Retire openstack-chef: remove repo content

OpenStack-chef project is retiring
- https://review.opendev.org/c/openstack/governance/+/905279

this commit remove the content of this project repo

Depends-On: https://review.opendev.org/c/openstack/project-config/+/909134
Change-Id: Ida0639315944c8c7852ec37fb10f133e8ab9c455
This commit is contained in:
Ghanshyam Mann 2024-02-15 14:17:05 -08:00
parent f052ede42b
commit 44d13c8c64
31 changed files with 8 additions and 2329 deletions

View File

@ -1,9 +0,0 @@
[local_phases]
unit = 'rspec spec/'
lint = 'cookstyle --display-cop-names --extra-details'
syntax = "berks install -e integration"
provision = "echo skipping"
deploy = "echo skipping"
smoke = "echo skipping"
functional = "echo skipping"
cleanup = "echo skipping"

9
.gitignore vendored
View File

@ -1,9 +0,0 @@
.bundle/
berks-cookbooks/
.kitchen/
.vagrant/
.coverage/
*.swp
Berksfile.lock
Gemfile.lock
Vagrantfile

View File

@ -1,4 +0,0 @@
Chef/Modernize/FoodcriticComments:
Enabled: true
Chef/Style/CopyrightCommentFormat:
Enabled: true

View File

@ -1,3 +0,0 @@
- project:
templates:
- openstack-chef-jobs

View File

@ -1,22 +0,0 @@
source 'https://supermarket.chef.io'
solver :ruby, :required
metadata
[
%w(client dep),
%w(-common dep),
%w(-dns integration),
%w(-image integration),
%w(-integration-test integration),
%w(-network integration),
%w(-ops-database integration),
%w(-ops-messaging integration),
].each do |cookbook, group|
if Dir.exist?("../cookbook-openstack#{cookbook}")
cookbook "openstack#{cookbook}", path: "../cookbook-openstack#{cookbook}", group: group
else
cookbook "openstack#{cookbook}", git: "https://opendev.org/openstack/cookbook-openstack#{cookbook}", group: group
end
end

View File

@ -1,36 +0,0 @@
Contributing
============
How To Get Started
------------------
If you would like to contribute to the development of OpenStack Chef Cookbooks,
you must follow the steps in this page:
http://docs.openstack.org/infra/manual/developers.html
Gerrit Workflow
---------------
Once those steps have been completed, changes to OpenStack
should be submitted for review via the Gerrit tool, following
the workflow documented at:
http://docs.openstack.org/infra/manual/developers.html#development-workflow
Pull requests submitted through GitHub will be ignored.
Bugs
----
Bugs should be filed on Launchpad, not GitHub:
https://bugs.launchpad.net/openstack-chef
Contacts
--------
Mailing list: groups.google.com/group/opscode-chef-openstack
IRC: #openstack-chef is our channel on irc.oftc.net
Wiki: https://wiki.openstack.org/wiki/Chef/GettingStarted and https://docs.getchef.com/openstack.html
Twitter: @chefopenstack

176
LICENSE
View File

@ -1,176 +0,0 @@
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.

