diff --git a/lib/puppet/provider/cinder.rb b/lib/puppet/provider/cinder.rb index ffb98f02..924e8d75 100644 --- a/lib/puppet/provider/cinder.rb +++ b/lib/puppet/provider/cinder.rb @@ -28,9 +28,9 @@ class Puppet::Provider::Cinder < Puppet::Provider::Openstack def self.cinder_request(service, action, error, properties=nil) properties ||= [] - @credentials.username = cinder_credentials['admin_user'] - @credentials.password = cinder_credentials['admin_password'] - @credentials.project_name = cinder_credentials['admin_tenant_name'] + @credentials.username = cinder_credentials['username'] + @credentials.password = cinder_credentials['password'] + @credentials.project_name = cinder_credentials['project_name'] @credentials.auth_url = auth_endpoint if @credentials.version == '3' @credentials.user_domain_name = cinder_credentials['user_domain_name'] @@ -49,8 +49,8 @@ class Puppet::Provider::Cinder < Puppet::Provider::Openstack end def self.get_cinder_credentials - auth_keys = ['auth_uri', 'admin_tenant_name', 'admin_user', - 'admin_password'] + auth_keys = ['auth_uri', 'project_name', 'username', + 'password'] conf = cinder_conf if conf and conf['keystone_authtoken'] and auth_keys.all?{|k| !conf['keystone_authtoken'][k].nil?} diff --git a/manifests/api.pp b/manifests/api.pp index c734067d..1110f724 100644 --- a/manifests/api.pp +++ b/manifests/api.pp @@ -4,21 +4,10 @@ # # === Parameters # -# [*keystone_password*] -# The password to use for authentication (keystone) -# # [*keystone_enabled*] # (optional) Use keystone for authentification # Defaults to true # -# [*keystone_tenant*] -# (optional) The tenant of the auth user -# Defaults to services -# -# [*keystone_user*] -# (optional) The name of the auth user -# Defaults to cinder -# # [*privileged_user*] # (optional) Enables OpenStack privileged account. # Defaults to false. @@ -71,14 +60,6 @@ # (optional) Same as nova_catalog_info, but for admin endpoint. # Defaults to 'compute:Compute Service:adminURL' # -# [*auth_uri*] -# (optional) Public Identity API endpoint. -# Defaults to 'http://localhost:5000/'. -# -# [*identity_uri*] -# (optional) Complete admin Identity API endpoint. -# Defaults to: 'http://localhost:35357/'. -# # [*service_workers*] # (optional) Number of cinder-api workers # Defaults to $::processorcount @@ -118,22 +99,6 @@ # (optional) Whether to validate the service is working after any service refreshes # Defaults to false # -# [*validation_options*] -# (optional) Service validation options -# Should be a hash of options defined in openstacklib::service_validation -# If empty, defaults values are taken from openstacklib function. -# Default command list volumes. -# Require validate set at True. -# Example: -# glance::api::validation_options: -# glance-api: -# command: check_cinder-api.py -# path: /usr/bin:/bin:/usr/sbin:/sbin -# provider: shell -# tries: 5 -# try_sleep: 10 -# Defaults to {} -# # [*sync_db*] # (Optional) Run db sync on the node. # Defaults to true @@ -181,52 +146,89 @@ # (optional) CA certificate file to use to verify connecting clients # Defaults to $::os_service_default # +# DEPRECATED PARAMETERS +# +# [*keystone_tenant*] +# (optional) Deprecated. Use cinder::keystone::authtoken::project_name instead. +# Defaults to undef. +# +# [*keystone_user*] +# (optional) Deprecated. Use cinder::keystone::authtoken::username instead. +# Defaults to undef. +# +# [*keystone_password*] +# (optional) Deprecated. Use cinder::keystone::authtoken::password instead. +# Defaults to undef. +# +# [*identity_uri*] +# (optional) Deprecated. Use cinder::keystone::authtoken::auth_url instead. +# Defaults to undef. +# +# [*auth_uri*] +# (optional) Deprecated. Use cinder::keystone::authtoken::auth_uri instead. +# Defaults to undef. +# # [*memcached_servers*] -# (optinal) a list of memcached server(s) to use for caching. If left -# undefined, tokens will instead be cached in-process. -# Defaults to $::os_service_default. +# (Optional) Deprecated. Use cinder::keystone::authtoken::memcached_servers. +# Defaults to undef. +# +# [*validation_options*] +# (optional) Service validation options +# Should be a hash of options defined in openstacklib::service_validation +# If empty, defaults values are taken from openstacklib function. +# Default command list volumes. +# Require validate set at True. +# Example: +# glance::api::validation_options: +# glance-api: +# command: check_cinder-api.py +# path: /usr/bin:/bin:/usr/sbin:/sbin +# provider: shell +# tries: 5 +# try_sleep: 10 +# Defaults to {} # class cinder::api ( - $keystone_password, - $keystone_enabled = true, - $keystone_tenant = 'services', - $keystone_user = 'cinder', - $auth_uri = 'http://localhost:5000/', - $identity_uri = 'http://localhost:35357/', - $nova_catalog_info = 'compute:Compute Service:publicURL', - $nova_catalog_admin_info = 'compute:Compute Service:adminURL', - $os_region_name = $::os_service_default, - $privileged_user = false, - $os_privileged_user_name = $::os_service_default, - $os_privileged_user_password = $::os_service_default, - $os_privileged_user_tenant = $::os_service_default, - $os_privileged_user_auth_url = $::os_service_default, - $keymgr_api_class = $::os_service_default, - $keymgr_encryption_api_url = $::os_service_default, - $keymgr_encryption_auth_url = $::os_service_default, - $service_workers = $::processorcount, - $package_ensure = 'present', - $bind_host = '0.0.0.0', - $enabled = true, - $manage_service = true, - $ratelimits = $::os_service_default, - $default_volume_type = $::os_service_default, + $keystone_enabled = true, + $nova_catalog_info = 'compute:Compute Service:publicURL', + $nova_catalog_admin_info = 'compute:Compute Service:adminURL', + $os_region_name = $::os_service_default, + $privileged_user = false, + $os_privileged_user_name = $::os_service_default, + $os_privileged_user_password = $::os_service_default, + $os_privileged_user_tenant = $::os_service_default, + $os_privileged_user_auth_url = $::os_service_default, + $keymgr_api_class = $::os_service_default, + $keymgr_encryption_api_url = $::os_service_default, + $keymgr_encryption_auth_url = $::os_service_default, + $service_workers = $::processorcount, + $package_ensure = 'present', + $bind_host = '0.0.0.0', + $enabled = true, + $manage_service = true, + $ratelimits = $::os_service_default, + $default_volume_type = $::os_service_default, $ratelimits_factory = 'cinder.api.v1.limits:RateLimitingMiddleware.factory', - $validate = false, - $sync_db = true, - $public_endpoint = $::os_service_default, - $osapi_volume_base_url = $::os_service_default, - $osapi_max_limit = $::os_service_default, - $service_name = $::cinder::params::api_service, - $enable_proxy_headers_parsing = $::os_service_default, - $use_ssl = false, - $cert_file = $::os_service_default, - $key_file = $::os_service_default, - $ca_file = $::os_service_default, - $memcached_servers = $::os_service_default, + $validate = false, + $sync_db = true, + $public_endpoint = $::os_service_default, + $osapi_volume_base_url = $::os_service_default, + $osapi_max_limit = $::os_service_default, + $service_name = $::cinder::params::api_service, + $enable_proxy_headers_parsing = $::os_service_default, + $use_ssl = false, + $cert_file = $::os_service_default, + $key_file = $::os_service_default, + $ca_file = $::os_service_default, # DEPRECATED PARAMETERS - $validation_options = {}, + $validation_options = {}, + $keystone_tenant = undef, + $keystone_user = undef, + $keystone_password = undef, + $identity_uri = undef, + $auth_uri = undef, + $memcached_servers = undef, ) inherits cinder::params { include ::cinder::params @@ -241,6 +243,25 @@ class cinder::api ( $key_file_real = pick($::cinder::key_file, $key_file) $ca_file_real = pick($::cinder::ca_file, $ca_file) + if $identity_uri { + warning('cinder::api::identity_uri is deprecated, use cinder::keystone::authtoken::auth_url instead.') + } + if $auth_uri { + warning('cinder::api::auth_uri is deprecated, use cinder::keystone::authtoken::auth_uri instead.') + } + if $keystone_tenant { + warning('cinder::api::keystone_tenant is deprecated, use cinder::keystone::authtoken::project_name instead.') + } + if $keystone_user { + warning('cinder::api::keystone_user is deprecated, use cinder::keystone::authtoken::username instead.') + } + if $keystone_password { + warning('cinder::api::keystone_password is deprecated, use cinder::keystone::authtoken::password instead.') + } + if $memcached_servers { + warning('cinder::api::memcached_servers is deprecated, use cinder::keystone::authtoken::memcached_servers instead.') + } + if $use_ssl_real { if is_service_default($cert_file_real) { fail('The cert_file parameter is required when use_ssl is set to true') @@ -343,21 +364,13 @@ class cinder::api ( } cinder_config { - 'keystone_authtoken/auth_uri': value => $auth_uri; - 'keystone_authtoken/identity_uri': value => $identity_uri; - 'keystone_authtoken/memcached_servers': value => join(any2array($memcached_servers), ','); - 'keymgr/api_class': value => $keymgr_api_class; - 'keymgr/encryption_api_url': value => $keymgr_encryption_api_url; - 'keymgr/encryption_auth_url': value => $keymgr_encryption_auth_url; + 