Configure keystone authtoken options

In cinder::api, use keystone::resource::authtoken to configure keystone_authtoken section in cinder.conf, with all parameters required to configure keystonemiddleware. This patch will allow to deploy Cinder to use Keystone v3 authentification. Some deprecations: cinder::api::auth_type is deprecated, use cinder::keystone::authtoken::auth_type instead. cinder::api::identity_uri is deprecated, use cinder::keystone::authtoken::auth_url instead. cinder::api::auth_uri is deprecated, use cinder::keystone::authtoken::auth_uri instead. cinder::api::keystone_tenant is deprecated, use cinder::keystone::authtoken::project_name instead. cinder::api::keystone_user is deprecated, use cinder::keystone::authtoken::username instead. cinder::api::keystone_password is deprecated, use cinder::keystone::authtoken::password instead. cinder::api::memcached_servers is deprecated, use cinder::keystone::authtoken::memcached_servers instead. Closes-Bug: #1604463 Change-Id: I64736457bd8527198a8a81ea784d3bf74284063b
2016-07-15 10:37:54 -04:00 · 2016-07-15 10:37:54 -04:00 · bd49302617
commit bd49302617
parent b306b501bb
8 changed files with 579 additions and 126 deletions
--- a/lib/puppet/provider/cinder.rb
+++ b/lib/puppet/provider/cinder.rb
@ -28,9 +28,9 @@ class Puppet::Provider::Cinder < Puppet::Provider::Openstack

  def self.cinder_request(service, action, error, properties=nil)
    properties ||= []
-    @credentials.username = cinder_credentials['admin_user']
-    @credentials.password = cinder_credentials['admin_password']
-    @credentials.project_name = cinder_credentials['admin_tenant_name']
+    @credentials.username = cinder_credentials['username']
+    @credentials.password = cinder_credentials['password']
+    @credentials.project_name = cinder_credentials['project_name']
    @credentials.auth_url = auth_endpoint
    if @credentials.version == '3'
      @credentials.user_domain_name = cinder_credentials['user_domain_name']
@ -49,8 +49,8 @@ class Puppet::Provider::Cinder < Puppet::Provider::Openstack
  end

  def self.get_cinder_credentials
-    auth_keys = ['auth_uri', 'admin_tenant_name', 'admin_user',
-                 'admin_password']
+    auth_keys = ['auth_uri', 'project_name', 'username',
+                 'password']
    conf = cinder_conf
    if conf and conf['keystone_authtoken'] and
        auth_keys.all?{|k| !conf['keystone_authtoken'][k].nil?}
--- a/manifests/api.pp
+++ b/manifests/api.pp
@ -4,21 +4,10 @@
 #
 # === Parameters
 #
-# [*keystone_password*]
-#   The password to use for authentication (keystone)
-#
 # [*keystone_enabled*]
 #   (optional) Use keystone for authentification
 #   Defaults to true
 #
-# [*keystone_tenant*]
-#   (optional) The tenant of the auth user
-#   Defaults to services
-#
-# [*keystone_user*]
-#   (optional) The name of the auth user
-#   Defaults to cinder
-#
 # [*privileged_user*]
 #   (optional) Enables OpenStack privileged account.
 #   Defaults to false.
@ -71,14 +60,6 @@
 #   (optional) Same as nova_catalog_info, but for admin endpoint.
 #   Defaults to 'compute:Compute Service:adminURL'
 #
-# [*auth_uri*]
-#   (optional) Public Identity API endpoint.
-#   Defaults to 'http://localhost:5000/'.
-#
-# [*identity_uri*]
-#   (optional) Complete admin Identity API endpoint.
-#   Defaults to: 'http://localhost:35357/'.
-#
 # [*service_workers*]
 #   (optional) Number of cinder-api workers
 #   Defaults to $::processorcount
@ -118,22 +99,6 @@
 #   (optional) Whether to validate the service is working after any service refreshes
 #   Defaults to false
 #
-# [*validation_options*]
-#   (optional) Service validation options
-#   Should be a hash of options defined in openstacklib::service_validation
-#   If empty, defaults values are taken from openstacklib function.
-#   Default command list volumes.
-#   Require validate set at True.
-#   Example:
-#   glance::api::validation_options:
-#     glance-api:
-#       command: check_cinder-api.py
-#       path: /usr/bin:/bin:/usr/sbin:/sbin
-#       provider: shell
-#       tries: 5
-#       try_sleep: 10
-#   Defaults to {}
-#
 # [*sync_db*]
 #   (Optional) Run db sync on the node.
 #   Defaults to true
@ -181,52 +146,89 @@
 #   (optional) CA certificate file to use to verify connecting clients
 #   Defaults to $::os_service_default
 #
+# DEPRECATED PARAMETERS
+#
+# [*keystone_tenant*]
+#   (optional) Deprecated. Use cinder::keystone::authtoken::project_name instead.
+#   Defaults to undef.
+#
+# [*keystone_user*]
+#   (optional) Deprecated. Use cinder::keystone::authtoken::username instead.
