the Kolla
# passwords file.
kolla_ansible_custom_passwords: "{{ kolla_ansible_default_custom_passwords }}"
Expand Down
2 changes: 2 additions & 0 deletions ansible/roles/kolla-ansible/defaults/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -238,6 +238,8 @@ kolla_nova_compute_ironic_host:

kolla_libvirt_tls:

kolla_libvirt_enable_sasl:

###############################################################################
# Extra free-form configuraton.

Expand Down
3 changes: 3 additions & 0 deletions ansible/roles/kolla-ansible/templates/kolla/globals.yml
Original file line number Diff line number Diff line change
Expand Up @@ -397,6 +397,9 @@ enable_{{ feature_flag }}: {{ hostvars[inventory_hostname]['kolla_enable_' ~ fea
libvirt_tls: {{ kolla_libvirt_tls | bool }}
{% endif %}

{% if kolla_libvirt_enable_sasl is not none %}
libvirt_enable_sasl: {{ kolla_libvirt_enable_sasl | bool }}
{% endif %}
#################
# Hyper-V options
#################
Expand Down
24 changes: 24 additions & 0 deletions doc/source/configuration/reference/hosts.rst
Original file line number Diff line number Diff line change
Expand Up @@ -1094,6 +1094,12 @@ are relevant only when using the libvirt daemon rather than the
A dict of configuration options to write to ``/etc/libvirt/qemu.conf``.
Default is a combination of ``compute_qemu_conf_default`` and
``compute_qemu_conf_extra``.
``compute_libvirt_enable_sasl``
Whether to enable libvirt SASL authentication. Default is the same as
``compute_libvirt_tcp_listen``.
``compute_libvirt_sasl_password``
libvirt SASL password. Default is unset. This must be defined when
``compute_libvirt_enable_sasl`` is ``true``.
``compute_libvirt_enable_tls``
Whether to enable a libvirt TLS listener. Default is false.
``compute_libvirt_ceph_repo_install``
Expand Down Expand Up @@ -1125,6 +1131,24 @@ To customise QEMU to avoid adding timestamps to logs:
compute_qemu_conf_extra:
log_timestamp: 0
Example: SASL
-------------

SASL authentication is enabled by default. This provides authentication for
TCP and TLS connections to the libvirt API. A password is required, and should
be encrypted using Ansible Vault.

.. code-block:: yaml
:caption: ``compute.yml``
compute_libvirt_sasl_password: !vault |
$ANSIBLE_VAULT;1.1;AES256
63363937303539373738356236393563636466313130633435353933613637343231303836343933
3463623265653030323665383337376462363434396361320a653737376237353261303066616637
66613562316533313632613433643537346463303363376664396661343835373033326261383065
3731643633656636360a623534313665343066656161333866613338313266613465336332376463
3234
Example: enabling libvirt TLS listener
--------------------------------------

Expand Down
3 changes: 3 additions & 0 deletions playbooks/kayobe-overcloud-base/overrides.yml.j2
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,9 @@ pip_trusted_hosts:
aio_bridge_ports:
- dummy1

# Generate a password for libvirt SASL authentication.
compute_libvirt_sasl_password: "{% raw %}{{ lookup('password', '/tmp/libvirt-sasl-password') }}{% endraw %}"

# Enable ironic for testing baremetal compute.
kolla_enable_ironic: true

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -187,3 +187,6 @@ controller_firewalld_rules:
- service: cockpit
state: disabled
zone: public

# Generate a password for libvirt SASL authentication.
compute_libvirt_sasl_password: "{% raw %}{{ lookup('password', '/tmp/libvirt-sasl-password') }}{% endraw %}"
3 changes: 3 additions & 0 deletions playbooks/kayobe-overcloud-upgrade-base/overrides.yml.j2
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,9 @@ pip_trusted_hosts:
aio_bridge_ports:
- dummy1

# Generate a password for libvirt SASL authentication.
compute_libvirt_sasl_password: "{% raw %}{{ lookup('password', '/tmp/libvirt-sasl-password') }}{% endraw %}"

# Enable ironic for testing baremetal compute.
kolla_enable_ironic: true

Expand Down
2 changes: 1 addition & 1 deletion requirements.yml
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ roles:
- src: stackhpc.grafana-conf
version: 1.1.1
- src: stackhpc.libvirt-host
version: v1.10.0
version: v1.11.0
- src: stackhpc.libvirt-vm
version: v1.14.2
- src: stackhpc.luks
Expand Down

0 comments on commit f4493e4

Please sign in to comment.