Neutron/LBaaS/SSL
Contents
Description
Terminating SSL connection on the load balancer and encrypting traffic back to the back end nodes, is a capabilities expected from modern load balancers and incorporated into many applications. This capability enables better certificate management and improved application based load balancing (ex: cookie based persistency, L7 Policies, etc.)
Rationale
Giving user the ability to use SSL on LBaaS.
User should be able to apply SSL certificates on LBaaS and configure SSL on vip, front-end and back-end.
API change
No API change
Resources change
LBaaS extension's resource attributes map should be extended with new parameters on the vip object:
Database persistent
* front_end_termination Boolean (default=False) Mandatory Visible * front_end_protocols List (comma-separated values from a list of allowed values=SSL3,TLS10, TLS11, default=None) Mandatory if termination enabled Visible if termination enabled * front_end_cipher_suite: List (coma-separated values from allowed values. value_format=<protocol>_<key-exchange-algorithm>_<encryption-algorithm>_<hash-function>) Mandatory if termination enabled Visible if termination enabled * back_end_encryption Boolean (default=False) Mandatory Visible * back_end_protocols List (comma-separated values from a list of allowed values=SSL3,TLS10, TLS11, default=None) Mandatory if termination enabled Visible if termination enabled * back_end_cipher_suite: List (coma-separated values from allowed values. value_format=<protocol>_<key-exchange-algorithm>_<encryption-algorithm>_<hash-function>) Mandatory if encryption enabled Visible if encryption enabled
Transient (Not stored in DB)
* passphrase (optional, if private key is encrypted) * public_key (PEM Formatted) * private_key (PEM Formatted) * certificate_chain (PEM Formatted)
Data model change
Vip database entity should be extended with new columns:
front_end_termination - Boolean front_end_SSL3 - Boolean front_end_TLS10 - Boolean front_end_TLS11 - Boolean front_end_cipher_type: String(128) back_end_encryption - Boolean back_end_SSL3 - Boolean back_end_TLS10 - Boolean back_end_TLS11 - Boolean back_end_cipher_type: String(128)
DB Migration
Vip table should be altered with new columns.
New columns of each existing Vip row should be populated with default values:
front_end_termination - False front_end_SSL3 - False front_end_TLS10 - False front_end_TLS11 - False front_end_cipher_type: None back_end_termination - False back_end_SSL3 - False back_end_TLS10 - False back_end_TLS11 - False back_end_cipher_type: None
Implementation Plan
- Modifying LBaaS Vip resources' attribute map with new parameters
- Modifying LBaaS Vip DB Model with new parameters
- Modifying LBaaS Vip DB Model tests to account new parameters if needed
- Modifying LBaaS HA-Proxy driver to support SSL
- Update HA-Proxy to version 1.5 {TBD}