Fix some issues of ironic cookbook

* Set default value for rpc_backend
* Change from "create_schema" to "upgrade" when dbsync
* Add some attributes
* Add identity_uri configuration item
* Add spec tests

Change-Id: Ic57ff8ae9ce69c24211527ddacd23f94d1e417e9
Closes-bug: #1429245

attributes/default.rb

@@ -32,6 +32,15 @@ default['openstack']['bare-metal']['debug'] = 'false'
 default['openstack']['bare-metal']['rpc_thread_pool_size'] = 64
 default['openstack']['bare-metal']['rpc_conn_pool_size'] = 30
 default['openstack']['bare-metal']['rpc_response_timeout'] = 60
+case node['openstack']['mq']['service_type']
+when 'rabbitmq'
+  default['openstack']['bare-metal']['rpc_backend'] = 'rabbit'
+when 'qpid'
+  default['openstack']['bare-metal']['rpc_backend'] = 'qpid'
+end
+
+# The AMQP exchange to connect to if using RabbitMQ or Qpid
+default['openstack']['bare-metal']['control_exchange'] =  node['openstack']['mq']['bare-metal']['control_exchange']
 
 # Logging stuff
 default['openstack']['bare-metal']['log_dir'] = '/var/log/ironic'
@@ -47,6 +56,12 @@ default['openstack']['bare-metal']['api']['auth_strategy'] = 'keystone'
 
 default['openstack']['bare-metal']['api']['auth']['version'] = node['openstack']['api']['auth']['version']
 
+# Whether to allow the client to perform insecure SSL (https) requests
+default['openstack']['bare-metal']['api']['auth']['insecure'] = false
+
+# Keystone PKI signing directories
+default['openstack']['bare-metal']['api']['auth']['cache_dir'] = '/var/cache/ironic/api'
+
 default['openstack']['bare-metal']['service_tenant_name'] = 'service'
 default['openstack']['bare-metal']['service_user'] = 'ironic'
 default['openstack']['bare-metal']['service_role'] = 'admin'

recipes/api.rb

@@ -34,6 +34,13 @@ platform_options['ironic_api_packages'].each do |pkg|
   end
 end
 
+directory '/var/cache/ironic' do
+  owner node['openstack']['bare-metal']['user']
+  group node['openstack']['bare-metal']['group']
+  mode 00700
+  action :create
+end
+
 service 'ironic-api' do
   service_name platform_options['ironic_api_service']
   supports status: true, restart: true
@@ -48,8 +55,8 @@ service 'ironic-api' do
 end
 
 execute 'ironic db sync' do
-  command 'ironic-dbsync --config-file /etc/ironic/ironic.conf create_schema'
-  user node['openstack']['bare-metal']['user']
-  group node['openstack']['bare-metal']['group']
+  command 'ironic-dbsync --config-file /etc/ironic/ironic.conf upgrade'
+  user 'root'
+  group 'root'
   action :run
 end

recipes/ironic-common.rb

@@ -63,8 +63,8 @@ end
 
 image_endpoint = endpoint 'image-api'
 
-identity_endpoint = endpoint 'identity-api'
-identity_admin_endpoint = endpoint 'identity-admin'
+identity_endpoint = internal_endpoint 'identity-internal'
+identity_admin_endpoint = admin_endpoint 'identity-admin'
 service_pass = get_password 'service', 'openstack-bare-metal'
 
 auth_uri = auth_uri_transform(identity_endpoint.to_s, node['openstack']['bare-metal']['api']['auth']['version'])
@@ -79,7 +79,6 @@ template '/etc/ironic/ironic.conf' do
     mq_service_type: mq_service_type,
     mq_password: mq_password,
     rabbit_hosts: rabbit_hosts,
-    identity_endpoint: identity_endpoint,
     glance_protocol: image_endpoint.scheme,
     glance_host: image_endpoint.host,
     glance_port: image_endpoint.port,

spec/api_spec.rb

@@ -44,6 +44,14 @@ describe 'openstack-bare-metal::api' do
       end
     end
 
+    it 'should create the directory /var/cache/ironic' do
+      expect(chef_run).to create_directory('/var/cache/ironic').with(
+        user: 'ironic',
+        group: 'ironic',
+        mode: 00700
+      )
+    end
+
     it 'enables ironic api on boot' do
       expect(chef_run).to enable_service('ironic-api')
     end
@@ -61,7 +69,7 @@ describe 'openstack-bare-metal::api' do
     end
 
     it 'runs db migrations' do
-      expect(chef_run).to run_execute('ironic db sync').with(user: 'ironic', group: 'ironic')
+      expect(chef_run).to run_execute('ironic db sync').with(user: 'root', group: 'root')
     end
   end
 end

spec/ironic-common_spec.rb

@@ -59,6 +59,29 @@ describe 'openstack-bare-metal::ironic-common' do
           mode: 0640
         )
       end
+
+      context 'template contents' do
+        it 'has the default rpc_backend attribute' do
+          expect(chef_run).to render_config_file(file.name)\
+            .with_section_content('DEFAULT', /^rpc_backend=rabbit$/)
+        end
+
+        it 'overrides the default rpc_backend attribute' do
+          node.set['openstack']['bare-metal']['rpc_backend'] = 'qpid'
+
+          expect(chef_run).to render_config_file(file.name)\
+            .with_section_content('DEFAULT', /^rpc_backend=qpid$/)
+        end
+
+        it 'sets the default auth attributes' do
+          [
+            /^insecure=false$/,
+            %r(^signing_dir=/var/cache/ironic/api$)
+          ].each do |line|
+            expect(chef_run).to render_config_file(file.name).with_section_content('keystone_authtoken', line)
+          end
+        end
+      end
     end
 
     describe 'rootwrap.conf' do

templates/default/ironic.conf.erb

@@ -943,12 +943,17 @@ auth_protocol=<%= @identity_admin_endpoint.scheme %>
 # Complete public Identity API endpoint. (string value)
 auth_uri=<%= @auth_uri %>
 
+# Complete admin Identity API endpoint. This should specify
+# the unversioned root endpoint e.g. https://localhost:3537/
+# (string value)
+identity_uri=<%= @identity_admin_endpoint.scheme %>://<%= @identity_admin_endpoint.host %>:<%= @identity_admin_endpoint.port %>
+
 # API version of the admin Identity API endpoint. (string
 # value)
 auth_version=<%= node['openstack']['bare-metal']['api']['auth']['version'] %>
 
 # Keystone account username (string value)
-admin_user = <%= node['openstack']['block-storage']['service_user'] %>
+admin_user = <%= node['openstack']['bare-metal']['service_user'] %>
 
 # Keystone account password (string value)
 admin_password = <%= @service_pass %>