+#   Defaults to undef.
+#
+# [*keystone_password*]
+#   (optional) Deprecated. Use cinder::keystone::authtoken::password instead.
+#   Defaults to undef.
+#
+# [*identity_uri*]
+#   (optional) Deprecated. Use cinder::keystone::authtoken::auth_url instead.
+#   Defaults to undef.
+#
+# [*auth_uri*]
+#  (optional) Deprecated. Use cinder::keystone::authtoken::auth_uri instead.
+#  Defaults to undef.
+#
 # [*memcached_servers*]
-#   (optinal) a list of memcached server(s) to use for caching. If left
-#   undefined, tokens will instead be cached in-process.
-#   Defaults to $::os_service_default.
+#  (Optional) Deprecated. Use cinder::keystone::authtoken::memcached_servers.
+#  Defaults to undef.
+#
+# [*validation_options*]
+#   (optional) Service validation options
+#   Should be a hash of options defined in openstacklib::service_validation
+#   If empty, defaults values are taken from openstacklib function.
+#   Default command list volumes.
+#   Require validate set at True.
+#   Example:
+#   glance::api::validation_options:
+#     glance-api:
+#       command: check_cinder-api.py
+#       path: /usr/bin:/bin:/usr/sbin:/sbin
+#       provider: shell
+#       tries: 5
+#       try_sleep: 10
+#   Defaults to {}
 #
 class cinder::api (
-  $keystone_password,
-  $keystone_enabled             = true,
-  $keystone_tenant              = 'services',
-  $keystone_user                = 'cinder',
-  $auth_uri                     = 'http://localhost:5000/',
-  $identity_uri                 = 'http://localhost:35357/',
-  $nova_catalog_info            = 'compute:Compute Service:publicURL',
-  $nova_catalog_admin_info      = 'compute:Compute Service:adminURL',
-  $os_region_name               = $::os_service_default,
-  $privileged_user              = false,
-  $os_privileged_user_name      = $::os_service_default,
-  $os_privileged_user_password  = $::os_service_default,
-  $os_privileged_user_tenant    = $::os_service_default,
-  $os_privileged_user_auth_url  = $::os_service_default,
-  $keymgr_api_class             = $::os_service_default,
-  $keymgr_encryption_api_url    = $::os_service_default,
-  $keymgr_encryption_auth_url   = $::os_service_default,
-  $service_workers              = $::processorcount,
-  $package_ensure               = 'present',
-  $bind_host                    = '0.0.0.0',
-  $enabled                      = true,
-  $manage_service               = true,
-  $ratelimits                   = $::os_service_default,
-  $default_volume_type          = $::os_service_default,
+  $keystone_enabled               = true,
+  $nova_catalog_info              = 'compute:Compute Service:publicURL',
+  $nova_catalog_admin_info        = 'compute:Compute Service:adminURL',
+  $os_region_name                 = $::os_service_default,
+  $privileged_user                = false,
+  $os_privileged_user_name        = $::os_service_default,
+  $os_privileged_user_password    = $::os_service_default,
+  $os_privileged_user_tenant      = $::os_service_default,
+  $os_privileged_user_auth_url    = $::os_service_default,
+  $keymgr_api_class               = $::os_service_default,
+  $keymgr_encryption_api_url      = $::os_service_default,
+  $keymgr_encryption_auth_url     = $::os_service_default,
+  $service_workers                = $::processorcount,
+  $package_ensure                 = 'present',
+  $bind_host                      = '0.0.0.0',
+  $enabled                        = true,
+  $manage_service                 = true,
+  $ratelimits                     = $::os_service_default,
+  $default_volume_type            = $::os_service_default,
  $ratelimits_factory =
    'cinder.api.v1.limits:RateLimitingMiddleware.factory',
-  $validate                     = false,
-  $sync_db                      = true,
-  $public_endpoint              = $::os_service_default,
-  $osapi_volume_base_url        = $::os_service_default,
-  $osapi_max_limit              = $::os_service_default,
-  $service_name                 = $::cinder::params::api_service,
-  $enable_proxy_headers_parsing = $::os_service_default,
-  $use_ssl                      = false,
-  $cert_file                    = $::os_service_default,
-  $key_file                     = $::os_service_default,
-  $ca_file                      = $::os_service_default,
-  $memcached_servers            = $::os_service_default,
+  $validate                       = false,
+  $sync_db                        = true,
+  $public_endpoint                = $::os_service_default,
+  $osapi_volume_base_url          = $::os_service_default,
+  $osapi_max_limit                = $::os_service_default,
+  $service_name                   = $::cinder::params::api_service,
+  $enable_proxy_headers_parsing   = $::os_service_default,
+  $use_ssl                        = false,
+  $cert_file                      = $::os_service_default,
+  $key_file                       = $::os_service_default,
+  $ca_file                        = $::os_service_default,
  # DEPRECATED PARAMETERS
-  $validation_options         = {},
+  $validation_options             = {},
+  $keystone_tenant                = undef,
+  $keystone_user                  = undef,
+  $keystone_password              = undef,
+  $identity_uri                   = undef,
+  $auth_uri                       = undef,
+  $memcached_servers              = undef,
 ) inherits cinder::params {

  include ::cinder::params
@ -241,6 +243,25 @@ class cinder::api (
  $key_file_real = pick($::cinder::key_file, $key_file)
  $ca_file_real = pick($::cinder::ca_file, $ca_file)

+  if $identity_uri {
+    warning('cinder::api::identity_uri is deprecated, use cinder::keystone::authtoken::auth_url instead.')
