6fba9d6785
Currently on F20 env when devstack tries to install barbican and barbicanclient, it's failing as corresponding dir doesn't exist and ERROR_ON_CLONE=True. As barbican is not part of devstack yet, we don't expect this dir to be present in this case, we should set ERROR_ON_CLONE=False to allow devstack to do git clone. Related-Bug: #1353696 Change-Id: I3c362f1b2e6c9abf940ea68a12085dd747ede37c
212 lines
7.1 KiB
Plaintext
Executable File
212 lines
7.1 KiB
Plaintext
Executable File
# lib/barbican
|
|
# Install and start **Barbican** service
|
|
|
|
# To enable a minimal set of Barbican features, add the following to localrc:
|
|
# enable_service barbican
|
|
#
|
|
# Dependencies:
|
|
# - functions
|
|
# - OS_AUTH_URL for auth in api
|
|
# - DEST set to the destination directory
|
|
# - SERVICE_PASSWORD, SERVICE_TENANT_NAME for auth in api
|
|
# - STACK_USER service user
|
|
|
|
# stack.sh
|
|
# ---------
|
|
# install_barbican
|
|
# configure_barbican
|
|
# init_barbican
|
|
# start_barbican
|
|
# stop_barbican
|
|
# cleanup_barbican
|
|
|
|
# Save trace setting
|
|
XTRACE=$(set +o | grep xtrace)
|
|
set +o xtrace
|
|
|
|
|
|
# Defaults
|
|
# --------
|
|
|
|
# Set up default directories
|
|
BARBICAN_DIR=$DEST/barbican
|
|
BARBICANCLIENT_DIR=$DEST/python-barbicanclient
|
|
BARBICAN_CONF_DIR=${BARBICAN_CONF_DIR:-/etc/barbican}
|
|
BARBICAN_CONF=$BARBICAN_CONF_DIR/barbican-api.conf
|
|
BARBICAN_PASTE_CONF=$BARBICAN_CONF_DIR/barbican-api-paste.ini
|
|
BARBICAN_API_LOG_DIR=$DEST/logs
|
|
BARBICAN_AUTH_CACHE_DIR=${BARBICAN_AUTH_CACHE_DIR:-/var/cache/barbican}
|
|
|
|
# Support potential entry-points console scripts
|
|
BARBICAN_BIN_DIR=$(get_python_exec_prefix)
|
|
|
|
# Set Barbican repository
|
|
BARBICAN_REPO=${BARBICAN_REPO:-${GIT_BASE}/openstack/barbican.git}
|
|
BARBICAN_BRANCH=${BARBICAN_BRANCH:-master}
|
|
|
|
# Set client library repository
|
|
BARBICANCLIENT_REPO=${BARBICANCLIENT_REPO:-${GIT_BASE}/openstack/python-barbicanclient.git}
|
|
BARBICANCLIENT_BRANCH=${BARBICANCLIENT_BRANCH:-master}
|
|
|
|
# Tell Tempest this project is present
|
|
TEMPEST_SERVICES+=,barbican
|
|
|
|
|
|
# Functions
|
|
# ---------
|
|
|
|
# cleanup_barbican - Remove residual data files, anything left over from previous
|
|
# runs that a clean run would need to clean up
|
|
function cleanup_barbican {
|
|
:
|
|
}
|
|
|
|
# configure_barbicanclient - Set config files, create data dirs, etc
|
|
function configure_barbicanclient {
|
|
setup_develop $BARBICANCLIENT_DIR
|
|
}
|
|
|
|
# configure_barbican - Set config files, create data dirs, etc
|
|
function configure_barbican {
|
|
setup_develop $BARBICAN_DIR
|
|
|
|
[ ! -d $BARBICAN_CONF_DIR ] && sudo mkdir -m 755 -p $BARBICAN_CONF_DIR
|
|
sudo chown $USER $BARBICAN_CONF_DIR
|
|
|
|
[ ! -d $BARBICAN_API_LOG_DIR ] && sudo mkdir -m 755 -p $BARBICAN_API_LOG_DIR
|
|
sudo chown $USER $BARBICAN_API_LOG_DIR
|
|
|
|
[ ! -d $BARBICAN_CONF_DIR ] && sudo mkdir -m 755 -p $BARBICAN_CONF_DIR
|
|
sudo chown $USER $BARBICAN_CONF_DIR
|
|
|
|
# Copy the barbican config files to the config dir
|
|
cp $BARBICAN_DIR/etc/barbican/barbican-api.conf $BARBICAN_CONF_DIR
|
|
cp $BARBICAN_DIR/etc/barbican/barbican-api-paste.ini $BARBICAN_CONF_DIR
|
|
cp $BARBICAN_DIR/etc/barbican/barbican-admin-paste.ini $BARBICAN_CONF_DIR
|
|
cp -R $BARBICAN_DIR/etc/barbican/vassals $BARBICAN_CONF_DIR
|
|
|
|
# Set the logging to INFO
|
|
iniset $BARBICAN_CONF DEFAULT verbose True
|
|
|
|
# Do not set to DEBUG
|
|
iniset $BARBICAN_CONF DEFAULT debug False
|
|
|
|
# Set the log file location
|
|
iniset $BARBICAN_CONF DEFAULT log_file "$BARBICAN_API_LOG_DIR/barbican.log"
|
|
|
|
# Install the policy file for the API server
|
|
cp $BARBICAN_DIR/etc/barbican/policy.json $BARBICAN_CONF_DIR
|
|
iniset $BARBICAN_CONF DEFAULT policy_file $BARBICAN_CONF_DIR/policy.json
|
|
|
|
# Set the database connection url
|
|
iniset $BARBICAN_CONF DEFAULT sql_connection `database_connection_url barbican`
|
|
|
