diff --git a/attributes/default.rb b/attributes/default.rb index ff086325..89e781fc 100644 --- a/attributes/default.rb +++ b/attributes/default.rb @@ -15,7 +15,14 @@ default["nova"]["custom_template_banner"] = " # that Nova uses default["nova"]["rabbit_server_chef_role"] = "rabbitmq-server" -# The name of the Chef role that sets up basic Nova stuff +# The name of the Chef role that creates the Nova database. Other +# recipes need to look up this node to get the value of the nova +# db user and password. +default["nova"]["nova_db_chef_role"] = "nova-setup" + +# The name of the Chef role that sets up basic Nova stuff. Other +# recipes need to look up this node to get the value of the +# password for the Keystone nova service user. default["nova"]["nova_setup_chef_role"] = "nova-setup" # The name of the Chef role that sets up the Keystone Service API @@ -23,7 +30,6 @@ default["nova"]["keystone_service_chef_role"] = "keystone" default["nova"]["db"]["name"] = "nova" default["nova"]["db"]["username"] = "nova" -default["nova"]["db"]["super_user"] = "root" default["nova"]["service_tenant_name"] = "service" default["nova"]["service_user"] = "nova" @@ -37,8 +43,7 @@ default["nova"]["syslog"]["use"] = false default["nova"]["syslog"]["facility"] = "LOG_LOCAL1" default["nova"]["syslog"]["config_facility"] = "local1" -# can this be wedged into the "api" endpoint? -default["nova"]["compute"]["region"] = "RegionOne" +default["nova"]["region"] = "RegionOne" # TODO(shep): This should probably be ['nova']['network']['fixed'] default["nova"]["networks"] = [ diff --git a/recipes/api-ec2.rb b/recipes/api-ec2.rb index cde86d3e..35963f8d 100644 --- a/recipes/api-ec2.rb +++ b/recipes/api-ec2.rb @@ -17,6 +17,7 @@ # limitations under the License. # + class ::Chef::Recipe include ::Openstack include ::Opscode::OpenSSL::Password @@ -26,9 +27,6 @@ include_recipe "nova::nova-common" platform_options = node["nova"]["platform"] -# Set a secure keystone service password -node.set_unless['nova']['service_pass'] = secure_password - directory "/var/lock/nova" do owner node["nova"]["user"] group node["nova"]["group"] @@ -57,6 +55,11 @@ service "nova-api-ec2" do action :enable end +# The node that runs the nova-setup recipe first +# will create a secure service password +nova_setup_role = node["nova"]["nova_setup_chef_role"] +nova_setup_info = config_by_role nova_setup_role, "nova" + identity_admin_endpoint = endpoint "identity-admin" identity_endpoint = endpoint "identity-api" keystone_service_role = node["nova"]["keystone_service_chef_role"] @@ -72,9 +75,8 @@ keystone_register "Register Service Tenant" do auth_protocol identity_admin_endpoint.scheme api_ver identity_admin_endpoint.path auth_token keystone["admin_token"] - tenant_name node["nova"]["service_tenant_name"] + tenant_name nova_setup_info["service_tenant_name"] tenant_description "Service Tenant" - tenant_enabled "true" # Not required as this is the default action :create_tenant end @@ -86,10 +88,9 @@ keystone_register "Register Service User" do auth_protocol identity_admin_endpoint.scheme api_ver identity_admin_endpoint.path auth_token keystone["admin_token"] - tenant_name node["nova"]["service_tenant_name"] - user_name node["nova"]["service_user"] - user_pass node["nova"]["service_pass"] - user_enabled "true" # Not required as this is the default + tenant_name nova_setup_info["service_tenant_name"] + user_name nova_setup_info["service_user"] + user_pass nova_setup_info["service_pass"] action :create_user end @@ -101,9 +102,9 @@ keystone_register "Grant 'admin' Role to Service User for Service Tenant" do auth_protocol identity_admin_endpoint.scheme api_ver identity_admin_endpoint.path auth_token keystone["admin_token"] - tenant_name node["nova"]["service_tenant_name"] - user_name node["nova"]["service_user"] - role_name node["nova"]["service_role"] + tenant_name nova_setup_info["service_tenant_name"] + user_name nova_setup_info["service_user"] + role_name nova_setup_info["service_role"] action :grant_role end @@ -122,20 +123,6 @@ keystone_register "Register EC2 Service" do action :create_service end -template "/etc/nova/api-paste.ini" do - source "api-paste.ini.erb" - owner "root" - group "root" - mode 00644 - variables( - :identity_admin_endpoint => identity_admin_endpoint, - :identity_endpoint => identity_endpoint, - :admin_token => keystone["admin_token"] - ) - - notifies :restart, resources(:service => "nova-api-ec2"), :delayed -end - # Register EC2 Endpoint keystone_register "Register Compute Endpoint" do auth_host identity_admin_endpoint.host @@ -144,10 +131,23 @@ keystone_register "Register Compute Endpoint" do api_ver identity_admin_endpoint.path auth_token keystone["admin_token"] service_type "ec2" - endpoint_region node["nova"]["compute"]["region"] - endpoint_adminurl ec2_admin_endpoint.to_s - endpoint_internalurl ec2_public_endpoint.to_s - endpoint_publicurl ec2_public_endpoint.to_s + endpoint_region node["nova"]["region"] + endpoint_adminurl ::URI.decode ec2_admin_endpoint.to_s + endpoint_internalurl ::URI.decode ec2_public_endpoint.to_s + endpoint_publicurl ::URI.decode ec2_public_endpoint.to_s action :create_endpoint end + +template "/etc/nova/api-paste.ini" do + source "api-paste.ini.erb" + owner "root" + group "root" + mode 00644 + variables( + "identity_admin_endpoint" => identity_admin_endpoint, + "nova_setup_info" => nova_setup_info + ) + + notifies :restart, resources(:service => "nova-api-ec2"), :delayed +end diff --git a/recipes/api-os-compute.rb b/recipes/api-os-compute.rb index 38c30925..c53501ca 100644 --- a/recipes/api-os-compute.rb +++ b/recipes/api-os-compute.rb @@ -23,11 +23,12 @@ class ::Chef::Recipe include ::Openstack end -::Chef::Recipe.send(:include, Opscode::OpenSSL::Password) include_recipe "nova::nova-common" -# Set a secure keystone service password -node.set_unless['nova']['service_pass'] = secure_password +# The node that runs the nova-setup recipe first +# will create a secure service password +nova_setup_role = node["nova"]["nova_setup_chef_role"] +nova_setup_info = config_by_role nova_setup_role, "nova" platform_options = node["nova"]["platform"] @@ -123,20 +124,6 @@ keystone_register "Register Compute Service" do action :create_service end -template "/etc/nova/api-paste.ini" do - source "api-paste.ini.erb" - owner "root" - group "root" - mode 00644 - variables( - :identity_admin_endpoint => identity_admin_endpoint, - :identity_endpoint => identity_endpoint, - :admin_token => keystone["admin_token"] - ) - - notifies :restart, resources(:service => "nova-api-os-compute"), :delayed -end - # Register Compute Endpoing keystone_register "Register Compute Endpoint" do auth_host identity_admin_endpoint.host @@ -152,3 +139,16 @@ keystone_register "Register Compute Endpoint" do action :create_endpoint end + +template "/etc/nova/api-paste.ini" do + source "api-paste.ini.erb" + owner "root" + group "root" + mode 00644 + variables( + "identity_admin_endpoint" => identity_admin_endpoint, + "nova_setup_info" => nova_setup_info + ) + + notifies :restart, resources(:service => "nova-api-os-compute"), :delayed +end diff --git a/recipes/nova-common.rb b/recipes/nova-common.rb index a5ec9e1e..418481c7 100644 --- a/recipes/nova-common.rb +++ b/recipes/nova-common.rb @@ -59,11 +59,11 @@ rabbit_info = get_settings_by_role rabbit_server_role, "queue" # Still need this but only to get the nova db password... # TODO(jaypipes): Refactor password generation/lookup into # openstack-common. -nova_setup_role = node["nova"]["nova_setup_chef_role"] -nova_setup_info = get_settings_by_role nova_setup_role, "nova" +nova_db_role = node["nova"]["nova_db_chef_role"] +nova_db_info = config_by_role nova_db_role, "nova" -db_user = node['nova']['db']['username'] -db_pass = nova_setup_info['db']['password'] +db_user = nova_db_info['db']['username'] +db_pass = nova_db_info['db']['password'] sql_connection = db_uri("compute", db_user, db_pass) keystone_service_role = node["nova"]["keystone_service_chef_role"] diff --git a/recipes/nova-setup.rb b/recipes/nova-setup.rb index 453be291..f2a17407 100644 --- a/recipes/nova-setup.rb +++ b/recipes/nova-setup.rb @@ -18,17 +18,18 @@ # class ::Chef::Recipe - include ::Openstack + include ::Opscode::OpenSSL::Password +end + +# Allow for using a well known service user password +if node["developer_mode"] + node.set_unless["nova"]["service_password"] = "nova" +else + node.set_unless["nova"]["service_password"] = secure_password end include_recipe "nova::nova-common" -keystone_service_role = node["nova"]["keystone_service_chef_role"] -keystone = get_settings_by_role keystone_service_role, "keystone" -keystone_admin_user = keystone["admin_user"] -keystone_admin_password = keystone["users"][keystone_admin_user]["password"] -keystone_admin_tenant = keystone["users"][keystone_admin_user]["default_tenant"] - execute "nova-manage db sync" do command "nova-manage db sync" diff --git a/templates/default/api-paste.ini.erb b/templates/default/api-paste.ini.erb index 27ab6f21..ae64169d 100644 --- a/templates/default/api-paste.ini.erb +++ b/templates/default/api-paste.ini.erb @@ -123,11 +123,7 @@ paste.filter_factory = nova.api.auth:NovaKeystoneContext.factory [filter:authtoken] paste.filter_factory = keystone.middleware.auth_token:filter_factory -service_protocol = <%= @identity_endpoint.scheme %> -service_host = <%= @identity_endpoint.host %> -service_port = <%= @identity_endpoint.port %> -auth_host = <%= @identity_admin_endpoint.host %> -auth_port = <%= @identity_admin_endpoint.port %> -auth_protocol = <%= @identity_admin_endpoint.scheme %> auth_uri = <%= @identity_admin_endpoint.to_s %> -admin_token = <%= @admin_token %> +admin_tenant_name = <%= nova_setup_info["service_tenant_name"] %> +admin_user = <%= nova_setup_info["service_user"] %> +admin_password = <%= nova_setup_info["service_password"] %>