'keymgr/api_class': value => $keymgr_api_class; + 'keymgr/encryption_api_url': value => $keymgr_encryption_api_url; + 'keymgr/encryption_auth_url': value => $keymgr_encryption_auth_url; } if $keystone_enabled { - cinder_config { - 'DEFAULT/auth_strategy': value => 'keystone' ; - 'keystone_authtoken/admin_tenant_name': value => $keystone_tenant; - 'keystone_authtoken/admin_user': value => $keystone_user; - 'keystone_authtoken/admin_password': value => $keystone_password, secret => true; - } + include ::cinder::keystone::authtoken } # SSL Options @@ -377,9 +390,12 @@ class cinder::api ( } if $validate { + $keystone_tenant_real = pick($keystone_tenant, $::cinder::keystone::authtoken::project_name) + $keystone_username_real = pick($keystone_user, $::cinder::keystone::authtoken::username) + $keystone_password_real = pick($keystone_password, $::cinder::keystone::authtoken::password) $defaults = { 'cinder-api' => { - 'command' => "cinder --os-auth-url ${auth_uri} --os-tenant-name ${keystone_tenant} --os-username ${keystone_user} --os-password ${keystone_password} list", + 'command' => "cinder --os-auth-url ${::cinder::keystone::authtoken::auth_uri} --os-project-name ${keystone_tenant_real} --os-username ${keystone_username_real} --os-password ${keystone_password_real} list", } } $validation_options_hash = merge ($defaults, $validation_options) diff --git a/manifests/keystone/authtoken.pp b/manifests/keystone/authtoken.pp new file mode 100644 index 00000000..64b95440 --- /dev/null +++ b/manifests/keystone/authtoken.pp @@ -0,0 +1,280 @@ +# class: cinder::keystone::authtoken +# +# Configure the keystone_authtoken section in the configuration file +# +# === Parameters +# +# [*username*] +# (Optional) The name of the service user +# Defaults to 'cinder' +# +# [*password*] +# (Optional) Password to create for the service user +# Defaults to $::os_service_default +# +# [*auth_url*] +# (Optional) The URL to use for authentication. +# Defaults to 'http://localhost:35357'. +# +# [*project_name*] +# (Optional) Service project name +# Defaults to 'services' +# +# [*user_domain_name*] +# (Optional) Name of domain for $username +# Defaults to $::os_service_default +# +# [*project_domain_name*] +# (Optional) Name of domain for $project_name +# Defaults to $::os_service_default +# +# [*insecure*] +# (Optional) If true, explicitly allow TLS without checking server cert +# against any certificate authorities. WARNING: not recommended. Use with +# caution. +# Defaults to $:os_service_default +# +# [*auth_section*] +# (Optional) Config Section from which to load plugin specific options +# Defaults to $::os_service_default. +# +# [*auth_type*] +# (Optional) Authentication type to load +# Defaults to $::os_service_default +# +# [*auth_uri*] +# (Optional) Complete public Identity API endpoint. +# Defaults to 'http://localhost:5000'. +# +# [*auth_version*] +# (Optional) API version of the admin Identity API endpoint. +# Defaults to $::os_service_default. +# +# [*cache*] +# (Optional) Env key for the swift cache. +# Defaults to $::os_service_default. +# +# [*cafile*] +# (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs +# connections. +# Defaults to $::os_service_default. +# +# [*certfile*] +# (Optional) Required if identity server requires client certificate +# Defaults to $::os_service_default. +# +# [*check_revocations_for_cached*] +# (Optional) If true, the revocation list will be checked for cached tokens. +# This requires that PKI tokens are configured on the identity server. +# boolean value. +# Defaults to $::os_service_default. +# +# [*delay_auth_decision*] +# (Optional) Do not handle authorization requests within the middleware, but +# delegate the authorization decision to downstream WSGI components. Boolean +# value +# Defaults to $::os_service_default. +# +# [*enforce_token_bind*] +# (Optional) Used to control the use and type of token binding. Can be set +# to: "disabled" to not check token binding. "permissive" (default) to +# validate binding information if the bind type is of a form known to the +# server and ignore it if not. "strict" like "permissive" but if the bind +# type is unknown the token will be rejected. "required" any form of token +# binding is needed to be allowed. Finally the name of a binding method that +# must be present in tokens. String value. +# Defaults to $::os_service_default. +# +# [*hash_algorithms*] +# (Optional) Hash algorithms to use for hashing PKI tokens. This may be a +# single algorithm or multiple. The algorithms are those supported by Python +# standard hashlib.new(). The