View File

@ -1,169 +1,10 @@
OpenStack Chef Cookbook - identity
==================================
This project is no longer maintained.
.. image:: https://governance.openstack.org/badges/cookbook-openstack-identity.svg
:target: https://governance.openstack.org/reference/tags/index.html
The contents of this repository are still available in the Git
source code management system. To see the contents of this
repository before it reached its end of life, please check out the
previous commit with "git checkout HEAD^1".
Description
===========
This cookbook installs the OpenStack Identity Service **Keystone** as
part of the OpenStack reference deployment Chef for OpenStack. The
`OpenStack chef-repo`_ contains documentation for using this cookbook in
the context of a full OpenStack deployment. Keystone is installed from
packages, creating the default user, tenant, and roles. It also
registers the identity service and identity endpoint.
.. _OpenStack chef-repo: https://opendev.org/openstack/openstack-chef
https://docs.openstack.org/keystone/latest/
Requirements
============
- Chef 16 or higher
- Chef Workstation 21.10.640 for testing (also includes Berkshelf for
cookbook dependency resolution)
Platform
========
- ubuntu
- redhat
- centos
Cookbooks
=========
The following cookbooks are dependencies:
- 'apache2', '~> 8.6'
- 'openstack-common', '>= 20.0.0'
- 'openstackclient'
Attributes
==========
Please see the extensive inline documentation in ``attributes/*.rb`` for
descriptions of all the settable attributes for this cookbook.
Note that all attributes are in the ``default['openstack']`` "namespace"
The usage of attributes to generate the ``keystone.conf`` is described
in the openstack-common cookbook.
Recipes
=======
openstack-identity::cloud_config
--------------------------------
- Manage the cloud config file located at ``/root/clouds.yaml``
openstack-identity::_credential_tokens
--------------------------------------
- Helper recipe to manage credential keys.
If you prefer, you can manually create the keys by doing the following:
.. code-block:: console
$ keystone-manage credential_setup \
--keystone-user keystone --keystone-group keystone
This should create a directory ``/etc/keystone/credential-keys`` with
the keys residing in it.
openstack-identity::_fernet_tokens
----------------------------------
- Helper recipe to manage fernet tokens
openstack-identity::openrc
--------------------------
- Creates a fully usable openrc file to export the needed environment
variables to use the openstack client.
openstack-identity::registration
--------------------------------
- Registers the initial keystone endpoint as well as users, tenants and
roles needed for the initial configuration utilizing the custom
resource provided in the openstackclient cookbook. The recipe is
documented in detail with inline comments inside the recipe.
openstack-identity::server-apache
---------------------------------
- Installs and configures the OpenStack Identity Service running inside
of an apache webserver. The recipe is documented in detail with inline
comments inside the recipe.
License and Author
==================
+------------+-------------------------------------------------+
| **Author** | Justin Shepherd (justin.shepherd@rackspace.com) |
+------------+-------------------------------------------------+
| **Author** | Jason Cannavale (jason.cannavale@rackspace.com) |
+------------+-------------------------------------------------+
| **Author** | Ron Pedde (ron.pedde@rackspace.com) |
+------------+-------------------------------------------------+
| **Author** | Joseph Breu (joseph.breu@rackspace.com) |
+------------+-------------------------------------------------+
| **Author** | William Kelly (william.kelly@rackspace.com) |
+------------+-------------------------------------------------+
| **Author** | Darren Birkett (darren.birkett@rackspace.co.uk) |
+------------+-------------------------------------------------+
| **Author** | Evan Callicoat (evan.callicoat@rackspace.com) |
+------------+-------------------------------------------------+
| **Author** | Matt Ray (matt@opscode.com) |
+------------+-------------------------------------------------+
| **Author** | Jay Pipes (jaypipes@att.com) |
+------------+-------------------------------------------------+
| **Author** | John Dewey (jdewey@att.com) |
+------------+-------------------------------------------------+
| **Author** | Sean Gallagher (sean.gallagher@att.com) |
+------------+-------------------------------------------------+
| **Author** | Ionut Artarisi (iartarisi@suse.cz) |
+------------+-------------------------------------------------+
| **Author** | Chen Zhiwei (zhiwchen@cn.ibm.com) |
+------------+-------------------------------------------------+
| **Author** | Eric Zhou (zyouzhou@cn.ibm.com) |
+------------+-------------------------------------------------+
| **Author** | Jan Klare (j.klare@cloudbau.de) |
+------------+-------------------------------------------------+
| **Author** | Christoph Albers (c.albers@x-ion.de) |
+------------+-------------------------------------------------+
| **Author** | Lance Albertson (lance@osuosl.org) |
+------------+-------------------------------------------------+
+---------------+----------------------------------------------+
| **Copyright** | Copyright 2012, Rackspace US, Inc. |
+---------------+----------------------------------------------+
| **Copyright** | Copyright 2012-2013, Opscode, Inc. |
+---------------+----------------------------------------------+
| **Copyright** | Copyright 2012-2013, AT&T Services, Inc. |
+---------------+----------------------------------------------+
| **Copyright** | Copyright 2013-2014, SUSE Linux |
+---------------+----------------------------------------------+
| **Copyright** | GmbH Copyright 2013-2014, IBM, Corp. |
+---------------+----------------------------------------------+
| **Copyright** | Copyright 2016-2021, Oregon State University |
+---------------+----------------------------------------------+
Licensed under the Apache License, Version 2.0 (the "License"); you may
not use this file except in compliance with the License. You may obtain
a copy of the License at
::
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
For any further questions, please email
openstack-discuss@lists.openstack.org or join #openstack-dev on
OFTC.

View File

@ -1,39 +0,0 @@
task default: ['test']
task test: [:syntax, :lint, :unit]
desc 'Vendor the cookbooks in the Berksfile'
task :berks_prep do
sh %(chef exec berks vendor)
end
desc 'Run FoodCritic (syntax) tests'
task :syntax do
sh %(chef exec foodcritic --exclude spec -f any .)
end
desc 'Run RuboCop (lint) tests'
task :lint do
sh %(chef exec cookstyle)
end
desc 'Run RSpec (unit) tests'
task unit: :berks_prep do
sh %(chef exec rspec --format documentation)
end
desc 'Remove the berks-cookbooks directory and the Berksfile.lock'
task :clean do
rm_rf [
'berks-cookbooks',
'Berksfile.lock',
]
end
desc 'All-in-One Neutron build Infra using Common task'
task :integration do
# Use the common integration task
sh %(wget -nv -t 3 -O Rakefile-Common https://opendev.org/openstack/cookbook-openstack-common/raw/branch/master/Rakefile)
load './Rakefile-Common'
Rake::Task['common_integration'].invoke
end

View File

@ -1,30 +0,0 @@
# Testing the Cookbook #
This cookbook uses [chefdk](https://downloads.chef.io/chef-dk/) and [berkshelf](http://berkshelf.com/) to isolate dependencies. Make sure you have chefdk and the header files for `gecode` installed before continuing. Make sure that you're using gecode version 3. More info [here](https://github.com/opscode/dep-selector-libgecode/tree/0bad63fea305ede624c58506423ced697dd2545e#using-a-system-gecode-instead). For more detailed information on what needs to be installed, you can have a quick look into the bootstrap.sh file in this repository, which does install all the needed things to get going on ubuntu trusty. The tests defined in the Rakefile include lint, style and unit. For integration testing please refere to the [openstack-chef-repo](https://github.com/openstack/openstack-chef-repo).
We have three test suites which you can run either, individually (there are three rake tasks):
$ chef exec rake lint
$ chef exec rake style
$ chef exec rake unit
or altogether:
$ chef exec rake
The `rake` tasks will take care of installing the needed cookbooks with `berkshelf`.
## Rubocop ##
[Rubocop](https://github.com/bbatsov/rubocop) is a static Ruby code analyzer, based on the community [Ruby style guide](https://github.com/bbatsov/ruby-style-guide). We are attempting to adhere to this where applicable, slowly cleaning up the cookbooks until we can turn on Rubocop for gating the commits.
## Foodcritic ##
[Foodcritic](http://acrmp.github.io/foodcritic/) is a lint tool for Chef cookbooks. We ignore the following rules:
* [FC003](http://acrmp.github.io/foodcritic/#FC003) These cookbooks are not intended for Chef Solo.
* [FC023](http://acrmp.github.io/foodcritic/#FC023) Prefer conditional attributes.
## Chefspec
[ChefSpec](https://github.com/sethvargo/chefspec) is a unit testing framework for testing Chef cookbooks. ChefSpec makes it easy to write examples and get fast feedback on cookbook changes without the need for virtual machines or cloud servers.

