2e933dceb5
A system-scoped token implies the user has authorization to act on the deployment system. These tokens are useful for interacting with resources that affect the deployment as a whole, or exposes resources that may otherwise violate project or domain isolation. Since Queens, the keystone-manage bootstrap command assigns the admin role to the admin user with system scope, as well as in the admin project. This patch transitions the Keystone admin user from authenticating using project scoped tokens to system scoped tokens. This is a necessary step towards being able to enable the updated oslo policies in services that allow finer grained access to system-level resources and APIs. An etherpad with discussion about the transition to the new oslo service policies is: https://etherpad.opendev.org/p/enabling-system-scope-in-kolla-ansible Change-Id: Ib631e2211682862296cce9ea179f2661c90fa585 Signed-off-by: Niklas Hagman <ubuntu@post.blinkiz.com>
78 lines
3.3 KiB
YAML
78 lines
3.3 KiB
YAML
---
|
|
# We need to wait for all expected compute services to register before running
|
|
# cells v2 host discovery. This includes virtualised compute services and
|
|
# ironic compute services.
|
|
# Work with --limit by including only hosts in ansible_play_batch.
|
|
- name: Build a list of expected compute service hosts
|
|
vars:
|
|
# For virt, use ansible_facts.nodename rather than inventory_hostname, since this
|
|
# is similar to what nova uses internally as its default for the
|
|
# [DEFAULT] host config option.
|
|
virt_compute_service_hosts: >-
|
|
{{ virt_computes_in_batch |
|
|
map('extract', hostvars, ['ansible_facts', 'nodename']) |
|
|
list }}
|
|
# For ironic, use {{ansible_facts.hostname}}-ironic since this is what we
|
|
# configure for [DEFAULT] host in nova.conf.
|
|
ironic_compute_service_hosts: >-
|
|
{{ ironic_computes_in_batch |
|
|
map('extract', hostvars, ['ansible_facts', 'hostname']) |
|
|
map('regex_replace', '^(.*)$', '\1-ironic') |
|
|
list }}
|
|
set_fact:
|
|
expected_compute_service_hosts: "{{ virt_compute_service_hosts + ironic_compute_service_hosts }}"
|
|
delegate_to: "{{ groups[nova_cell_conductor_group][0] }}"
|
|
|
|
- name: Waiting for nova-compute services to register themselves
|
|
become: true
|
|
command: >
|
|
docker exec kolla_toolbox openstack
|
|
--os-interface {{ openstack_interface }}
|
|
--os-auth-url {{ openstack_auth.auth_url }}
|
|
--os-username {{ openstack_auth.username }}
|
|
--os-password {{ openstack_auth.password }}
|
|
--os-identity-api-version 3
|
|
--os-user-domain-name {{ openstack_auth.user_domain_name }}
|
|
--os-system-scope {{ openstack_auth.system_scope }}
|
|
--os-region-name {{ openstack_region_name }}
|
|
{% if openstack_cacert != '' %}--os-cacert {{ openstack_cacert }}{% endif %}
|
|
compute service list --format json --column Host --service nova-compute
|
|
register: nova_compute_services
|
|
changed_when: false
|
|
retries: 20
|
|
delay: 10
|
|
until:
|
|
- nova_compute_services is success
|
|
# A list containing the 'Host' field of compute services that have
|
|
# registered themselves. Don't exclude compute services that are disabled
|
|
# since these could have been explicitly disabled by the operator. While we
|
|
# could exclude services that are down, the nova-manage cell_v2
|
|
# discover_hosts does not do this so let's not block on it here.
|
|
# NOTE(mgoddard): Cannot factor this out into an intermediary variable
|
|
# before ansible 2.8, due to
|
|
# https://bugs.launchpad.net/kolla-ansible/+bug/1835817.
|
|
- (nova_compute_services.stdout |
|
|
from_json |
|
|
map(attribute='Host') |
|
|
list)
|
|
is superset(expected_compute_service_hosts)
|
|
delegate_to: "{{ groups[nova_cell_conductor_group][0] }}"
|
|
|
|
- import_tasks: get_cell_settings.yml
|
|
delegate_to: "{{ groups[nova_cell_conductor_group][0] }}"
|
|
|
|
- name: Fail if cell settings not found
|
|
fail:
|
|
msg: >-
|
|
Unable to find settings for {{ nova_cell_name or 'the default cell' }}.
|
|
when: not nova_cell_settings
|
|
delegate_to: "{{ groups[nova_cell_conductor_group][0] }}"
|
|
|
|
# TODO(yoctozepto): no need to do --by-service if ironic not used
|
|
- name: Discover nova hosts
|
|
become: true
|
|
command: >
|
|
docker exec nova_conductor nova-manage cell_v2 discover_hosts --by-service --cell_uuid {{ nova_cell_settings.cell_uuid }}
|
|
changed_when: False
|
|
delegate_to: "{{ groups[nova_cell_conductor_group][0] }}"
|