+  }
+  if $auth_uri {
+    warning('cinder::api::auth_uri is deprecated, use cinder::keystone::authtoken::auth_uri instead.')
+  }
+  if $keystone_tenant {
+    warning('cinder::api::keystone_tenant is deprecated, use cinder::keystone::authtoken::project_name instead.')
+  }
+  if $keystone_user {
+    warning('cinder::api::keystone_user is deprecated, use cinder::keystone::authtoken::username instead.')
+  }
+  if $keystone_password {
+    warning('cinder::api::keystone_password is deprecated, use cinder::keystone::authtoken::password instead.')
+  }
+  if $memcached_servers {
+    warning('cinder::api::memcached_servers is deprecated, use cinder::keystone::authtoken::memcached_servers instead.')
+  }
+
  if $use_ssl_real {
    if is_service_default($cert_file_real) {
      fail('The cert_file parameter is required when use_ssl is set to true')
@ -343,21 +364,13 @@ class cinder::api (
  }

  cinder_config {
-    'keystone_authtoken/auth_uri':          value => $auth_uri;
-    'keystone_authtoken/identity_uri':      value => $identity_uri;
-    'keystone_authtoken/memcached_servers': value => join(any2array($memcached_servers), ',');
-    'keymgr/api_class':                     value => $keymgr_api_class;
-    'keymgr/encryption_api_url':            value => $keymgr_encryption_api_url;
-    'keymgr/encryption_auth_url':           value => $keymgr_encryption_auth_url;
+    'keymgr/api_class':           value => $keymgr_api_class;
+    'keymgr/encryption_api_url':  value => $keymgr_encryption_api_url;
+    'keymgr/encryption_auth_url': value => $keymgr_encryption_auth_url;
  }

  if $keystone_enabled {
-    cinder_config {
-      'DEFAULT/auth_strategy':                value => 'keystone' ;
-      'keystone_authtoken/admin_tenant_name': value => $keystone_tenant;
-      'keystone_authtoken/admin_user':        value => $keystone_user;
-      'keystone_authtoken/admin_password':    value => $keystone_password, secret => true;
-    }
+    include ::cinder::keystone::authtoken
  }

  # SSL Options
@ -377,9 +390,12 @@ class cinder::api (
  }

  if $validate {
+    $keystone_tenant_real = pick($keystone_tenant, $::cinder::keystone::authtoken::project_name)
+    $keystone_username_real = pick($keystone_user, $::cinder::keystone::authtoken::username)
+    $keystone_password_real = pick($keystone_password, $::cinder::keystone::authtoken::password)
    $defaults = {
      'cinder-api' => {
-        'command'  => "cinder --os-auth-url ${auth_uri} --os-tenant-name ${keystone_tenant} --os-username ${keystone_user} --os-password ${keystone_password} list",
+        'command'  => "cinder --os-auth-url ${::cinder::keystone::authtoken::auth_uri} --os-project-name ${keystone_tenant_real} --os-username ${keystone_username_real} --os-password ${keystone_password_real} list",
      }
    }
    $validation_options_hash = merge ($defaults, $validation_options)
--- a/manifests/keystone/authtoken.pp
+++ b/manifests/keystone/authtoken.pp
@ -0,0 +1,280 @@
+# class: cinder::keystone::authtoken
+#
+# Configure the keystone_authtoken section in the configuration file
+#
+# === Parameters
+#
+# [*username*]
+#   (Optional) The name of the service user
+#   Defaults to 'cinder'
+#
+# [*password*]
+#   (Optional) Password to create for the service user
+#   Defaults to $::os_service_default
+#
+# [*auth_url*]
+#   (Optional) The URL to use for authentication.
+#   Defaults to 'http://localhost:35357'.
+#
+# [*project_name*]
+#   (Optional) Service project name
+#   Defaults to 'services'
+#
+# [*user_domain_name*]
+#   (Optional) Name of domain for $username
+#   Defaults to $::os_service_default
+#
+# [*project_domain_name*]
+#   (Optional) Name of domain for $project_name
+#   Defaults to $::os_service_default
+#
+# [*insecure*]
+#  (Optional) If true, explicitly allow TLS without checking server cert
+#  against any certificate authorities.  WARNING: not recommended.  Use with
+#  caution.
+#  Defaults to $:os_service_default
+#
+# [*auth_section*]
+#  (Optional) Config Section from which to load plugin specific options
+#  Defaults to $::os_service_default.