View File

@ -1,214 +0,0 @@
#
# Cookbook:: openstack-identity
# Recipe:: default
#
# Copyright:: 2012-2021, AT&T Services, Inc.
# Copyright:: 2013-2021, Chef Software, Inc.
# Copyright:: 2013-2021, IBM Corp.
# Copyright:: 2017-2021, x-ion GmbH
# Copyright:: 2018-2021, Workday, Inc.
# Copyright:: 2019-2021, x-ion GmbH
# Copyright:: 2016-2021, Oregon State University
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Set to some text value if you want templated config files
# to contain a custom banner at the top of the written file
default['openstack']['identity']['custom_template_banner'] = '
# This file is automatically generated by Chef
# Any changes will be overwritten
'
%w(internal public).each do |ep_type|
# host for openstack internal/public identity endpoint
default['openstack']['endpoints'][ep_type]['identity']['host'] = '127.0.0.1'
# scheme for openstack internal/public identity endpoint
default['openstack']['endpoints'][ep_type]['identity']['scheme'] = 'http'
# port for openstack internal/public identity endpoint
default['openstack']['endpoints'][ep_type]['identity']['port'] = 5000
# path for openstack internal/public identity endpoint
default['openstack']['endpoints'][ep_type]['identity']['path'] = '/v3'
end
# address for openstack identity service main endpoint to bind to
default['openstack']['bind_service']['public']['identity']['host'] = '127.0.0.1'
# port for openstack identity service main endpoint to bind to
default['openstack']['bind_service']['public']['identity']['port'] = 5000
# identity service token backend for user and service tokens
default['openstack']['identity']['token']['backend'] = 'sql'
# Specify a location to retrieve keystone-paste.ini from
# which can either be a remote url using http:// or a
# local path to a file using file:// which would generally
# be a distribution file - if this option is left nil then
# the templated version distributed with this cookbook
# will be used (keystone-paste.ini.erb)
default['openstack']['identity']['pastefile_url'] = nil
# This specifies the pipeline of the keystone V3 API,
# all Identity V3 API requests will be processed by the order of the pipeline.
# this value will be used in the templated version of keystone-paste.ini
# The last item in this pipeline must be service_v3 or an equivalent
# application. It cannot be a filter.
default['openstack']['identity']['pipeline']['api_v3'] = 'healthcheck cors sizelimit http_proxy_to_wsgi osprofiler url_normalize request_id build_auth_context token_auth json_body ec2_extension_v3 s3_extension service_v3'
# region to be used for endpoint registration
default['openstack']['identity']['region'] = node['openstack']['region']
# enable or disable the usage of syslog
default['openstack']['identity']['syslog']['use'] = false
# syslog log facility to log to in case syslog is used
default['openstack']['identity']['syslog']['facility'] = 'LOG_LOCAL2'
# syslog config facility in case syslog is used
default['openstack']['identity']['syslog']['config_facility'] = 'local2'
# endpoint type to be used for creating resources
default['openstack']['identity']['endpoint_type'] = 'internalURL'
# user to be created and used for identity service
default['openstack']['identity']['admin_user'] = 'admin'
# project to be created and used for identity service
default['openstack']['identity']['admin_project'] = 'admin'
# domain to be created and used for identity service project
default['openstack']['identity']['admin_project_domain'] = 'default'
# role to be created and used for identity service
default['openstack']['identity']['admin_role'] = 'admin'
# domain to be created and used for identity service user
default['openstack']['identity']['admin_domain_name'] = 'default'
# specify whether to enable SSL for Keystone API endpoint
default['openstack']['identity']['ssl']['enabled'] = false
# specify server whether to enforce client certificate requirement
default['openstack']['identity']['ssl']['cert_required'] = false
# SSL certificate, keyfile and CA certficate file locations
default['openstack']['identity']['ssl']['basedir'] = '/etc/keystone/ssl'
# Protocol for SSL (Apache)
default['openstack']['identity']['ssl']['protocol'] = 'All -SSLv2 -SSLv3'
# Which ciphers to use with the SSL/TLS protocol (Apache)
# Example: 'RSA:HIGH:MEDIUM:!LOW:!kEDH:!aNULL:!ADH:!eNULL:!EXP:!SSLv2:!SEED:!CAMELLIA:!PSK!RC4:!RC4-MD5:!RC4-SHA'
default['openstack']['identity']['ssl']['ciphers'] = nil
# path of the cert file for SSL.
default['openstack']['identity']['ssl']['certfile'] = "#{node['openstack']['identity']['ssl']['basedir']}/certs/sslcert.pem"
