From 04b99a0f81ea592ff5036dbde970670f4b40a658 Mon Sep 17 00:00:00 2001 From: Dmitriy Rabotyagov Date: Wed, 15 Jun 2022 19:33:43 +0200 Subject: [PATCH] Support service tokens Implement support for service_tokens. For that we convert role_name to be a list along with renaming corresponding variable. Additionally service_type is defined now for keystone_authtoken which enables to validate tokens with restricted access rules Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/845690 Change-Id: Id451d06bcc40c94e9ef021dd7e3c1d14703e73cc --- defaults/main.yml | 7 ++++++- tasks/main.yml | 4 ++-- templates/zun.conf.j2 | 5 ++++- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index dc43251..f8a0005 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -179,7 +179,12 @@ zun_service_project_name: "service" zun_service_project_domain_id: default zun_service_user_domain_id: default zun_service_user_name: "zun" -zun_service_role_name: "admin" +zun_service_role_names: + - admin + - service +zun_service_token_roles: + - service +zun_service_token_roles_required: "{{ openstack_service_token_roles_required | default(True) }}" ## Zun Auth for kuryr zun_kuryr_service_username: kuryr diff --git a/tasks/main.yml b/tasks/main.yml index 2545cf1..d4e9f02 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -123,10 +123,10 @@ _service_users: - name: "{{ zun_service_user_name }}" password: "{{ zun_service_password }}" - role: "{{ zun_service_role_name }}" + role: "{{ zun_service_role_names }}" - name: "{{ zun_kuryr_service_username }}" password: "{{ zun_kuryr_service_password }}" - role: "{{ zun_service_role_name }}" + role: "{{ zun_service_role_names }}" _service_endpoints: - service: "{{ zun_service_name }}" interface: "public" diff --git a/templates/zun.conf.j2 b/templates/zun.conf.j2 index 6ce7ec9..b444c09 100644 --- a/templates/zun.conf.j2 +++ b/templates/zun.conf.j2 @@ -64,12 +64,15 @@ memcached_servers = {{ zun_memcached_servers }} token_cache_time = 300 memcache_security_strategy = ENCRYPT memcache_secret_key = {{ memcached_encryption_key }} -service_token_roles_required = true auth_type = {{ zun_keystone_auth_plugin }} username = {{ zun_service_user_name }} user_domain_id = {{ zun_service_user_domain_id }} password = {{ zun_service_password }} +service_token_roles_required = {{ zun_service_token_roles_required | bool }} +service_token_roles = {{ zun_service_token_roles | join(',') }} +service_type = {{ zun_service_type }} + [network] driver = kuryr driver_name = kuryr