diff options
| author | Jay Faulkner <jay.faulkner@verizonmedia.com> | 2020-08-20 07:49:41 -0700 |
|---|---|---|
| committer | Jay Faulkner <jay.faulkner@verizonmedia.com> | 2020-09-02 16:07:42 -0700 |
| commit | 1d11f0b7dd9d2044cc8fce3b20f5851a4e6a94a8 (patch) | |
| tree | 778f3462cf878b7c97e3936b2489235f022e4bd3 /ironic_python_agent/api | |
| parent | 7d0ad36ebd350a7162bc3c33bbefd26b9e962a78 (diff) | |
| download | ironic-python-agent-1d11f0b7dd9d2044cc8fce3b20f5851a4e6a94a8.tar.gz | |
If listen_tls is true, enable TLS on wsgi server
This change enables operators to set [DEFAULT]listen_tls to
true configure IPA to be host its WSGI server over TLS using
existing SSL support in oslo.service.
In addition to configuring this in IPA, a deployer will need to
also set [ssl]cert_file, [ssl]key_file, and optionally
[ssl]ca_file in their ipa config, in addition to embedding those
files into the IPA ramdisk in order for this to be functional.
In order to make this change work, we also need to monkey patch
socket library early, or else oslo.service will end up passing an
unpatched socket to the eventlet wsgi server, which causes
deadlocks.
Change-Id: Ib7decae410915f3c27b045ee08538c94d455b030
Diffstat (limited to 'ironic_python_agent/api')
| -rw-r--r-- | ironic_python_agent/api/app.py | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/ironic_python_agent/api/app.py b/ironic_python_agent/api/app.py index a4575ce7..a379a7e0 100644 --- a/ironic_python_agent/api/app.py +++ b/ironic_python_agent/api/app.py @@ -130,7 +130,8 @@ class Application(object): """Start the API service in the background.""" self.service = wsgi.Server(self._conf, 'ironic-python-agent', app=self, host=self.agent.listen_address.hostname, - port=self.agent.listen_address.port) + port=self.agent.listen_address.port, + use_ssl=self._conf.listen_tls) self.service.start() LOG.info('Started API service on port %s', self.agent.listen_address.port) |