From 1d39c7ab4456301ee5de87d811d4bdd8da4466a8 Mon Sep 17 00:00:00 2001 From: Dmitriy Rabotyagov Date: Wed, 15 Jun 2022 18:23:20 +0200 Subject: [PATCH] Support service tokens Implement support for service_tokens. For that we convert role_name to be a list along with renaming corresponding variable. Additionally service_type is defined now for keystone_authtoken which enables to validate tokens with restricted access rules Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/845690 Change-Id: Ib5d15aaf56112a776e2b9abb2396f9ea4f4fe319 --- defaults/main.yml | 7 ++++++- tasks/heat_service_setup.yml | 2 +- templates/heat.conf.j2 | 4 ++++ 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index c95c390..db3a378 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -130,7 +130,12 @@ heat_profiler_trace_sqlalchemy: false heat_service_region: "{{ service_region | default('RegionOne') }}" heat_service_project_name: "service" heat_service_user_name: "heat" -heat_service_role_name: admin +heat_service_role_names: + - admin + - service +heat_service_token_roles: + - service +heat_service_token_roles_required: "{{ openstack_service_token_roles_required | default(True) }}" heat_service_project_domain_id: default heat_service_user_domain_id: default heat_keystone_auth_plugin: password diff --git a/tasks/heat_service_setup.yml b/tasks/heat_service_setup.yml index e7e244e..9b32504 100644 --- a/tasks/heat_service_setup.yml +++ b/tasks/heat_service_setup.yml @@ -41,7 +41,7 @@ password: "{{ heat_service_password }}" domain: default project: "{{ heat_service_project_name }}" - role: "{{ heat_service_role_name }}" + role: "{{ heat_service_role_names }}" # We add the keystone role used by heat to delegate to the heat service user # for performing deferred operations via trusts. - name: "{{ heat_service_user_name }}" diff --git a/templates/heat.conf.j2 b/templates/heat.conf.j2 index 4e1e00c..da0caa0 100644 --- a/templates/heat.conf.j2 +++ b/templates/heat.conf.j2 @@ -94,6 +94,10 @@ username = {{ heat_service_user_name }} password = {{ heat_service_password }} region_name = {{ keystone_service_region }} +service_token_roles_required = {{ heat_service_token_roles_required | bool }} +service_token_roles = {{ heat_service_token_roles | join(',') }} +service_type = {{ heat_service_type }} + memcached_servers = {{ heat_memcached_servers }} token_cache_time = 300