From 1e09e553edf091f53b3bbfe667630adc236cf223 Mon Sep 17 00:00:00 2001 From: Denis Egorenko Date: Fri, 29 Jul 2016 13:12:29 +0300 Subject: [PATCH] Move Glance to new authtoken scheme Use glance::::authtoken to configure keystone_authtoken section in glance configs, with all parameters required to configure keystonemiddleware. Also changed auth_type to auth_strategy, because auth_type is related to keystone authentication. Change-Id: I722a1e41b2cee0b3040c37f07adfd13c33edaa5c Closes-bug: #1604463 --- lib/puppet/provider/glance.rb | 38 +-- manifests/api.pp | 167 +++++++---- manifests/api/authtoken.pp | 282 ++++++++++++++++++ manifests/glare.pp | 161 ++++++---- manifests/glare/authtoken.pp | 282 ++++++++++++++++++ manifests/registry.pp | 157 ++++++---- manifests/registry/authtoken.pp | 282 ++++++++++++++++++ .../notes/authtoken-2439e462e0a84399.yaml | 25 ++ spec/acceptance/basic_glance_spec.rb | 13 +- spec/classes/glance_api_authtoken_spec.rb | 145 +++++++++ spec/classes/glance_api_spec.rb | 71 +++-- spec/classes/glance_glare_authtoken_spec.rb | 145 +++++++++ spec/classes/glance_glare_spec.rb | 44 +-- .../classes/glance_registry_authtoken_spec.rb | 145 +++++++++ spec/classes/glance_registry_spec.rb | 53 ++-- 15 files changed, 1728 insertions(+), 282 deletions(-) create mode 100644 manifests/api/authtoken.pp create mode 100644 manifests/glare/authtoken.pp create mode 100644 manifests/registry/authtoken.pp create mode 100644 releasenotes/notes/authtoken-2439e462e0a84399.yaml create mode 100644 spec/classes/glance_api_authtoken_spec.rb create mode 100644 spec/classes/glance_glare_authtoken_spec.rb create mode 100644 spec/classes/glance_registry_authtoken_spec.rb diff --git a/lib/puppet/provider/glance.rb b/lib/puppet/provider/glance.rb index a34944f8..caadfcc9 100644 --- a/lib/puppet/provider/glance.rb +++ b/lib/puppet/provider/glance.rb @@ -18,9 +18,9 @@ class Puppet::Provider::Glance < Puppet::Provider::Openstack end def self.glance_request(service, action, error, properties=nil) - @credentials.username = glance_credentials['admin_user'] - @credentials.password = glance_credentials['admin_password'] - @credentials.project_name = glance_credentials['admin_tenant_name'] + @credentials.username = glance_credentials['username'] + @credentials.password = glance_credentials['password'] + @credentials.project_name = glance_credentials['project_name'] @credentials.auth_url = auth_endpoint raise error unless @credentials.set? Puppet::Provider::Openstack.request(service, action, properties, @credentials) @@ -35,18 +35,18 @@ class Puppet::Provider::Glance < Puppet::Provider::Openstack glance_file['keystone_authtoken']['auth_host'] and glance_file['keystone_authtoken']['auth_port'] and glance_file['keystone_authtoken']['auth_protocol'] and - glance_file['keystone_authtoken']['admin_tenant_name'] and - glance_file['keystone_authtoken']['admin_user'] and - glance_file['keystone_authtoken']['admin_password'] and + glance_file['keystone_authtoken']['project_name'] and + glance_file['keystone_authtoken']['username'] and + glance_file['keystone_authtoken']['password'] and glance_file['glance_store']['os_region_name'] g = {} g['auth_host'] = glance_file['keystone_authtoken']['auth_host'].strip g['auth_port'] = glance_file['keystone_authtoken']['auth_port'].strip g['auth_protocol'] = glance_file['keystone_authtoken']['auth_protocol'].strip - g['admin_tenant_name'] = glance_file['keystone_authtoken']['admin_tenant_name'].strip - g['admin_user'] = glance_file['keystone_authtoken']['admin_user'].strip - g['admin_password'] = glance_file['keystone_authtoken']['admin_password'].strip + g['project_name'] = glance_file['keystone_authtoken']['project_name'].strip + g['username'] = glance_file['keystone_authtoken']['username'].strip + g['password'] = glance_file['keystone_authtoken']['password'].strip g['os_region_name'] = glance_file['glance_store']['os_region_name'].strip # auth_admin_prefix not required to be set. @@ -54,17 +54,17 @@ class Puppet::Provider::Glance < Puppet::Provider::Openstack return g elsif glance_file and glance_file['keystone_authtoken'] and - glance_file['keystone_authtoken']['identity_uri'] and - glance_file['keystone_authtoken']['admin_tenant_name'] and - glance_file['keystone_authtoken']['admin_user'] and - glance_file['keystone_authtoken']['admin_password'] and + glance_file['keystone_authtoken']['auth_url'] and + glance_file['keystone_authtoken']['project_name'] and + glance_file['keystone_authtoken']['username'] and + glance_file['keystone_authtoken']['password'] and glance_file['glance_store']['os_region_name'] g = {} - g['identity_uri'] = glance_file['keystone_authtoken']['identity_uri'].strip - g['admin_tenant_name'] = glance_file['keystone_authtoken']['admin_tenant_name'].strip - g['admin_user'] = glance_file['keystone_authtoken']['admin_user'].strip - g['admin_password'] = glance_file['keystone_authtoken']['admin_password'].strip + g['auth_url'] = glance_file['keystone_authtoken']['auth_url'].strip + g['project_name'] = glance_file['keystone_authtoken']['project_name'].strip + g['username'] = glance_file['keystone_authtoken']['username'].strip + g['password'] = glance_file['keystone_authtoken']['password'].strip g['os_region_name'] = glance_file['glance_store']['os_region_name'].strip return g @@ -79,8 +79,8 @@ class Puppet::Provider::Glance < Puppet::Provider::Openstack def self.get_auth_endpoint g = glance_credentials - if g.key?('identity_uri') - "#{g['identity_uri']}/" + if g.key?('auth_url') + "#{g['auth_url']}/" else "#{g['auth_protocol']}://#{g['auth_host']}:#{g['auth_port']}#{g['auth_admin_prefix']}/v2.0/" end diff --git a/manifests/api.pp b/manifests/api.pp index 97c5bf4e..b4bc9a8b 100644 --- a/manifests/api.pp +++ b/manifests/api.pp @@ -4,9 +4,6 @@ # # == Parameters # -# [*keystone_password*] -# (required) Password used to authentication. -# # [*package_ensure*] # (optional) Ensure state for package. On RedHat platforms this # setting is ignored and the setting from the glance class is used @@ -62,31 +59,15 @@ # (optional) Turn on/off delayed delete. # Defaults to $::os_service_default. # -# [*auth_type*] +# [*auth_strategy*] # (optional) Type is authorization being used. # Defaults to 'keystone' # -# [*auth_uri*] -# (optional) Complete public Identity API endpoint. -# Defaults to 'http://127.0.0.1:5000/'. -# -# [*identity_uri*] -# (optional) Complete admin Identity API endpoint. -# Defaults to 'http://127.0.0.1:35357/'. -# # [*pipeline*] # (optional) Partial name of a pipeline in your paste configuration file with the # service name removed. # Defaults to 'keystone'. # -# [*keystone_tenant*] -# (optional) Tenant to authenticate to. -# Defaults to services. -# -# [*keystone_user*] -# (optional) User to authenticate as with keystone. -# Defaults to 'glance'. -# # [*manage_service*] # (optional) If Puppet should manage service startup / shutdown. # Defaults to true. @@ -213,21 +194,6 @@ # (optional) Sets the keystone region to use. # Defaults to 'RegionOne'. # -# [*signing_dir*] -# (optional) Directory used to cache files related to PKI tokens. -# Defaults to $::os_service_default. -# -# [*memcached_servers*] -# (optinal) a list of memcached server(s) to use for caching. If left undefined, -# tokens will instead be cached in-process. -# Defaults to $::os_service_default. -# -# [*token_cache_time*] -# (optional) In order to prevent excessive effort spent validating tokens, -# the middleware caches previously-seen tokens for a configurable duration (in seconds). -# Set to -1 to disable caching completely. -# Defaults to $::os_service_default. -# # [*enable_proxy_headers_parsing*] # (Optional) Enable paste middleware to handle SSL requests through # HTTPProxyToWSGI middleware. @@ -272,8 +238,55 @@ # then region name can be specified. # Defaults to undef # +# [*keystone_password*] +# (Optional) Password used to authentication. +# Deprecated and will be replaced by ::glance::api::authtoken::password +# Defaults to undef. +# +# [*auth_type*] +# (optional) Type is authorization being used. +# Deprecated and replaced by ::glance::api::auth_strategy +# Defaults to undef. +# +# [*auth_uri*] +# (optional) Complete public Identity API endpoint. +# Deprecated and will be replaced by ::glance::api::authtoken::auth_uri +# Defaults to undef. +# +# [*identity_uri*] +# (optional) Complete admin Identity API endpoint. +# Deprecated and will be replaced by ::glance::api::authtoken::auth_url +# Defaults to undef. +# +# [*keystone_tenant*] +# (optional) Tenant to authenticate to. +# Deprecated and will be replaced by ::glance::api::authtoken::project_name +# Defaults to undef. +# +# [*keystone_user*] +# (optional) User to authenticate as with keystone. +# Deprecated and will be replaced by ::glance::api::authtoken::username +# Defaults to undef. +# +# [*signing_dir*] +# (optional) Directory used to cache files related to PKI tokens. +# Deprecated and will be replaced by ::glance::api::authtoken::signing_dir +# Defaults to undef. +# +# [*memcached_servers*] +# (optinal) a list of memcached server(s) to use for caching. If left undefined, +# tokens will instead be cached in-process. +# Deprecated and will be replaced by ::glance::api::authtoken::memcached_servers +# Defaults to undef. +# +# [*token_cache_time*] +# (optional) In order to prevent excessive effort spent validating tokens, +# the middleware caches previously-seen tokens for a configurable duration (in seconds). +# Set to -1 to disable caching completely. +# Deprecated and will be replaced by ::glance::api::authtoken::token_cache_time +# Defaults to undef. +# class glance::api( - $keystone_password, $package_ensure = 'present', $debug = undef, $bind_host = $::os_service_default, @@ -287,13 +300,8 @@ class glance::api( $registry_client_protocol = $::os_service_default, $scrub_time = $::os_service_default, $delayed_delete = $::os_service_default, - $auth_type = 'keystone', - $auth_uri = 'http://127.0.0.1:5000/', - $identity_uri = 'http://127.0.0.1:35357/', - $memcached_servers = $::os_service_default, + $auth_strategy = 'keystone', $pipeline = 'keystone', - $keystone_tenant = 'services', - $keystone_user = 'glance', $manage_service = true, $enabled = true, $use_syslog = undef, @@ -323,8 +331,6 @@ class glance::api( $image_cache_stall_time = $::os_service_default, $image_cache_dir = '/var/lib/glance/image-cache', $os_region_name = 'RegionOne', - $signing_dir = $::os_service_default, - $token_cache_time = $::os_service_default, $enable_proxy_headers_parsing = $::os_service_default, $validate = false, $validation_options = {}, @@ -332,6 +338,15 @@ class glance::api( $known_stores = false, $verbose = undef, $auth_region = undef, + $keystone_password = undef, + $auth_type = undef, + $auth_uri = undef, + $identity_uri = undef, + $keystone_tenant = undef, + $keystone_user = undef, + $memcached_servers = undef, + $signing_dir = undef, + $token_cache_time = undef, ) inherits glance { include ::glance::deps @@ -348,6 +363,45 @@ class glance::api( warning('auth_region is deprecated, has no effect and and will be removed in the O release.') } + if $keystone_password { + warning('glance::api::keystone_password is deprecated, please use glance::api::authtoken::password') + } + + if $auth_type { + warning('glance::api::auth_type is