puppet-openstack-integration

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

classopenstack_integration::barbican{

Convert all class usage to relative names In Puppet 3 there was a need to use absolute names to prevent issues. Since Puppet 4 everything is absolute by default which makes this not needed. We need to change this everywhere so that we can revert the pin in [1] that now prevents us from using the latest version of the puppet-lint check puppet-lint-absolute_classname_check that properly checks that we dont use absolute names. [1] https://review.opendev.org/#/c/697742/ Change-Id: I78b74fbeb08be7234189e4d266412fb7fb7a73c0

2019年12月08日 12:59:28 +01:00

includeopenstack_integration::config

includeopenstack_integration::params

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

Refactor usage of RabbitMQ resources This patch refactors all creation of RabbitMQ resources such as users and ACLs to a define called openstack_integration::mq_user. This will make sure RabbitMQ is automatically installed as well, as there are times where dependencies to RabbitMQ are added to things like Keystone which break Beaker tests in other repos (but we don't know they're broken until the change merges). In addition, instead of setting up dependencies on the tagged services, we use the anchors provided which should hopefully test against them as well. Change-Id: Ib122ddd105529de5e12389cc9db2e4e09ec4ad54

2017年09月15日 08:33:55 -04:00

openstack_integration::mq_user{'barbican':

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

password=>'an_even_bigger_secret',

Refactor usage of RabbitMQ resources This patch refactors all creation of RabbitMQ resources such as users and ACLs to a define called openstack_integration::mq_user. This will make sure RabbitMQ is automatically installed as well, as there are times where dependencies to RabbitMQ are added to things like Keystone which break Beaker tests in other repos (but we don't know they're broken until the change merges). In addition, instead of setting up dependencies on the tagged services, we use the anchors provided which should hopefully test against them as well. Change-Id: Ib122ddd105529de5e12389cc9db2e4e09ec4ad54

2017年09月15日 08:33:55 -04:00

before=>Anchor['barbican::service::begin'],

Add support for dual oslo.messaging backend configuration Introduce configuration parameters to specify the oslo.messaging rpc or notification backend as one of rabbit, amqp. The default config is to use rabbit broker for both rpc and notification. Selection of amqp for rpc will use brokerless qpid-dispatch router. This patch: * Adds notification_transport_url parameter across services where needed * Adds rpc and notification parameters to config * Adds qdr for rpc amqp1 configuration * Modifies scenario001 for dual messaging backends * supports ssl config Depends-On: Id6ebc4ce8b0ffdb0be92a758dbf89c84c3274725 Change-Id: Ia2a79a2e1482f6f72426bc81c8e6d2a04cb211e3

2017年01月06日 08:57:09 -05:00

}

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

if$::openstack_integration::config::ssl{

openstack_integration::ssl_key{'barbican':

notify=>Service['httpd'],

require=>Package['barbican-api'],

}

Exec['update-ca-certificates']~>Service['httpd']

}

Convert all class usage to relative names In Puppet 3 there was a need to use absolute names to prevent issues. Since Puppet 4 everything is absolute by default which makes this not needed. We need to change this everywhere so that we can revert the pin in [1] that now prevents us from using the latest version of the puppet-lint check puppet-lint-absolute_classname_check that properly checks that we dont use absolute names. [1] https://review.opendev.org/#/c/697742/ Change-Id: I78b74fbeb08be7234189e4d266412fb7fb7a73c0

2019年12月08日 12:59:28 +01:00

includebarbican

class{'barbican::db::mysql':

Ubuntu: Use utf8mb3 charset in MySQL We are observing the failure in Ubuntu integration job caused by broken idempotency. It seems current mysql/mariadb in Ubuntu replaces utf8 with uft8mb3 automatically and this behavior results in unexpected change in second run. This change ensures that we use utf8mb3 in Ubuntu to avoid such mismatch caused by internal translation. Note this change is intended to be a quick gate fix and the charset would be updated to utf8mb4 later. Closes-Bug: #1929073 Change-Id: I7742120758057b5a00f1d093f355fda3791f4e02