+#
+# [*auth_type*]
+#  (Optional) Authentication type to load
+#  Defaults to $::os_service_default
+#
+# [*auth_uri*]
+#  (Optional) Complete public Identity API endpoint.
+#  Defaults to 'http://localhost:5000'.
+#
+# [*auth_version*]
+#  (Optional) API version of the admin Identity API endpoint.
+#  Defaults to $::os_service_default.
+#
+# [*cache*]
+#  (Optional) Env key for the swift cache.
+#  Defaults to $::os_service_default.
+#
+# [*cafile*]
+#  (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs
+#  connections.
+#  Defaults to $::os_service_default.
+#
+# [*certfile*]
+#  (Optional) Required if identity server requires client certificate
+#  Defaults to $::os_service_default.
+#
+# [*check_revocations_for_cached*]
+#  (Optional) If true, the revocation list will be checked for cached tokens.
+#  This requires that PKI tokens are configured on the identity server.
+#  boolean value.
+#  Defaults to $::os_service_default.
+#
+# [*delay_auth_decision*]
+#  (Optional) Do not handle authorization requests within the middleware, but
+#  delegate the authorization decision to downstream WSGI components. Boolean
+#  value
+#  Defaults to $::os_service_default.
+#
+# [*enforce_token_bind*]
+#  (Optional) Used to control the use and type of token binding. Can be set
+#  to: "disabled" to not check token binding. "permissive" (default) to
+#  validate binding information if the bind type is of a form known to the
+#  server and ignore it if not. "strict" like "permissive" but if the bind
+#  type is unknown the token will be rejected. "required" any form of token
+#  binding is needed to be allowed. Finally the name of a binding method that
+#  must be present in tokens. String value.
+#  Defaults to $::os_service_default.
+#
+# [*hash_algorithms*]
+#  (Optional) Hash algorithms to use for hashing PKI tokens. This may be a
+#  single algorithm or multiple. The algorithms are those supported by Python
+#  standard hashlib.new(). The hashes will be tried in the order given, so put
+#  the preferred one first for performance. The result of the first hash will
+#  be stored in the cache. This will typically be set to multiple values only
+#  while migrating from a less secure algorithm to a more secure one. Once all
+#  the old tokens are expired this option should be set to a single value for
+#  better performance. List value.
+#  Defaults to $::os_service_default.
+#
+# [*http_connect_timeout*]
+#  (Optional) Request timeout value for communicating with Identity API
+#  server.
+#  Defaults to $::os_service_default.
+#
+# [*http_request_max_retries*]
+#  (Optional) How many times are we trying to reconnect when communicating
+#  with Identity API Server. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*include_service_catalog*]
+#  (Optional) Indicate whether to set the X-Service-Catalog header. If False,
+#  middleware will not ask for service catalog on token validation and will
+#  not
+#  set the X-Service-Catalog header. Boolean value.
+#  Defaults to $::os_service_default.
+#
+# [*keyfile*]
+#  (Optional) Required if identity server requires client certificate
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_conn_get_timeout*]
+#  (Optional) Number of seconds that an operation will wait to get a memcached
+#  client connection from the pool. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_dead_retry*]
+#  (Optional) Number of seconds memcached server is considered dead before it
+#  is tried again. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_maxsize*]
+#  (Optional) Maximum total number of open connections to every memcached
+#  server. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_socket_timeout*]
+#  (Optional) Number of seconds a connection to memcached is held unused in
+#  the
+#  pool before it is closed. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_unused_timeout*]
+#  (Optional) Number of seconds a connection to memcached is held unused in
+#  the
+#  pool before it is closed. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_secret_key*]
+#  (Optional, mandatory if memcache_security_strategy is defined) This string
+#  is used for key derivation.
+#  Defaults to $::os_service_default.
+#
+# [*memcache_security_strategy*]
+#  (Optional) If defined, indicate whether token data should be authenticated
+#  or
+#  authenticated and encrypted. If MAC, token data is authenticated (with
+#  HMAC)
+#  in the cache. If ENCRYPT, token data is encrypted and authenticated in the
+#  cache. If the value is not one of these options or empty, auth_token will
+#  raise an exception on initialization.
+#  Defaults to $::os_service_default.
+#
+# [*memcache_use_advanced_pool*]
+#  (Optional)  Use the advanced (eventlet safe) memcached client pool. The
+#  advanced pool will only work under python 2.x Boolean value
+#  Defaults to $::os_service_default.
+#
+# [*memcached_servers*]
+#  (Optional) Optionally specify a list of memcached server(s) to use for
+#  caching. If left undefined, tokens will instead be cached in-process.
+#  Defaults to $::os_service_default.
+#
+# [*region_name*]
+#  (Optional) The region in which the identity server can be found.
+#  Defaults to $::os_service_default.