hashes will be tried in the order given, so put +# the preferred one first for performance. The result of the first hash will +# be stored in the cache. This will typically be set to multiple values only +# while migrating from a less secure algorithm to a more secure one. Once all +# the old tokens are expired this option should be set to a single value for +# better performance. List value. +# Defaults to $::os_service_default. +# +# [*http_connect_timeout*] +# (Optional) Request timeout value for communicating with Identity API +# server. +# Defaults to $::os_service_default. +# +# [*http_request_max_retries*] +# (Optional) How many times are we trying to reconnect when communicating +# with Identity API Server. Integer value +# Defaults to $::os_service_default. +# +# [*include_service_catalog*] +# (Optional) Indicate whether to set the X-Service-Catalog header. If False, +# middleware will not ask for service catalog on token validation and will +# not +# set the X-Service-Catalog header. Boolean value. +# Defaults to $::os_service_default. +# +# [*keyfile*] +# (Optional) Required if identity server requires client certificate +# Defaults to $::os_service_default. +# +# [*memcache_pool_conn_get_timeout*] +# (Optional) Number of seconds that an operation will wait to get a memcached +# client connection from the pool. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_dead_retry*] +# (Optional) Number of seconds memcached server is considered dead before it +# is tried again. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_maxsize*] +# (Optional) Maximum total number of open connections to every memcached +# server. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_socket_timeout*] +# (Optional) Number of seconds a connection to memcached is held unused in +# the +# pool before it is closed. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_unused_timeout*] +# (Optional) Number of seconds a connection to memcached is held unused in +# the +# pool before it is closed. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_secret_key*] +# (Optional, mandatory if memcache_security_strategy is defined) This string +# is used for key derivation. +# Defaults to $::os_service_default. +# +# [*memcache_security_strategy*] +# (Optional) If defined, indicate whether token data should be authenticated +# or +# authenticated and encrypted. If MAC, token data is authenticated (with +# HMAC) +# in the cache. If ENCRYPT, token data is encrypted and authenticated in the +# cache. If the value is not one of these options or empty, auth_token will +# raise an exception on initialization. +# Defaults to $::os_service_default. +# +# [*memcache_use_advanced_pool*] +# (Optional) Use the advanced (eventlet safe) memcached client pool. The +# advanced pool will only work under python 2.x Boolean value +# Defaults to $::os_service_default. +# +# [*memcached_servers*] +# (Optional) Optionally specify a list of memcached server(s) to use for +# caching. If left undefined, tokens will instead be cached in-process. +# Defaults to $::os_service_default. +# +# [*region_name*] +# (Optional) The region in which the identity server can be found. +# Defaults to $::os_service_default. +# +# [*revocation_cache_time*] +# (Optional) Determines the frequency at which the list of revoked tokens is +# retrieved from the Identity service (in seconds). A high number of +# revocation events combined with a low cache duration may significantly +# reduce performance. Only valid for PKI tokens. Integer value +# Defaults to $::os_service_default. +# +# [*signing_dir*] +# (Optional) Directory used to cache files related to PKI tokens. +# Defaults to $::os_service_default. +# +# [*token_cache_time*] +# (Optional) In order to prevent excessive effort spent validating tokens, +# the middleware caches previously-seen tokens for a configurable duration +# (in seconds). Set to -1 to disable caching completely. Integer value +# Defaults to $::os_service_default. +# +class cinder::keystone::authtoken( + $username = 'cinder', + $password = $::os_service_default, + $auth_url = 'http://localhost:35357', + $project_name = 'services', + $user_domain_name = $::os_service_default, + $project_domain_name = $::os_service_default, + $insecure = $::os_service_default, + $auth_section = $::os_service_default, + $auth_type = 'password', + $auth_uri = 'http://localhost:5000', + $auth_version = $::os_service_default, + $cache = $::os_service_default, + $cafile = $::os_service_default, + $certfile = $::os_service_default, + $check_revocations_for_cached = $::os_service_default, + $delay_auth_decision = $::os_service_default, + $enforce_token_bind = $::os_service_default, + $hash_algorithms = $::os_service_default, + $http_connect_timeout = $::os_service_default, + $http_request_max_retries = $::os_service_default, + $include_service_catalog = $::os_service_default, + $keyfile = $::os_service_default, + $memcache_pool_conn_get_timeout = $::os_service_default, + $memcache_pool_dead_retry = $::os_service_default, + $memcache_pool_maxsize = $::os_service_default, + $memcache_pool_socket_timeout = $::os_service_default, + $memcache_pool_unused_timeout = $::os_service_default, + $memcache_secret_key = $::os_service_default, + $memcache_security_strategy = $::os_service_default, + $memcache_use_advanced_pool = $::os_service_default, + $memcached_servers = $::os_service_default, + $region_name = $::os_service_default, + $revocation_cache_time = $::os_service_default, + $signing_dir = $::os_service_default, + $token_cache_time = $::os_service_default, +) { + + if is_service_default($password) and ! $::cinder::api::keystone_password { + fail('Please set password for cinder service user') + } + + $username_real = pick($::cinder::api::keystone_user,$username) + $password_real = pick($::cinder::api::keystone_password,$password) + $project_name_real = pick($::cinder::api::keystone_tenant,$project_name) + $auth_uri_real = pick($::cinder::api::auth_uri,$auth_uri) + $auth_url_real = pick($::cinder::api::identity_uri,$auth_url) + $memcached_servers_real = pick($::cinder::api::memcached_servers,$memcached_servers) + + keystone::resource::authtoken { 'cinder_config': + username => $username_real, + password => $password_real, + project_name => $project_name_real, + auth_url => $auth_url_real, + auth_uri => $auth_uri_real, + auth_version => $auth_version, + auth_type => $auth_type, + auth_section => $auth_section, + user_domain_name => $user_domain_name, + project_domain_name => $project_domain_name, + insecure => $insecure, + cache => $cache, + cafile => $cafile, + certfile => $certfile, + check_revocations_for_cached => $check_revocations_for_cached, + delay_auth_decision => $delay_auth_decision, + enforce_token_bind => $enforce_token_bind, + hash_algorithms => $hash_algorithms, + http_connect_timeout => $http_connect_timeout, + http_request_max_retries => $http_request_max_retries, + include_service_catalog => $include_service_catalog, + keyfile => $keyfile, + memcache_pool_conn_get_timeout => $memcache_pool_conn_get_timeout, + memcache_pool_dead_retry => $memcache_pool_dead_retry, + memcache_pool_maxsize => $memcache_pool_maxsize, + memcache_pool_socket_timeout => $memcache_pool_socket_timeout, + memcache_secret_key => $memcache_secret_key, + memcache_security_strategy => $memcache_security_strategy, + memcache_use_advanced_pool => $memcache_use_advanced_pool, + memcache_pool_unused_timeout => $memcache_pool_unused_timeout, + memcached_servers => $memcached_servers_real, + region_name => $region_name, + revocation_cache_time => $revocation_cache_time, + signing_dir => $signing_dir, + token_cache_time => $token_cache_time, + } +} + diff --git a/releasenotes/notes/authtoken-75874feee752aa5d.yaml b/releasenotes/notes/authtoken-75874feee752aa5d.yaml new file mode 100644 index 00000000..e61b433d --- /dev/null +++ b/releasenotes/notes/authtoken-75874feee752aa5d.yaml @@ -0,0 +1,11 @@ +--- +features: + - Configure keystonemiddleware in a consistent way with all options required for Keystone v3. +deprecations: + - cinder::api::auth_type is deprecated, use cinder::keystone::authtoken::auth_type instead. + - cinder::api::identity_uri is deprecated, use cinder::keystone::authtoken::auth_url instead. + - cinder::api::auth_uri is deprecated, use cinder::keystone::authtoken::auth_uri instead. + - cinder::api::keystone_tenant is deprecated, use cinder::keystone::authtoken::project_name instead. + - cinder::api::keystone_user is deprecated, use cinder::keystone::authtoken::username instead. + - cinder::api::keystone_password is deprecated, use cinder::keystone::authtoken::password instead. + - cinder::api::memcached_servers is deprecated, use cinder::keystone::authtoken::memcached_servers instead. diff --git a/spec/acceptance/basic_cinder_spec.rb b/spec/acceptance/basic_cinder_spec.rb index d2e4c477..f1bf3c6b 100644 --- a/spec/acceptance/basic_cinder_spec.rb +++ b/spec/acceptance/basic_cinder_spec.rb @@ -41,9 +41,10 @@ describe 'basic cinder' do class { '::cinder::db::mysql': password => 'a_big_secret', } + class { '::cinder::keystone::authtoken': + password => 'a_big_secret', + } class { '::cinder::api': - keystone_password => 'a_big_secret', - identity_uri => 'http://127.0.0.1:35357/', default_volume_type => 'iscsi_backend', service_name => 'httpd', } diff --git a/spec/classes/cinder_api_spec.rb b/spec/classes/cinder_api_spec.rb index 400fb82b..efcc68e1 100644 --- a/spec/classes/cinder_api_spec.rb +++ b/spec/classes/cinder_api_spec.rb @@ -19,9 +19,6 @@ describe 'cinder::api' do )} it 'should configure cinder api correctly' do - is_expected.to contain_cinder_config('DEFAULT/auth_strategy').with( - :value => 'keystone' - ) is_expected.to contain_cinder_config('DEFAULT/osapi_volume_listen').with( :value => '0.0.0.0' ) @@ -50,18 +47,18 @@ describe 'cinder::api' do :value => '' ) is_expected.to contain_cinder_config('keystone_authtoken/auth_uri').with( - :value => 'http://localhost:5000/' + :value => 'http://localhost:5000' ) - is_expected.to contain_cinder_config('keystone_authtoken/identity_uri').with( - :value => 'http://localhost:35357/' + is_expected.to contain_cinder_config('keystone_authtoken/auth_url').with( + :value => 'http://localhost:35357' ) - is_expected.to contain_cinder_config('keystone_authtoken/admin_tenant_name').with( + is_expected.to contain_cinder_config('keystone_authtoken/project_name').with( :value => 'services' ) - is_expected.to contain_cinder_config('keystone_authtoken/admin_user').with( + is_expected.to contain_cinder_config('keystone_authtoken/username').with( :value => 'cinder' ) - is_expected.to contain_cinder_config('keystone_authtoken/admin_password').with( + is_expected.to contain_cinder_config('keystone_authtoken/password').with( :value => 'foo' ) is_expected.to contain_cinder_config('keystone_authtoken/memcached_servers').with_value('') @@ -88,6 +85,22 @@ describe 'cinder::api' do it { is_expected.to contain_cinder_config('DEFAULT/nova_catalog_info').with_value('compute:nova:publicURL') } end + describe 'without deprecated keystone_authtoken parameters' do + let :params do + req_params.merge({ + 'keystone_user' => 'dummy', + 'keystone_tenant' => 'mytenant', + 'identity_uri' => 'https://127.0.0.1:35357/deprecated', + 'auth_uri' => 'https://127.0.0.1:5000/deprecated', + }) + end + + it { is_expected.to contain_cinder_config('keystone_authtoken/auth_url').with_value('https://127.0.0.1:35357/deprecated') } + it { is_expected.to contain_cinder_config('keystone_authtoken/username').with_value('dummy') } + it { is_expected.to contain_cinder_config('keystone_authtoken/project_name').with_value('mytenant') } + it { is_expected.to contain_cinder_config('keystone_authtoken/auth_uri').with_value('https://127.0.0.1:5000/deprecated') } + end + describe 'with a custom region for nova' do let :params do req_params.merge({'os_region_name' => 'MyRegion'}) @@ -256,7 +269,7 @@ describe 'cinder::api' do :provider => 'shell', :tries => '10', :try_sleep => '2', - :command => 'cinder --os-auth-url http://localhost:5000/ --os-tenant-name services --os-username cinder --os-password foo list', + :command => 'cinder --os-auth-url http://localhost:5000 --os-project-name services --os-username cinder --os-password foo list', )} it { is_expected.to contain_anchor('create cinder-api anchor').with( @@ -284,20 +297,7 @@ describe 'cinder::api' do )} end - describe "with custom keystone identity_uri and auth_uri" do - let :params do - req_params.merge({ - :identity_uri => 'https://localhost:35357/', - :auth_uri => 'https://localhost:5000/', - }) - end - it 'configures identity_uri and auth_uri but deprecates old auth settings' do - is_expected.to contain_cinder_config('keystone_authtoken/identity_uri').with_value("https://localhost:35357/") - is_expected.to contain_cinder_config('keystone_authtoken/auth_uri').with_value("https://localhost:5000/") - end - end - - describe "with memcached servers for keystone authtoken" do + describe "with deprecated memcached servers for keystone authtoken" do let :params do req_params.merge({ :memcached_servers => '1.1.1.1:11211', diff --git a/spec/classes/cinder_keystone_authtoken_spec.rb b/spec/classes/cinder_keystone_authtoken_spec.rb new file mode 100644 index 00000000..7ce0e2c1 --- /dev/null +++ b/spec/classes/cinder_keystone_authtoken_spec.rb @@ -0,0 +1,145 @@ +require 'spec_helper' + +describe 'cinder::keystone::authtoken' do + + let :params do + { :password => 'cinder_password', } + end + + shared_examples 'cinder authtoken' do + + context 'with default parameters' do + + it 'configure keystone_authtoken' do + is_expected.to contain_cinder_config('keystone_authtoken/username').with_value('cinder') + is_expected.to contain_cinder_config('keystone_authtoken/password').with_value('cinder_password') + is_expected.to contain_cinder_config('keystone_authtoken/auth_url').with_value('http://localhost:35357') + is_expected.to contain_cinder_config('keystone_authtoken/project_name').with_value('services') + is_expected.to contain_cinder_config('keystone_authtoken/user_domain_name').