diff --git a/tasks/main.yml b/tasks/main.yml index 38c4bff..7df5e8a 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -83,7 +83,35 @@ - common-db - zun-config -- import_tasks: zun_service_setup.yml +- import_tasks: service_setup.yml + vars: + _service_adminuri_insecure: "{{ keystone_service_adminuri_insecure }}" + _service_in_ldap: "{{ zun_service_in_ldap }}" + _service_setup_host: "{{ zun_service_setup_host }}" + _service_setup_host_python_interpreter: "{{ zun_service_setup_host_python_interpreter }}" + _service_project_name: "{{ zun_service_project_name }}" + _service_region: "{{ zun_service_region }}" + _service_users: + - name: "{{ zun_service_user_name }}" + password: "{{ zun_service_password }}" + role: "{{ zun_service_role_name }}" + - name: "{{ zun_kuryr_service_username }}" + password: "{{ zun_kuryr_service_password }}" + role: "{{ zun_service_role_name }}" + _service_endpoints: + - service: "{{ zun_service_name }}" + interface: "public" + url: "{{ zun_service_publicurl }}" + - service: "{{ zun_service_name }}" + interface: "internal" + url: "{{ zun_service_internalurl }}" + - service: "{{ zun_service_name }}" + interface: "admin" + url: "{{ zun_service_adminurl }}" + _service_catalog: + - name: "{{ zun_service_name }}" + type: "{{ zun_service_type }}" + description: "{{ zun_service_description }}" when: - "zun_services['zun-api']['group'] in group_names" - "inventory_hostname == ((groups['zun_api'] | intersect(ansible_play_hosts)) | list)[0]" diff --git a/tasks/service_setup.yml b/tasks/service_setup.yml new file mode 100644 index 0000000..0ff5465 --- /dev/null +++ b/tasks/service_setup.yml @@ -0,0 +1,159 @@ +--- +# Copyright 2019, VEXXHOST, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# WARNING: +# This file is maintained in the openstack-ansible-tests repository. +# https://opendev.org/openstack/openstack-ansible-tests/src/sync/tasks/service_setup.yml +# If you need to modify this file, update the one in the openstack-ansible-tests +# repository. Once it merges there, the changes will automatically be proposed to +# all the repositories which use it. + +# We set the python interpreter to the ansible runtime venv if +# the delegation is to localhost so that we get access to the +# appropriate python libraries in that venv. If the delegation +# is to another host, we assume that it is accessible by the +# system python instead. + +- name: Setup the OS service + delegate_to: "{{ _service_setup_host }}" + vars: + ansible_python_interpreter: "{{ _service_setup_host_python_interpreter }}" + block: + - name: Add keystone domain + os_keystone_domain: + cloud: default + state: present + name: "{{ _domain_name }}" + endpoint_type: admin + verify: "{{ not _service_adminuri_insecure }}" + register: add_domain + when: _domain_name is defined + until: add_domain is success + retries: 5 + delay: 10 + + - name: Add service project + os_project: + cloud: default + state: present + name: "{{ _project_name }}" + description: "{{ _project_description | default(omit) }}" + domain_id: "{{ _project_domain | default('default') }}" + endpoint_type: admin + validate_certs: "{{ not (_service_adminuri_insecure | default(True) | bool) }}" + register: add_service + when: + - not (_service_in_ldap | default(False) | bool) + - _project_name is defined + until: add_service is success + retries: 5 + delay: 10 + + - name: Add services to the keystone service catalog + os_keystone_service: + cloud: default + state: "{{ item.state | default('present') }}" + name: "{{ item.name }}" + service_type: "{{ item.type }}" + description: "{{ item.description | default('') }}" + endpoint_type: admin + validate_certs: "{{ not (_service_adminuri_insecure | default(True) | bool) }}" + register: add_service + with_items: "{{ _service_catalog }}" + when: _service_catalog is defined + until: add_service is success + retries: 5 + delay: 10 + + - name: Add keystone roles + os_keystone_role: + cloud: default + state: present + name: "{{ item.role }}" + endpoint_type: admin + validate_certs: "{{ not (_service_adminuri_insecure | default(True) | bool) }}" + register: add_service + when: + - not (_service_in_ldap | default(False) | bool) + - _service_users is defined + - "'role' in item" + - (item.condition | default(True)) | bool + until: add_service is success + with_items: "{{ _service_users }}" + retries: 5 + delay: 10 + + - name: Add service users + os_user: + cloud: default + state: present + name: "{{ item.name }}" + password: "{{ item.password }}" + domain: "{{ item.domain | default('default') }}" + default_project: "{{ item.project | default(_service_project_name) }}" + endpoint_type: admin + validate_certs: "{{ not (_service_adminuri_insecure | default(True) | bool) }}" + update_password: always + register: add_service + when: + - not (_service_in_ldap | default(False) | bool) + - _service_users is defined + - "'name' in item" + - "'password' in item" + - (item.condition | default(True)) | bool + until: add_service is success + with_items: "{{ _service_users }}" + retries: 5 + delay: 10 + no_log: True + + - name: Add service users to the role + os_user_role: + cloud: default + state: present + user: "{{ item.name }}" + role: "{{ item.role }}" + project: "{{ item.project | default(_service_project_name) }}" + domain: "{{ item.domain | default(omit) }}" + endpoint_type: admin + validate_certs: "{{ not (_service_adminuri_insecure | default(True) | bool) }}" + register: add_service + when: + - not (_service_in_ldap | default(False) | bool) + - _service_users is defined + - "'name' in item" + - "'role' in item" + - (item.condition | default(True)) | bool + until: add_service is success + with_items: "{{ _service_users }}" + retries: 5 + delay: 10 + + - name: Add endpoints to keystone endpoint catalog + os_keystone_endpoint: + cloud: default + state: "{{ item.state | default('present') }}" + service: "{{ item.service }}" + endpoint_interface: "{{ item.interface }}" + url: "{{ item.url }}" + region: "{{ _service_region | default('RegionOne') }}" + endpoint_type: admin + validate_certs: "{{ not (_service_adminuri_insecure | default(True) | bool) }}" + register: add_service + until: add_service is success + retries: 5 + delay: 10 + with_items: "{{ _service_endpoints }}" + when: _service_endpoints is defined diff --git a/tasks/zun_service_setup.yml b/tasks/zun_service_setup.yml deleted file mode 100644 index e677318..0000000 --- a/tasks/zun_service_setup.yml +++ /dev/null @@ -1,102 +0,0 @@ ---- -# Copyright 2018, Rackspace US, Inc. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# We set the python interpreter to the ansible runtime venv if -# the delegation is to localhost so that we get access to the -# appropriate python libraries in that venv. If the delegation -# is to another host, we assume that it is accessible by the -# system python instead. -- name: Setup the service - delegate_to: "{{ zun_service_setup_host }}" - vars: - ansible_python_interpreter: "{{ zun_service_setup_host_python_interpreter }}" - block: - - name: Add service to the keystone service catalog - os_keystone_service: - cloud: default - state: present - name: "{{ zun_service_name }}" - service_type: "{{ zun_service_type }}" - description: "{{ zun_service_description }}" - endpoint_type: admin - verify: "{{ not keystone_service_adminuri_insecure }}" - register: add_service - until: add_service is success - retries: 5 - delay: 10 - - - name: Add service user - os_user: - cloud: default - state: present - name: "{{ item.name }}" - password: "{{ item.password }}" - domain: default - default_project: "{{ zun_service_project_name }}" - endpoint_type: admin - verify: "{{ not keystone_service_adminuri_insecure }}" - register: add_service - when: not zun_service_in_ldap | bool - until: add_service is success - retries: 5 - delay: 10 - no_log: True - with_items: - - name: "{{ zun_service_user_name }}" - password: "{{ zun_service_password }}" - - name: "{{ zun_kuryr_service_username }}" - password: "{{ zun_kuryr_service_password }}" - loop_control: - label: "{{ item.name }}" - - - name: Add service user to admin role - os_user_role: - cloud: default - state: present - user: "{{ item }}" - role: "{{ zun_service_role_name }}" - project: "{{ zun_service_project_name }}" - endpoint_type: admin - verify: "{{ not keystone_service_adminuri_insecure }}" - register: add_service - when: not zun_service_in_ldap | bool - until: add_service is success - retries: 5 - delay: 10 - with_items: - - "{{ zun_service_user_name }}" - - "{{ zun_kuryr_service_username }}" - - - name: Add endpoints to keystone endpoint catalog - os_keystone_endpoint: - cloud: default - state: present - service: "{{ zun_service_name }}" - endpoint_interface: "{{ item.interface }}" - url: "{{ item.url }}" - region: "{{ zun_service_region }}" - endpoint_type: admin - verify: "{{ not keystone_service_adminuri_insecure }}" - register: add_service - until: add_service is success - retries: 5 - delay: 10 - with_items: - - interface: "public" - url: "{{ zun_service_publicurl }}" - - interface: "internal" - url: "{{ zun_service_internalurl }}" - - interface: "admin" - url: "{{ zun_service_adminurl }}"