+#
+# [*revocation_cache_time*]
+#  (Optional) Determines the frequency at which the list of revoked tokens is
+#  retrieved from the Identity service (in seconds). A high number of
+#  revocation events combined with a low cache duration may significantly
+#  reduce performance. Only valid for PKI tokens. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*signing_dir*]
+#  (Optional) Directory used to cache files related to PKI tokens.
+#  Defaults to $::os_service_default.
+#
+# [*token_cache_time*]
+#  (Optional) In order to prevent excessive effort spent validating tokens,
+#  the middleware caches previously-seen tokens for a configurable duration
+#  (in seconds). Set to -1 to disable caching completely. Integer value
+#  Defaults to $::os_service_default.
+#
+class cinder::keystone::authtoken(
+  $username                       = 'cinder',
+  $password                       = $::os_service_default,
+  $auth_url                       = 'http://localhost:35357',
+  $project_name                   = 'services',
+  $user_domain_name               = $::os_service_default,
+  $project_domain_name            = $::os_service_default,
+  $insecure                       = $::os_service_default,
+  $auth_section                   = $::os_service_default,
+  $auth_type                      = 'password',
+  $auth_uri                       = 'http://localhost:5000',
+  $auth_version                   = $::os_service_default,
+  $cache                          = $::os_service_default,
+  $cafile                         = $::os_service_default,
+  $certfile                       = $::os_service_default,
+  $check_revocations_for_cached   = $::os_service_default,
+  $delay_auth_decision            = $::os_service_default,
+  $enforce_token_bind             = $::os_service_default,
+  $hash_algorithms                = $::os_service_default,
+  $http_connect_timeout           = $::os_service_default,
+  $http_request_max_retries       = $::os_service_default,
+  $include_service_catalog        = $::os_service_default,
+  $keyfile                        = $::os_service_default,
+  $memcache_pool_conn_get_timeout = $::os_service_default,
+  $memcache_pool_dead_retry       = $::os_service_default,
+  $memcache_pool_maxsize          = $::os_service_default,
+  $memcache_pool_socket_timeout   = $::os_service_default,
+  $memcache_pool_unused_timeout   = $::os_service_default,
+  $memcache_secret_key            = $::os_service_default,
+  $memcache_security_strategy     = $::os_service_default,
+  $memcache_use_advanced_pool     = $::os_service_default,
+  $memcached_servers              = $::os_service_default,
+  $region_name                    = $::os_service_default,
+  $revocation_cache_time          = $::os_service_default,
+  $signing_dir                    = $::os_service_default,
+  $token_cache_time               = $::os_service_default,
+) {
+
+  if is_service_default($password) and ! $::cinder::api::keystone_password {
+    fail('Please set password for cinder service user')
+  }
+
+  $username_real = pick($::cinder::api::keystone_user,$username)
+  $password_real = pick($::cinder::api::keystone_password,$password)
+  $project_name_real = pick($::cinder::api::keystone_tenant,$project_name)
+  $auth_uri_real = pick($::cinder::api::auth_uri,$auth_uri)
+  $auth_url_real = pick($::cinder::api::identity_uri,$auth_url)
+  $memcached_servers_real = pick($::cinder::api::memcached_servers,$memcached_servers)
+
+  keystone::resource::authtoken { 'cinder_config':
+    username                       => $username_real,
+    password                       => $password_real,
+    project_name                   => $project_name_real,
+    auth_url                       => $auth_url_real,
+    auth_uri                       => $auth_uri_real,
+    auth_version                   => $auth_version,
+    auth_type                      => $auth_type,
+    auth_section                   => $auth_section,
+    user_domain_name               => $user_domain_name,
+    project_domain_name            => $project_domain_name,
+    insecure                       => $insecure,
+    cache                          => $cache,
+    cafile                         => $cafile,
+    certfile                       => $certfile,
+    check_revocations_for_cached   => $check_revocations_for_cached,
+    delay_auth_decision            => $delay_auth_decision,
+    enforce_token_bind             => $enforce_token_bind,
+    hash_algorithms                => $hash_algorithms,
+    http_connect_timeout           => $http_connect_timeout,
+    http_request_max_retries       => $http_request_max_retries,
+    include_service_catalog        => $include_service_catalog,
+    keyfile                        => $keyfile,
+    memcache_pool_conn_get_timeout => $memcache_pool_conn_get_timeout,
+    memcache_pool_dead_retry       => $memcache_pool_dead_retry,
+    memcache_pool_maxsize          => $memcache_pool_maxsize,
+    memcache_pool_socket_timeout   => $memcache_pool_socket_timeout,
+    memcache_secret_key            => $memcache_secret_key,
+    memcache_security_strategy     => $memcache_security_strategy,
+    memcache_use_advanced_pool     => $memcache_use_advanced_pool,
+    memcache_pool_unused_timeout   => $memcache_pool_unused_timeout,
+    memcached_servers              => $memcached_servers_real,
+    region_name                    => $region_name,
+    revocation_cache_time          => $revocation_cache_time,
+    signing_dir                    => $signing_dir,
+    token_cache_time               => $token_cache_time,
+  }
+}
+
--- a/releasenotes/notes/authtoken-75874feee752aa5d.yaml
+++ b/releasenotes/notes/authtoken-75874feee752aa5d.yaml
@ -0,0 +1,11 @@
+---
+features:
+  - Configure keystonemiddleware in a consistent way with all options required for Keystone v3.