deprecated, please use glance::api::auth_strategy') + $auth_strategy_real = $auth_type + } else { + $auth_strategy_real = $auth_strategy + } + + if $auth_uri { + warning('glance::api::auth_uri is deprecated, please use glance::api::authtoken::auth_uri') + } + + if $identity_uri { + warning('glance::api::identity_uri is deprecated, please use glance::api::authtoken::auth_url') + } + + if $keystone_tenant { + warning('glance::api::keystone_tenant is deprecated, please use glance::api::authtoken::project_name') + } + + if $keystone_user { + warning('glance::api::keystone_user is deprecated, please use glance::api::authtoken::username') + } + + if $memcached_servers { + warning('glance::api::memcached_servers is deprecated, please use glance::api::authtoken::memcached_servers') + } + + if $signing_dir { + warning('glance::api::signing_dir is deprecated, please use glance::api::authtoken::signing_dir') + } + + if $token_cache_time { + warning('glance::api::token_cache_time is deprecated, please use glance::api::authtoken::token_cache_time') + } + if ( $glance::params::api_package_name != $glance::params::registry_package_name ) { ensure_packages('glance-api', { @@ -459,23 +513,8 @@ class glance::api( } # keystone config - if $auth_type == 'keystone' { - glance_api_config { - 'keystone_authtoken/admin_tenant_name': value => $keystone_tenant; - 'keystone_authtoken/admin_user': value => $keystone_user; - 'keystone_authtoken/admin_password': value => $keystone_password, secret => true; - 'keystone_authtoken/token_cache_time': value => $token_cache_time; - 'keystone_authtoken/signing_dir': value => $signing_dir; - 'keystone_authtoken/auth_uri': value => $auth_uri; - 'keystone_authtoken/identity_uri': value => $identity_uri; - 'keystone_authtoken/memcached_servers': value => join(any2array($memcached_servers), ','); - } - glance_cache_config { - 'DEFAULT/auth_url' : value => $auth_uri; - 'DEFAULT/admin_tenant_name': value => $keystone_tenant; - 'DEFAULT/admin_user' : value => $keystone_user; - 'DEFAULT/admin_password' : value => $keystone_password, secret => true; - } + if $auth_strategy_real == 'keystone' { + include ::glance::api::authtoken } oslo::middleware { 'glance_api_config': @@ -510,9 +549,13 @@ class glance::api( } if $validate { + $keystone_tenant_real = pick($keystone_tenant, $::glance::api::authtoken::project_name) + $keystone_username_real = pick($keystone_user, $::glance::api::authtoken::username) + $keystone_password_real = pick($keystone_password, $::glance::api::authtoken::password) + $auth_uri_real = pick($auth_uri, $::glance::api::authtoken::auth_uri) $defaults = { 'glance-api' => { - 'command' => "glance --os-auth-url ${auth_uri} --os-tenant-name ${keystone_tenant} --os-username ${keystone_user} --os-password ${keystone_password} image-list", + 'command' => "glance --os-auth-url ${auth_uri_real} --os-project-name ${keystone_tenant_real} --os-username ${keystone_username_real} --os-password ${keystone_password_real} image-list", } } $validation_options_hash = merge ($defaults, $validation_options) diff --git a/manifests/api/authtoken.pp b/manifests/api/authtoken.pp new file mode 100644 index 00000000..47cd01cc --- /dev/null +++ b/manifests/api/authtoken.pp @@ -0,0 +1,282 @@ +# class: glance::api::authtoken +# +# Configure the keystone_authtoken section in the Glance API configuration file +# +# === Parameters +# +# [*username*] +# (Optional) The name of the service user +# Defaults to 'glance' +# +# [*password*] +# (Optional) Password to create for the service user +# Defaults to $::os_service_default +# +# [*auth_url*] +# (Optional) The URL to use for authentication. +# Defaults to 'http://127.0.0.1:35357' +# +# [*project_name*] +# (Optional) Service project name +# Defaults to 'services' +# +# [*user_domain_name*] +# (Optional) Name of domain for $username +# Defaults to $::os_service_default +# +# [*project_domain_name*] +# (Optional) Name of domain for $project_name +# Defaults to $::os_service_default +# +# [*insecure*] +# (Optional) If true, explicitly allow TLS without checking server cert +# against any certificate authorities. WARNING: not recommended. Use with +# caution. +# Defaults to $:os_service_default +# +# [*auth_section*] +# (Optional) Config Section from which to load plugin specific options +# Defaults to $::os_service_default. +# +# [*auth_type*] +# (Optional) Authentication type to load +# Defaults to 'password' +# +# [*auth_uri*] +# (Optional) Complete public Identity API endpoint. +# Defaults to 'http://127.0.0.1:5000'. +# +# [*auth_version*] +# (Optional) API version of the admin Identity API endpoint. +# Defaults to $::os_service_default. +# +# [*cache*] +# (Optional) Env key for the swift cache. +# Defaults to $::os_service_default. +# +# [*cafile*] +# (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs +# connections. +# Defaults to $::os_service_default. +# +# [*certfile*] +# (Optional) Required if identity server requires client certificate +# Defaults to $::os_service_default. +# +# [*check_revocations_for_cached*] +# (Optional) If true, the revocation list will be checked for cached tokens. +# This requires that PKI tokens are configured on the identity server. +# boolean value. +# Defaults to $::os_service_default. +# +# [*delay_auth_decision*] +# (Optional) Do not handle authorization requests within the middleware, but +# delegate the authorization decision to downstream WSGI components. Boolean +# value +# Defaults to $::os_service_default. +# +# [*enforce_token_bind*] +# (Optional) Used to control the use and type of token binding. Can be set +# to: "disabled" to not check token binding. "permissive" (default) to +# validate binding information if the bind type is of a form known to the +# server and ignore it if not. "strict" like "permissive" but if the bind +# type is unknown the token will be rejected. "required" any form of token +# binding is needed to be allowed. Finally the name of a binding method that +# must be present in tokens. String value. +# Defaults to $::os_service_default. +# +# [*hash_algorithms*] +# (Optional) Hash algorithms to use for hashing PKI tokens. This may be a +# single algorithm or multiple. The algorithms are those supported by Python +# standard hashlib.new(). The hashes will be tried in the order given, so put +# the preferred one first for performance. The result of the first hash will +# be stored in the cache. This will typically be set to multiple values only +# while migrating from a less secure algorithm to a more secure one. Once all +# the old tokens are expired this option should be set to a single value for +# better performance. List value. +# Defaults to $::os_service_default. +# +# [*http_connect_timeout*] +# (Optional) Request timeout value for communicating with Identity API +# server. +# Defaults to $::os_service_default. +# +# [*http_request_max_retries*] +# (Optional) How many times are we trying to reconnect when communicating +# with Identity API Server. Integer value +# Defaults to $::os_service_default. +# +# [*include_service_catalog*] +# (Optional) Indicate whether to set the X-Service-Catalog header. If False, +# middleware will not ask for service catalog on token validation and will +# not +# set the X-Service-Catalog header. Boolean value. +# Defaults to $::os_service_default. +# +# [*keyfile*] +# (Optional) Required if identity server requires client certificate +# Defaults to $::os_service_default. +# +# [*memcache_pool_conn_get_timeout*] +# (Optional) Number of seconds that an operation will wait to get a memcached +# client connection from the pool. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_dead_retry*] +# (Optional) Number of seconds memcached server is considered dead before it +# is tried again. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_maxsize*] +# (Optional) Maximum total number of open connections to every memcached +# server. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_socket_timeout*] +# (Optional) Number of seconds a connection to memcached is held unused in +# the +# pool before it is closed. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_unused_timeout*] +# (Optional) Number of seconds a connection to memcached is held unused in +# the +# pool before it is closed. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_secret_key*] +# (Optional, mandatory if memcache_security_strategy is defined) This string +# is used for key derivation. +# Defaults to $::os_service_default. +# +# [*memcache_security_strategy*] +# (Optional) If defined, indicate whether token data should be authenticated +# or +# authenticated and encrypted. If MAC, token data is authenticated (with +# HMAC) +# in the cache. If ENCRYPT, token data is encrypted and authenticated in the +# cache. If the value is not one of these options or empty, auth_token will +# raise an exception on initialization. +# Defaults to $::os_service_default. +# +# [*memcache_use_advanced_pool*] +# (Optional) Use the advanced (eventlet safe) memcached client pool. The +# advanced pool will only work under python 2.x Boolean value +# Defaults to $::os_service_default. +# +# [*memcached_servers*] +# (Optional) Optionally specify a list of memcached server(s) to use for +# caching. If left undefined, tokens will instead be cached in-process. +# Defaults to $::os_service_default. +# +# [*region_name*] +# (Optional) The region in which the identity server can be found. +# Defaults to $::os_service_default. +# +# [*revocation_cache_time*] +# (Optional) Determines the frequency at which the list of revoked tokens is +# retrieved from the Identity service (in seconds). A high number of +# revocation events combined with a low cache duration may significantly +# reduce performance. Only valid for PKI tokens. Integer value +# Defaults to $::os_service_default. +# +# [*signing_dir*] +# (Optional) Directory used to cache files related to PKI tokens. +# Defaults to $::os_service_default. +# +# [*token_cache_time*] +# (Optional) In order to prevent excessive effort spent validating tokens, +# the middleware caches previously-seen tokens for a configurable duration +# (in seconds). Set to -1 to disable caching completely. Integer value +# Defaults to $::os_service_default. +# +class glance::api::authtoken( + $username = 'glance', + $password = $::os_service_default, + $auth_url = 'http://127.0.0.1:35357', + $project_name = 'services', + $user_domain_name = $::os_service_default, + $project_domain_name = $::os_service_default, + $insecure = $::os_service_default, + $auth_section = $::os_service_default, + $auth_type = 'password', + $auth_uri = 'http://127.0.0.1:5000', + $auth_version = $::os_service_default, + $cache = $::os_service_default, + $cafile = $::os_service_default, + $certfile = $::os_service_default, + $check_revocations_for_cached = $::os_service_default, + $delay_auth_decision = $::os_service_default, + $enforce_token_bind = $::os_service_default, + $hash_algorithms = $::os_service_default, + $http_connect_timeout = $::os_service_default, + $http_request_max_retries = $::os_service_default, + $include_service_catalog = $::os_service_default, + $keyfile = $::os_service_default, + $memcache_pool_conn_get_timeout = $::os_service_default, + $memcache_pool_dead_retry = $::os_service_default, + $memcache_pool_maxsize = $::os_service_default, + $memcache_pool_socket_timeout = $::os_service_default, + $memcache_pool_unused_timeout = $::os_service_default, + $memcache_secret_key = $::os_service_default, + $memcache_security_strategy = $::os_service_default, + $memcache_use_advanced_pool = $::os_service_default, + $memcached_servers = $::os_service_default, + $region_name = $::os_service_default, + $revocation_cache_time = $::os_service_default, + $signing_dir = $::os_service_default, + $token_cache_time = $::os_service_default, +) { + + if is_service_default($password) and $::glance::api::keystone_password == undef { + fail('Please set password for Glance service user') + } + + #NOTE(degorenko): Use pick to keep backward compatibility + $username_real = pick($::glance::api::keystone_user, $username) + $password_real = pick($::glance::api::keystone_password, $password) + $project_name_real = pick($::glance::api::keystone_tenant, $project_name) + $auth_url_real = pick($::glance::api::identity_uri, $auth_url) + $auth_uri_real = pick($::glance::api::auth_uri, $auth_uri) + $memcached_servers_real = pick($::glance::api::memcached_servers, $memcached_servers) + $token_cache_time_real = pick($::glance::api::token_cache_time, $token_cache_time) + $signing_dir_real = pick($::glance::api::signing_dir, $signing_dir) + + keystone::resource::authtoken { 'glance_api_config': + username => $username_real, + password => $password_real, + project_name => $project_name_real, + auth_url => $auth_url_real, + auth_uri => $auth_uri_real, + auth_version => $auth_version, + auth_type => $auth_type, + auth_section => $auth_section, + user_domain_name => $user_domain_name, + project_domain_name => $project_domain_name, + insecure => $insecure, + cache => $cache, + cafile => $cafile, + certfile => $certfile, + check_revocations_for_cached => $check_revocations_for_cached, + delay_auth_decision => $delay_auth_decision, + enforce_token_bind => $enforce_token_bind, + hash_algorithms => $hash_algorithms, + http_connect_timeout => $http_connect_timeout, + http_request_max_retries => $http_request_max_retries, + include_service_catalog => $include_service_catalog, + keyfile => $keyfile, + memcache_pool_conn_get_timeout => $memcache_pool_conn_get_timeout, + memcache_pool_dead_retry => $memcache_pool_dead_retry, + memcache_pool_maxsize => $memcache_pool_maxsize, + memcache_pool_socket_timeout => $memcache_pool_socket_timeout, + memcache_secret_key => $memcache_secret_key, + memcache_security_strategy => $memcache_security_strategy, + memcache_use_advanced_pool => $memcache_use_advanced_pool, + memcache_pool_unused_timeout => $memcache_pool_unused_timeout, + memcached_servers => $memcached_servers_real, + region_name => $region_name, + revocation_cache_time => $revocation_cache_time, + signing_dir => $signing_dir_real, + token_cache_time => $token_cache_time_real, + } +} diff --git a/manifests/glare.pp b/manifests/glare.pp index 3ec43349..156a9723 100644 --- a/manifests/glare.pp +++ b/manifests/glare.pp @@ -25,35 +25,15 @@ # (optional) Number of Glance Glare worker processes to start # Default: $::processorcount # -# [*auth_type*] +# [*auth_strategy*] # (optional) Type is authorization being used. # Defaults to 'keystone' # -# [*auth_uri*] -# (optional) Complete public Identity API endpoint. -# Defaults to 'http://127.0.0.1:5000/'. -# -# [*identity_uri*] -# (optional) Complete admin Identity API endpoint. -# Defaults to 'http://127.0.0.1:35357/'. -# # [*pipeline*] # (optional) Partial name of a pipeline in your paste configuration file with the # service name removed. # Defaults to 'keystone'. # -# [*keystone_tenant*] -# (optional) Tenant to authenticate to. -# Defaults to services. -# -# [*keystone_user*] -# (optional) User to authenticate as with keystone. -# Defaults to 'glance'. -# -# [*keystone_password*] -# (optional) Password used to authentication. -# Defaults to false. -# # [*manage_service*] # (optional) If Puppet should manage service startup / shutdown. # Defaults to true. @@ -93,21 +73,6 @@ # (optional) Sets the keystone region to use. # Defaults to 'RegionOne'. # -# [*signing_dir*] -# (optional) Directory used to cache files related to PKI tokens. -# Defaults to $::os_service_default. -# -# [*memcached_servers*] -# (optinal) a list of memcached server(s) to use for caching. If left undefined, -# tokens will instead be cached in-process. -# Defaults to $::os_service_default. -# -# [*token_cache_time*] -# (optional) In order to prevent excessive effort spent validating tokens, -# the middleware caches previously-seen tokens for a configurable duration (in seconds). -# Set to -1 to disable caching completely. -# Defaults to $::os_service_default. -# # == DEPRECATED PARAMETERS # # [*auth_region*] @@ -116,20 +81,62 @@ # then region name can be specified. # Defaults to $::os_service_default. # +# [*auth_type*] +# (optional) Type is authorization being used. +# Deprecated and replaced by ::glance::glare::auth_strategy +# Defaults to undef. +# +# [*auth_uri*] +# (optional) Complete public Identity API endpoint. +# Deprecated and will be replaced by ::glance::glare::authtoken::auth_uri +# Defaults to undef. +# +# [*identity_uri*] +# (optional) Complete admin Identity API endpoint. +# Deprecated and will be replaced by ::glance::glare::authtoken::auth_url +# Defaults to undef. +# +# [*keystone_tenant*] +# (optional) Tenant to authenticate to. +# Deprecated and will be replaced by ::glance::glare::authtoken::project_name +# Defaults to undef. +# +# [*keystone_user*] +# (optional) User to authenticate as with keystone. +# Deprecated and will be replaced by ::glance::glare::authtoken::username +# Defaults to undef. +# +# [*keystone_password*] +# (optional) Password used to authentication. +# Deprecated and will be replaced by ::glance::glare::authtoken::password +# Defaults to undef. +# +# [*signing_dir*] +# (optional) Directory used to cache files related to PKI tokens. +# Deprecated and will be replaced by ::glance::glare::authtoken::signing_dir +# Defaults to undef. +# +# [*memcached_servers*] +# (optinal) a list of memcached server(s) to use for caching. If left undefined, +# tokens will instead be cached in-process. +# Deprecated and will be replaced by ::glance::glare::authtoken::memcached_servers +# Defaults to undef. +# +# [*token_cache_time*] +# (optional) In order to prevent excessive effort spent validating tokens, +# the middleware caches previously-seen tokens for a configurable duration (in seconds). +# Set to -1 to disable caching completely. +# Deprecated and will be replaced by ::glance::glare::authtoken::token_cache_time +# Defaults to undef. +# class glance::glare( $package_ensure = 'present', $bind_host = '0.0.0.0', $bind_port = '9494', $backlog = '4096', $workers = $::processorcount, - $auth_type = 'keystone', - $auth_uri = 'http://127.0.0.1:5000/', - $identity_uri = 'http://127.0.0.1:35357/', - $memcached_servers = $::os_service_default, + $auth_strategy = 'keystone', $pipeline = 'keystone', - $keystone_tenant = 'services', - $keystone_user = 'glance', - $keystone_password = false, $manage_service = true, $enabled = true, $cert_file = $::os_service_default, @@ -139,10 +146,17 @@ class glance::glare( $default_store = undef, $multi_store = false, $os_region_name = 'RegionOne', - $signing_dir = $::os_service_default, - $token_cache_time = $::os_service_default, # DEPRECATED PARAMETERS - $auth_region = $::os_service_default, + $auth_region = undef, + $auth_type = undef, + $auth_uri = undef, + $identity_uri = undef, + $memcached_servers = undef, + $keystone_tenant = undef, + $keystone_user = undef, + $keystone_password = undef, + $signing_dir = undef, + $token_cache_time = undef, ) inherits glance { include ::glance::deps @@ -154,6 +168,45 @@ class glance::glare( warning('auth_region is deprecated, has no effect and and will be removed in the O release.') } + if $keystone_password { + warning('glance::glare::keystone_password is deprecated, please use glance::glare::authtoken::password') + } + + if $auth_type { + warning('glance::glare::auth_type is deprecated, please use glance::glare::auth_strategy') + $auth_strategy_real = $auth_type + } else { + $auth_strategy_real = $auth_strategy + } + + if $auth_uri { + warning('glance::glare::auth_uri is deprecated, please use glance::glare::authtoken::auth_uri') + } + + if $identity_uri { + warning('glance::glare::identity_uri is deprecated, please use glance::glare::authtoken::auth_url') + } + + if $keystone_tenant { + warning('glance::glare::keystone_tenant is deprecated, please use glance::glare::authtoken::project_name') + } + + if $keystone_user { + warning('glance::glare::keystone_user is deprecated, please use glance::glare::authtoken::username') + } + + if $memcached_servers { + warning('glance::glare::memcached_servers is deprecated, please use glance::glare::authtoken::memcached_servers') + } + + if $signing_dir { + warning('glance::glare::signing_dir is deprecated, please use glance::glare::authtoken::signing_dir') + } + + if $token_cache_time { + warning('glance::glare::token_cache_time is deprecated, please use glance::glare::authtoken::token_cache_time') + } + if ( $glance::params::glare_package_name != $glance::params::registry_package_name ) { ensure_packages('glance-glare', { ensure => $package_ensure, @@ -222,20 +275,8 @@ class glance::glare( } # keystone config - if $auth_type == 'keystone' { - if ! $keystone_password { - fail('Parameter keystone_password must be provided, when auth_type is keystone') - } - glance_glare_config { - 'keystone_authtoken/admin_tenant_name': value => $keystone_tenant; - 'keystone_authtoken/admin_user': value => $keystone_user; - 'keystone_authtoken/admin_password': value => $keystone_password, secret => true; - 'keystone_authtoken/token_cache_time': value => $token_cache_time; - 'keystone_authtoken/signing_dir': value => $signing_dir; - 'keystone_authtoken/auth_uri': value => $auth_uri; - 'keystone_authtoken/identity_uri': value => $identity_uri; - 'keystone_authtoken/memcached_servers': value => join(any2array($memcached_servers), ','); - } + if $auth_strategy == 'keystone' { + include ::glance::glare::authtoken } # SSL Options diff --git a/manifests/glare/authtoken.pp b/manifests/glare/authtoken.pp new file mode 100644 index 00000000..351b3166 --- /dev/null +++ b/manifests/glare/authtoken.pp @@ -0,0 +1,282 @@ +# class: glance::glare::authtoken +# +# Configure the keystone_authtoken section in the Glance Glare configuration file +# +# === Parameters +# +# [*username*] +# (Optional) The name of the service user +# Defaults to 'glance' +# +# [*password*] +# (Optional) Password to create for the service user +# Defaults to $::os_service_default +# +# [*auth_url*] +# (Optional) The URL to use for authentication. +# Defaults to 'http://127.0.0.1:35357' +# +# [*project_name*] +# (Optional) Service project name +# Defaults to 'services' +# +# [*user_domain_name*] +# (Optional) Name of domain for $username +# Defaults to $::os_service_default +# +# [*project_domain_name*] +# (Optional) Name of domain for $project_name +# Defaults to $::os_service_default +# +# [*insecure*] +# (Optional) If true, explicitly allow TLS without checking server cert +# against any certificate