|
# Increase default request buffer size, keystone auth PKI tokens can be very long
|
|
iniset $BARBICAN_CONF_DIR/vassals/barbican-api.ini uwsgi buffer-size 65535
|
|
|
|
# Rabbit settings
|
|
if is_service_enabled rabbit; then
|
|
iniset $BARBICAN_CONF 'secrets' broker rabbit://guest:$RABBIT_PASSWORD@$RABBIT_HOST
|
|
else
|
|
echo_summary "Barbican requires that the RabbitMQ service is enabled"
|
|
fi
|
|
|
|
## Set up keystone
|
|
|
|
# Turn on the middleware
|
|
iniset $BARBICAN_PASTE_CONF 'pipeline:barbican_api' pipeline 'keystone_authtoken context apiapp'
|
|
|
|
# Set the keystone parameters
|
|
iniset $BARBICAN_PASTE_CONF 'filter:keystone_authtoken' auth_protocol $KEYSTONE_AUTH_PROTOCOL
|
|
iniset $BARBICAN_PASTE_CONF 'filter:keystone_authtoken' auth_host $KEYSTONE_AUTH_HOST
|
|
iniset $BARBICAN_PASTE_CONF 'filter:keystone_authtoken' auth_port $KEYSTONE_AUTH_PORT
|
|
iniset $BARBICAN_PASTE_CONF 'filter:keystone_authtoken' admin_user barbican
|
|
iniset $BARBICAN_PASTE_CONF 'filter:keystone_authtoken' admin_password $SERVICE_PASSWORD
|
|
iniset $BARBICAN_PASTE_CONF 'filter:keystone_authtoken' admin_tenant_name $SERVICE_TENANT_NAME
|
|
iniset $BARBICAN_PASTE_CONF 'filter:keystone_authtoken' signing_dir $BARBICAN_AUTH_CACHE_DIR
|
|
}
|
|
|
|
# init_barbican - Initialize etc.
|
|
function init_barbican {
|
|
# Create cache dir
|
|
sudo mkdir -p $BARBICAN_AUTH_CACHE_DIR
|
|
sudo chown $STACK_USER $BARBICAN_AUTH_CACHE_DIR
|
|
rm -f $BARBICAN_AUTH_CACHE_DIR/*
|
|
|
|
recreate_database barbican utf8
|
|
}
|
|
|
|
# install_barbican - Collect source and prepare
|
|
function install_barbican {
|
|
# Install package requirements
|
|
if is_fedora; then
|
|
install_package sqlite-devel
|
|
fi
|
|
# TODO(ravips): We need this until barbican gets into devstack
|
|
ERROR_ON_CLONE=False
|
|
git_clone $BARBICAN_REPO $BARBICAN_DIR $BARBICAN_BRANCH
|
|
setup_develop $BARBICAN_DIR
|
|
pip_install 'uwsgi'
|
|
}
|
|
|
|
# install_barbicanclient - Collect source and prepare
|
|
function install_barbicanclient {
|
|
# TODO(ravips): We need this until barbican gets into devstack
|
|
ERROR_ON_CLONE=False
|
|
git_clone $BARBICANCLIENT_REPO $BARBICANCLIENT_DIR $BARBICANCLIENT_BRANCH
|
|
setup_develop $BARBICANCLIENT_DIR
|
|
}
|
|
|
|
# start_barbican - Start running processes, including screen
|
|
function start_barbican {
|
|
screen_it barbican "uwsgi --master --emperor $BARBICAN_CONF_DIR/vassals"
|
|
}
|
|
|
|
# stop_barbican - Stop running processes
|
|
function stop_barbican {
|
|
# This will eventually be refactored to work like
|
|
# Solum and Manila (script to kick off a wsgiref server)
|
|
# For now, this will stop uWSGI rather than have it hang
|
|
killall -9 uwsgi
|
|
|
|
# This cleans up the PID file, but uses pkill so Barbican
|
|
# uWSGI emperor process doesn't actually stop
|
|
screen_stop barbican
|
|
}
|
|
|
|
function create_barbican_accounts {
|
|
SERVICE_TENANT=$(keystone tenant-list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
|
|
ADMIN_ROLE=$(keystone role-list | awk "/ admin / { print \$2 }")
|
|
|
|
BARBICAN_USER=$(keystone user-create --name=barbican \
|
|
--pass="$SERVICE_PASSWORD" \
|
|
--tenant-id $SERVICE_TENANT \
|
|
--email=barbican@example.com \
|
|
| grep " id " | get_field 2)
|
|
keystone user-role-add --tenant-id $SERVICE_TENANT \
|
|
--user-id $BARBICAN_USER \
|
|
--role-id $ADMIN_ROLE
|
|
if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
|
|
BARBICAN_SERVICE=$(keystone service-create \
|
|
--name=barbican \
|
|
--type=keystore \
|
|
--description="Barbican Service" \
|
|
| grep " id " | get_field 2)
|
|
keystone endpoint-create \
|
|
--region RegionOne \
|
|
--service_id $BARBICAN_SERVICE \
|
|
--publicurl "http://$SERVICE_HOST:9311/v1" \
|
|
--adminurl "http://$SERVICE_HOST:9312/v1" \
|
|
--internalurl "http://$SERVICE_HOST:9311/v1"
|
|
fi
|
|
|
|
}
|
|
|
|
|
|
# Restore xtrace
|
|
$XTRACE
|
|
|
|
# Local variables:
|
|
# mode: shell-script
|
|
# End:
|