+deprecations:
+  - cinder::api::auth_type is deprecated, use cinder::keystone::authtoken::auth_type instead.
+  - cinder::api::identity_uri is deprecated, use cinder::keystone::authtoken::auth_url instead.
+  - cinder::api::auth_uri is deprecated, use cinder::keystone::authtoken::auth_uri instead.
+  - cinder::api::keystone_tenant is deprecated, use cinder::keystone::authtoken::project_name instead.
+  - cinder::api::keystone_user is deprecated, use cinder::keystone::authtoken::username instead.
+  - cinder::api::keystone_password is deprecated, use cinder::keystone::authtoken::password instead.
+  - cinder::api::memcached_servers is deprecated, use cinder::keystone::authtoken::memcached_servers instead.
--- a/spec/acceptance/basic_cinder_spec.rb
+++ b/spec/acceptance/basic_cinder_spec.rb
@ -41,9 +41,10 @@ describe 'basic cinder' do
      class { '::cinder::db::mysql':
        password => 'a_big_secret',
      }
+      class { '::cinder::keystone::authtoken':
+        password => 'a_big_secret',
+      }
      class { '::cinder::api':
-        keystone_password   => 'a_big_secret',
-        identity_uri        => 'http://127.0.0.1:35357/',
        default_volume_type => 'iscsi_backend',
        service_name        => 'httpd',
      }
--- a/spec/classes/cinder_api_spec.rb
+++ b/spec/classes/cinder_api_spec.rb
@ -19,9 +19,6 @@ describe 'cinder::api' do
      )}

      it 'should configure cinder api correctly' do
-        is_expected.to contain_cinder_config('DEFAULT/auth_strategy').with(
-         :value => 'keystone'
-        )
        is_expected.to contain_cinder_config('DEFAULT/osapi_volume_listen').with(
         :value => '0.0.0.0'
        )
@ -50,18 +47,18 @@ describe 'cinder::api' do
         :value => '<SERVICE DEFAULT>'
        )
        is_expected.to contain_cinder_config('keystone_authtoken/auth_uri').with(
-         :value => 'http://localhost:5000/'
+         :value => 'http://localhost:5000'
        )
-        is_expected.to contain_cinder_config('keystone_authtoken/identity_uri').with(
-         :value => 'http://localhost:35357/'
+        is_expected.to contain_cinder_config('keystone_authtoken/auth_url').with(
+         :value => 'http://localhost:35357'
        )
-        is_expected.to contain_cinder_config('keystone_authtoken/admin_tenant_name').with(
+        is_expected.to contain_cinder_config('keystone_authtoken/project_name').with(
         :value => 'services'
        )
-        is_expected.to contain_cinder_config('keystone_authtoken/admin_user').with(
+        is_expected.to contain_cinder_config('keystone_authtoken/username').with(
         :value => 'cinder'
        )
-        is_expected.to contain_cinder_config('keystone_authtoken/admin_password').with(
+        is_expected.to contain_cinder_config('keystone_authtoken/password').with(
         :value => 'foo'
        )
        is_expected.to contain_cinder_config('keystone_authtoken/memcached_servers').with_value('<SERVICE DEFAULT>')
@ -88,6 +85,22 @@ describe 'cinder::api' do
      it { is_expected.to contain_cinder_config('DEFAULT/nova_catalog_info').with_value('compute:nova:publicURL') }
    end

+    describe 'without deprecated keystone_authtoken parameters' do
+      let :params do
+        req_params.merge({
+          'keystone_user'   => 'dummy',
+          'keystone_tenant' => 'mytenant',
+          'identity_uri'    => 'https://127.0.0.1:35357/deprecated',
+          'auth_uri'        => 'https://127.0.0.1:5000/deprecated',
+        })
+      end
+
+      it { is_expected.to contain_cinder_config('keystone_authtoken/auth_url').with_value('https://127.0.0.1:35357/deprecated') }
+      it { is_expected.to contain_cinder_config('keystone_authtoken/username').with_value('dummy') }
+      it { is_expected.to contain_cinder_config('keystone_authtoken/project_name').with_value('mytenant') }
+      it { is_expected.to contain_cinder_config('keystone_authtoken/auth_uri').with_value('https://127.0.0.1:5000/deprecated') }
+    end
+
    describe 'with a custom region for nova' do
      let :params do
        req_params.merge({'os_region_name' => 'MyRegion'})
@ -256,7 +269,7 @@ describe 'cinder::api' do
        :provider    => 'shell',
        :tries       => '10',
        :try_sleep   => '2',
-        :command     => 'cinder --os-auth-url http://localhost:5000/ --os-tenant-name services --os-username cinder --os-password foo list',
+        :command     => 'cinder --os-auth-url http://localhost:5000 --os-project-name services --os-username cinder --os-password foo list',
      )}

      it { is_expected.to contain_anchor('create cinder-api anchor').with(
@ -284,20 +297,7 @@ describe 'cinder::api' do
      )}
    end

-    describe "with custom keystone identity_uri and auth_uri" do
-      let :params do
-        req_params.merge({
-          :identity_uri         => 'https://localhost:35357/',
-          :auth_uri             => 'https://localhost:5000/',
-        })
-      end
-      it 'configures identity_uri and auth_uri but deprecates old auth settings' do
-        is_expected.to contain_cinder_config('keystone_authtoken/identity_uri').with_value("https://localhost:35357/")
-        is_expected.to contain_cinder_config('keystone_authtoken/auth_uri').with_value("https://localhost:5000/")
-      end
-    end
-
-    describe "with memcached servers for keystone authtoken" do
+    describe "with deprecated memcached servers for keystone authtoken" do
      let :params do
        req_params.merge({
          :memcached_servers => '1.1.1.1:11211',