authorities. WARNING: not recommended. Use with +# caution. +# Defaults to $:os_service_default +# +# [*auth_section*] +# (Optional) Config Section from which to load plugin specific options +# Defaults to $::os_service_default. +# +# [*auth_type*] +# (Optional) Authentication type to load +# Defaults to 'password' +# +# [*auth_uri*] +# (Optional) Complete public Identity API endpoint. +# Defaults to 'http://127.0.0.1:5000'. +# +# [*auth_version*] +# (Optional) API version of the admin Identity API endpoint. +# Defaults to $::os_service_default. +# +# [*cache*] +# (Optional) Env key for the swift cache. +# Defaults to $::os_service_default. +# +# [*cafile*] +# (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs +# connections. +# Defaults to $::os_service_default. +# +# [*certfile*] +# (Optional) Required if identity server requires client certificate +# Defaults to $::os_service_default. +# +# [*check_revocations_for_cached*] +# (Optional) If true, the revocation list will be checked for cached tokens. +# This requires that PKI tokens are configured on the identity server. +# boolean value. +# Defaults to $::os_service_default. +# +# [*delay_auth_decision*] +# (Optional) Do not handle authorization requests within the middleware, but +# delegate the authorization decision to downstream WSGI components. Boolean +# value +# Defaults to $::os_service_default. +# +# [*enforce_token_bind*] +# (Optional) Used to control the use and type of token binding. Can be set +# to: "disabled" to not check token binding. "permissive" (default) to +# validate binding information if the bind type is of a form known to the +# server and ignore it if not. "strict" like "permissive" but if the bind +# type is unknown the token will be rejected. "required" any form of token +# binding is needed to be allowed. Finally the name of a binding method that +# must be present in tokens. String value. +# Defaults to $::os_service_default. +# +# [*hash_algorithms*] +# (Optional) Hash algorithms to use for hashing PKI tokens. This may be a +# single algorithm or multiple. The algorithms are those supported by Python +# standard hashlib.new(). The hashes will be tried in the order given, so put +# the preferred one first for performance. The result of the first hash will +# be stored in the cache. This will typically be set to multiple values only +# while migrating from a less secure algorithm to a more secure one. Once all +# the old tokens are expired this option should be set to a single value for +# better performance. List value. +# Defaults to $::os_service_default. +# +# [*http_connect_timeout*] +# (Optional) Request timeout value for communicating with Identity API +# server. +# Defaults to $::os_service_default. +# +# [*http_request_max_retries*] +# (Optional) How many times are we trying to reconnect when communicating +# with Identity API Server. Integer value +# Defaults to $::os_service_default. +# +# [*include_service_catalog*] +# (Optional) Indicate whether to set the X-Service-Catalog header. If False, +# middleware will not ask for service catalog on token validation and will +# not +# set the X-Service-Catalog header. Boolean value. +# Defaults to $::os_service_default. +# +# [*keyfile*] +# (Optional) Required if identity server requires client certificate +# Defaults to $::os_service_default. +# +# [*memcache_pool_conn_get_timeout*] +# (Optional) Number of seconds that an operation will wait to get a memcached +# client connection from the pool. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_dead_retry*] +# (Optional) Number of seconds memcached server is considered dead before it +# is tried again. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_maxsize*] +# (Optional) Maximum total number of open connections to every memcached +# server. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_socket_timeout*] +# (Optional) Number of seconds a connection to memcached is held unused in +# the +# pool before it is closed. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_unused_timeout*] +# (Optional) Number of seconds a connection to memcached is held unused in +# the +# pool before it is closed. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_secret_key*] +# (Optional, mandatory if memcache_security_strategy is defined) This string +# is used for key derivation. +# Defaults to $::os_service_default. +# +# [*memcache_security_strategy*] +# (Optional) If defined, indicate whether token data should be authenticated +# or +# authenticated and encrypted. If MAC, token data is authenticated (with +# HMAC) +# in the cache. If ENCRYPT, token data is encrypted and authenticated in the +# cache. If the value is not one of these options or empty, auth_token will +# raise an exception on initialization. +# Defaults to $::os_service_default. +# +# [*memcache_use_advanced_pool*] +# (Optional) Use the advanced (eventlet safe) memcached client pool. The +# advanced pool will only work under python 2.x Boolean value +# Defaults to $::os_service_default. +# +# [*memcached_servers*] +# (Optional) Optionally specify a list of memcached server(s) to use for +# caching. If left undefined, tokens will instead be cached in-process. +# Defaults to $::os_service_default. +# +# [*region_name*] +# (Optional) The region in which the identity server can be found. +# Defaults to $::os_service_default. +# +# [*revocation_cache_time*] +# (Optional) Determines the frequency at which the list of revoked tokens is +# retrieved from the Identity service (in seconds). A high number of +# revocation events combined with a low cache duration may significantly +# reduce performance. Only valid for PKI tokens. Integer value +# Defaults to $::os_service_default. +# +# [*signing_dir*] +# (Optional) Directory used to cache files related to PKI tokens. +# Defaults to $::os_service_default. +# +# [*token_cache_time*] +# (Optional) In order to prevent excessive effort spent validating tokens, +# the middleware caches previously-seen tokens for a configurable duration +# (in seconds). Set to -1 to disable caching completely. Integer value +# Defaults to $::os_service_default. +# +class glance::glare::authtoken( + $username = 'glance', + $password = $::os_service_default, + $auth_url = 'http://127.0.0.1:35357', + $project_name = 'services', + $user_domain_name = $::os_service_default, + $project_domain_name = $::os_service_default, + $insecure = $::os_service_default, + $auth_section = $::os_service_default, + $auth_type = 'password', + $auth_uri = 'http://127.0.0.1:5000', + $auth_version = $::os_service_default, + $cache = $::os_service_default, + $cafile = $::os_service_default, + $certfile = $::os_service_default, + $check_revocations_for_cached = $::os_service_default, + $delay_auth_decision = $::os_service_default, + $enforce_token_bind = $::os_service_default, + $hash_algorithms = $::os_service_default, + $http_connect_timeout = $::os_service_default, + $http_request_max_retries = $::os_service_default, + $include_service_catalog = $::os_service_default, + $keyfile = $::os_service_default, + $memcache_pool_conn_get_timeout = $::os_service_default, + $memcache_pool_dead_retry = $::os_service_default, + $memcache_pool_maxsize = $::os_service_default, + $memcache_pool_socket_timeout = $::os_service_default, + $memcache_pool_unused_timeout = $::os_service_default, + $memcache_secret_key = $::os_service_default, + $memcache_security_strategy = $::os_service_default, + $memcache_use_advanced_pool = $::os_service_default, + $memcached_servers = $::os_service_default, + $region_name = $::os_service_default, + $revocation_cache_time = $::os_service_default, + $signing_dir = $::os_service_default, + $token_cache_time = $::os_service_default, +) { + + if is_service_default($password) and $::glance::glare::keystone_password == undef { + fail('Please set password for Glance service user') + } + + #NOTE(degorenko): Use pick to keep backward compatibility + $username_real = pick($::glance::glare::keystone_user, $username) + $password_real = pick($::glance::glare::keystone_password, $password) + $project_name_real = pick($::glance::glare::keystone_tenant, $project_name) + $auth_url_real = pick($::glance::glare::identity_uri, $auth_url) + $auth_uri_real = pick($::glance::glare::auth_uri, $auth_uri) + $memcached_servers_real = pick($::glance::glare::memcached_servers, $memcached_servers) + $token_cache_time_real = pick($::glance::glare::token_cache_time, $token_cache_time) + $signing_dir_real = pick($::glance::glare::signing_dir, $signing_dir) + + keystone::resource::authtoken { 'glance_glare_config': + username => $username_real, + password => $password_real, + project_name => $project_name_real, + auth_url => $auth_url_real, + auth_uri => $auth_uri_real, + auth_version => $auth_version, + auth_type => $auth_type, + auth_section => $auth_section, + user_domain_name => $user_domain_name, + project_domain_name => $project_domain_name, + insecure => $insecure, + cache => $cache, + cafile => $cafile, + certfile => $certfile, + check_revocations_for_cached => $check_revocations_for_cached, + delay_auth_decision => $delay_auth_decision, + enforce_token_bind => $enforce_token_bind, + hash_algorithms => $hash_algorithms, + http_connect_timeout => $http_connect_timeout, + http_request_max_retries => $http_request_max_retries, + include_service_catalog => $include_service_catalog, + keyfile => $keyfile, + memcache_pool_conn_get_timeout => $memcache_pool_conn_get_timeout, + memcache_pool_dead_retry => $memcache_pool_dead_retry, + memcache_pool_maxsize => $memcache_pool_maxsize, + memcache_pool_socket_timeout => $memcache_pool_socket_timeout, + memcache_secret_key => $memcache_secret_key, + memcache_security_strategy => $memcache_security_strategy, + memcache_use_advanced_pool => $memcache_use_advanced_pool, + memcache_pool_unused_timeout => $memcache_pool_unused_timeout, + memcached_servers => $memcached_servers_real, + region_name => $region_name, + revocation_cache_time => $revocation_cache_time, + signing_dir => $signing_dir_real, + token_cache_time => $token_cache_time_real, + } +} diff --git a/manifests/registry.pp b/manifests/registry.pp index da76a47b..7d89201b 100644 --- a/manifests/registry.pp +++ b/manifests/registry.pp @@ -4,9 +4,6 @@ # # === Parameters # -# [*keystone_password*] -# (required) The keystone password for administrative user -# # [*package_ensure*] # (optional) Ensure state for package. Defaults to 'present'. On RedHat # platforms this setting is ignored and the setting from the glance class is @@ -66,24 +63,9 @@ # (optional) If set, use this value for max_overflow with sqlalchemy. # Defaults to undef. # -# [*auth_type*] -# (optional) Authentication type. Defaults to 'keystone'. -# -# [*auth_uri*] -# (optional) Complete public Identity API endpoint. -# Defaults to 'http://127.0.0.1:5000/'. -# -# [*identity_uri*] -# (optional) Complete admin Identity API endpoint. -# Defaults to 'http://127.0.0.1:35357/'. -# -# [*keystone_tenant*] -# (optional) administrative tenant name to connect to keystone. -# Defaults to 'services'. -# -# [*keystone_user*] -# (optional) administrative user name to connect to keystone. -# Defaults to 'glance'. +# [*auth_strategy*] +# (optional) Type is authorization being used. +# Defaults to 