# path of the keyfile for SSL.
default['openstack']['identity']['ssl']['keyfile'] = "#{node['openstack']['identity']['ssl']['basedir']}/private/sslkey.pem"
default['openstack']['identity']['ssl']['chainfile'] = nil
# path of the CA cert file for SSL.
default['openstack']['identity']['ssl']['ca_certs'] = "#{node['openstack']['identity']['ssl']['basedir']}/certs/sslca.pem"
# path of the CA cert files for SSL (Apache)
default['openstack']['identity']['ssl']['ca_certs_path'] = "#{node['openstack']['identity']['ssl']['basedir']}/certs/"
# (optional) path to certificate-revocation lists (Apache)
default['openstack']['identity']['ssl']['ca_revocation_path'] = nil
# Fernet keys to read from databags/vaults. This should be changed in the
# environment when rotating keys (with the defaults below, the items
# 'fernet_key0' and 'fernet_key1' will be read from the databag/vault
# 'keystone).
# For more information please read:
# https://docs.openstack.org/keystone/queens/admin/identity-fernet-token-faq.html
default['openstack']['identity']['fernet']['keys'] = [0, 1]
default['openstack']['identity']['conf']['fernet_tokens']['key_repository'] =
'/etc/keystone/fernet-tokens'
# Credential keys to read from databags/vaults. This should be changed in the
# environment when rotating keys (with the defaults below, the items
# 'credential_key0' and 'credential_key1' will be read from the databag/vault
# 'keystone).
# For more information please read:
# https://docs.openstack.org/keystone/queens/admin/identity-credential-encryption.html
default['openstack']['identity']['credential']['keys'] = [0, 1]
default['openstack']['identity']['conf']['credential']['key_repository'] =
'/etc/keystone/credential-tokens'
# configuration directory for keystone domain specific options
default['openstack']['identity']['domain_config_dir'] = '/etc/keystone/domains'
# keystone service user name
default['openstack']['identity']['user'] = 'keystone'
# keystone service user group
default['openstack']['identity']['group'] = 'keystone'
# platform defaults
case node['platform_family']
when 'rhel'
# platform specific package and service name options
case node['platform_version'].to_i
when 8
default['openstack']['identity']['platform'] = {
'memcache_python_packages' => ['python3-memcached'],
# TODO(ramereth): python3-urllib3 is here to workaround an issue if
# it's already been installed from the base repository which is
# incompatible with what's shipped with RDO. This should be removed
# once fixed upstream.
'keystone_packages' =>
%w(
openstack-keystone
openstack-selinux
python3-urllib3
),
'keystone_apache2_site' => 'keystone', # currently unused on RHEL
'keystone_service' => 'openstack-keystone',
'keystone_process_name' => 'keystone-all',
'package_options' => '',
}
when 7
default['openstack']['identity']['platform'] = {
'memcache_python_packages' => ['python-memcached'],
# TODO(ramereth): python2-urllib3 is here to workaround an issue if
# it's already been installed from the base repository which is
# incompatible with what's shipped with RDO. This should be removed
# once fixed upstream.
'keystone_packages' =>
%w(
openstack-keystone
openstack-selinux
python2-urllib3
),
'keystone_apache2_site' => 'keystone', # currently unused on RHEL
'keystone_service' => 'openstack-keystone',
'keystone_process_name' => 'keystone-all',
'package_options' => '',
}
end
when 'debian'
# platform specific package and service name options
default['openstack']['identity']['platform'] = {
'memcache_python_packages' => ['python3-memcache'],
'keystone_packages' =>
%w(
keystone
python3-keystone
),
'keystone_apache2_site' => platform?('ubuntu') ? 'keystone' : 'wsgi-keystone',
'keystone_service' => 'keystone',
'keystone_process_name' => 'keystone-all',
'package_overrides' => '',
}
end
# array of bare options for openrc (e.g. 'option=value')
default['openstack']['misc_openrc'] = nil
%w(openrc cloud_config).each do |file_type|
default['openstack']['identity'][file_type]['path'] = '/root'
default['openstack']['identity'][file_type]['path_mode'] = '0700'
default['openstack']['identity'][file_type]['file_mode'] = '0600'
default['openstack']['identity'][file_type]['user'] = 'root'
default['openstack']['identity'][file_type]['group'] = 'root'
end
# openrc file name
default['openstack']['identity']['openrc']['file'] = 'openrc'
# cloud_config file name
default['openstack']['identity']['cloud_config']['file'] = 'clouds.yaml'
# cloud_config cloud name
default['openstack']['identity']['cloud_config']['cloud_name'] = 'default'