--- a/spec/classes/cinder_keystone_authtoken_spec.rb
+++ b/spec/classes/cinder_keystone_authtoken_spec.rb
@ -0,0 +1,145 @@
+require 'spec_helper'
+
+describe 'cinder::keystone::authtoken' do
+
+  let :params do
+    { :password => 'cinder_password', }
+  end
+
+  shared_examples 'cinder authtoken' do
+
+    context 'with default parameters' do
+
+      it 'configure keystone_authtoken' do
+        is_expected.to contain_cinder_config('keystone_authtoken/username').with_value('cinder')
+        is_expected.to contain_cinder_config('keystone_authtoken/password').with_value('cinder_password')
+        is_expected.to contain_cinder_config('keystone_authtoken/auth_url').with_value('http://localhost:35357')
+        is_expected.to contain_cinder_config('keystone_authtoken/project_name').with_value('services')
+        is_expected.to contain_cinder_config('keystone_authtoken/user_domain_name').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/project_domain_name').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/insecure').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/auth_section').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/auth_type').with_value('password')
+        is_expected.to contain_cinder_config('keystone_authtoken/auth_uri').with_value('http://localhost:5000')
+        is_expected.to contain_cinder_config('keystone_authtoken/auth_version').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/cache').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/cafile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/certfile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/check_revocations_for_cached').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/delay_auth_decision').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/enforce_token_bind').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/hash_algorithms').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/http_connect_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/http_request_max_retries').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/include_service_catalog').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/keyfile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_dead_retry').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_maxsize').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_socket_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_unused_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_secret_key').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_security_strategy').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_use_advanced_pool').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/memcached_servers').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/region_name').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/revocation_cache_time').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/signing_dir').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_cinder_config('keystone_authtoken/token_cache_time').with_value('<SERVICE DEFAULT>')
+      end
+    end
+
+    context 'when overriding parameters' do
+      before do
+        params.merge!({
+          :auth_uri                             => 'https://10.0.0.1:9999/',
+          :username                             => 'myuser',
+          :password                             => 'mypasswd',
+          :auth_url                             => 'https://127.0.0.1:35357',
+          :project_name                         => 'service_project',
+          :user_domain_name                     => 'domainX',
+          :project_domain_name                  => 'domainX',
+          :insecure                             => false,
+          :auth_section                         => 'new_section',
+          :auth_type                            => 'password',
+          :auth_version                         => 'v3',
+          :cache                                => 'somevalue',
+          :cafile                               => '/opt/stack/data/cafile.pem',
+          :certfile                             => 'certfile.crt',
+          :check_revocations_for_cached         => false,
+          :delay_auth_decision                  => false,
+          :enforce_token_bind                   => 'permissive',
+          :hash_algorithms                      => 'md5',
+          :http_connect_timeout                 => '300',
+          :http_request_max_retries             => '3',
+          :include_service_catalog              => true,
+          :keyfile                              => 'keyfile',
+          :memcache_pool_conn_get_timeout       => '9',
+          :memcache_pool_dead_retry             => '302',
+          :memcache_pool_maxsize                => '11',
+          :memcache_pool_socket_timeout         => '2',
+          :memcache_pool_unused_timeout         => '61',
+          :memcache_secret_key                  => 'secret_key',
+          :memcache_security_strategy           => 'ENCRYPT',
+          :memcache_use_advanced_pool           => true,
+          :memcached_servers                    => ['memcached01:11211','memcached02:11211'],
+          :region_name                          => 'region2',
+          :revocation_cache_time                => '11',
+          :signing_dir                          => '/var/cache',
+          :token_cache_time                     => '301',
+        })
+      end
+
+      it 'configure keystone_authtoken' do
