Implement use of redis as backend for Tooz orchestration/coordination in Ansible Kolla

[fdobrovolny]

Epic #462

As an SCS Operator, I want orchestration and coordination using Tooz to use Redis over TLS for orchestration so that all traffic is encrypted.

Tooz, as of this release, now supports using TLS to connect to Redis. By default, ansible kolla uses an unencrypted MySQL connection for orchestration but can also use Redis.

Tooz is used by the following:

• CloudKitty:
  • https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/cloudkitty/templates/cloudkitty.conf.j2#L115-L117
• Designate:
  • Uses non-encrypted redis by default - https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/designate/templates/designate.conf.j2#L121
• Cinder:
  • https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/cinder/templates/cinder.conf.j2#L257-L267
  • Uses non-encrypted redis or ETCD

Definition of Ready:

• [ ] User Story is small enough to be finished within one sprint
• [ ] User Story is clear and understood by the whole team
• [ ] Acceptance criteria are defined
• [ ] Acceptance criteria are clear and understood by the whole team

Definition of Done:

• [ ] All acceptance criteria are met
• [ ] Changes have been reviewed
• [ ] CI tests have run successfully
• [ ] Documentation has been updated
• [ ] Release Notes have been updated

[berendt]

Do we use Cloudkitty at all? We don't even build the images for it.

[fdobrovolny]

Do we use Cloudkitty at all? We don't even build the images for it.

It was brought up in our dedicated breakout meeting, but I don't know by whom.

Barbican and Designate have also been mentioned on the topic. Do you have any comments about them? I have already looked into them, and I'm in the process of documenting them and making issues.

EDIT: I looked in the meeting notes from the breakout session https://input.scs.community/e2ee-openstack-services, and it is not mentioned there, so it had to be from someone when I was presenting it in the IaaS call.

[fdobrovolny]

Updated the task to mention the use of tooz in Designate and Cinder

[MatusJenca2]

I started working on this, I will either create another patch or it will be included in https://review.opendev.org/c/openstack/kolla-ansible/+/909188