View File

@ -1,27 +0,0 @@
# options to add to the keystone.conf as secrets (will not be saved in node
# attribute)
default['openstack']['identity']['conf_secrets'] = {}
default['openstack']['identity']['conf'].tap do |conf|
# [DEFAULT]
if node['openstack']['identity']['syslog']['use']
# [DEFAULT] option in keystone.conf to read additional logging.conf
conf['DEFAULT']['log_config_append'] = '/etc/openstack/logging.conf'
else
# [DEFAULT] option in keystone.conf to set keystone log dir
conf['DEFAULT']['log_dir'] = '/var/log/keystone'
end
if node['openstack']['identity']['notification_driver'] == 'messaging'
# [DEFAULT] option in keystone.conf to define mq notification topics
conf['DEFAULT']['notification_topics'] = 'notifications'
end
# [assignment] option in keystone.conf to set driver
conf['assignment']['driver'] = 'sql'
# [cache] option in keystone.conf to set oslo backend
conf['cache']['enabled'] = true
conf['cache']['backend'] = 'oslo_cache.memcache_pool'
# [policy] option in keystone.conf to set policy backend driver
conf['policy']['driver'] = 'sql'
end

View File

@ -1,18 +0,0 @@
name 'openstack-identity'
maintainer 'openstack-chef'
maintainer_email 'openstack-discuss@lists.openstack.org'
license 'Apache-2.0'
description 'The OpenStack Identity service Keystone.'
version '20.0.0'
%w(ubuntu redhat centos).each do |os|
supports os
end
depends 'apache2', '~> 8.6'
depends 'openstackclient'
depends 'openstack-common', '>= 20.0.0'
issues_url 'https://launchpad.net/openstack-chef'
source_url 'https://opendev.org/openstack/cookbook-openstack-identity'
chef_version '>= 16.0'

View File

@ -1,47 +0,0 @@
#
# Cookbook:: openstack-identity
# Recipe:: _credential_tokens
#
# Copyright:: 2020-2021, Oregon State University
#
# Licensed under the Apache License, Version 2.0 (the 'License');
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an 'AS IS' BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# This recipe is automatically included in openstack-identity::service-apache.
# It will add the needed configuration options to the keystone.conf and create
# the needed credential keys from predefined secrets (e.g. encrypted data
# bags or vaults).
class ::Chef::Recipe
include ::Openstack
end
key_repository = node['openstack']['identity']['conf']['credential']['key_repository']
keystone_user = node['openstack']['identity']['user']
keystone_group = node['openstack']['identity']['group']
directory key_repository do
owner keystone_user
group keystone_group
mode '700'
end
node['openstack']['identity']['credential']['keys'].each do |key_index|
key = secret(node['openstack']['secret']['secrets_data_bag'], "credential_key#{key_index}")
file File.join(key_repository, key_index.to_s) do
content key
owner keystone_user
group keystone_group
mode '400'
sensitive true
end
end

View File

@ -1,51 +0,0 @@
#
# Cookbook:: openstack-identity
# Recipe:: _fernet_tokens
#
# Copyright:: 2020-2021, Oregon State University
#
# Licensed under the Apache License, Version 2.0 (the 'License');
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an 'AS IS' BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# This recipe is automatically included in openstack-identity::service-apache.
# It will add the needed configuration options to the keystone.conf and create
# the needed fernet keys from predefined secrets (e.g. encrypted data bags or vaults).
class ::Chef::Recipe
include ::Openstack
end
key_repository = node['openstack']['identity']['conf']['fernet_tokens']['key_repository']
keystone_user = node['openstack']['identity']['user']
keystone_group = node['openstack']['identity']['group']
directory key_repository do
owner keystone_user
group keystone_group
mode '700'
end
node['openstack']['identity']['fernet']['keys'].each do |key_index|
key = secret(node['openstack']['secret']['secrets_data_bag'], "fernet_key#{key_index}")
file File.join(key_repository, key_index.to_s) do
content key
owner keystone_user
group keystone_group
mode '400'
sensitive true
end
end
execute 'keystone-manage fernet_setup' do
command "keystone-manage fernet_setup --keystone-user #{keystone_user} --keystone-group #{keystone_group}"
creates '/etc/keystone/fernet-keys'
end

View File

@ -1,60 +0,0 @@
#
# Cookbook:: openstack-identity
# recipe:: cloud_config
#
# Copyright:: 2019-2021, x-ion GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# This recipe creates a fully usable cloud config file to be used directly
# by the openstack client or sdk.
class ::Chef::Recipe
include ::Openstack
end
ksadmin_project = node['openstack']['identity']['admin_project']
project_domain_name = node['openstack']['identity']['admin_project_domain']
ksadmin_user = node['openstack']['identity']['admin_user']
admin_domain_name = node['openstack']['identity']['admin_domain_name']
ksadmin_pass = get_password 'user', ksadmin_user
identity_endpoint = public_endpoint 'identity'
auth_url = identity_endpoint.to_s
cloud_config = node['openstack']['identity']['cloud_config']
directory cloud_config['path'] do
owner cloud_config['user']
group cloud_config['group']
mode cloud_config['path_mode']
recursive true
end
template "#{cloud_config['path']}/#{cloud_config['file']}" do
source 'cloud_config.erb'
owner cloud_config['user']
group cloud_config['group']
mode cloud_config['file_mode']
sensitive true
variables(
cloud_name: cloud_config['cloud_name'],
user: ksadmin_user,
user_domain_name: admin_domain_name,
project: ksadmin_project,
project_domain_name: project_domain_name,
password: ksadmin_pass,
identity_endpoint: auth_url
)
end

View File

@ -1,59 +0,0 @@
#
# Cookbook:: openstack-identity
# recipe:: openrc
#
# Copyright:: 2014-2021, IBM Corp.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# This recipe create a fully usable openrc file to export the needed environment
# variables to use the openstack client.
class ::Chef::Recipe
include ::Openstack
end
ksadmin_project = node['openstack']['identity']['admin_project']
project_domain_name = node['openstack']['identity']['admin_project_domain']
ksadmin_user = node['openstack']['identity']['admin_user']
admin_domain_name = node['openstack']['identity']['admin_domain_name']
ksadmin_pass = get_password 'user', ksadmin_user
identity_endpoint = public_endpoint 'identity'
auth_url = identity_endpoint.to_s
openrc_config = node['openstack']['identity']['openrc']
directory openrc_config['path'] do
owner openrc_config['user']
group openrc_config['group']
mode openrc_config['path_mode']
recursive true
end
template "#{openrc_config['path']}/#{openrc_config['file']}" do
source 'openrc.erb'
owner openrc_config['user']
group openrc_config['group']
mode openrc_config['file_mode']
sensitive true
variables(
user: ksadmin_user,
user_domain_name: admin_domain_name,
project: ksadmin_project,
project_domain_name: project_domain_name,
password: ksadmin_pass,
identity_endpoint: auth_url
)
end

