Adding details for QDR password auth (#502)

* Adding details for QDR password auth * Move note about disabling auth to main section * Update doc-Service-Telemetry-Framework/modules/proc_retrieving-the-qdr-password.adoc Co-authored-by: Leif Madsen <[email protected]> * Update doc-Service-Telemetry-Framework/modules/proc_retrieving-the-qdr-password.adoc Co-authored-by: mickogeary <[email protected]> --------- Co-authored-by: Leif Madsen <[email protected]> Co-authored-by: mickogeary <[email protected]>
infrawatch · vkmc · Sep 11, 2024 · Jun 19, 2023 · Aug 22, 2023 · Aug 22, 2023
commit 3e400fc7127f22bf843730b809d116dadb6d94c5
diff --git a/...e-Telemetry-Framework/assemblies/assembly_completing-the-stf-configuration.adoc b/...e-Telemetry-Framework/assemblies/assembly_completing-the-stf-configuration.adoc
@@ -29,6 +29,7 @@ include::../modules/proc_configuring-red-hat-openstack-platform-overcloud-for-st
 ifdef::include_when_13,include_when_17[]
 include::../modules/proc_getting-ca-certificate-from-stf-for-overcloud-configuration.adoc[leveloffset=+2]
 endif::include_when_13,include_when_17[]
+include::../modules/proc_retrieving-the-qdr-password.adoc[leveloffset=+2]
 include::../modules/proc_retrieving-the-qdr-route-address.adoc[leveloffset=+2]
 include::../modules/proc_creating-the-base-configuration-for-stf.adoc[leveloffset=+2]
 include::../modules/proc_configuring-the-stf-connection-for-the-overcloud.adoc[leveloffset=+2]

diff --git a/...work/modules/proc_configuring-red-hat-openstack-platform-overcloud-for-stf.adoc b/...work/modules/proc_configuring-red-hat-openstack-platform-overcloud-for-stf.adoc
@@ -9,6 +9,7 @@ As part of the {OpenStack} ({OpenStackShort}) overcloud deployment using directo
 ifdef::include_when_13,include_when_17[]
 . xref:getting-ca-certificate-from-stf-for-overcloud-configuration_assembly-completing-the-stf-configuration[]
 endif::include_when_13,include_when_17[]
+. xref:retrieving-the-qdr-password_assembly-completing-the-stf-configuration[Retrieving the {MessageBus} password]
 . xref:retrieving-the-qdr-route-address_assembly-completing-the-stf-configuration[Retrieving the {MessageBus} route address]
 . xref:creating-the-base-configuration-for-stf_assembly-completing-the-stf-configuration[Creating the base configuration for {ProjectShort}]
 . xref:configuring-the-stf-connection-for-the-overcloud_assembly-completing-the-stf-configuration[Configuring the {ProjectShort} connection for the overcloud]

diff --git a/...roc_configuring-the-stf-connection-for-director-operator-for-the-overcloud.adoc b/...roc_configuring-the-stf-connection-for-director-operator-for-the-overcloud.adoc
@@ -40,6 +40,8 @@ data:
               role: edge
               verifyHostname: false
               sslProfile: sslProfile
+              saslUsername: guest@default-interconnect
+              saslPassword: pass:<password_from_stf>
 
         MetricsQdrSSLProfiles:
             - name: sslProfile

diff --git a/...ry-Framework/modules/proc_configuring-the-stf-connection-for-the-overcloud.adoc b/...ry-Framework/modules/proc_configuring-the-stf-connection-for-the-overcloud.adoc
@@ -9,6 +9,7 @@ To configure the {Project} ({ProjectShort}) connection, you must create a file t
 ifdef::include_when_13,include_when_17[]
 * Retrieve the CA certificate from the {MessageBus} deployed by {ProjectShort}. For more information, see xref:getting-ca-certificate-from-stf-for-overcloud-configuration_assembly-completing-the-stf-configuration[].
 endif::include_when_13,include_when_17[]
+* Retrieve the {MessageBus} password. For more information, see xref:retrieving-the-qdr-password_assembly-completing-the-stf-configuration[].
 * Retrieve the {MessageBus} route address. For more information, see xref:retrieving-the-qdr-route-address_assembly-completing-the-stf-configuration[].
 
 // The following configuration should match the contents in modules/proc_creating-openstack-environment-file-for-multiple-clouds.adoc. If you have changes to make, please make the same changes to both files.
@@ -41,6 +42,8 @@ parameter_defaults:
           role: edge
           verifyHostname: false
           sslProfile: sslProfile
+          saslUsername: guest@default-interconnect
+          saslPassword: pass:<password_from_stf>
 
     MetricsQdrSSLProfiles:
         - name: sslProfile
@@ -68,6 +71,7 @@ endif::[]
 * The `qdr::router_id` configuration is to override the default value which uses the fully-qualified domain name (FQDN) of the host. In some cases the FQDN can result in a router ID length of greater than 61 characters which results in failed QDR connections. For deployments with shorter FQDN values this is not necessary.
 * The `resource_registry` configuration directly loads the collectd service because you do not include the `collectd-write-qdr.yaml` environment file for multiple cloud deployments.
 * Replace the `host` sub-parameter of `MetricsQdrConnectors` with the value that you retrieved in xref:retrieving-the-qdr-route-address_assembly-completing-the-stf-configuration[].
+* Replace the `<password_from_stf>` portion of the `saslPassword` sub-parameter of `MetricsQdrConnectors` with the value you retrieved in xref:retrieving-the-qdr-password_assembly-completing-the-stf-configuration[].
 ifdef::include_when_13,include_when_17[]
 * Replace the `caCertFileContent` parameter with the contents retrieved in xref:getting-ca-certificate-from-stf-for-overcloud-configuration_assembly-completing-the-stf-configuration[].
 endif::include_when_13,include_when_17[]

diff --git a/doc-Service-Telemetry-Framework/modules/proc_retrieving-the-qdr-password.adoc b/doc-Service-Telemetry-Framework/modules/proc_retrieving-the-qdr-password.adoc
@@ -0,0 +1,25 @@
+[id="retrieving-the-qdr-password_{context}"]
+= Retrieving the {MessageBus} password
+
+[role="_abstract"]
+When you configure the {OpenStack} ({OpenStackShort}) overcloud for {Project} ({ProjectShort}), you must provide the {MessageBus} password in the {ProjectShort} connection file.
+
+You can disable basic authentication on the {MessageBus} connection by setting the value of the `transports.qdr.auth` parameter of the ServiceTelemetry spec to `none`. The `transports.qdr.auth` parameter is absent in versions of {ProjectShort} before 1.5.3, so the default behavior is that basic authentication is disabled. In a new install of {ProjectShort} 1.5.3 or later, the default value of  `transports.qdr.auth` is `basic`, but if you upgraded to {ProjectShort} 1.5.3, the default value of `transports.qdr.auth` is `none`.
+
+.Procedure
+
+. Log in to your {OpenShift} environment where {ProjectShort} is hosted.
+
+. Change to the `service-telemetry` project:
++
+[source,bash]
+----
+$ oc project service-telemetry
+----
+
+. Retrieve the {MessageBus} password:
++
+[source,bash,options="nowrap",subs="verbatim"]
+----
+$ oc get secret default-interconnect-users -o json | jq -r .data.guest | base64 -d
+----