8f92d6f508
This patch refactors the devstack plugin to separate the legacy (now deprecated) RBAC settings from the Secure RBAC (new default) settings. The legacy policies can still be deployed by setting ENFORCE_SCOPE=False. Change-Id: Idec818e43016402de0188cf5ade032a1aee638ff
48 lines
1.6 KiB
Plaintext
48 lines
1.6 KiB
Plaintext
# Defaults
|
|
# --------
|
|
|
|
define_plugin barbican
|
|
|
|
# Set up default directories
|
|
BARBICAN_DIR=$DEST/barbican
|
|
BARBICAN_CONF_DIR=${BARBICAN_CONF_DIR:-/etc/barbican}
|
|
BARBICAN_CONF=$BARBICAN_CONF_DIR/barbican.conf
|
|
BARBICAN_PASTE_CONF=$BARBICAN_CONF_DIR/barbican-api-paste.ini
|
|
BARBICAN_API_LOG_DIR=$DEST/logs
|
|
|
|
PYKMIP_CONF_DIR=${PYKMIP_CONF_DIR:-/etc/pykmip}
|
|
PYKMIP_CONF=${PYKMIP_CONF_DIR}/server.conf
|
|
PYKMIP_LOG_DIR=${PYKMIP_LOG_DIR:-/var/log/pykmip}
|
|
|
|
# Barbican virtual environment
|
|
if [[ ${USE_VENV} = True ]]; then
|
|
PROJECT_VENV["barbican"]=${BARBICAN_DIR}.venv
|
|
BARBICAN_BIN_DIR=${PROJECT_VENV["barbican"]}/bin
|
|
else
|
|
BARBICAN_BIN_DIR=$(get_python_exec_prefix)
|
|
fi
|
|
# WSGI variables
|
|
BARBICAN_WSGI=$BARBICAN_BIN_DIR/barbican-wsgi-api
|
|
BARBICAN_UWSGI_CONF=$BARBICAN_CONF_DIR/barbican-uwsgi.ini
|
|
|
|
# Set Barbican repository
|
|
BARBICAN_REPO=${BARBICAN_REPO:-${GIT_BASE}/openstack/barbican.git}
|
|
BARBICAN_BRANCH=${BARBICAN_BRANCH:-master}
|
|
|
|
# python barbican client library
|
|
GITREPO["python-barbicanclient"]=${BARBICANCLIENT_REPO:-${GIT_BASE}/openstack/python-barbicanclient.git}
|
|
GITBRANCH["python-barbicanclient"]=${BARBICANCLIENT_BRANCH:-$TARGET_BRANCH}
|
|
GITDIR["python-barbicanclient"]=$DEST/python-barbicanclient
|
|
|
|
# Set host href
|
|
BARBICAN_HOST_HREF=${BARBICAN_HOST_HREF:-$SERVICE_PROTOCOL://${SERVICE_HOST}/key-manager}
|
|
|
|
GITREPO["barbican-tempest-plugin"]=${BARBICANTEMPEST_REPO:-${GIT_BASE}/openstack/barbican-tempest-plugin.git}
|
|
GITBRANCH["barbican-tempest-plugin"]=${BARBICANTEMPEST_BRANCH:-master}
|
|
GITDIR["barbican-tempest-plugin"]=$DEST/barbican-tempest-plugin
|
|
|
|
# Secure RBAC
|
|
BARBICAN_ENFORCE_SCOPE=$(trueorfalse True ENFORCE_SCOPE)
|
|
|
|
enable_service barbican
|