disabling the admin_token after bootstrap

Code Issues Proposed changes

The keystone documentation highly recommends disabling the admin_token
authentication after the initial bootstrap because it exposes a major
attack vector.
A patch in puppet-keystone [1] added the support to remove
admin_token_auth keyword from the pipeline lists.
This patch aims to use this new class when deploying Keystone.
[1] https://review.openstack.org/#/c/256248
Change-Id: Ic545005122a0f7b92b8a9d3f1e4978b397bfc9c2

This commit is contained in:

Emilien Macchi

2016年02月15日 13:16:09 -05:00

parent e75159f71c

commit becca2e139

2 changed files with 12 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

11
manifests/keystone.pp

View File

@@ -43,5 +43,16 @@ class openstack_integration::keystone (

class{ '::keystone::endpoint':

default_domain => $default_domain,

}

class{ '::keystone::disable_admin_token_auth': }

if$default_domain{

$default_domain_real = $default_domain

}else{

$default_domain_real = 'default'

}

class{ '::openstack_extras::auth_file':

password => 'a_big_secret',

project_domain => $default_domain_real,

user_domain => $default_domain_real,

}

1
manifests/provision.pp

View File

@@ -88,4 +88,5 @@ class openstack_integration::provision {

# source => '/home/jenkins/cache/files/cirros-0.3.4-x86_64-disk.img',

source => 'http://download.cirros-cloud.net/0.3.4/cirros-0.3.4-x86_64-disk.img',

}

Keystone_user_role['admin@openstack']->Glance_image<||>

}