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/project_domain_name').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/insecure').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/auth_section').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/auth_type').with_value('password') + is_expected.to contain_cinder_config('keystone_authtoken/auth_uri').with_value('http://localhost:5000') + is_expected.to contain_cinder_config('keystone_authtoken/auth_version').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/cache').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/cafile').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/certfile').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/check_revocations_for_cached').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/delay_auth_decision').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/enforce_token_bind').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/hash_algorithms').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/http_connect_timeout').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/http_request_max_retries').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/include_service_catalog').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/keyfile').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_dead_retry').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_maxsize').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_socket_timeout').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_unused_timeout').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/memcache_secret_key').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/memcache_security_strategy').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/memcache_use_advanced_pool').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/memcached_servers').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/region_name').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/revocation_cache_time').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/signing_dir').with_value('') + is_expected.to contain_cinder_config('keystone_authtoken/token_cache_time').with_value('') + end + end + + context 'when overriding parameters' do + before do + params.merge!({ + :auth_uri => 'https://10.0.0.1:9999/', + :username => 'myuser', + :password => 'mypasswd', + :auth_url => 'https://127.0.0.1:35357', + :project_name => 'service_project', + :user_domain_name => 'domainX', + :project_domain_name => 'domainX', + :insecure => false, + :auth_section => 'new_section', + :auth_type => 'password', + :auth_version => 'v3', + :cache => 'somevalue', + :cafile => '/opt/stack/data/cafile.pem', + :certfile => 'certfile.crt', + :check_revocations_for_cached => false, + :delay_auth_decision => false, + :enforce_token_bind => 'permissive', + :hash_algorithms => 'md5', + :http_connect_timeout => '300', + :http_request_max_retries => '3', + :include_service_catalog => true, + :keyfile => 'keyfile', + :memcache_pool_conn_get_timeout => '9', + :memcache_pool_dead_retry => '302', + :memcache_pool_maxsize => '11', + :memcache_pool_socket_timeout => '2', + :memcache_pool_unused_timeout => '61', + :memcache_secret_key => 'secret_key', + :memcache_security_strategy => 'ENCRYPT', + :memcache_use_advanced_pool => true, + :memcached_servers => ['memcached01:11211','memcached02:11211'], + :region_name => 'region2', + :revocation_cache_time => '11', + :signing_dir => '/var/cache', + :token_cache_time => '301', + }) + end + + it 'configure keystone_authtoken' do + is_expected.to contain_cinder_config('keystone_authtoken/auth_uri').with_value('https://10.0.0.1:9999/') + is_expected.to contain_cinder_config('keystone_authtoken/username').with_value(params[:username]) + is_expected.to contain_cinder_config('keystone_authtoken/password').with_value(params[:password]).with_secret(true) + is_expected.to contain_cinder_config('keystone_authtoken/auth_url').with_value(params[:auth_url]) + is_expected.to contain_cinder_config('keystone_authtoken/project_name').with_value(params[:project_name]) + is_expected.to contain_cinder_config('keystone_authtoken/user_domain_name').with_value(params[:user_domain_name]) + is_expected.to