2021年08月12日 17:48:51 +09:00

charset=>$::openstack_integration::params::mysql_charset,

Ubuntu: Use utf8mb3_general_ci collate in MySQL Currently idempotency in Ubuntu is broken because of the below change detected in collate in MySQL. ``` /Stage[main]/Keystone::Db::Mysql/Openstacklib::Db::Mysql[keystone]/ Mysql_database[keystone]/collate: collate changed 'utf8mb3_general_ci' to 'utf8_general_ci' ``` Similarly to what we observed in the past about charset[1], it seems MySQL in Ubuntu is automatically converting the collate value and that is causing the "unexpected" change detected in the 2nd puppet run. This fixes the idempotency by using utf8mb3_general_ci in Ubuntu to avoid the mismatch caused by internal translation. [1] 085d3569021441810c1dff7c8f4396003c690805 Change-Id: I56f31397669d3d7b08aa2e9808947141e003ab0b

2022年08月02日 08:17:09 +09:00

collate=>$::openstack_integration::params::mysql_collate,

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

password=>'barbican',

MySQL: Use appropriate IP version Currently we always use IPv4 for MySQL even in the test cases which are supposed to use IPv6. This fixes that and ensures the expected ip version is used. Change-Id: I483f04376f29b75dcca20061ae381c7e71f26caf

2023年02月24日 14:05:02 +09:00

host=>$::openstack_integration::config::host,

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

}

Convert all class usage to relative names In Puppet 3 there was a need to use absolute names to prevent issues. Since Puppet 4 everything is absolute by default which makes this not needed. We need to change this everywhere so that we can revert the pin in [1] that now prevents us from using the latest version of the puppet-lint check puppet-lint-absolute_classname_check that properly checks that we dont use absolute names. [1] https://review.opendev.org/#/c/697742/ Change-Id: I78b74fbeb08be7234189e4d266412fb7fb7a73c0

2019年12月08日 12:59:28 +01:00

class{'barbican::db':

MySQL: Use appropriate IP version Currently we always use IPv4 for MySQL even in the test cases which are supposed to use IPv6. This fixes that and ensures the expected ip version is used. Change-Id: I483f04376f29b75dcca20061ae381c7e71f26caf

2023年02月24日 14:05:02 +09:00

database_connection=>os_database_connection({

'dialect'=>'mysql+pymysql',

'host'=>$::openstack_integration::config::ip_for_url,

'username'=>'barbican',

'password'=>'barbican',

'database'=>'barbican',

'charset'=>'utf8',

Mysql: Enable SSL Change-Id: Ia4276ef65947c36c5d3712859381bd7536018b0c

2023年03月20日 14:18:09 +09:00

'extra'=>$::openstack_integration::config::db_extra,

MySQL: Use appropriate IP version Currently we always use IPv4 for MySQL even in the test cases which are supposed to use IPv6. This fixes that and ensures the expected ip version is used. Change-Id: I483f04376f29b75dcca20061ae381c7e71f26caf

2023年02月24日 14:05:02 +09:00

}),

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

}

Convert all class usage to relative names In Puppet 3 there was a need to use absolute names to prevent issues. Since Puppet 4 everything is absolute by default which makes this not needed. We need to change this everywhere so that we can revert the pin in [1] that now prevents us from using the latest version of the puppet-lint check puppet-lint-absolute_classname_check that properly checks that we dont use absolute names. [1] https://review.opendev.org/#/c/697742/ Change-Id: I78b74fbeb08be7234189e4d266412fb7fb7a73c0

2019年12月08日 12:59:28 +01:00

class{'barbican::keystone::auth':

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

public_url=>"${::openstack_integration::config::base_url}:9311",

internal_url=>"${::openstack_integration::config::base_url}:9311",

admin_url=>"${::openstack_integration::config::base_url}:9311",

Enable service user token for interaction with nova/barbican This enables usage of service user token for interaction with nova and barbican to avoid failure caused by token expiration during operations. This also enables service_token_roles_required option in authtoken middleware to allow only users with the service role to use this feature. Change-Id: Id6b0aad7aa24af2b6d03d484ada23357828c4325

