diff --git a/devstack/lib/ironic b/devstack/lib/ironic index ac61bbce4b..1feff57508 100644 --- a/devstack/lib/ironic +++ b/devstack/lib/ironic @@ -1095,14 +1095,6 @@ function configure_client_for { iniset $IRONIC_CONF_FILE $service_config_section project_domain_id default # keystoneauth session options iniset $IRONIC_CONF_FILE $service_config_section cafile $SSL_BUNDLE_FILE -} - -# TODO(pas-ha) this function is for transition period only, -# after all clients are moved to use keystoneauth adapters, it will be merged -# into configure_client_for function -function configure_adapter_for { - local service_config_section - service_config_section=$1 # keystoneauth adapter options # NOTE(pas-ha) relying on defaults for valid_interfaces being "internal,public" in ironic iniset $IRONIC_CONF_FILE $service_config_section region_name $REGION_NAME @@ -1119,14 +1111,6 @@ function configure_ironic_conductor { configure_client_for $conf_section done - # TODO(pas-ha) this block is for transition period only, - # after all clients are moved to use keystoneauth adapters, - # it will be deleted - local sections_with_adapter="service_catalog glance cinder inspector swift neutron" - for conf_section in $sections_with_adapter; do - configure_adapter_for $conf_section - done - configure_rootwrap ironic # set up drivers / hardware types diff --git a/doc/source/install/include/configure-ironic-conductor.rst b/doc/source/install/include/configure-ironic-conductor.rst index cfb4734997..4d393d81bf 100644 --- a/doc/source/install/include/configure-ironic-conductor.rst +++ b/doc/source/install/include/configure-ironic-conductor.rst @@ -67,15 +67,18 @@ Configuring ironic-conductor service service users for each service. Under the hood, Bare Metal service uses ``keystoneauth`` library - together with ``Authentication plugin`` and ``Session`` concepts - provided by it to instantiate service clients. + together with ``Authentication plugin``, ``Session`` and ``Adapter`` + concepts provided by it to instantiate service clients. Please refer to `Keystoneauth documentation`_ for supported plugins, - their available options as well as Session-related options - for authentication and connection respectively. + their available options as well as Session- and Adapter-related options + for authentication, connection and endpoint discovery respectively. In the example below, authentication information for user to access the OpenStack Networking service is configured to use: + * Networking service is deployed in the Identity service region named + ``RegionTwo``, with only its ``public`` endpoint interface registered + in the service catalog. * HTTPS connection with specific CA SSL certificate when making requests * the same service user as configured for ironic-api service * dynamic ``password`` authentication plugin that will discover @@ -116,61 +119,46 @@ Configuring ironic-conductor service # HTTPs connections. (string value) cafile=/opt/stack/data/ca-bundle.pem -#. Notes for configuring the Image service access + # The default region_name for endpoint URL discovery. (string + # value) + region_name = RegionTwo - .. note:: - Swift backend for the Image service must be installed and configured - for ``agent_*`` drivers. Ceph Object Gateway (RADOS Gateway) is also - supported as the Image service's backend (:ref:`radosgw support`). - - Configure the ironic-conductor service to use specific Image service - endpoints - only if you do not want to use Image service endpoint discovery - from the keystone service catalog. - Replace ```` with the address of the image service API: - - .. code-block:: ini - - [glance] - endpoint_override = + # List of interfaces, in order of preference, for endpoint + # URL. (list value) + valid_interfaces=public -#. Notes for configuring the Network service access - - .. note:: - To configure the network for ironic-conductor service to perform node - cleaning, see :ref:`cleaning` from the admin guide. - - Set a specific URL (replace ``NETWORKING_SERVICE_ENDPOINT``) - for connecting to the Networking service, to be the Networking - service endpoint - only for the case when you do not want to use - discovery of Networking service endpoint from keystone service catalog: + By default, in order to communicate with another service, the Bare + Metal service will attempt to discover an appropriate endpoint for + that service via the Identity service's service catalog. + The relevant configuration options from that service group in the Bare + Metal service configuration file are used for this purpose. + If you want to use a different endpoint for a particular service, + specify this via the ``endpoint_override`` configuration option of + that service group, in the Bare Metal service's configuration file. + Taking the previous Networking service example, this would be .. code-block:: ini [neutron] + ... + endpoint_override = - # URL for connecting to neutron. (string value) - endpoint_override = - -#. Configure a specific ironic-api service URL - only if you do not want - to use discovery of the Baremetal service endpoint from keystone catalog - (for example when having deployed two separate pools of ironic-api services - for security reasons). - Replace ``IRONIC_API_IP`` with IP of specific ironic-api service as follows: - - .. code-block:: ini - - [conductor] - - # URL of Ironic API service. If not set ironic can get the - # current value from the keystone service catalog. (string - # value) - endpoint_override=http://IRONIC_API_IP:6385 - + (Replace `` with actual address of a specific + Networking service endpoint.) #. Configure enabled drivers and hardware types as described in :doc:`/install/enabling-drivers`. + A. If you enabled any driver that uses :ref:`direct-deploy`, + Swift backend for the Image service must be installed and configured, + see :ref:`image-store`. + Ceph Object Gateway (RADOS Gateway) is also supported as the Image + service's backend, see :ref:`radosgw support`. + +#. Configure the network for ironic-conductor service to perform node + cleaning, see :ref:`cleaning` from the admin guide. + #. Restart the ironic-conductor service: .. TODO(mmitchell): Split this based on operating system diff --git a/etc/ironic/ironic.conf.sample b/etc/ironic/ironic.conf.sample index eb47e93298..0d54a145c3 100644 --- a/etc/ironic/ironic.conf.sample +++ b/etc/ironic/ironic.conf.sample @@ -2221,8 +2221,14 @@ # From ironic # -# The region used for getting endpoints of OpenStack services. -# (string value) +# DEPRECATED: The region used for getting endpoints of +# OpenStack services. (string value) +# This option is deprecated for removal. +# Its value may be silently ignored in the future. +# Reason: Use 'region_name' option in the following sections - +# '[service_catalog]', '[neutron]', '[glance]', '[cinder]', +# '[swift]' and '[inspector]' to configure region for those +# services individually. #region_name = @@ -2646,7 +2652,9 @@ #domain_name = # Always use this endpoint URL for requests for this client. -# (string value) +# NOTE: The unversioned endpoint should be specified here; to +# request a particular API version, use the `version`, `min- +# version`, and/or `max-version` options. (string value) #endpoint_override = # Verify HTTPS connections. (boolean value) @@ -2739,16 +2747,16 @@ # Its value may be silently ignored in the future. # Reason: Use [neutron]/endpoint_override option instead. It # has no default value and must be set explicitly if required -# to connect to specific neutron URL, for example when -# [neutron]auth_strategy is noauth. +# to connect to specific neutron URL, for example in stand +# alone mode when [neutron]/auth_type is 'none'. #url = # DEPRECATED: Timeout value for connecting to neutron in # seconds. (integer value) # This option is deprecated for removal. # Its value may be silently ignored in the future. -# Reason: Use [neutron]/timeout option instead. It has no -# default value and must be set explicitly. +# Reason: Set the desired value explicitly using the +# [neutron]/timeout option instead. #url_timeout = 30 # User's domain id (string value) @@ -4060,7 +4068,9 @@ #domain_name = # Always use this endpoint URL for requests for this client. -# (string value) +# NOTE: The unversioned endpoint should be specified here; to +# request a particular API version, use the `version`, `min- +# version`, and/or `max-version` options. (string value) #endpoint_override = # Verify HTTPS connections. (boolean value) diff --git a/ironic/conf/auth.py b/ironic/conf/auth.py index 35b3f492c4..122d84f97b 100644 --- a/ironic/conf/auth.py +++ b/ironic/conf/auth.py @@ -32,10 +32,11 @@ def register_auth_opts(conf, group, service_type=None): """ kaloading.register_session_conf_options(conf, group) kaloading.register_auth_conf_options(conf, group) + kaloading.register_adapter_conf_options(conf, group) + conf.set_default('valid_interfaces', DEFAULT_VALID_INTERFACES, group=group) + # TODO(pas-ha) use os-service-type to try find the service_type by the + # config group name assuming it is a project name (e.g. 'glance') if service_type: - kaloading.register_adapter_conf_options(conf, group) - conf.set_default('valid_interfaces', DEFAULT_VALID_INTERFACES, - group=group) conf.set_default('service_type', service_type, group=group) diff --git a/ironic/conf/keystone.py b/ironic/conf/keystone.py index 981e648a76..95ea5f0474 100644 --- a/ironic/conf/keystone.py +++ b/ironic/conf/keystone.py @@ -18,6 +18,12 @@ from ironic.common.i18n import _ opts = [ cfg.StrOpt('region_name', + deprecated_for_removal=True, + deprecated_reason=_("Use 'region_name' option in the following " + "sections - '[service_catalog]', " + "'[neutron]', '[glance]', '[cinder]', " + "'[swift]' and '[inspector]' to configure " + "region for those services individually."), help=_('The region used for getting endpoints of OpenStack' ' services.')), ] diff --git a/releasenotes/notes/deprecate-global-region-4dbea91de71ebf59.yaml b/releasenotes/notes/deprecate-global-region-4dbea91de71ebf59.yaml new file mode 100644 index 0000000000..8f4166ceec --- /dev/null +++ b/releasenotes/notes/deprecate-global-region-4dbea91de71ebf59.yaml @@ -0,0 +1,28 @@ +--- +deprecations: + - | + Configuration option ``[keystone]/region_name`` is deprecated + and will be ignored in the Rocky release. + Instead, provide per-service ``region_name`` option in the following + configuration file sections: + + - service_catalog (for ironic API discovery from keystone service catalog) + - glance + - neutron + - cinder + - inspector + - swift + +upgrade: + - | + Configuration option ``[keystone]/region_name`` is deprecated + and will be ignored in the Rocky release. + Instead, provide per-service ``region_name`` option in the following + configuration file sections: + + - service_catalog (for ironic API discovery from keystone service catalog) + - glance + - neutron + - cinder + - inspector + - swift