Files
5aeac6db6fb2b6301829b9fbaf6871f9991357fa
puppet-openstack-integration /manifests /keystone.pp

152 lines
5.7 KiB
ObjectPascal
Raw Normal View History

#ConfiguretheKeystoneservice
#
#[*default_domain*]
#(optional)Definethedefaultdomainid.
#Setto'undef'for'Default'domain.
#Defaulttoundef.
#
#[*using_domain_config*]
#(optional)Easestheuseofthekeystone_domain_configresourcetype.
#Itensuresthatadirectoryforholdingthedomainconfigurationispresent
#andtheassociatedconfigurationinkeystone.confissetupright.
#Defaultstofalse
#
#[*token_expiration*]
#(optional)Definethetokenexpirationtouse.
#Defaultto'600'.
#
classopenstack_integration::keystone(
$default_domain=undef,
$using_domain_config=false,
$token_expiration='600',
){
include::openstack_integration::config
include::openstack_integration::params
openstack_integration::mq_user{'keystone':
password=>'an_even_bigger_secret',
before=>Anchor['keystone::service::begin'],
}
if$::openstack_integration::config::ssl{
openstack_integration::ssl_key{'keystone':
notify=>Service['httpd'],
require=>Package['keystone'],
}
Exec['update-ca-certificates']~>Service['httpd']
}
#KeystonecredentialsetupisnotpackagedinUCAyet.
#ItshouldbedonewhenNewtonisreleased.
if$::osfamily=='RedHat'{
$enable_credential_setup=true
}else{
$enable_credential_setup=false
}
class{ '::keystone::client': }
class{ '::keystone::cron::token_flush': }
class{'::keystone::cron::fernet_rotate':
hour=>'*',
minute=>'*/5',
}
class{'::keystone::db::mysql':
password=>'keystone',
}
class{'::keystone':
debug=>true,
database_connection=>'mysql+pymysql://keystone:keystone@127.0.0.1/keystone',
admin_token=>'a_big_token',
admin_password=>'a_big_secret',
enabled=>true,
service_name=>'httpd',
default_domain=>$default_domain,
using_domain_config=>$using_domain_config,
enable_ssl=>$::openstack_integration::config::ssl,
public_bind_host=>$::openstack_integration::config::host,
admin_bind_host=>$::openstack_integration::config::host,
manage_policyrcd=>true,
enable_credential_setup=>$enable_credential_setup,
fernet_max_active_keys=>'4',
token_expiration=>$token_expiration,
default_transport_url=>os_transport_url({
'transport'=>$::openstack_integration::config::messaging_default_proto,
'host'=>$::openstack_integration::config::host,
'port'=>$::openstack_integration::config::messaging_default_port,
'username'=>'keystone',
'password'=>'an_even_bigger_secret',
}),
notification_transport_url=>os_transport_url({
'transport'=>$::openstack_integration::config::messaging_notify_proto,
'host'=>$::openstack_integration::config::host,
'port'=>$::openstack_integration::config::messaging_notify_port,
'username'=>'keystone',
'password'=>'an_even_bigger_secret',
}),
rabbit_use_ssl=>$::openstack_integration::config::ssl,
}
class{'::keystone::messaging::amqp':
amqp_sasl_mechanisms=>'PLAIN',
}
include::apache
class{'::keystone::wsgi::apache':
bind_host=>$::openstack_integration::config::ip_for_url,
admin_bind_host=>$::openstack_integration::config::ip_for_url,
ssl=>$::openstack_integration::config::ssl,
ssl_key=>"/etc/keystone/ssl/private/${::fqdn}.pem",
ssl_cert=>$::openstack_integration::params::cert_path,
workers=>2,
}
#WorkaroundtoemptyKeystonevhostthatisprovided&activatedbydefaultwithrunning
#Canonicalpackaging(called'keystone').Thiswillmakesureupgradingthepackageis
#possible,seehttps://bugs.launchpad.net/ubuntu/+source/keystone/+bug/1737697
if($::operatingsystem=='Ubuntu')and(versioncmp($::operatingsystemmajrelease,'16')>=0){
ensure_resource('file','/etc/apache2/sites-available/keystone.conf',{
'ensure'=>'present',
'content'=>'',
})
ensure_resource('file','/etc/apache2/sites-enabled/keystone.conf',{
'ensure'=>'present',
'content'=>'',
})
Package['keystone']->File['/etc/apache2/sites-available/keystone.conf']
->File['/etc/apache2/sites-enabled/keystone.conf']~>Anchor['keystone::install::end']
}
class{'::keystone::roles::admin':
email=>'test@example.tld',
password=>'a_big_secret',
}
class{'::keystone::endpoint':
default_domain=>$default_domain,
public_url=>$::openstack_integration::config::keystone_auth_uri,
admin_url=>$::openstack_integration::config::keystone_admin_uri,
version=>'',
}
class{ '::keystone::disable_admin_token_auth': }
class{'::openstack_extras::auth_file':
password=>'a_big_secret',
project_domain=>'default',
user_domain=>'default',
auth_url=>"${::openstack_integration::config::keystone_auth_uri}/v3/",
}
#Weneedtempestuserstohavethecreatorroletobeabletostore
#secretsinbarbican.Wedothisbyaddingthecreatorroletothe
#tempest_roleslistintempest.conf.
#WealsoneedtheMemberroleforsomeswiftcontainertests.
#Ordinarilytempestcodeindynamic_creds.pywouldcreate
#thisroleandassignuserstoit.Thiscodeisnotexecuted,however,
#whentempest_rolesisdefined.Thereforeweneedtomakesurethis
#roleiscreatedhere,andaddedtotempest_roles.
keystone_role{'creator':
ensure=>present,
}
keystone_role{'Member':
ensure=>present,
}
}