'keystone' # # [*pipeline*] # (optional) Partial name of a pipeline in your paste configuration @@ -135,28 +117,59 @@ # (optional) Sets the keystone region to use. # Defaults to $::os_service_default. # -# [*signing_dir*] -# Directory used to cache files related to PKI tokens. -# Defaults to $::os_service_default. -# -# [*memcached_servers*] -# (optinal) a list of memcached server(s) to use for caching. If left undefined, -# tokens will instead be cached in-process. -# Defaults to $::os_service_default. -# -# [*token_cache_time*] -# In order to prevent excessive effort spent validating tokens, -# the middleware caches previously-seen tokens for a configurable duration (in seconds). -# Set to -1 to disable caching completely. -# Defaults to $::os_service_default. -# # DEPRECATED PARAMETERS # # [*verbose*] # (optional) Deprecated. Enable verbose logs (true|false). Defaults to undef. # +# [*keystone_password*] +# (optional) The keystone password for administrative user. +# Deprecated and will be replaced by ::glance::registry::authtoken::password +# Default to undef. +# +# [*auth_type*] +# (optional) Authentication type. Defaults to undef. +# Deprecated and will be replaced by ::glance::registry::auth_strategy +# +# [*auth_uri*] +# (optional) Complete public Identity API endpoint. +# Deprecated and will be replaced by ::glance::registry::authtoken::auth_uri +# Defaults to undef. +# +# [*identity_uri*] +# (optional) Complete admin Identity API endpoint. +# Deprecated and will be replaced by ::glance::registry::authtoken::auth_url +# Defaults to undef. +# +# [*keystone_tenant*] +# (optional) administrative tenant name to connect to keystone. +# Deprecated and will be replaced by ::glance::registry::authtoken::project_name +# Defaults to undef. +# +# [*keystone_user*] +# (optional) administrative user name to connect to keystone. +# Deprecated and will be replaced by ::glance::registry::authtoken::username +# Defaults to undef. +# +# [*signing_dir*] +# Directory used to cache files related to PKI tokens. +# Deprecated and will be replaced by ::glance::registry::authtoken::signing_dir +# Defaults to undef. +# +# [*memcached_servers*] +# (optinal) a list of memcached server(s) to use for caching. If left undefined, +# tokens will instead be cached in-process. +# Deprecated and will be replaced by ::glance::registry::authtoken::memcached_servers +# Defaults to undef. +# +# [*token_cache_time*] +# In order to prevent excessive effort spent validating tokens, +# the middleware caches previously-seen tokens for a configurable duration (in seconds). +# Set to -1 to disable caching completely. +# Deprecated and will be replaced by ::glance::registry::authtoken::token_cache_time +# Defaults to undef. +# class glance::registry( - $keystone_password, $package_ensure = 'present', $debug = undef, $bind_host = $::os_service_default, @@ -171,11 +184,7 @@ class glance::registry( $database_max_retries = undef, $database_retry_interval = undef, $database_max_overflow = undef, - $auth_type = 'keystone', - $auth_uri = 'http://127.0.0.1:5000/', - $identity_uri = 'http://127.0.0.1:35357/', - $keystone_tenant = 'services', - $keystone_user = 'glance', + $auth_strategy = 'keystone', $pipeline = 'keystone', $use_syslog = undef, $use_stderr = undef, @@ -188,11 +197,17 @@ class glance::registry( $ca_file = $::os_service_default, $sync_db = true, $os_region_name = $::os_service_default, - $signing_dir = $::os_service_default, - $memcached_servers = $::os_service_default, - $token_cache_time = $::os_service_default, # Deprecated $verbose = undef, + $keystone_password = undef, + $auth_type = undef, + $auth_uri = undef, + $identity_uri = undef, + $keystone_tenant = undef, + $keystone_user = undef, + $signing_dir = undef, + $memcached_servers = undef, + $token_cache_time = undef, ) inherits glance { include ::glance::deps @@ -203,6 +218,45 @@ class glance::registry( warning('verbose is deprecated, has no effect and will be removed after Newton cycle.') } + if $keystone_password { + warning('glance::registry::keystone_password is deprecated, please use glance::registry::authtoken::password') + } + + if $auth_type { + warning('glance::registry::auth_type is deprecated, please use glance::registry::auth_strategy') + $auth_strategy_real = $auth_type + } else { + $auth_strategy_real = $auth_strategy + } + + if $auth_uri { + warning('glance::registry::auth_uri is deprecated, please use glance::registry::authtoken::auth_uri') + } + + if $identity_uri { + warning('glance::registry::identity_uri is deprecated, please use glance::registry::authtoken::auth_url') + } + + if $keystone_tenant { + warning('glance::registry::keystone_tenant is deprecated, please use glance::registry::authtoken::project_name') + } + + if $keystone_user { + warning('glance::registry::keystone_user is deprecated, please use glance::registry::authtoken::username') + } + + if $memcached_servers { + warning('glance::registry::memcached_servers is deprecated, please use glance::registry::authtoken::memcached_servers') + } + + if $signing_dir { + warning('glance::registry::signing_dir is deprecated, please use glance::registry::authtoken::signing_dir') + } + + if $token_cache_time { + warning('glance::registry::token_cache_time is deprecated, please use glance::registry::authtoken::token_cache_time') + } + if ( $glance::params::api_package_name != $glance::params::registry_package_name ) { ensure_packages( 'glance-registry', { @@ -236,17 +290,8 @@ class glance::registry( } # keystone config - if $auth_type == 'keystone' { - glance_registry_config { - 'keystone_authtoken/admin_tenant_name': value => $keystone_tenant; - 'keystone_authtoken/admin_user': value => $keystone_user; - 'keystone_authtoken/admin_password': value => $keystone_password, secret => true; - 'keystone_authtoken/token_cache_time': value => $token_cache_time; - 'keystone_authtoken/signing_dir': value => $signing_dir; - 'keystone_authtoken/auth_uri': value => $auth_uri; - 'keystone_authtoken/identity_uri': value => $identity_uri; - 'keystone_authtoken/memcached_servers': value => join(any2array($memcached_servers), ','); - } + if $auth_strategy_real == 'keystone' { + include ::glance::registry::authtoken } # SSL Options diff --git a/manifests/registry/authtoken.pp b/manifests/registry/authtoken.pp new file mode 100644 index 00000000..1587cf4b --- /dev/null +++ b/manifests/registry/authtoken.pp @@ -0,0 +1,282 @@ +# class: glance::registry::authtoken +# +# Configure the keystone_authtoken section in the Glance API configuration file +# +# === Parameters +# +# [*username*] +# (Optional) The name of the service user +# Defaults to 'glance' +# +# [*password*] +# (Optional) Password to create for the service user +# Defaults to $::os_service_default +# +# [*auth_url*] +# (Optional) The URL to use for authentication. +# Defaults to 'http://127.0.0.1:35357' +# +# [*project_name*] +# (Optional) Service project name +# Defaults to 'services' +# +# [*user_domain_name*] +# (Optional) Name of domain for $username +# Defaults to $::os_service_default +# +# [*project_domain_name*] +# (Optional) Name of domain for $project_name +# Defaults to $::os_service_default +# +# [*insecure*] +# (Optional) If true, explicitly allow TLS without checking server cert +# against any certificate authorities. WARNING: not recommended. Use with +# caution. +# Defaults to $:os_service_default +# +# [*auth_section*] +# (Optional) Config Section from which to load plugin specific options +# Defaults to $::os_service_default. +# +# [*auth_type*] +# (Optional) Authentication type to load +# Defaults to 'password'. +# +# [*auth_uri*] +# (Optional) Complete public Identity API endpoint. +# Defaults to 'http://127.0.0.1:5000'. +# +# [*auth_version*] +# (Optional) API version of the admin Identity API endpoint. +# Defaults to $::os_service_default. +# +# [*cache*] +# (Optional) Env key for the swift cache. +# Defaults to $::os_service_default. +# +# [*cafile*] +# (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs +# connections. +# Defaults to $::os_service_default. +# +# [*certfile*] +# (Optional) Required if identity server requires client certificate +# Defaults to $::os_service_default. +# +# [*check_revocations_for_cached*] +# (Optional) If true, the revocation list will be checked for cached tokens. +# This requires that PKI tokens are configured on the identity server. +# boolean value. +# Defaults to $::os_service_default. +# +# [*delay_auth_decision*] +# (Optional) Do not handle authorization requests within the middleware, but +# delegate the authorization decision to downstream WSGI components. Boolean +# value +# Defaults to $::os_service_default. +# +# [*enforce_token_bind*] +# (Optional) Used to control the use and type of token binding. Can be set +# to: "disabled" to not check token binding. "permissive" (default) to +# validate binding information if the bind type is of a form known to the +# server and ignore it if not. "strict" like "permissive" but if the bind +# type is unknown the token will be rejected. "required" any form of token +# binding is needed to be allowed. Finally the name of a binding method that +# must be present in tokens. String value. +# Defaults to $::os_service_default. +# +# [*hash_algorithms*] +# (Optional) Hash algorithms to use for hashing PKI tokens. This may be a +# single algorithm or multiple. The algorithms are those supported by Python +# standard hashlib.new(). The hashes will be tried in the order given, so put +# the preferred one first for performance. The result of the first hash will +# be stored in the cache. This will typically be set to multiple values only +# while migrating from a less secure algorithm to a more secure one. Once all +# the old tokens are expired this option should be set to a single value for +# better performance. List value. +# Defaults to $::os_service_default. +# +# [*http_connect_timeout*] +# (Optional) Request timeout value for communicating with Identity API +# server. +# Defaults to $::os_service_default. +# +# [*http_request_max_retries*] +# (Optional) How many times are we trying to reconnect when communicating +# with Identity API Server. Integer value +# Defaults to $::os_service_default. +# +# [*include_service_catalog*] +# (Optional) Indicate whether to set the X-Service-Catalog header. If False, +# middleware will not ask for service catalog on token validation and will +# not +# set the X-Service-Catalog header. Boolean value. +# Defaults to $::os_service_default. +# +# [*keyfile*] +# (Optional) Required if identity server requires client certificate +# Defaults to $::os_service_default. +# +# [*memcache_pool_conn_get_timeout*] +# (Optional) Number of seconds that an operation will wait to get a memcached +# client connection from the pool. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_dead_retry*] +# (Optional) Number of seconds memcached server is considered dead before it +# is tried again. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_maxsize*] +# (Optional) Maximum total number of open connections to every memcached +# server. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_socket_timeout*] +# (Optional) Number of seconds a connection to memcached is held unused in +# the +# pool before it is closed. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_unused_timeout*] +# (Optional) Number of seconds a connection to memcached is held unused in +# the +# pool before it is closed. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_secret_key*] +# (Optional, mandatory if memcache_security_strategy is defined) This string +# is used for key derivation. +# Defaults to $::os_service_default. +# +# [*memcache_security_strategy*] +# (Optional) If defined, indicate whether token data should be authenticated +# or +# authenticated and encrypted. If MAC, token data is authenticated (with +# HMAC) +# in the cache. If ENCRYPT, token data is encrypted and authenticated in the +# cache. If the value is not one of these options or empty, auth_token will +# raise an exception on initialization. +# Defaults to $::os_service_default. +# +# [*memcache_use_advanced_pool*] +# (Optional) Use the advanced (eventlet safe) memcached client pool. The +# advanced pool will only work under python 2.x Boolean value +# Defaults to $::os_service_default. +# +# [*memcached_servers*] +# (Optional) Optionally specify a list of memcached server(s) to use for +# caching. If left undefined, tokens will instead be cached in-process. +# Defaults to $::os_service_default. +# +# [*region_name*] +# (Optional) The region in which the identity server can be found. +# Defaults to $::os_service_default. +# +# [*revocation_cache_time*] +# (Optional) Determines the frequency at which the list of revoked tokens is +# retrieved from the Identity service (in seconds). A high number of +# revocation events combined with a low cache duration may significantly +# reduce performance. Only valid for PKI tokens. Integer value +# Defaults to $::os_service_default. +# +# [*signing_dir*] +# (Optional) Directory used to cache files related to PKI tokens. +# Defaults to $::os_service_default. +# +# [*token_cache_time*] +# (Optional) In order to prevent excessive effort spent validating tokens, +# the middleware caches previously-seen tokens for a configurable duration +# (in seconds). Set to -1 to disable caching completely. Integer value +# Defaults to $::os_service_default. +# +class glance::registry::authtoken( + $username = 'glance', + $password = $::os_service_default, + $auth_url = 'http://127.0.0.1:35357', + $project_name = 'services', + $user_domain_name = $::os_service_default, + $project_domain_name = $::os_service_default, + $insecure = $::os_service_default, + $auth_section = $::os_service_default, + $auth_type = 'password', + $auth_uri = 'http://127.0.0.1:5000', + $auth_version = $::os_service_default, + $cache = $::os_service_default, + $cafile = $::os_service_default, + $certfile = $::os_service_default, + $check_revocations_for_cached = $::os_service_default, + $delay_auth_decision = $::os_service_default, + $enforce_token_bind = $::os_service_default, + $hash_algorithms = $::os_service_default, + $http_connect_timeout = $::os_service_default, + $http_request_max_retries = $::os_service_default, + $include_service_catalog = $::os_service_default, + $keyfile = $::os_service_default, + $memcache_pool_conn_get_timeout = $::os_service_default, + $memcache_pool_dead_retry = $::os_service_default, + $memcache_pool_maxsize = $::os_service_default, + $memcache_pool_socket_timeout = $::os_service_default, + $memcache_pool_unused_timeout = $::os_service_default, + $memcache_secret_key = $::os_service_default, + $memcache_security_strategy = $::os_service_default, + $memcache_use_advanced_pool = $::os_service_default, + $memcached_servers = $::os_service_default, + $region_name = $::os_service_default, + $revocation_cache_time = $::os_service_default, + $signing_dir = $::os_service_default, + $token_cache_time = $::os_service_default, +) { + + if is_service_default($password) and $::glance::registry::keystone_password == undef { + fail('Please set password for Glance service user') + } + + #NOTE(degorenko): Use pick to keep backward compatibility + $username_real = pick($::glance::registry::keystone_user, $username) + $password_real = pick($::glance::registry::keystone_password, $password) + $project_name_real = pick($::glance::registry::keystone_tenant, $project_name) + $auth_url_real = pick($::glance::registry::identity_uri, $auth_url) + $auth_uri_real = pick($::glance::registry::auth_uri, $auth_uri) + $memcached_servers_real = pick($::glance::registry::memcached_servers, $memcached_servers) + $token_cache_time_real = pick($::glance::registry::token_cache_time, $token_cache_time) + $signing_dir_real = pick($::glance::registry::signing_dir, $signing_dir) + + keystone::resource::authtoken { 'glance_registry_config': + username => $username_real, + password => $password_real, + project_name => $project_name_real, + auth_url => $auth_url_real, + auth_uri => $auth_uri_real, + auth_version => $auth_version, + auth_type => $auth_type, + auth_section => $auth_section, + user_domain_name => $user_domain_name, + project_domain_name => $project_domain_name, + insecure => $insecure, + cache => $cache, + cafile => $cafile, + certfile => $certfile, + check_revocations_for_cached => $check_revocations_for_cached, + delay_auth_decision => $delay_auth_decision, + enforce_token_bind => $enforce_token_bind, + hash_algorithms => $hash_algorithms, + http_connect_timeout => $http_connect_timeout, + http_request_max_retries => $http_request_max_retries, + include_service_catalog => $include_service_catalog, + keyfile => $keyfile, + memcache_pool_conn_get_timeout => $memcache_pool_conn_get_timeout, + memcache_pool_dead_retry => $memcache_pool_dead_retry, + memcache_pool_maxsize => $memcache_pool_maxsize, + memcache_pool_socket_timeout => $memcache_pool_socket_timeout, + memcache_secret_key => $memcache_secret_key, + memcache_security_strategy => $memcache_security_strategy, + memcache_use_advanced_pool => $memcache_use_advanced_pool, + memcache_pool_unused_timeout => $memcache_pool_unused_timeout, + memcached_servers => $memcached_servers_real, + region_name => $region_name, + revocation_cache_time => $revocation_cache_time, + signing_dir => $signing_dir_real, + token_cache_time => $token_cache_time_real, + } +} diff --git a/releasenotes/notes/authtoken-2439e462e0a84399.yaml b/releasenotes/notes/authtoken-2439e462e0a84399.yaml new file mode 100644 index 00000000..b3895bcb --- /dev/null +++ b/releasenotes/notes/authtoken-2439e462e0a84399.yaml @@ -0,0 +1,25 @@ +--- +features: + - Configure keystonemiddleware in a consistent way with all options required for Keystone v3. +deprecations: + - glance::api::identity_uri is deprecated, use glance::api::authtoken::auth_url instead. + - glance::api::auth_uri is deprecated, use glance::api::authtoken::auth_uri instead. + - glance::api::keystone_tenant is deprecated, use glance::api::authtoken::project_name instead. + - glance::api::keystone_user is deprecated, use glance::api::authtoken::username instead. + - glance::api::keystone_password is deprecated, use glance::api::authtoken::password instead. + - glance::api::memcached_servers is deprecated, use glance::api::authtoken::memcached_servers instead. + - glance::glare::identity_uri is deprecated, use glance::glare::authtoken::auth_url instead. + - glance::glare::auth_uri is deprecated, use glance::glare::authtoken::auth_uri instead. + - glance::glare::keystone_tenant is deprecated, use glance::glare::authtoken::project_name instead. + - glance::glare::keystone_user is deprecated, use glance::glare::authtoken::username instead. + - glance::glare::keystone_password is deprecated, use glance::glare::authtoken::password instead. + - glance::glare::memcached_servers is deprecated, use glance::glare::authtoken::memcached_servers instead. + - glance::registry::identity_uri is deprecated, use glance::registry::authtoken::auth_url instead. + - glance::registry::auth_uri is deprecated, use glance::registry::authtoken::auth_uri instead. + - glance::registry::keystone_tenant is deprecated, use glance::registry::authtoken::project_name instead. + - glance::registry::keystone_user is deprecated, use glance::registry::authtoken::username instead. + - glance::registry::keystone_password is deprecated, use glance::registry::authtoken::password instead. + - glance::registry::memcached_servers is deprecated, use glance::registry::authtoken::memcached_servers instead. + - glance::api::auth_type is deprecated, use glance::api::auth_strategy instead. + - glance::glare::auth_type is deprecated, use glance::glare::auth_strategy instead. + - glance::registry::auth_type is deprecated, use glance::registry::auth_strategy instead. diff --git a/spec/acceptance/basic_glance_spec.rb b/spec/acceptance/basic_glance_spec.rb index 8bc60348..57b9cc09 100644 --- a/spec/acceptance/basic_glance_spec.rb +++ b/spec/acceptance/basic_glance_spec.rb @@ -24,20 +24,25 @@ describe 'glance class' do class { '::glance::keystone::glare_auth': password => 'a_big_secret', } + class { '::glance::api::authtoken': + password => 'a_big_secret', + } class { '::glance::api': database_connection => 'mysql+pymysql://glance:a_big_secret@127.0.0.1/glance?charset=utf8', - keystone_password => 'a_big_secret', + } + class { '::glance::registry::authtoken': + password => 'a_big_secret', } class { '::glance::registry': database_connection => 'mysql+pymysql://glance:a_big_secret@127.0.0.1/glance?charset=utf8', - keystone_password => 'a_big_secret', } class { '::glance::glare::db': database_connection => 'mysql+pymysql://glance:a_big_secret@127.0.0.1/glance?charset=utf8', } - class { '::glance::glare': - keystone_password => 'a_big_secret', + class { '::glance::glare::authtoken': + password => 'a_big_secret', } + include ::glance::glare glance_image { 'test_image': ensure => present, diff --git a/spec/classes/glance_api_authtoken_spec.rb b/spec/classes/glance_api_authtoken_spec.rb new file mode 100644 index 00000000..94b61ba8 --- /dev/null +++ b/spec/classes/glance_api_authtoken_spec.rb @@ -0,0 +1,145 @@ +require 'spec_helper' + +describe 'glance::api::authtoken' do + + let :params do + { :password => 'glance_api_password', } + end + + shared_examples 'glance_api authtoken' do + + context 'with default parameters' do + + it 'configure keystone_authtoken' do + is_expected.to contain_glance_api_config('keystone_authtoken/username').with_value('glance') + is_expected.to contain_glance_api_config('keystone_authtoken/password').with_value('glance_api_password') + is_expected.to contain_glance_api_config('keystone_authtoken/auth_url').with_value('http://127.0.0.1:35357') + is_expected.to contain_glance_api_config('keystone_authtoken/project_name').with_value('services') + is_expected.to contain_glance_api_config('keystone_authtoken/user_domain_name').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/project_domain_name').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/insecure').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/auth_section').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/auth_type').with_value('password') + is_expected.to contain_glance_api_config('keystone_authtoken/auth_uri').with_value('http://127.0.0.1:5000') + is_expected.to contain_glance_api_config('keystone_authtoken/auth_version').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/cache').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/cafile').