2023年05月23日 10:14:59 +09:00

roles=>['admin','service'],

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

password=>'a_big_secret',

}

Convert all class usage to relative names In Puppet 3 there was a need to use absolute names to prevent issues. Since Puppet 4 everything is absolute by default which makes this not needed. We need to change this everywhere so that we can revert the pin in [1] that now prevents us from using the latest version of the puppet-lint check puppet-lint-absolute_classname_check that properly checks that we dont use absolute names. [1] https://review.opendev.org/#/c/697742/ Change-Id: I78b74fbeb08be7234189e4d266412fb7fb7a73c0

2019年12月08日 12:59:28 +01:00

includebarbican::quota

Barbican: Consume notifications from keystone Change-Id: Ie836bb7fa8338891784459ea7222c091636ac1d6

2022年01月23日 23:42:41 +09:00

class{'barbican::keystone::notification':

enable_keystone_notification=>true,

}

Convert all class usage to relative names In Puppet 3 there was a need to use absolute names to prevent issues. Since Puppet 4 everything is absolute by default which makes this not needed. We need to change this everywhere so that we can revert the pin in [1] that now prevents us from using the latest version of the puppet-lint check puppet-lint-absolute_classname_check that properly checks that we dont use absolute names. [1] https://review.opendev.org/#/c/697742/ Change-Id: I78b74fbeb08be7234189e4d266412fb7fb7a73c0

2019年12月08日 12:59:28 +01:00

class{'barbican::api::logging':

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

debug=>true,

}

Convert all class usage to relative names In Puppet 3 there was a need to use absolute names to prevent issues. Since Puppet 4 everything is absolute by default which makes this not needed. We need to change this everywhere so that we can revert the pin in [1] that now prevents us from using the latest version of the puppet-lint check puppet-lint-absolute_classname_check that properly checks that we dont use absolute names. [1] https://review.opendev.org/#/c/697742/ Change-Id: I78b74fbeb08be7234189e4d266412fb7fb7a73c0

2019年12月08日 12:59:28 +01:00

class{'barbican::keystone::authtoken':

Enable service user token for interaction with nova/barbican This enables usage of service user token for interaction with nova and barbican to avoid failure caused by token expiration during operations. This also enables service_token_roles_required option in authtoken middleware to allow only users with the service role to use this feature. Change-Id: Id6b0aad7aa24af2b6d03d484ada23357828c4325

2023年05月23日 10:14:59 +09:00

password=>'a_big_secret',

auth_url=>"${::openstack_integration::config::keystone_admin_uri}/v3",

www_authenticate_uri=>"${::openstack_integration::config::keystone_auth_uri}/v3",

user_domain_name=>'Default',

project_domain_name=>'Default',

memcached_servers=>$::openstack_integration::config::memcached_servers,

service_token_roles_required=>true,

Re enable barbican This patch enable barbican again and use the authtoken class Change-Id: I7327882c6188d23e2a9f65a2c026652b5a4d3c5d

2016年08月15日 21:45:54 -03:00

}

Convert all class usage to relative names In Puppet 3 there was a need to use absolute names to prevent issues. Since Puppet 4 everything is absolute by default which makes this not needed. We need to change this everywhere so that we can revert the pin in [1] that now prevents us from using the latest version of the puppet-lint check puppet-lint-absolute_classname_check that properly checks that we dont use absolute names. [1] https://review.opendev.org/#/c/697742/ Change-Id: I78b74fbeb08be7234189e4d266412fb7fb7a73c0

2019年12月08日 12:59:28 +01:00

class{'barbican::api':

Switch to default_transport_url The rabbit_host, rabbit_hosts, rabbit_userid, rabbit_password, rabbit_port and rabbit_virtual_host parameters are being deprecated. This change updates the p-o-i tests to use the default_transport_url for the rabbit connection instead. Change-Id: Icb15ad3b5d75a35afcb685f4ae03c5755031fc3d Depends-On: I43ac3079da9e52179457ca1a34f4faee60d5617b Depends-On: Ie63457370ae37ef5af5878b1a97b8bafa80a8189 Depends-On: Ia0c5b5072431bbc186c8b96b7f034e68e9248af3 Depends-On: I43500ac7be4296ea534266fa14ca37fc700b0092 Depends-On: If4dfe8b82518fc4e590731a805ee3115b11f4f47 Depends-On: I00d4782693c1f67b82673624d4d36822c9762303 Depends-On: If83c0f0e61a08061334536399a42767a305966b7