contain_cinder_config('keystone_authtoken/project_domain_name').with_value(params[:project_domain_name]) + is_expected.to contain_cinder_config('keystone_authtoken/insecure').with_value(params[:insecure]) + is_expected.to contain_cinder_config('keystone_authtoken/auth_section').with_value(params[:auth_section]) + is_expected.to contain_cinder_config('keystone_authtoken/auth_type').with_value(params[:auth_type]) + is_expected.to contain_cinder_config('keystone_authtoken/auth_version').with_value(params[:auth_version]) + is_expected.to contain_cinder_config('keystone_authtoken/cache').with_value(params[:cache]) + is_expected.to contain_cinder_config('keystone_authtoken/cafile').with_value(params[:cafile]) + is_expected.to contain_cinder_config('keystone_authtoken/certfile').with_value(params[:certfile]) + is_expected.to contain_cinder_config('keystone_authtoken/check_revocations_for_cached').with_value(params[:check_revocations_for_cached]) + is_expected.to contain_cinder_config('keystone_authtoken/delay_auth_decision').with_value(params[:delay_auth_decision]) + is_expected.to contain_cinder_config('keystone_authtoken/enforce_token_bind').with_value(params[:enforce_token_bind]) + is_expected.to contain_cinder_config('keystone_authtoken/hash_algorithms').with_value(params[:hash_algorithms]) + is_expected.to contain_cinder_config('keystone_authtoken/http_connect_timeout').with_value(params[:http_connect_timeout]) + is_expected.to contain_cinder_config('keystone_authtoken/http_request_max_retries').with_value(params[:http_request_max_retries]) + is_expected.to contain_cinder_config('keystone_authtoken/include_service_catalog').with_value(params[:include_service_catalog]) + is_expected.to contain_cinder_config('keystone_authtoken/keyfile').with_value(params[:keyfile]) + is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value(params[:memcache_pool_conn_get_timeout]) + is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_dead_retry').with_value(params[:memcache_pool_dead_retry]) + is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_maxsize').with_value(params[:memcache_pool_maxsize]) + is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_socket_timeout').with_value(params[:memcache_pool_socket_timeout]) + is_expected.to contain_cinder_config('keystone_authtoken/memcache_pool_unused_timeout').with_value(params[:memcache_pool_unused_timeout]) + is_expected.to contain_cinder_config('keystone_authtoken/memcache_secret_key').with_value(params[:memcache_secret_key]) + is_expected.to contain_cinder_config('keystone_authtoken/memcache_security_strategy').with_value(params[:memcache_security_strategy]) + is_expected.to contain_cinder_config('keystone_authtoken/memcache_use_advanced_pool').with_value(params[:memcache_use_advanced_pool]) + is_expected.to contain_cinder_config('keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211') + is_expected.to contain_cinder_config('keystone_authtoken/region_name').with_value(params[:region_name]) + is_expected.to contain_cinder_config('keystone_authtoken/revocation_cache_time').with_value(params[:revocation_cache_time]) + is_expected.to contain_cinder_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir]) + is_expected.to contain_cinder_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time]) + end + end + end + + on_supported_os({ + :supported_os => OSDefaults.get_supported_os + }).each do |os,facts| + context "on #{os}" do + let (:facts) do + facts.merge!(OSDefaults.get_facts()) + end + + it_configures 'cinder authtoken' + end + end + +end diff --git a/spec/unit/provider/cinder_spec.rb b/spec/unit/provider/cinder_spec.rb index 246ae58d..dcc9dbb7 100644 --- a/spec/unit/provider/cinder_spec.rb +++ b/spec/unit/provider/cinder_spec.rb @@ -25,18 +25,18 @@ describe Puppet::Provider::Cinder do it 'should read conf file with all sections' do creds_hash = { 'auth_uri' => 'https://192.168.56.210:35357/v2.0/', - 'admin_tenant_name' => 'admin_tenant', - 'admin_user' => 'admin', - 'admin_password' => 'password', + 'project_name' => 'admin_tenant', + 'username' => 'admin', + 'password' => 'password', 'project_domain_name' => 'Default', 'user_domain_name' => 'Default', } mock = { 'keystone_authtoken' => { - 'auth_uri' => 'https://192.168.56.210:35357/v2.0/', - 'admin_tenant_name' => 'admin_tenant', - 'admin_user' => 'admin', - 'admin_password' => 'password', + 'auth_uri' => 'https://192.168.56.210:35357/v2.0/', + 'project_name' => 'admin_tenant', + 'username' => 'admin', + 'password' => 'password', } } Puppet::Util::IniConfig::File.expects(:new).returns(mock)