Support for setting the service user/pass/tenant_name in paste.ini

Removes use of admin_token and now-irrelevant host/port/scheme
sections of api-paste.ini in favor of admin_user/tenant_name and
admin_password corresponding to the service user/tenant/pass.

attributes/default.rb

@@ -15,7 +15,14 @@ default["nova"]["custom_template_banner"] = "
 # that Nova uses
 default["nova"]["rabbit_server_chef_role"] = "rabbitmq-server"
 
-# The name of the Chef role that sets up basic Nova stuff
+# The name of the Chef role that creates the Nova database. Other
+# recipes need to look up this node to get the value of the nova
+# db user and password.
+default["nova"]["nova_db_chef_role"] = "nova-setup"
+
+# The name of the Chef role that sets up basic Nova stuff. Other
+# recipes need to look up this node to get the value of the
+# password for the Keystone nova service user.
 default["nova"]["nova_setup_chef_role"] = "nova-setup"
 
 # The name of the Chef role that sets up the Keystone Service API
@@ -23,7 +30,6 @@ default["nova"]["keystone_service_chef_role"] = "keystone"
 
 default["nova"]["db"]["name"] = "nova"
 default["nova"]["db"]["username"] = "nova"
-default["nova"]["db"]["super_user"] = "root"
 
 default["nova"]["service_tenant_name"] = "service"
 default["nova"]["service_user"] = "nova"
@@ -37,8 +43,7 @@ default["nova"]["syslog"]["use"] = false
 default["nova"]["syslog"]["facility"] = "LOG_LOCAL1"
 default["nova"]["syslog"]["config_facility"] = "local1"
 
-# can this be wedged into the "api" endpoint?
+default["nova"]["region"] = "RegionOne"
-default["nova"]["compute"]["region"] = "RegionOne"
 
 # TODO(shep): This should probably be ['nova']['network']['fixed']
 default["nova"]["networks"] = [

recipes/api-ec2.rb

@@ -17,6 +17,7 @@
 # limitations under the License.
 #
 
+
 class ::Chef::Recipe
   include ::Openstack
   include ::Opscode::OpenSSL::Password
@@ -26,9 +27,6 @@ include_recipe "nova::nova-common"
 
 platform_options = node["nova"]["platform"]
 
-# Set a secure keystone service password
-node.set_unless['nova']['service_pass'] = secure_password
-
 directory "/var/lock/nova" do
   owner node["nova"]["user"]
   group node["nova"]["group"]
@@ -57,6 +55,11 @@ service "nova-api-ec2" do
   action :enable
 end
 
+# The node that runs the nova-setup recipe first
+# will create a secure service password
+nova_setup_role = node["nova"]["nova_setup_chef_role"]
+nova_setup_info = config_by_role nova_setup_role, "nova"
+
 identity_admin_endpoint = endpoint "identity-admin"
 identity_endpoint = endpoint "identity-api"
 keystone_service_role = node["nova"]["keystone_service_chef_role"]
@@ -72,9 +75,8 @@ keystone_register "Register Service Tenant" do
   auth_protocol identity_admin_endpoint.scheme
   api_ver identity_admin_endpoint.path
   auth_token keystone["admin_token"]
-  tenant_name node["nova"]["service_tenant_name"]
+  tenant_name nova_setup_info["service_tenant_name"]
   tenant_description "Service Tenant"
-  tenant_enabled "true" # Not required as this is the default
 
   action :create_tenant
 end
@@ -86,10 +88,9 @@ keystone_register "Register Service User" do
   auth_protocol identity_admin_endpoint.scheme
   api_ver identity_admin_endpoint.path
   auth_token keystone["admin_token"]
-  tenant_name node["nova"]["service_tenant_name"]
+  tenant_name nova_setup_info["service_tenant_name"]
-  user_name node["nova"]["service_user"]
+  user_name nova_setup_info["service_user"]
-  user_pass node["nova"]["service_pass"]
+  user_pass nova_setup_info["service_pass"]
-  user_enabled "true" # Not required as this is the default
 
   action :create_user
 end
@@ -101,9 +102,9 @@ keystone_register "Grant 'admin' Role to Service User for Service Tenant" do
   auth_protocol identity_admin_endpoint.scheme
   api_ver identity_admin_endpoint.path
   auth_token keystone["admin_token"]
-  tenant_name node["nova"]["service_tenant_name"]
+  tenant_name nova_setup_info["service_tenant_name"]
-  user_name node["nova"]["service_user"]
+  user_name nova_setup_info["service_user"]
-  role_name node["nova"]["service_role"]
+  role_name nova_setup_info["service_role"]
 
   action :grant_role
 end
@@ -122,20 +123,6 @@ keystone_register "Register EC2 Service" do
   action :create_service
 end
 
