Volans has submitted this change and it was merged. Change subject: MariaDB: allow multiple MySQL TLS configurations ......................................................................
MariaDB: allow multiple MySQL TLS configurations The ssl parameter allows three values now: - on: the current TLS behaviour, from which we are moving towards the Puppet certs. - puppet-cert: use the exposed Puppet certs for TLS in the my.cnf, will be the new standard and could be renamed to 'on' once the migration is completed an all hosts. - multiple-ca: use the exposed Puppet certs for TLS in the my.cnf but use a special CA certificate with both CAs to accept connections from hosts with any configuration, needed during the migration is some cases. Bug: T111654 Change-Id: I295f0e360b1c5a347edd766e598677c9a5f80741 --- M modules/mariadb M templates/mariadb/production.my.cnf.erb 2 files changed, 26 insertions(+), 0 deletions(-) Approvals: Volans: Looks good to me, approved jenkins-bot: Verified diff --git a/modules/mariadb b/modules/mariadb index 228ba7e..ebd0b8f 160000 --- a/modules/mariadb +++ b/modules/mariadb -Subproject commit 228ba7e0dac9fb357159b5c9853e2ff5fccc12de +Subproject commit ebd0b8fd1e4d3630b9c522e1a277598d24512d23 diff --git a/templates/mariadb/production.my.cnf.erb b/templates/mariadb/production.my.cnf.erb index 0d5bed2..9730616 100644 --- a/templates/mariadb/production.my.cnf.erb +++ b/templates/mariadb/production.my.cnf.erb @@ -12,6 +12,20 @@ # skip server cert validation until we generate one cert per server # it would check the cert's common name against the host # ssl-verify-server-cert +<% elsif @ssl == 'puppet-cert' %> +# ssl +ssl-ca=/etc/ssl/certs/Puppet_Internal_CA.pem +ssl-cert=/etc/mysql/ssl/cert.pem +ssl-key=/etc/mysql/ssl/server.key +ssl-verify-server-cert +<% elsif @ssl == 'multiple-ca' %> +# ssl +ssl-ca=/etc/mysql/ssl/ca.crt +ssl-cert=/etc/mysql/ssl/cert.pem +ssl-key=/etc/mysql/ssl/server.key +# skip server cert validation until we generate one cert per server +# it would check the cert's common name against the host +# ssl-verify-server-cert <% end %> [mysqld] @@ -101,6 +115,18 @@ ssl-cert=/etc/mysql/ssl/server-cert.pem ssl-key=/etc/mysql/ssl/server-key.pem ssl-cipher=TLSv1.2 +<% elsif @ssl == 'puppet-cert' %> +# ssl +ssl-ca=/etc/ssl/certs/Puppet_Internal_CA.pem +ssl-cert=/etc/mysql/ssl/cert.pem +ssl-key=/etc/mysql/ssl/server.key +ssl-cipher=TLSv1.2 +<% elsif @ssl == 'multiple-ca' %> +# ssl +ssl-ca=/etc/mysql/ssl/ca.crt +ssl-cert=/etc/mysql/ssl/cert.pem +ssl-key=/etc/mysql/ssl/server.key +ssl-cipher=TLSv1.2 <% end %> <% if @p_s == 'on' %> # Enabling performance_schema (disabled by default in MariaDB10) -- To view, visit https://gerrit.wikimedia.org/r/282385 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: merged Gerrit-Change-Id: I295f0e360b1c5a347edd766e598677c9a5f80741 Gerrit-PatchSet: 2 Gerrit-Project: operations/puppet Gerrit-Branch: production Gerrit-Owner: Volans <[email protected]> Gerrit-Reviewer: Jcrespo <[email protected]> Gerrit-Reviewer: Volans <[email protected]> Gerrit-Reviewer: jenkins-bot <> _______________________________________________ MediaWiki-commits mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