View File

@ -1,83 +0,0 @@
#
# Cookbook:: openstack-identity
# Recipe:: setup
#
# Copyright:: 2012-2021, Rackspace US, Inc.
# Copyright:: 2012-2021, Chef Software, Inc.
# Copyright:: 2020-2021, Oregon State University
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# This recipe registers the initial keystone endpoint as well as users, tenants
# and roles needed for the initial configuration utilizing the LWRP provided
# inside of this cookbook. The recipe is documented in detail with inline
# comments inside the recipe.
require 'chef/mixin/shell_out'
class ::Chef::Recipe
include ::Openstack
end
identity_endpoint = public_endpoint 'identity'
identity_internal_endpoint = internal_endpoint 'identity'
auth_url = identity_internal_endpoint.to_s
# define the credentials to use for the initial admin user
admin_project = node['openstack']['identity']['admin_project']
admin_user = node['openstack']['identity']['admin_user']
admin_pass = get_password 'user', node['openstack']['identity']['admin_user']
admin_domain = node['openstack']['identity']['admin_domain_name']
# endpoint type to use when creating resources
# NOTE(frickler): fog-openstack defaults to the 'admin' endpoint for
# Identity operations, so we need to override this after we dropped that one
# TODO(ramereth): commenting this out until
# https://github.com/fog/fog-openstack/pull/494 gets merged and released.
# endpoint_type = node['openstack']['identity']['endpoint_type']
connection_params = {
openstack_auth_url: auth_url,
openstack_username: admin_user,
openstack_api_key: admin_pass,
openstack_project_name: admin_project,
openstack_domain_id: admin_domain,
# openstack_endpoint_type: endpoint_type,
}
ruby_block 'wait for identity endpoint' do
block do
begin
Timeout.timeout(60) do
until Net::HTTP.get_response(URI(auth_url)).message == 'OK'
Chef::Log.info 'waiting for identity endpoint to be up...'
sleep 1
end
end
rescue Timeout::Error
raise 'Waited 60 seconds for identity endpoint to become ready'\
' and will not wait any longer'
end
end
end
# create default service role
openstack_role 'service' do
connection_params connection_params
end
node.default['openstack']['identity']['internalURL'] = identity_internal_endpoint.to_s
node.default['openstack']['identity']['publicURL'] = identity_endpoint.to_s
Chef::Log.info "Keystone InternalURL: #{identity_internal_endpoint}"
Chef::Log.info "Keystone PublicURL: #{identity_endpoint}"

