From 1ac273041bdd7742c80a817f560759061670d012 Mon Sep 17 00:00:00 2001 From: Dmitriy Rabotyagov Date: Wed, 15 Jun 2022 18:49:31 +0200 Subject: [PATCH] Support service tokens Implement support for service_tokens. For that we convert role_name to be a list along with renaming corresponding variable. Additionally service_type is defined now for keystone_authtoken which enables to validate tokens with restricted access rules Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/845690 Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/845994 Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/845894 Change-Id: I3db09c840b448c665c9f2a16c78fe0e0a38f158a --- defaults/main.yml | 7 ++++++- tasks/main.yml | 2 +- templates/masakari.conf.j2 | 6 +++++- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index e20e396..41dd2cd 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -122,7 +122,12 @@ masakari_service_adminurl: "{{ masakari_service_adminuri }}/v1/%(tenant_id)s" masakari_service_in_ldap: "{{ service_ldap_backend_enabled | default(False) }}" -masakari_role_name: admin +masakari_service_role_names: + - admin + - service +masakari_service_token_roles: + - service +masakari_service_token_roles_required: "{{ openstack_service_token_roles_required | default(True) }}" masakari_api_bind_address: "{{ openstack_service_bind_address | default('0.0.0.0') }}" masakari_api_service_port: 15868 diff --git a/tasks/main.yml b/tasks/main.yml index a5c7bf2..c014c9c 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -147,7 +147,7 @@ _service_users: - name: "{{ masakari_service_user_name }}" password: "{{ masakari_service_password }}" - role: "{{ masakari_role_name }}" + role: "{{ masakari_service_role_names }}" _service_endpoints: - service: "{{ masakari_service_name }}" interface: "public" diff --git a/templates/masakari.conf.j2 b/templates/masakari.conf.j2 index ff52425..2f5eed4 100644 --- a/templates/masakari.conf.j2 +++ b/templates/masakari.conf.j2 @@ -34,10 +34,14 @@ user_domain_id = {{ masakari_service_project_domain_id }} project_name = {{ masakari_service_project_name }} username = {{ masakari_service_user_name }} password = {{ masakari_service_password }} + +service_token_roles = {{ masakari_service_token_roles | join(',') }} +service_token_roles_required = {{ masakari_service_token_roles_required | bool }} +service_type = {{ masakari_service_type }} + memcached_servers = {{ masakari_memcached_servers }} memcache_security_strategy = ENCRYPT memcache_secret_key = {{ memcached_encryption_key }} -service_token_roles_required = True [database] connection = mysql+pymysql://{{ masakari_galera_user }}:{{ masakari_container_mysql_password }}@{{ masakari_galera_address }}/{{ masakari_galera_database }}?charset=utf8{% if masakari_galera_use_ssl | bool %}&ssl_verify_cert=true{% if masakari_galera_ssl_ca_cert | length > 0 %}&ssl_ca={{ masakari_galera_ssl_ca_cert }}{% endif %}{% endif +%}