+        is_expected.to contain_cinder_config('keystone_authtoken/auth_uri').with_value('https://10.0.0.1:9999/')
+        is_expected.to contain_cinder_config('keystone_authtoken/username').with_value(params[:username])
+        is_expected.to contain_cinder_config('keystone_authtoken/password').with_value(params[:password]).with_secret(true)
+        is_expected.to contain_cinder_config('keystone_authtoken/auth_url').with_value(params[:auth_url])
+        is_expected.to contain_cinder_config('keystone_authtoken/project_name').with_value(params[:project_name])
+        is_expected.to contain_cinder_config('keystone_authtoken/user_domain_name').with_value(params[:user_domain_name])
+        is_expected.to contain_cinder_config('keystone_authtoken/project_domain_name').with_value(params[:project_domain_name])
+        is_expected.to contain_cinder_config('keystone_authtoken/insecure').with_value(params[:insecure])
+        is_expected.to contain_cinder_config('keystone_authtoken/auth_section').with_value(params[:auth_section])
+        is_expected.to contain_cinder_config('keystone_authtoken/auth_type').with_value(params[:auth_type])
+        is_expected.to contain_cinder_config('keystone_authtoken/auth_version').with_value(params[:auth_version])
+        is_expected.to contain_cinder_config('keystone_authtoken/cache').with_value(params[:cache])
+        is_expected.to contain_cinder_config('keystone_authtoken/cafile').with_value(params[:cafile])
+        is_expected.to contain_cinder_config('keystone_authtoken/certfile').with_value(params[:certfile])
+        is_expected.to contain_cinder_config('keystone_authtoken/check_revocations_for_cached').with_value(params[:check_revocations_for_cached])
+        is_expected.to contain_cinder_config('keystone_authtoken/delay_auth_decision').with_value(params[:delay_auth_decision])
+        is_expected.to contain_cinder_config('keystone_authtoken/enforce_token_bind').with_value(params[:enforce_token_bind])
+        is_expected.to contain_cinder_config('keystone_authtoken/hash_algorithms').with_value(params[:hash_algorithms])
+        is_expected.to contain_cinder_config('keystone_authtoken/http_connect_timeout').with_value(params[:http_connect_timeout])
+        is_expected.to contain_cinder_config('keystone_authtoken/http_request_max_retries').with_value(params[:http_request_max_retries])
+        is_expected.to contain_cinder_config('keystone_authtoken/include_service_catalog').with_value(params[:include_service_catalog])
+        is_expected.to contain_cinder_config('keystone_authtoken/keyfile').with_value(params[:keyfile])
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value(params[:memcache_pool_conn_get_timeout])
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_dead_retry').with_value(params[:memcache_pool_dead_retry])
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_maxsize').with_value(params[:memcache_pool_maxsize])
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_socket_timeout').with_value(params[:memcache_pool_socket_timeout])
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_unused_timeout').with_value(params[:memcache_pool_unused_timeout])
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_secret_key').with_value(params[:memcache_secret_key])
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_security_strategy').with_value(params[:memcache_security_strategy])
+        is_expected.to contain_cinder_config('keystone_authtoken/memcache_use_advanced_pool').with_value(params[:memcache_use_advanced_pool])
+        is_expected.to contain_cinder_config('keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211')
+        is_expected.to contain_cinder_config('keystone_authtoken/region_name').with_value(params[:region_name])
+        is_expected.to contain_cinder_config('keystone_authtoken/revocation_cache_time').with_value(params[:revocation_cache_time])
+        is_expected.to contain_cinder_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir])
+        is_expected.to contain_cinder_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time])
+      end
+    end
+  end
+
+  on_supported_os({
+    :supported_os => OSDefaults.get_supported_os
+  }).each do |os,facts|
+    context "on #{os}" do
+      let (:facts) do
+        facts.merge!(OSDefaults.get_facts())
+      end
+
+      it_configures 'cinder authtoken'
+    end
+  end
+
+end
--- a/spec/unit/provider/cinder_spec.rb
+++ b/spec/unit/provider/cinder_spec.rb
@ -25,18 +25,18 @@ describe Puppet::Provider::Cinder do
    it 'should read conf file with all sections' do
      creds_hash = {
        'auth_uri'            => 'https://192.168.56.210:35357/v2.0/',
-        'admin_tenant_name'   => 'admin_tenant',
-        'admin_user'          => 'admin',
-        'admin_password'      => 'password',
+        'project_name'        => 'admin_tenant',
+        'username'            => 'admin',
+        'password'            => 'password',
        'project_domain_name' => 'Default',
        'user_domain_name'    => 'Default',
      }
      mock = {
        'keystone_authtoken' => {
-          'auth_uri'          => 'https://192.168.56.210:35357/v2.0/',
-          'admin_tenant_name' => 'admin_tenant',
-          'admin_user'        => 'admin',
-          'admin_password'    => 'password',
+          'auth_uri'     => 'https://192.168.56.210:35357/v2.0/',
+          'project_name' => 'admin_tenant',
+          'username'     => 'admin',
+          'password'     => 'password',
        }
      }
      Puppet::Util::IniConfig::File.expects(:new).returns(mock)