openstack/openstack-ansible-os_neutron
Code Issues Proposed changes

Support service tokens

Browse Source 
Implement support for service_tokens. For that we convert
role_name to be a list along with renaming corresponding variable.

Additionally service_type is defined now for keystone_authtoken which
enables to validate tokens with restricted access rules

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/845690
Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/845903
Change-Id: Id2a50a1df6287789eeb59d6ed5246e2375d93b52
This commit is contained in:
Dmitriy Rabotyagov 2022-06-15 11:14:20 +02:00 committed by Dmitriy Rabotyagov
parent d0af9ee286
commit ce9992335e
3 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
defaults/main.yml
View File

@ -289,7 +289,12 @@ neutron_rpc_workers: "{{ [[(ansible_facts['processor_vcpus']//ansible_facts['pro
neutron_service_project_name: service
neutron_service_project_domain_id: default
neutron_service_user_domain_id: default
neutron_service_role_name: admin
neutron_service_role_names:
- admin
- service
neutron_service_token_roles:
- service
neutron_service_token_roles_required: "{{ openstack_service_token_roles_required | default(True) }}"
neutron_service_user_name: neutron
neutron_service_name: neutron
neutron_service_type: network

2
tasks/main.yml
View File

@ -203,7 +203,7 @@
_service_users:
- name: "{{ neutron_service_user_name }}"
password: "{{ neutron_service_password }}"
role: "{{ neutron_service_role_name }}"
role: "{{ neutron_service_role_names }}"
_service_endpoints:
- service: "{{ neutron_service_name }}"
interface: "public"

4
templates/neutron.conf.j2
View File

@ -188,6 +188,10 @@ username = {{ neutron_service_user_name }}
password = {{ neutron_service_password }}
region_name = {{ keystone_service_region }}
service_token_roles_required = {{ neutron_service_token_roles_required | bool }}
service_token_roles = {{ neutron_service_token_roles | join(',') }}
service_type = {{ neutron_service_type }}
memcached_servers = {{ neutron_memcached_servers }}
token_cache_time = 300
# Prevent cache poisoning if sharing a memcached server