os_capacity verification flag

Author: assumptionsandg

doc/source/configuration/monitoring.rst

@@ -161,6 +161,14 @@ HAProxy configuration to be templated to controllers during deployment.
 
     stackhpc_enable_os_capacity: true
 
+If you are deploying in a cloud with internal TLS, you may be required
+to disable certificate verification for the OpenStack Capacity exporter
+if your certificate is not signed by a trusted CA.
+
+.. code-block:: yaml
+
+    stackhpc_os_capacity_openstack_verify: false
+
 After defining your credentials, You may deploy OpenStack Capacity
 using the ``ansible/deploy-os-capacity-exporter.yml`` Ansible playbook
 via Kayobe.

etc/kayobe/ansible/templates/os_capacity-clouds.yml.j2

@@ -8,6 +8,6 @@ clouds:
     interface: "internal"
     identity_api_version: 3
     auth_type: "v3applicationcredential"
-{% if kolla_enable_tls_internal | bool %}
+{% if not stackhpc_os_capacity_openstack_verify | bool %}
     verify: False
 {% endif %}

etc/kayobe/stackhpc-monitoring.yml

@@ -15,3 +15,7 @@ alertmanager_low_memory_threshold_gib: 5
 # Enabling this flag will result in HAProxy configuration and Prometheus scrape
 # targets being templated during deployment.
 stackhpc_enable_os_capacity: false
+
+# Whether TLS certificate verification is enabled for the OpenStack Capacity
+# exporter during Keystone authentication.
+stackhpc_os_capacity_openstack_verify: true

releasenotes/notes/os-capacity-94006f03f16583e4.yaml

@@ -15,5 +15,9 @@ upgrade:
     'Monitoring' documentation.
 
     You must also enable the ``stackhpc_enable_os_capacity``
-    flag for OpenStack Capacity HAProxy configuration to be
-    templated.
+    flag for OpenStack Capacity HAProxy and Prometheus configuration
+    to be templated.
+
+    To disable certificate verification for the OpenStack Capacity
+    exporter, you can set ``stackhpc_os_capacity_openstack_verify``
+    to false.