ha_proxy information is not very clear about docs-deploying-cf HOT 6 CLOSED

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/134220245

The labels on this github issue will be updated when the story is started.

from docs-deploying-cf.

Yeah, that's bad-- will clarify-- thanks for pointing it out!

from docs-deploying-cf.

@voelzmo you configure a key and cert for HAproxy in the CF manifest on Openstack -- this is the main key and cert pair used to access CF, right?

For people using the relevant doc linked above, where can we tell them to find these values, or in what previous step did they first generate or choose them? Thanks!

from docs-deploying-cf.

@pspinrad @jadekler The situation is unfortunately a bit complicated:

• You usually setup your CF installation with some kind of domain you own, e.g. pivotal.io
• You define separate subdomains for your applications and system services, e.g. apps.pivotal.io and sys.pivotal.io
• You have a loadbalancer in front (in the OpenStack case this is HAProxy, in the AWS case this is an AWS ELB) which does SSL termination. This loadbalancer gets assigned a floating IP so it can be accessed from the outside
• With means outside of CF and BOSH you need to issue a certificate for a wildcard domain *.pivotal.io and have it signed by some Certificate Authority (i.e. a private key)
• The certificate and its private key need to be put into those variables mentioned

So TL;DR: The Certificate and private key necessary here are not created during the installation of CF, but are a prerequisite. Probably we should add a section about prerequisites somewhere and reference this section here.

PS: Instructions for vSPhere have essentially the same problem but slightly different wording: https://docs.cloudfoundry.org/deploying/common/vsphere-vcloud-cf-stub.html#editing

from docs-deploying-cf.

@voelzmo - great info, thanks for laying it out!

from docs-deploying-cf.

Thanks @voelzmo

from docs-deploying-cf.