Difference between revisions of "Network/LBaaS/docs/how-to-create-tls-loadbalancer"

Latest revision as of 21:54, 19 January 2017

How To Create A TLS Enabled Load Balancer

The following article will walk through the steps required to set up a load balancer to serve TLS terminated traffic. This article is geared towards the current state of the project and will evolve along with the project itself.

Some of the items to be discussed are:

• Barbican devstack setup
• Certificate and key generation
• Barbican secret and container operations
• Load balancer creation
• Verifying the setup

Neutron-LBaaS utilizes Barbican as its keystore and requires some setting up, let's get started.

Firstly, this article assumes that the reader is familiar with Git, Openstack, Devstack and other related tools and technologies to get this going. This article will not go through setting up Devstack, Openstack, Git or any thing in this regard.

Barbican Devstack:

Add 'enable_plugin barbican https://review.openstack.org/openstack/barbican' to right above the lbaas plugins in your localrc, then run stack.sh

./<devstack_dir>/stack.sh

Create certificate chain and key.

• The following may be a little more verbose then whats actually needed, please feel free to create/retrieve cert/key/intermediates as you see fit.

openssl genrsa -des3 -out ca.key 1024 
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt  
openssl x509  -in  ca.crt -out ca.pem 
openssl genrsa -des3 -out ca-int_encrypted.key 1024 
openssl rsa -in ca-int_encrypted.key -out ca-int.key 
openssl req -new -key ca-int.key -out ca-int.csr -subj "/CN=ca-int@acme.com" 
openssl x509 -req -days 3650 -in ca-int.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out ca-int.crt 
openssl genrsa -des3 -out server_encrypted.key 1024 
openssl rsa -in server_encrypted.key -out server.key 
openssl req -new -key server.key -out server.csr -subj "/CN=server@acme.com" 
openssl x509 -req -days 3650 -in server.csr  -CA ca-int.crt -CAkey ca-int.key -set_serial 01 -out server.crt

If youd like to also test SNI create atleast one more cert chain with different CN:

openssl genrsa -des3 -out ca2.key 1024 
openssl req -new -x509 -days 3650 -key ca2.key -out ca2.crt  
openssl x509  -in  ca2.crt -out ca2.pem 
openssl genrsa -des3 -out ca-int_encrypted2.key 1024 
openssl rsa -in ca-int_encrypted2.key -out ca-int2.key 
openssl req -new -key ca-int2.key -out ca-int2.csr -subj "/CN=ca-int-test2@stacme.com" 
openssl x509 -req -days 3650 -in ca-int2.csr -CA ca2.crt -CAkey ca2.key -set_serial 01 -out ca-int2.crt 
openssl genrsa -des3 -out server_encrypted2.key 1024 
openssl rsa -in server_encrypted2.key -out server2.key 
openssl req -new -key server2.key -out server2.csr -subj "/CN=test2@stacme.com" 
openssl x509 -req -days 3650 -in server2.csr --CA ca-int2.crt -CAkey ca-int2.key -set_serial 01 -out server2.crt

• Note the CN for both chains as well use them to verify SNI later

Barbican secrets and containers:

barbican secret store --payload-content-type='text/plain' --name='certificate' --payload="$(cat server.crt)"

barbican secret store --payload-content-type='text/plain' --name='private_key' --payload="$(cat server.key)"

barbican secret container create --name='tls_container' --type='certificate' --secret="certificate=$(barbican secret list | awk '/ certificate / {print $2}')" --secret="private_key=$(barbican secret list | awk '/ private_key / {print $2}')"

Add the second certificate chain to test SNI:

barbican secret store --payload-content-type='text/plain' --name='certificate2' --payload="$(cat server2.crt)"

barbican secret store --payload-content-type='text/plain' --name='private_key2' --payload="$(cat server2.key)"

barbican secret container create --name='tls_container2' --type='certificate' --secret="certificate=$(barbican secret list | awk '/ certificate2 / {print $2}')" --secret="private_key=$(barbican secret list | awk '/ private_key2 / {print $2}')"

Update neutron config

Add or update the 'service_auth' group in /etc/neutron/neutron_lbaas.conf:

auth_uri = http://localhost:35357/v2.0
admin_tenant_name = admin
admin_user = admin
admin_password = password
auth_version = 2

• The needed values may differ from your particular devstack install, ensure to use those values.
• Neutron-server and neutron-lbaasv2-agent will need to be restarted to pick up the change
  • Note: at time of writing, this config is not loaded correctly by the devstack plugin, so you will have to add the command-line arg to load it when restarting the service.

Update octavia config.

Change in the 'certificates' group the cert_manager:

cert_manager=barbican_cert_manager

• The needed values may differ from your particular devstack install, ensure to use those values.
• Octavia controller worker ('o-cw') will need to be restarted to pick up the change

Create nova instances:

Create member for simple testing (basic devstack cirros instance):

nova keypair-add default --pub-key ~/.ssh/id_rsa.pub 
nova secgroup-add-rule default tcp 22 22 0.0.0.0/0
nova secgroup-add-rule default tcp 80 80 0.0.0.0/0
nova secgroup-add-rule default icmp -1 -1 0.0.0.0/0
nova boot --image $(nova image-list | grep -o cirros.*-disk) --flavor 2 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') member1 --security-groups default --key-name default

Add another member for load balanced testing (basic devstack cirros instance):

nova boot --image $(nova image-list | grep -o cirros.*-disk) --flavor 2 --nic net-id=$(neutron net-list | awk '/ private / {print $2}') member2 --security-groups default --key-name default

Create TLS enabled load balancer:

neutron lbaas-loadbalancer-create $(neutron subnet-list | awk '/ private-subnet / {print $2}') --name lb1

Create listener with TLS no SNI:

neutron lbaas-listener-create --loadbalancer lb1 --protocol-port 443 --protocol TERMINATED_HTTPS --name listener1 --default-tls-container=$(barbican secret container list | awk '/ tls_container / {print $2}')

Create listener with TLS and SNI:

neutron lbaas-listener-create --loadbalancer lb1 --protocol-port 443 --protocol TERMINATED_HTTPS --name listener1 --default-tls-container=$(barbican secret container list | awk '/ tls_container / {print $2}') --sni-container $(barbican secret container list | awk '/ tls_container2 / {print $2}')

Create pool:

neutron lbaas-pool-create --name pool1 --protocol HTTP --listener listener1 --lb-algorithm ROUND_ROBIN

Create members:

neutron lbaas-member-create pool1 --address $(nova show member1 | awk '/private network/ {a = substr($5, 0, length($5)-1); if (a ~ "\\.") print a; else print $6}')  --protocol-port 80 --subnet $(neutron subnet-list | awk '/ private-subnet / {print $2}') 

neutron lbaas-member-create pool1 --address $(nova show member2 | awk '/private network/ {a = substr($5, 0, length($5)-1); if (a ~ "\\.") print a; else print $6}')  --protocol-port 80 --subnet $(neutron subnet-list | awk '/ private-subnet / {print $2}') 

Test it out:

• For a simple example, our members can run a simple web server :

while true; do echo -e 'HTTP/1.0 200 OK\r\n\r\nIt Works member<N>!' | sudo nc -l -p 80 ; done 

Verify the response:

curl -k https://$(neutron lbaas-loadbalancer-list | awk '/ lb1 / {print $6}')

Should result in:

It Works member<N>!

Verify SNI:

openssl s_client -servername test2@stacme.com -connect $(neutron lbaas-loadbalancer-list | awk '/ lb1 / {print $6}'):443

The certificate information should print to screen, verify the CN matches the CN you passed to '-servername'