2016年11月09日 09:41:17 -07:00

default_transport_url=>os_transport_url({

Add support for dual oslo.messaging backend configuration Introduce configuration parameters to specify the oslo.messaging rpc or notification backend as one of rabbit, amqp. The default config is to use rabbit broker for both rpc and notification. Selection of amqp for rpc will use brokerless qpid-dispatch router. This patch: * Adds notification_transport_url parameter across services where needed * Adds rpc and notification parameters to config * Adds qdr for rpc amqp1 configuration * Modifies scenario001 for dual messaging backends * supports ssl config Depends-On: Id6ebc4ce8b0ffdb0be92a758dbf89c84c3274725 Change-Id: Ia2a79a2e1482f6f72426bc81c8e6d2a04cb211e3

2017年01月06日 08:57:09 -05:00

'transport'=>$::openstack_integration::config::messaging_default_proto,

'host'=>$::openstack_integration::config::host,

'port'=>$::openstack_integration::config::messaging_default_port,

'username'=>'barbican',

'password'=>'an_even_bigger_secret',

}),

notification_transport_url=>os_transport_url({

'transport'=>$::openstack_integration::config::messaging_notify_proto,

Switch to default_transport_url The rabbit_host, rabbit_hosts, rabbit_userid, rabbit_password, rabbit_port and rabbit_virtual_host parameters are being deprecated. This change updates the p-o-i tests to use the default_transport_url for the rabbit connection instead. Change-Id: Icb15ad3b5d75a35afcb685f4ae03c5755031fc3d Depends-On: I43ac3079da9e52179457ca1a34f4faee60d5617b Depends-On: Ie63457370ae37ef5af5878b1a97b8bafa80a8189 Depends-On: Ia0c5b5072431bbc186c8b96b7f034e68e9248af3 Depends-On: I43500ac7be4296ea534266fa14ca37fc700b0092 Depends-On: If4dfe8b82518fc4e590731a805ee3115b11f4f47 Depends-On: I00d4782693c1f67b82673624d4d36822c9762303 Depends-On: If83c0f0e61a08061334536399a42767a305966b7

2016年11月09日 09:41:17 -07:00

'host'=>$::openstack_integration::config::host,

Add support for dual oslo.messaging backend configuration Introduce configuration parameters to specify the oslo.messaging rpc or notification backend as one of rabbit, amqp. The default config is to use rabbit broker for both rpc and notification. Selection of amqp for rpc will use brokerless qpid-dispatch router. This patch: * Adds notification_transport_url parameter across services where needed * Adds rpc and notification parameters to config * Adds qdr for rpc amqp1 configuration * Modifies scenario001 for dual messaging backends * supports ssl config Depends-On: Id6ebc4ce8b0ffdb0be92a758dbf89c84c3274725 Change-Id: Ia2a79a2e1482f6f72426bc81c8e6d2a04cb211e3

2017年01月06日 08:57:09 -05:00

'port'=>$::openstack_integration::config::messaging_notify_port,

Switch to default_transport_url The rabbit_host, rabbit_hosts, rabbit_userid, rabbit_password, rabbit_port and rabbit_virtual_host parameters are being deprecated. This change updates the p-o-i tests to use the default_transport_url for the rabbit connection instead. Change-Id: Icb15ad3b5d75a35afcb685f4ae03c5755031fc3d Depends-On: I43ac3079da9e52179457ca1a34f4faee60d5617b Depends-On: Ie63457370ae37ef5af5878b1a97b8bafa80a8189 Depends-On: Ia0c5b5072431bbc186c8b96b7f034e68e9248af3 Depends-On: I43500ac7be4296ea534266fa14ca37fc700b0092 Depends-On: If4dfe8b82518fc4e590731a805ee3115b11f4f47 Depends-On: I00d4782693c1f67b82673624d4d36822c9762303 Depends-On: If83c0f0e61a08061334536399a42767a305966b7

