Configure authentication for the memcached service

Memcached is a distributed memory-caching service. Configure the service to require authentication to protect sensitive cached data, such as Keystone tokens and user sessions, from unauthorized access. By default, authentication is disabled.

Before you begin

  • You have the oc command line tool installed on your workstation.
  • You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges.

You can set the authentication mode for the memcached service on your control plane. The following authentication modes are supported:

None
No authentication is required. The client does not require a certificate from the server to proceed with the connection. This mode has the least impact upon performance but does not provide any security. This is the default authentication mode.
Request
Authentication is attempted. The client requests a certificate from the server but does not strictly require it to proceed with the connection. This mode provides flexible connections but weaker security.
Require
Authentication is enforced. The client demands that the server present a valid and verifiable certificate. If the server fails to provide one, or if the client cannot successfully validate the certificate against its trusted Certificate Authorities (CAs), the connection fails. This mode provides strong security at the cost of brittle connections.

Procedure

  1. Open your OpenStackControlPlane custom resource (CR) file, openstack_control_plane.yaml, on your workstation.
  2. Update the memcached service with the required authentication mode:

    The following example configures the default memcached cluster (memcached):

    spec:
  memcached:
    enabled: true
    templates:
      memcached:
        ...
        tls:
          mtls:
            sslVerifyMode: <authentication_mode>
    • Replace <authentication_mode> with the required authentication mode, either Request or Require.
  3. Save openstack_control_plane.yaml.
  4. Update the control plane: 
    $ oc apply -f openstack_control_plane.yaml -n openstack
  5. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status: 
    $ oc get openstackcontrolplane -n openstack

    The OpenStackControlPlane resources are created when the status is "Setup complete".

    Tip
    Append the -w option to the end of the get command to track deployment progress.