Neutron/LBaaS/SSL

Terminating SSL connection on the load balancer and encrypting traffic back to the back end nodes, is a capabilities expected from modern load balancers and incorporated into many applications. This capability enables better certificate management and improved application based load balancing (ex: cookie based persistency, L7 Policies, etc.)

Rationale

Giving user the ability to use SSL on LBaaS.

User should be able to apply SSL certificates on LBaaS and configure SSL on vip, front-end and back-end.

API change

No API change

Resources change

LBaaS extension's resource attributes map should be extended with new parameters:

Database persistent

FrontEndTermination
  [Y/N] default=N
  NOT mandatory
  visible
FrontEndProtocols
  String
  Mandatory if termination enabled
  visible if termination enabled
FrontEndCipherSuite:
  String
  Mandatory if termination enabled
  visible if termination enabled
 
BackEndTermination
  [Y/N] default=N
  NOT mandatory
  visible
BackEndProtocols
  String
  Mandatory if termination enabled
  visible if termination enabled
BackEndCipherSuite:
  String
  Mandatory if termination enabled
  visible if termination enabled

Transient

Passphrase
Public Key (PEM)
Private Key (PEM)

Data model change

Vip database entity should be extended with new columns:

front_end_termination - Boolean
front_end_protocols - String
front_end_cipher_type: ENUM
back_end_termination - Boolean 
back_end_protocols - String
back_end_cipher_type: ENUM

DB Migration

Vip table should be altered with new columns.

New columns of each existing Vip row should be populated with default values:

front_end_termination - 'N'
front_end_protocols - 
front_end_cipher_type: None
back_end_termination - 'N'
back_end_protocols - 
back_end_cipher_type: None

Implementation Plan

Modifying LBaaS Vip resources' attribute map with new parameters
Modifying LBaaS Vip DB Model with new parameters
Modifying LBaaS Vip DB Model tests to account new parameters if needed