2016年11月09日 09:41:17 -07:00

'username'=>'barbican',

'password'=>'an_even_bigger_secret',

}),

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

host_href=>"${::openstack_integration::config::base_url}:9311",

Re enable barbican This patch enable barbican again and use the authtoken class Change-Id: I7327882c6188d23e2a9f65a2c026652b5a4d3c5d

2016年08月15日 21:45:54 -03:00

auth_strategy=>'keystone',

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

service_name=>'httpd',

enabled_certificate_plugins=>['simple_certificate'],

db_auto_create=>false,

Barbican: Enable asynchronous process This ensure barbican-api delegate processes to barbican-worker over rabbitmq, which is more popular deployment pattern in production. Change-Id: Id2ec1bf07ee77a3ede1888db09d21005468d25ab

2024年02月14日 23:56:51 +09:00

enable_queue=>true,

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

rabbit_use_ssl=>$::openstack_integration::config::ssl,

}

Convert all class usage to relative names In Puppet 3 there was a need to use absolute names to prevent issues. Since Puppet 4 everything is absolute by default which makes this not needed. We need to change this everywhere so that we can revert the pin in [1] that now prevents us from using the latest version of the puppet-lint check puppet-lint-absolute_classname_check that properly checks that we dont use absolute names. [1] https://review.opendev.org/#/c/697742/ Change-Id: I78b74fbeb08be7234189e4d266412fb7fb7a73c0

2019年12月08日 12:59:28 +01:00

class{'barbican::wsgi::apache':

Use raw IP address for apache The latest puppetlabs-apache no longer accepts IPv6 address surrounded by [] as a valid value for $ip. This removes the unnecessary [] to fix the validation failure. Change-Id: I16ba2d81bc0ef85b2abd4b7e4af922ca99e825d5

2022年08月15日 01:58:58 +09:00

bind_host=>$::openstack_integration::config::host,

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

ssl=>$::openstack_integration::config::ssl,

Replace legacy facts and use fact hash ... because the latest lint no longer allows usage of legacy facts and top scope fact. Change-Id: I25d27829f66c4ee56e2755579dad21530ef09c3a

2023年03月01日 10:29:37 +09:00

ssl_key=>"/etc/barbican/ssl/private/${facts['networking']['fqdn']}.pem",

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

ssl_cert=>$::openstack_integration::params::cert_path,

workers=>2,

}

Convert all class usage to relative names In Puppet 3 there was a need to use absolute names to prevent issues. Since Puppet 4 everything is absolute by default which makes this not needed. We need to change this everywhere so that we can revert the pin in [1] that now prevents us from using the latest version of the puppet-lint check puppet-lint-absolute_classname_check that properly checks that we dont use absolute names. [1] https://review.opendev.org/#/c/697742/ Change-Id: I78b74fbeb08be7234189e4d266412fb7fb7a73c0

2019年12月08日 12:59:28 +01:00

class{ 'barbican::worker': }

Barbican: Enable retry scheduler Depends-on: https://review.opendev.org/859734 Change-Id: Id97cfe0ea35afe2d294f749efeae7e49b83eccfb

2022年09月29日 08:31:38 +09:00

class{ 'barbican::retry_scheduler': }

scenario002: enable Barbican and Volume Encryption testing Start testing Barbican for real. Depends-On: I7a51c1a3baae5fd96b75cc73acd4c8c3e2c4ade5 Change-Id: I034a38bb7adde9f39db99b1a82715ce11e8ca63b

2016年07月08日 15:59:50 -04:00

}

openstack/puppet-openstack-integration - puppet-openstack-integration - OpenDev: Free Software Needs Free Tools

94 lines

3.6 KiB

ObjectPascal

Raw Normal View History

openstack/puppet-openstack-integration - puppet-openstack-integration - OpenDev: Free Software Needs Free Tools

94 lines 3.6 KiB ObjectPascal Raw Normal View History Unescape Escape

94 lines

3.6 KiB

ObjectPascal

Raw Normal View History