View File

@ -1,261 +0,0 @@
#
# Cookbook:: openstack-identity
# Recipe:: server-apache
#
# Copyright:: 2015-2021, IBM Corp. Inc.
# Copyright:: 2016-2021, Oregon State University
#
# Licensed under the Apache License, Version 2.0 (the 'License');
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an 'AS IS' BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# This recipe installs and configures the OpenStack Identity Service running
# inside of an apache webserver. The recipe is documented in detail with inline
# comments inside the recipe.
# load the methods defined in cookbook-openstack-common libraries
class ::Chef::Recipe
include ::Openstack
include Apache2::Cookbook::Helpers
end
# include the logging recipe from openstack-common if syslog usage is enbaled
if node['openstack']['identity']['syslog']['use']
include_recipe 'openstack-common::logging'
end
platform_options = node['openstack']['identity']['platform']
identity_internal_endpoint = internal_endpoint 'identity'
identity_endpoint = public_endpoint 'identity'
# define the address where the keystone public endpoint will be reachable
ie = identity_endpoint
# define the keystone public endpoint full path
api_endpoint = "#{ie.scheme}://#{ie.host}:#{ie.port}/"
# define the credentials to use for the initial admin user
admin_project = node['openstack']['identity']['admin_project']
admin_user = node['openstack']['identity']['admin_user']
admin_pass = get_password 'user', node['openstack']['identity']['admin_user']
admin_role = node['openstack']['identity']['admin_role']
region = node['openstack']['identity']['region']
keystone_user = node['openstack']['identity']['user']
keystone_group = node['openstack']['identity']['group']
# install the database python adapter packages for the selected database
# service_type
db_type = node['openstack']['db']['identity']['service_type']
unless db_type == 'sqlite'
node['openstack']['db']['python_packages'][db_type].each do |pkg|
package "identity cookbook package #{pkg}" do
package_name pkg
options platform_options['package_options']
action :upgrade
end
end
end
# install the python memcache adapter packages
platform_options['memcache_python_packages'].each do |pkg|
package "identity cookbook package #{pkg}" do
package_name pkg
options platform_options['package_options']
action :upgrade
end
end
# install the keystone packages
platform_options['keystone_packages'].each do |pkg|
package "identity cookbook package #{pkg}" do
package_name pkg
options platform_options['package_options']
action :upgrade
end
end
# stop and disable the service keystone itself, since it should be run inside
# of apache
service 'keystone' do
service_name platform_options['keystone_service']
action [:stop, :disable]
end
# disable default keystone config file from UCA package
apache2_site platform_options['keystone_apache2_site'] do
action :disable
only_if { platform_family?('debian') }
end
# create the keystone config directory and set correct permissions
directory '/etc/keystone' do
owner keystone_user
group keystone_group
mode '700'
end
# create keystone domain config dir if needed
directory node['openstack']['identity']['domain_config_dir'] do
owner keystone_user
group keystone_group
mode '700'
only_if { node['openstack']['identity']['domain_specific_drivers_enabled'] }
end
# delete the keystone.db sqlite file if another db backend is used
file '/var/lib/keystone/keystone.db' do
action :delete
not_if { node['openstack']['db']['identity']['service_type'] == 'sqlite' }
end
# include the recipes to setup tokens
include_recipe 'openstack-identity::_fernet_tokens'
include_recipe 'openstack-identity::_credential_tokens'
# define the address to bind the keystone apache public service to
bind_service = node['openstack']['bind_service']['public']['identity']
bind_address = bind_address bind_service
# set the keystone database credentials
db_user = node['openstack']['db']['identity']['username']
db_pass = get_password 'db', 'keystone'
node.default['openstack']['identity']['conf_secrets']
.[]('database')['connection'] =
db_uri('identity', db_user, db_pass)
# search for memcache servers using the method from cookbook-openstack-common
memcache_servers = memcached_servers.join ','
# If a keystone-paste.ini is specified use it.
# TODO(jh): Starting with Rocky keystone-paste.ini is no longer being used
# and this block can be removed
if node['openstack']['identity']['pastefile_url']
remote_file '/etc/keystone/keystone-paste.ini' do
action :create_if_missing
source node['openstack']['identity']['pastefile_url']
owner keystone_user
group keystone_group
mode '644'
end
else
template '/etc/keystone/keystone-paste.ini' do
source 'keystone-paste.ini.erb'
owner keystone_user
group keystone_group
mode '644'
end
end
# set keystone config parameter for rabbitmq if rabbit is the rpc_backend
if node['openstack']['mq']['service_type'] == 'rabbit'
node.default['openstack']['identity']['conf_secrets']['DEFAULT']['transport_url'] = rabbit_transport_url 'identity'
end
# set keystone config parameters for endpoints, memcache
node.default['openstack']['identity']['conf'].tap do |conf|
conf['DEFAULT']['public_endpoint'] = api_endpoint
conf['memcache']['servers'] = memcache_servers if memcache_servers
end
# merge all config options and secrets to be used in the keystone.conf.erb
keystone_conf_options = merge_config_options 'identity'
# create the keystone.conf from attributes
template '/etc/keystone/keystone.conf' do
source 'openstack-service.conf.erb'
cookbook 'openstack-common'
owner keystone_user
group keystone_group
mode '640'
sensitive true
variables(
service_config: keystone_conf_options
)
notifies :restart, 'service[apache2]'
end
# delete all secrets saved in the attribute
# node['openstack']['identity']['conf_secrets'] after creating the keystone.conf
ruby_block "delete all attributes in node['openstack']['identity']['conf_secrets']" do
block do
node.rm(:openstack, :identity, :conf_secrets)
end
end
# sync db after keystone.conf is generated
execute 'keystone-manage db_sync' do
user 'root'
only_if { node['openstack']['db']['identity']['migrate'] }
end
# bootstrap keystone after keystone.conf is generated
# TODO(frickler): drop admin endpoint once keystonemiddleware is fixed
execute 'bootstrap_keystone' do
command "keystone-manage bootstrap \\
--bootstrap-password #{admin_pass} \\
--bootstrap-username #{admin_user} \\
--bootstrap-project-name #{admin_project} \\
--bootstrap-role-name #{admin_role} \\
--bootstrap-service-name keystone \\
--bootstrap-region-id #{region} \\
--bootstrap-admin-url #{identity_internal_endpoint} \\
--bootstrap-public-url #{identity_endpoint} \\
--bootstrap-internal-url #{identity_internal_endpoint}"
sensitive true
end
#### Start of Apache specific work
# service['apache2'] is defined in the apache2_default_install resource
# but other resources are currently unable to reference it. To work
# around this issue, define the following helper in your cookbook:
service 'apache2' do
extend Apache2::Cookbook::Helpers
service_name lazy { apache_platform_service_name }
supports restart: true, status: true, reload: true
action :nothing
end
apache2_install 'openstack' do
listen "#{bind_address}:#{bind_service['port']}"
end
apache2_mod_wsgi 'openstack'
apache2_module 'ssl' if node['openstack']['identity']['ssl']['enabled']
# create the keystone apache directory
keystone_apache_dir = "#{default_docroot_dir}/keystone"
directory keystone_apache_dir do
owner 'root'
group 'root'
mode '755'
end
# create the keystone apache config using template
template "#{apache_dir}/sites-available/identity.conf" do
extend Apache2::Cookbook::Helpers
source 'wsgi-keystone.conf.erb'
variables(
server_host: bind_address,
server_port: bind_service['port'],
server_entry: '/usr/bin/keystone-wsgi-public',
server_alias: 'identity',
log_dir: default_log_dir,
run_dir: lock_dir,
user: keystone_user,
group: keystone_group
)
notifies :restart, 'service[apache2]'
end
apache2_site 'identity' do
notifies :restart, 'service[apache2]', :immediately
end