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/certfile').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/check_revocations_for_cached').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/delay_auth_decision').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/enforce_token_bind').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/hash_algorithms').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/http_connect_timeout').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/http_request_max_retries').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/include_service_catalog').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/keyfile').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_dead_retry').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_maxsize').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_socket_timeout').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_unused_timeout').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_secret_key').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_security_strategy').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_use_advanced_pool').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/memcached_servers').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/region_name').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/revocation_cache_time').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/signing_dir').with_value('') + is_expected.to contain_glance_api_config('keystone_authtoken/token_cache_time').with_value('') + end + end + + context 'when overriding parameters' do + before do + params.merge!({ + :auth_uri => 'https://10.0.0.1:9999/', + :username => 'myuser', + :password => 'mypasswd', + :auth_url => 'http://:127.0.0.1:35357', + :project_name => 'service_project', + :user_domain_name => 'domainX', + :project_domain_name => 'domainX', + :insecure => false, + :auth_section => 'new_section', + :auth_type => 'password', + :auth_version => 'v3', + :cache => 'somevalue', + :cafile => '/opt/stack/data/cafile.pem', + :certfile => 'certfile.crt', + :check_revocations_for_cached => false, + :delay_auth_decision => false, + :enforce_token_bind => 'permissive', + :hash_algorithms => 'md5', + :http_connect_timeout => '300', + :http_request_max_retries => '3', + :include_service_catalog => true, + :keyfile => 'keyfile', + :memcache_pool_conn_get_timeout => '9', + :memcache_pool_dead_retry => '302', + :memcache_pool_maxsize => '11', + :memcache_pool_socket_timeout => '2', + :memcache_pool_unused_timeout => '61', + :memcache_secret_key => 'secret_key', + :memcache_security_strategy => 'ENCRYPT', + :memcache_use_advanced_pool => true, + :memcached_servers => ['memcached01:11211','memcached02:11211'], + :region_name => 'region2', + :revocation_cache_time => '11', + :signing_dir => '/var/cache', + :token_cache_time => '301', + }) + end + + it 'configure keystone_authtoken' do + is_expected.to contain_glance_api_config('keystone_authtoken/auth_uri').with_value('https://10.0.0.1:9999/') + is_expected.to contain_glance_api_config('keystone_authtoken/username').with_value(params[:username]) + is_expected.to contain_glance_api_config('keystone_authtoken/password').with_value(params[:password]).with_secret(true) + is_expected.to contain_glance_api_config('keystone_authtoken/auth_url').with_value(params[:auth_url]) + is_expected.to contain_glance_api_config('keystone_authtoken/project_name').with_value(params[:project_name]) + is_expected.to contain_glance_api_config('keystone_authtoken/user_domain_name').with_value(params[:user_domain_name]) + is_expected.to contain_glance_api_config('keystone_authtoken/project_domain_name').with_value(params[:project_domain_name]) + is_expected.to contain_glance_api_config('keystone_authtoken/insecure').with_value(params[:insecure]) + is_expected.to contain_glance_api_config('keystone_authtoken/auth_section').with_value(params[:auth_section]) + is_expected.to contain_glance_api_config('keystone_authtoken/auth_type').with_value(params[:auth_type]) + is_expected.to contain_glance_api_config('keystone_authtoken/auth_version').with_value(params[:auth_version]) + is_expected.to contain_glance_api_config('keystone_authtoken/cache').with_value(params[:cache]) + is_expected.to contain_glance_api_config('keystone_authtoken/cafile').with_value(params[:cafile]) + is_expected.to contain_glance_api_config('keystone_authtoken/certfile').with_value(params[:certfile]) + is_expected.to contain_glance_api_config('keystone_authtoken/check_revocations_for_cached').with_value(params[:check_revocations_for_cached]) + is_expected.to contain_glance_api_config('keystone_authtoken/delay_auth_decision').with_value(params[:delay_auth_decision]) + is_expected.to contain_glance_api_config('keystone_authtoken/enforce_token_bind').with_value(params[:enforce_token_bind]) + is_expected.to contain_glance_api_config('keystone_authtoken/hash_algorithms').with_value(params[:hash_algorithms]) + is_expected.to contain_glance_api_config('keystone_authtoken/http_connect_timeout').with_value(params[:http_connect_timeout]) + is_expected.to contain_glance_api_config('keystone_authtoken/http_request_max_retries').with_value(params[:http_request_max_retries]) + is_expected.to contain_glance_api_config('keystone_authtoken/include_service_catalog').with_value(params[:include_service_catalog]) + is_expected.to contain_glance_api_config('keystone_authtoken/keyfile').with_value(params[:keyfile]) + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value(params[:memcache_pool_conn_get_timeout]) + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_dead_retry').with_value(params[:memcache_pool_dead_retry]) + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_maxsize').with_value(params[:memcache_pool_maxsize]) + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_socket_timeout').with_value(params[:memcache_pool_socket_timeout]) + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_unused_timeout').with_value(params[:memcache_pool_unused_timeout]) + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_secret_key').with_value(params[:memcache_secret_key]) + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_security_strategy').with_value(params[:memcache_security_strategy]) + is_expected.to contain_glance_api_config('keystone_authtoken/memcache_use_advanced_pool').with_value(params[:memcache_use_advanced_pool]) + is_expected.to contain_glance_api_config('keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211') + is_expected.to contain_glance_api_config('keystone_authtoken/region_name').with_value(params[:region_name]) + is_expected.to contain_glance_api_config('keystone_authtoken/revocation_cache_time').with_value(params[:revocation_cache_time]) + is_expected.to contain_glance_api_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir]) + is_expected.to contain_glance_api_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time]) + end + end + end + + on_supported_os({ + :supported_os => OSDefaults.get_supported_os + }).each do |os,facts| + context "on #{os}" do + let (:facts) do + facts.merge!(OSDefaults.get_facts()) + end + + it_configures 'glance_api authtoken' + end + end + +end diff --git a/spec/classes/glance_api_spec.rb b/spec/classes/glance_api_spec.rb index b3756efb..b29d9636 100644 --- a/spec/classes/glance_api_spec.rb +++ b/spec/classes/glance_api_spec.rb @@ -13,16 +13,12 @@ describe 'glance::api' do :registry_client_protocol => '', :log_file => '/var/log/glance/api.log', :log_dir => '/var/log/glance', - :auth_type => 'keystone', + :auth_strategy => 'keystone', :enabled => true, :manage_service => true, :backlog => '', :workers => '7', - :keystone_tenant => 'services', - :keystone_user => 'glance', :keystone_password => 'ChangeMe', - :token_cache_time => '', - :memcached_servers => '', :show_image_direct_url => '', :show_multiple_locations => '', :location_strategy => '', @@ -35,14 +31,12 @@ describe 'glance::api' do :image_cache_stall_time => '', :image_cache_max_size => '', :os_region_name => 'RegionOne', - :signing_dir => '', :pipeline => 'keystone', - :auth_uri => 'http://127.0.0.1:5000/', - :identity_uri => 'http://127.0.0.1:35357/', } end shared_examples_for 'glance::api' do + [{:keystone_password => 'ChangeMe'}, { :debug => true, @@ -51,14 +45,11 @@ describe 'glance::api' do :registry_host => '127.0.0.1', :registry_port => '9111', :registry_client_protocol => 'https', - :auth_type => 'not_keystone', + :auth_strategy => 'not_keystone', :enabled => false, :backlog => '4095', :workers => '5', - :keystone_tenant => 'admin2', - :keystone_user => 'admin2', - :keystone_password => 'ChangeMe2', - :token_cache_time => '300', + :keystone_password => 'ChangeMe', :show_image_direct_url => true, :show_multiple_locations => true, :location_strategy => 'store_type', @@ -68,14 +59,11 @@ describe 'glance::api' do :image_cache_stall_time => '10', :image_cache_max_size => '10737418240', :os_region_name => 'RegionOne2', - :signing_dir => '/path/to/dir', :pipeline => 'keystone2', - :auth_uri => 'http://127.0.0.1:5000/v2.0', - :identity_uri => 'http://127.0.0.1:35357/v2.0', } ].each do |param_set| - describe "when #{param_set == {:keystone_password => 'ChangeMe'} ? "using default" : "specifying"} class parameters" do + describe "when #{param_set.empty? ? "using default" : "specifying"} class parameters" do let :param_hash do default_params.merge(param_set) @@ -154,22 +142,6 @@ describe 'glance::api' do :purge => false }) end - - it 'is_expected.to configure itself for keystone if that is the auth_type' do - if params[:auth_type] == 'keystone' - is_expected.to contain('paste_deploy/flavor').with_value('keystone+cachemanagement') - is_expected.to contain_glance_api_config('keystone_authtoken/memcached_servers').with_value(param_hash[:memcached_servers]) - ['admin_tenant_name', 'admin_user', 'admin_password', 'token_cache_time', 'signing_dir', 'auth_uri', 'identity_uri'].each do |config| - is_expected.to contain_glance_api_config("keystone_authtoken/#{config}").with_value(param_hash[config.intern]) - end - is_expected.to contain_glance_api_config('keystone_authtoken/admin_password').with_value(param_hash[:keystone_password]).with_secret(true) - - ['admin_tenant_name', 'admin_user', 'admin_password'].each do |config| - is_expected.to contain_glance_cache_config("keystone_authtoken/#{config}").with_value(param_hash[config.intern]) - end - is_expected.to contain_glance_cache_config('keystone_authtoken/admin_password').with_value(param_hash[:keystone_password]).with_secret(true) - end - end end end @@ -178,8 +150,8 @@ describe 'glance::api' do let :params do { :keystone_password => 'ChangeMe', - :manage_service => false, - :enabled => false, + :manage_service => false, + :enabled => false, } end @@ -224,7 +196,6 @@ describe 'glance::api' do describe "with pipeline incorrect value #{pipeline}" do let :params do { - :keystone_password => 'ChangeMe', :pipeline => pipeline } end @@ -342,7 +313,7 @@ describe 'glance::api' do :provider => 'shell', :tries => '10', :try_sleep => '2', - :command => 'glance --os-auth-url http://127.0.0.1:5000/ --os-tenant-name services --os-username glance --os-password ChangeMe image-list', + :command => 'glance --os-auth-url