openstack-helm/neutron/templates/configmap-etc.yaml
Pete Birley 7cfd182929 Security: Make policy fully configurable via helm values
This PS moves the policy.json to be fully driven by gotpl,
allowing full configuration without editing the template.

Nova and Cinder are addressed in the seperate patchsets:
 * https://review.openstack.org/#/c/498215/
 * https://review.openstack.org/#/c/498216/

Change-Id: Ia2be5fb4e460d41034fdadbbefc1e48d0869e023
2017-08-26 17:50:22 -05:00

145 lines
9.6 KiB
YAML

{{/*
Copyright 2017 The Openstack-Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/}}
{{- if .Values.manifests.configmap_etc }}
{{- $envAll := . }}
{{- include "neutron.conf.neutron_values_skeleton" .Values.conf.neutron | trunc 0 -}}
{{- include "neutron.conf.dhcp_agent_values_skeleton" .Values.conf.dhcp_agent | trunc 0 -}}
{{- include "neutron.conf.l3_agent_values_skeleton" .Values.conf.l3_agent | trunc 0 -}}
{{- include "neutron.conf.metadata_agent_values_skeleton" .Values.conf.metadata_agent | trunc 0 -}}
{{- include "neutron.conf.metering_agent_values_skeleton" .Values.conf.metering_agent | trunc 0 -}}
{{- include "neutron.conf.linuxbridge_agent_values_skeleton" .Values.conf.linuxbridge_agent | trunc 0 -}}
{{- include "neutron.conf.macvtap_agent_values_skeleton" .Values.conf.macvtap_agent | trunc 0 -}}
{{- include "neutron.conf.ml2_conf_values_skeleton" .Values.conf.ml2_conf | trunc 0 -}}
{{- include "neutron.conf.ml2_conf_sriov_values_skeleton" .Values.conf.ml2_conf_sriov | trunc 0 -}}
{{- include "neutron.conf.openvswitch_agent_values_skeleton" .Values.conf.openvswitch_agent | trunc 0 -}}
{{- include "neutron.conf.sriov_agent_values_skeleton" .Values.conf.sriov_agent | trunc 0 -}}
{{- if empty .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token.auth_uri -}}
{{- tuple "identity" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup"| set .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token "auth_uri" | quote | trunc 0 -}}
{{- end }}
{{- if empty .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token.auth_url -}}
{{- tuple "identity" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup"| set .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token "auth_url" | quote | trunc 0 -}}
{{- end }}
# Set a random string as secret key.
{{- if empty .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token.memcache_secret_key -}}
{{- randAlphaNum 64 | set .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token "memcache_secret_key" | quote | trunc 0 -}}
{{- end -}}
{{- if empty .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token.project_name -}}
{{- set .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token "project_name" .Values.endpoints.identity.auth.user.project_name | quote | trunc 0 -}}
{{- end -}}
{{- if empty .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token.project_domain_name -}}
{{- set .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token "project_domain_name" .Values.endpoints.identity.auth.user.project_domain_name | quote | trunc 0 -}}
{{- end -}}
{{- if empty .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token.user_domain_name -}}
{{- set .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token "user_domain_name" .Values.endpoints.identity.auth.user.user_domain_name | quote | trunc 0 -}}
{{- end -}}
{{- if empty .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token.username -}}
{{- set .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token "username" .Values.endpoints.identity.auth.user.username | quote | trunc 0 -}}
{{- end -}}
{{- if empty .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token.password -}}
{{- set .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token "password" .Values.endpoints.identity.auth.user.password | quote | trunc 0 -}}
{{- end -}}
{{- if empty .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token.region_name -}}
{{- set .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token "region_name" .Values.endpoints.identity.auth.user.region_name | quote | trunc 0 -}}
{{- end -}}
{{- if empty .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token.memcached_servers -}}
{{- tuple "oslo_cache" "internal" "memcache" . | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" | set .Values.conf.neutron.keystone_authtoken.keystonemiddleware.auth_token "memcached_servers" | quote | trunc 0 -}}
{{- end }}
{{- if empty .Values.conf.neutron.database.oslo.db.connection -}}
{{- tuple "oslo_db" "internal" "user" "mysql" . | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup"| set .Values.conf.neutron.database.oslo.db "connection" | quote | trunc 0 -}}