-template "/etc/nova/api-paste.ini" do
-  source "api-paste.ini.erb"
-  owner  "root"
-  group  "root"
-  mode   00644
-  variables(
-    :identity_admin_endpoint => identity_admin_endpoint,
-    :identity_endpoint => identity_endpoint,
-    :admin_token => keystone["admin_token"]
-  )
-
-  notifies :restart, resources(:service => "nova-api-ec2"), :delayed
-end
-
 # Register EC2 Endpoint
 keystone_register "Register Compute Endpoint" do
   auth_host identity_admin_endpoint.host
@@ -144,10 +131,23 @@ keystone_register "Register Compute Endpoint" do
   api_ver identity_admin_endpoint.path
   auth_token keystone["admin_token"]
   service_type "ec2"
-  endpoint_region node["nova"]["compute"]["region"]
+  endpoint_region node["nova"]["region"]
-  endpoint_adminurl ec2_admin_endpoint.to_s
+  endpoint_adminurl ::URI.decode ec2_admin_endpoint.to_s
-  endpoint_internalurl ec2_public_endpoint.to_s
+  endpoint_internalurl ::URI.decode ec2_public_endpoint.to_s
-  endpoint_publicurl ec2_public_endpoint.to_s
+  endpoint_publicurl ::URI.decode ec2_public_endpoint.to_s
 
   action :create_endpoint
 end
+
+template "/etc/nova/api-paste.ini" do
+  source "api-paste.ini.erb"
+  owner  "root"
+  group  "root"
+  mode   00644
+  variables(
+    "identity_admin_endpoint" => identity_admin_endpoint,
+    "nova_setup_info" => nova_setup_info
+  )
+
+  notifies :restart, resources(:service => "nova-api-ec2"), :delayed
+end

recipes/api-os-compute.rb

@@ -23,11 +23,12 @@ class ::Chef::Recipe
   include ::Openstack
 end
 
-::Chef::Recipe.send(:include, Opscode::OpenSSL::Password)
 include_recipe "nova::nova-common"
 
-# Set a secure keystone service password
+# The node that runs the nova-setup recipe first
-node.set_unless['nova']['service_pass'] = secure_password
+# will create a secure service password
+nova_setup_role = node["nova"]["nova_setup_chef_role"]
+nova_setup_info = config_by_role nova_setup_role, "nova"
 
 platform_options = node["nova"]["platform"]
 
@@ -123,20 +124,6 @@ keystone_register "Register Compute Service" do
   action :create_service
 end
 
-template "/etc/nova/api-paste.ini" do
-  source "api-paste.ini.erb"
-  owner  "root"
-  group  "root"
-  mode   00644
-  variables(
-    :identity_admin_endpoint => identity_admin_endpoint,
-    :identity_endpoint => identity_endpoint,
-    :admin_token => keystone["admin_token"]
-  )
-
-  notifies :restart, resources(:service => "nova-api-os-compute"), :delayed
-end
-
 # Register Compute Endpoing
 keystone_register "Register Compute Endpoint" do
   auth_host identity_admin_endpoint.host
@@ -152,3 +139,16 @@ keystone_register "Register Compute Endpoint" do
 
   action :create_endpoint
 end
+
+template "/etc/nova/api-paste.ini" do
+  source "api-paste.ini.erb"
+  owner  "root"
+  group  "root"
+  mode   00644
+  variables(
+    "identity_admin_endpoint" => identity_admin_endpoint,
+    "nova_setup_info" => nova_setup_info
+  )
+
+  notifies :restart, resources(:service => "nova-api-os-compute"), :delayed
+end

recipes/nova-common.rb

@@ -59,11 +59,11 @@ rabbit_info = get_settings_by_role rabbit_server_role, "queue"
 # Still need this but only to get the nova db password...
 # TODO(jaypipes): Refactor password generation/lookup into
 # openstack-common.
-nova_setup_role = node["nova"]["nova_setup_chef_role"]
+nova_db_role = node["nova"]["nova_db_chef_role"]
-nova_setup_info = get_settings_by_role nova_setup_role, "nova"
+nova_db_info = config_by_role nova_db_role, "nova"
 
-db_user = node['nova']['db']['username']
+db_user = nova_db_info['db']['username']
-db_pass = nova_setup_info['db']['password']
+db_pass = nova_db_info['db']['password']
 sql_connection = db_uri("compute", db_user, db_pass)
 
 keystone_service_role = node["nova"]["keystone_service_chef_role"]

recipes/nova-setup.rb

@@ -18,17 +18,18 @@
 #
 
 class ::Chef::Recipe
-  include ::Openstack
+  include ::Opscode::OpenSSL::Password
+end
+
+# Allow for using a well known service user password
+if node["developer_mode"]
+  node.set_unless["nova"]["service_password"] = "nova"
+else
+  node.set_unless["nova"]["service_password"] = secure_password
 end
 
 include_recipe "nova::nova-common"
 
-keystone_service_role = node["nova"]["keystone_service_chef_role"]
-keystone = get_settings_by_role keystone_service_role, "keystone"
-keystone_admin_user = keystone["admin_user"]
-keystone_admin_password = keystone["users"][keystone_admin_user]["password"]
-keystone_admin_tenant = keystone["users"][keystone_admin_user]["default_tenant"]
-
 execute "nova-manage db sync" do
   command "nova-manage db sync"
 

templates/default/api-paste.ini.erb

@@ -123,11 +123,7 @@ paste.filter_factory = nova.api.auth:NovaKeystoneContext.factory
 
 [filter:authtoken]
 paste.filter_factory = keystone.middleware.auth_token:filter_factory
-service_protocol = <%= @identity_endpoint.scheme %>
-service_host = <%= @identity_endpoint.host %>
-service_port = <%= @identity_endpoint.port %>
-auth_host = <%= @identity_admin_endpoint.host %>
-auth_port = <%= @identity_admin_endpoint.port %>
-auth_protocol = <%= @identity_admin_endpoint.scheme %>
 auth_uri = <%= @identity_admin_endpoint.to_s %>
-admin_token = <%= @admin_token %>
+admin_tenant_name = <%= nova_setup_info["service_tenant_name"] %>
+admin_user = <%= nova_setup_info["service_user"] %>
+admin_password = <%= nova_setup_info["service_password"] %>