Files
5aeac6db6fb2b6301829b9fbaf6871f9991357fa
puppet-openstack-integration /manifests /keystone.pp

152 lines
5.7 KiB
ObjectPascal
Raw Normal View History

#
#[*default_domain*]
#(optional)Definethedefaultdomainid.
#Setto'undef'for'Default'domain.
#Defaulttoundef.
#
#(optional)Easestheuseofthekeystone_domain_configresourcetype.
#Itensuresthatadirectoryforholdingthedomainconfigurationispresent
#andtheassociatedconfigurationinkeystone.confissetupright.
#Defaultstofalse
#
#(optional)Definethetokenexpirationtouse.
#Defaultto'600'.
#
$using_domain_config=false,
include::openstack_integration::params
openstack_integration::ssl_key{'keystone':
notify=>Service['httpd'],
require=>Package['keystone'],
}
Exec['update-ca-certificates']~>Service['httpd']
}
#ItshouldbedonewhenNewtonisreleased.
if$::osfamily=='RedHat'{
$enable_credential_setup=true
class{ '::keystone::client': }
class{ '::keystone::cron::token_flush': }
hour=>'*',
minute=>'*/5',
}
class{'::keystone::db::mysql':
password=>'keystone',
}
class{'::keystone':
database_connection=>'mysql+pymysql://keystone:keystone@127.0.0.1/keystone',
admin_token=>'a_big_token',
admin_password=>'a_big_secret',
enabled=>true,
service_name=>'httpd',
default_domain=>$default_domain,
using_domain_config=>$using_domain_config,
enable_ssl=>$::openstack_integration::config::ssl,
public_bind_host=>$::openstack_integration::config::host,
admin_bind_host=>$::openstack_integration::config::host,
manage_policyrcd=>true,
token_expiration=>$token_expiration,
default_transport_url=>os_transport_url({
'transport'=>$::openstack_integration::config::messaging_default_proto,
'host'=>$::openstack_integration::config::host,
'port'=>$::openstack_integration::config::messaging_default_port,
'username'=>'keystone',
'password'=>'an_even_bigger_secret',
}),
notification_transport_url=>os_transport_url({
'transport'=>$::openstack_integration::config::messaging_notify_proto,
'host'=>$::openstack_integration::config::host,
'port'=>$::openstack_integration::config::messaging_notify_port,
'username'=>'keystone',
'password'=>'an_even_bigger_secret',
}),
rabbit_use_ssl=>$::openstack_integration::config::ssl,
}
class{'::keystone::messaging::amqp':
amqp_sasl_mechanisms=>'PLAIN',
include::apache
class{'::keystone::wsgi::apache':
admin_bind_host=>$::openstack_integration::config::ip_for_url,
ssl=>$::openstack_integration::config::ssl,
ssl_key=>"/etc/keystone/ssl/private/${::fqdn}.pem",
ssl_cert=>$::openstack_integration::params::cert_path,
workers=>2,
#Canonicalpackaging(called'keystone').Thiswillmakesureupgradingthepackageis
#possible,seehttps://bugs.launchpad.net/ubuntu/+source/keystone/+bug/1737697
ensure_resource('file','/etc/apache2/sites-available/keystone.conf',{
'content'=>'',
ensure_resource('file','/etc/apache2/sites-enabled/keystone.conf',{
'content'=>'',
Package['keystone']->File['/etc/apache2/sites-available/keystone.conf']
->File['/etc/apache2/sites-enabled/keystone.conf']~>Anchor['keystone::install::end']
}
class{'::keystone::roles::admin':
email=>'test@example.tld',
password=>'a_big_secret',
}
class{'::keystone::endpoint':
admin_url=>$::openstack_integration::config::keystone_admin_uri,
password=>'a_big_secret',
user_domain=>'default',
#Weneedtempestuserstohavethecreatorroletobeabletostore
#secretsinbarbican.Wedothisbyaddingthecreatorroletothe
#tempest_roleslistintempest.conf.
#WealsoneedtheMemberroleforsomeswiftcontainertests.
#Ordinarilytempestcodeindynamic_creds.pywouldcreate
#thisroleandassignuserstoit.Thiscodeisnotexecuted,however,
#whentempest_rolesisdefined.Thereforeweneedtomakesurethis
#roleiscreatedhere,andaddedtotempest_roles.
keystone_role{'creator':
ensure=>present,
}
keystone_role{'Member':
ensure=>present,
}