{{- end }}
{{- if empty .Values.conf.neutron.default.oslo.messaging.transport_url -}}
{{- tuple "oslo_messaging" "internal" "user" "amqp" . | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | set .Values.conf.neutron.default.oslo.messaging "transport_url" | quote | trunc 0 -}}
{{- end }}
{{- if empty .Values.conf.neutron.nova.nova.auth.auth_url -}}
{{- tuple "identity" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup"| set .Values.conf.neutron.nova.nova.auth "auth_url" | quote | trunc 0 -}}
{{- end }}
{{- if empty .Values.conf.metadata_agent.cache.oslo.cache.memcache_servers -}}
{{- tuple "oslo_cache" "internal" "memcache" . | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" | set .Values.conf.metadata_agent.cache.oslo.cache "memcache_servers" | quote | trunc 0 -}}
{{- end -}}
---
apiVersion: v1
kind: ConfigMap
metadata:
name: neutron-etc
data:
rally_tests.yaml: |+
{{- tuple .Values.conf.rally_tests "etc/_rally_tests.yaml.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
api-paste.ini: |+
{{- tuple .Values.conf.paste "etc/_api-paste.ini.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
policy.json: |+
{{ toJson .Values.conf.policy | indent 4 }}
dhcp_agent.ini: |+
{{- tuple .Values.conf.dhcp_agent "etc/_dhcp_agent.ini.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
l3_agent.ini: |+
{{- tuple .Values.conf.l3_agent "etc/_l3_agent.ini.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
metadata_agent.ini: |+
{{- tuple .Values.conf.metadata_agent "etc/_metadata_agent.ini.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
metering_agent.ini: |+
{{- tuple .Values.conf.metering_agent "etc/_metering_agent.ini.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
neutron.conf: |+
{{- tuple .Values.conf.neutron "etc/_neutron.conf.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
ml2_conf.ini: |+
{{- tuple .Values.conf.ml2_conf "etc/plugins/_ml2_conf.ini.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
ml2_conf_sriov.ini: |+
{{- tuple .Values.conf.ml2_conf_sriov "etc/plugins/_ml2_conf_sriov.ini.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
macvtap_agent.ini: |+
{{- tuple .Values.conf.macvtap_agent "etc/plugins/_macvtap_agent.ini.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
linuxbridge_agent.ini: |+
{{- tuple .Values.conf.linuxbridge_agent "etc/plugins/_linuxbridge_agent.ini.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
openvswitch_agent.ini: |+
{{- tuple .Values.conf.openvswitch_agent "etc/plugins/_openvswitch_agent.ini.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
sriov_agent.ini: |+
{{- tuple .Values.conf.sriov_agent "etc/plugins/_sriov_agent.ini.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
dnsmasq.conf: ""
neutron_sudoers: |+
{{- tuple .Values.conf.neutron_sudoers "etc/_neutron_sudoers.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
rootwrap.conf: |+
{{- tuple .Values.conf.rootwrap "etc/_rootwrap.conf.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
debug.filters: |+
{{- tuple .Values.conf.rootwrap_filters.debug "etc/rootwrap.d/_debug.filters.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
dibbler.filters: |+
{{- tuple .Values.conf.rootwrap_filters.dibbler "etc/rootwrap.d/_dibbler.filters.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
ipset-firewall.filters: |+
{{- tuple .Values.conf.rootwrap_filters.ipset_firewall "etc/rootwrap.d/_ipset-firewall.filters.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
l3.filters: |+
{{- tuple .Values.conf.rootwrap_filters.l3 "etc/rootwrap.d/_l3.filters.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
netns-cleanup.filters: |+
{{- tuple .Values.conf.rootwrap_filters.netns_cleanup "etc/rootwrap.d/_netns-cleanup.filters.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
dhcp.filters: |+
{{- tuple .Values.conf.rootwrap_filters.dhcp "etc/rootwrap.d/_dhcp.filters.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
ebtables.filters: |+
{{- tuple .Values.conf.rootwrap_filters.ebtables "etc/rootwrap.d/_ebtables.filters.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
iptables-firewall.filters: |+
{{- tuple .Values.conf.rootwrap_filters.iptables_firewall "etc/rootwrap.d/_iptables-firewall.filters.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
linuxbridge-plugin.filters: |+
{{- tuple .Values.conf.rootwrap_filters.linuxbridge_plugin "etc/rootwrap.d/_linuxbridge-plugin.filters.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
openvswitch-plugin.filters: |+
{{- tuple .Values.conf.rootwrap_filters.openvswitch_plugin "etc/rootwrap.d/_openvswitch-plugin.filters.tpl" . | include "helm-toolkit.utils.configmap_templater" }}
{{- end }}