View File

@ -1,94 +0,0 @@
require_relative 'spec_helper'
require 'yaml'
describe 'openstack-identity::cloud_config' do
describe 'ubuntu' do
let(:runner) { ChefSpec::SoloRunner.new(UBUNTU_OPTS) }
let(:node) { runner.node }
cached(:chef_run) do
runner.converge(described_recipe)
end
include_context 'identity_stubs'
describe '/root/clouds.yaml' do
let(:file) { chef_run.template('/root/clouds.yaml') }
it 'creates the /root/clouds.yaml file' do
expect(chef_run).to create_directory('/root').with(
owner: 'root',
group: 'root',
mode: '0700',
recursive: true
)
expect(chef_run).to create_template(file.name).with(
sensitive: true,
user: 'root',
group: 'root',
mode: '0600',
variables: {
cloud_name: 'default',
identity_endpoint: 'http://127.0.0.1:5000/v3',
password: 'admin',
project: 'admin',
project_domain_name: 'default',
user_domain_name: 'default',
user: 'admin',
}
)
end
cloud_yaml = {
'clouds' => {
'default' => {
'auth' => {
'username' => 'admin',
'user_domain_name' => 'default',
'password' => 'admin',
'project_name' => 'admin',
'project_domain_name' => 'default',
'auth_url' => 'http://127.0.0.1:5000/v3',
},
'identity_api_version' => 3,
'region_name' => 'RegionOne',
},
},
}
it 'contains auth environment variables' do
expect(chef_run).to render_file(file.name).with_content(YAML.dump(cloud_yaml))
end
context 'override auth environment variables' do
cloud_yaml_override = {
'clouds' => {
'cloud-config-override' => {
'auth' => {
'username' => 'identity_admin',
'user_domain_name' => 'admin-domain-override',
'password' => 'identity_admin_pass',
'project_name' => 'admin-project-name-override',
'project_domain_name' => 'admin-domain-name-override',
'auth_url' => 'https://public.identity:1234/',
},
'identity_api_version' => 3,
'region_name' => 'RegionOne',
},
},
}
cached(:chef_run) do
node.override['openstack']['identity']['cloud_config']['cloud_name'] = 'cloud-config-override'
node.override['openstack']['identity']['admin_user'] = 'identity_admin'
node.override['openstack']['identity']['admin_project_domain'] = 'admin-domain-name-override'
node.override['openstack']['identity']['admin_project'] = 'admin-project-name-override'
node.override['openstack']['identity']['admin_domain_name'] = 'admin-domain-override'
node.override['openstack']['endpoints']['public']['identity']['uri'] = 'https://public.identity:1234/'
runner.converge(described_recipe)
end
it 'contains overridden auth environment variables' do
expect(chef_run).to render_file(file.name).with_content(YAML.dump(cloud_yaml_override))
end
end
end
end
end

View File

@ -1,29 +0,0 @@
require_relative 'spec_helper'
describe 'openstack-identity::_credential_tokens' do
describe 'ubuntu' do
include_context 'identity_stubs'
let(:runner) { ChefSpec::SoloRunner.new(UBUNTU_OPTS) }
let(:node) { runner.node }
cached(:chef_run) { runner.converge(described_recipe) }
it do
expect(chef_run).to create_directory('/etc/keystone/credential-tokens')
.with(owner: 'keystone', user: 'keystone', mode: '700')
end
[0, 1].each do |key_index|
it do
expect(chef_run).to create_file("/etc/keystone/credential-tokens/#{key_index}")
.with(
content: "thisiscredentialkey#{key_index}",
owner: 'keystone',
group: 'keystone',
mode: '400'
)
end
end
end
end

View File

@ -1,34 +0,0 @@
require_relative 'spec_helper'
describe 'openstack-identity::_fernet_tokens' do
describe 'ubuntu' do
include_context 'identity_stubs'
let(:runner) { ChefSpec::SoloRunner.new(UBUNTU_OPTS) }
let(:node) { runner.node }
cached(:chef_run) { runner.converge(described_recipe) }
it do
expect(chef_run).to create_directory('/etc/keystone/fernet-tokens')
.with(owner: 'keystone', user: 'keystone', mode: '700')
end
[0, 1].each do |key_index|
it do
expect(chef_run).to create_file("/etc/keystone/fernet-tokens/#{key_index}")
.with(
content: "thisisfernetkey#{key_index}",
owner: 'keystone',
group: 'keystone',
mode: '400'
)
end
end
it do
expect(chef_run).to run_execute('keystone-manage fernet_setup').with(
command: 'keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone'
)
end
end
end

View File

@ -1,82 +0,0 @@
require_relative 'spec_helper'
describe 'openstack-identity::openrc' do
describe 'ubuntu' do
let(:runner) { ChefSpec::SoloRunner.new(UBUNTU_OPTS) }
let(:node) { runner.node }
cached(:chef_run) do
runner.converge(described_recipe)
end
include_context 'identity_stubs'
describe '/root/openrc' do
let(:file) { chef_run.template('/root/openrc') }
it 'creates the /root/openrc file' do
expect(chef_run).to create_directory('/root').with(
owner: 'root',
group: 'root',
mode: '0700',
recursive: true
)
expect(chef_run).to create_template(file.name).with(
sensitive: true,
user: 'root',
group: 'root',
mode: '0600'
)
end
it 'contains auth environment variables' do
[
/^export OS_USERNAME=admin$/,
/^export OS_USER_DOMAIN_NAME=default$/,
/^export OS_PASSWORD=admin$/,
/^export OS_PROJECT_NAME=admin$/,
/^export OS_PROJECT_DOMAIN_NAME=default$/,
/^export OS_IDENTITY_API_VERSION=3$/,
%r{^export OS_AUTH_URL=http://127.0.0.1:5000/v3$},