http://127.0.0.1:5000 --os-project-name services --os-username glance --os-password ChangeMe image-list', )} it { is_expected.to contain_anchor('create glance-api anchor').with( @@ -380,6 +351,32 @@ describe 'glance::api' do :require => 'Exec[execute glance-api validation]', )} end + + describe 'with deprecated auth parameters' do + let :params do + default_params.merge({ + :auth_type => 'keystone', + :keystone_tenant => 'services', + :keystone_user => 'glance', + :keystone_password => 'password', + :token_cache_time => '1000', + :memcached_servers => 'localhost:11211', + :signing_dir => '/tmp/keystone', + :auth_uri => 'http://127.0.0.1:5000', + :identity_uri => 'http://127.0.0.1:35357', + }) + end + it 'deprecated auth parameters' do + is_expected.to contain_glance_api_config('keystone_authtoken/memcached_servers').with_value(params[:memcached_servers]) + is_expected.to contain_glance_api_config('keystone_authtoken/username').with_value(params[:keystone_user]) + is_expected.to contain_glance_api_config('keystone_authtoken/project_name').with_value(params[:keystone_tenant]) + is_expected.to contain_glance_api_config('keystone_authtoken/password').with_value(params[:keystone_password]) + is_expected.to contain_glance_api_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time]) + is_expected.to contain_glance_api_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir]) + is_expected.to contain_glance_api_config('keystone_authtoken/auth_uri').with_value(params[:auth_uri]) + is_expected.to contain_glance_api_config('keystone_authtoken/auth_url').with_value(params[:identity_uri]) + end + end end shared_examples_for 'glance::api Debian' do diff --git a/spec/classes/glance_glare_authtoken_spec.rb b/spec/classes/glance_glare_authtoken_spec.rb new file mode 100644 index 00000000..82ee4674 --- /dev/null +++ b/spec/classes/glance_glare_authtoken_spec.rb @@ -0,0 +1,145 @@ +require 'spec_helper' + +describe 'glance::glare::authtoken' do + + let :params do + { :password => 'glance_glare_password', } + end + + shared_examples 'glance_glare authtoken' do + + context 'with default parameters' do + + it 'configure keystone_authtoken' do + is_expected.to contain_glance_glare_config('keystone_authtoken/username').with_value('glance') + is_expected.to contain_glance_glare_config('keystone_authtoken/password').with_value('glance_glare_password') + is_expected.to contain_glance_glare_config('keystone_authtoken/auth_url').with_value('http://127.0.0.1:35357') + is_expected.to contain_glance_glare_config('keystone_authtoken/project_name').with_value('services') + is_expected.to contain_glance_glare_config('keystone_authtoken/user_domain_name').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/project_domain_name').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/insecure').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/auth_section').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/auth_type').with_value('password') + is_expected.to contain_glance_glare_config('keystone_authtoken/auth_uri').with_value('http://127.0.0.1:5000') + is_expected.to contain_glance_glare_config('keystone_authtoken/auth_version').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/cache').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/cafile').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/certfile').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/check_revocations_for_cached').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/delay_auth_decision').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/enforce_token_bind').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/hash_algorithms').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/http_connect_timeout').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/http_request_max_retries').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/include_service_catalog').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/keyfile').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_dead_retry').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_maxsize').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_socket_timeout').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_unused_timeout').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_secret_key').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_security_strategy').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_use_advanced_pool').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/memcached_servers').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/region_name').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/revocation_cache_time').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/signing_dir').with_value('') + is_expected.to contain_glance_glare_config('keystone_authtoken/token_cache_time').with_value('') + end + end + + context 'when overriding parameters' do + before do + params.merge!({ + :auth_uri => 'https://10.0.0.1:9999/', + :username => 'myuser', + :password => 'mypasswd', + :auth_url => 'http://:127.0.0.1:35357', + :project_name => 'service_project', + :user_domain_name => 'domainX', + :project_domain_name => 'domainX', + :insecure => false, + :auth_section => 'new_section', + :auth_type => 'password', + :auth_version => 'v3', + :cache => 'somevalue', + :cafile => '/opt/stack/data/cafile.pem', + :certfile => 'certfile.crt', + :check_revocations_for_cached => false, + :delay_auth_decision => false, + :enforce_token_bind => 'permissive', + :hash_algorithms => 'md5', + :http_connect_timeout => '300', + :http_request_max_retries => '3', + :include_service_catalog => true, + :keyfile => 'keyfile', + :memcache_pool_conn_get_timeout => '9', + :memcache_pool_dead_retry => '302', + :memcache_pool_maxsize => '11', + :memcache_pool_socket_timeout => '2', + :memcache_pool_unused_timeout => '61', + :memcache_secret_key => 'secret_key', + :memcache_security_strategy => 'ENCRYPT', + :memcache_use_advanced_pool => true, + :memcached_servers => ['memcached01:11211','memcached02:11211'], + :region_name => 'region2', + :revocation_cache_time => '11', + :signing_dir => '/var/cache', + :token_cache_time => '301', + }) + end + + it 'configure keystone_authtoken' do + is_expected.to contain_glance_glare_config('keystone_authtoken/auth_uri').with_value('https://10.0.0.1:9999/') + is_expected.to contain_glance_glare_config('keystone_authtoken/username').with_value(params[:username]) + is_expected.to contain_glance_glare_config('keystone_authtoken/password').with_value(params[:password]).with_secret(true) + is_expected.to contain_glance_glare_config('keystone_authtoken/auth_url').with_value(params[:auth_url]) + is_expected.to contain_glance_glare_config('keystone_authtoken/project_name').with_value(params[:project_name]) + is_expected.to contain_glance_glare_config('keystone_authtoken/user_domain_name').with_value(params[:user_domain_name]) + is_expected.to contain_glance_glare_config('keystone_authtoken/project_domain_name').with_value(params[:project_domain_name]) + is_expected.to contain_glance_glare_config('keystone_authtoken/insecure').with_value(params[:insecure]) + is_expected.to contain_glance_glare_config('keystone_authtoken/auth_section').with_value(params[:auth_section]) + is_expected.to contain_glance_glare_config('keystone_authtoken/auth_type').with_value(params[:auth_type]) + is_expected.to contain_glance_glare_config('keystone_authtoken/auth_version').with_value(params[:auth_version]) + is_expected.to contain_glance_glare_config('keystone_authtoken/cache').with_value(params[:cache]) + is_expected.to contain_glance_glare_config('keystone_authtoken/cafile').with_value(params[:cafile]) + is_expected.to contain_glance_glare_config('keystone_authtoken/certfile').with_value(params[:certfile]) + is_expected.to contain_glance_glare_config('keystone_authtoken/check_revocations_for_cached').with_value(params[:check_revocations_for_cached]) + is_expected.to contain_glance_glare_config('keystone_authtoken/delay_auth_decision').with_value(params[:delay_auth_decision]) + is_expected.to contain_glance_glare_config('keystone_authtoken/enforce_token_bind').with_value(params[:enforce_token_bind]) + is_expected.to contain_glance_glare_config('keystone_authtoken/hash_algorithms').with_value(params[:hash_algorithms]) + is_expected.to contain_glance_glare_config('keystone_authtoken/http_connect_timeout').with_value(params[:http_connect_timeout]) + is_expected.to contain_glance_glare_config('keystone_authtoken/http_request_max_retries').with_value(params[:http_request_max_retries]) + is_expected.to contain_glance_glare_config('keystone_authtoken/include_service_catalog').with_value(params[:include_service_catalog]) + is_expected.to contain_glance_glare_config('keystone_authtoken/keyfile').with_value(params[:keyfile]) + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value(params[:memcache_pool_conn_get_timeout]) + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_dead_retry').with_value(params[:memcache_pool_dead_retry]) + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_maxsize').with_value(params[:memcache_pool_maxsize]) + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_socket_timeout').with_value(params[:memcache_pool_socket_timeout]) + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_unused_timeout').with_value(params[:memcache_pool_unused_timeout]) + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_secret_key').with_value(params[:memcache_secret_key]) + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_security_strategy').with_value(params[:memcache_security_strategy]) + is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_use_advanced_pool').with_value(params[:memcache_use_advanced_pool]) + is_expected.to contain_glance_glare_config('keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211') + is_expected.to contain_glance_glare_config('keystone_authtoken/region_name').with_value(params[:region_name]) + is_expected.to contain_glance_glare_config('keystone_authtoken/revocation_cache_time').with_value(params[:revocation_cache_time]) + is_expected.to contain_glance_glare_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir]) + is_expected.to contain_glance_glare_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time]) + end + end + end + + on_supported_os({ + :supported_os => OSDefaults.get_supported_os + }).each do |os,facts| + context "on #{os}" do + let (:facts) do + facts.merge!(OSDefaults.get_facts()) + end + + it_configures 'glance_glare authtoken' + end + end + +end diff --git a/spec/classes/glance_glare_spec.rb b/spec/classes/glance_glare_spec.rb index 1269dbc2..c36c99c6 100644 --- a/spec/classes/glance_glare_spec.rb +++ b/spec/classes/glance_glare_spec.rb @@ -11,18 +11,11 @@ describe 'glance::glare' do :manage_service => true, :backlog => '4096', :workers => '7', - :keystone_tenant => 'services', - :keystone_user => 'glance', :keystone_password => 'ChangeMe', - :token_cache_time => '', - :memcached_servers => '', :stores => false, :default_store => false, :os_region_name => 'RegionOne', - :signing_dir => '', :pipeline => 'keystone', - :auth_uri => 'http://127.0.0.1:5000/', - :identity_uri => 'http://127.0.0.1:35357/', } end @@ -35,15 +28,9 @@ describe 'glance::glare' do :enabled => false, :backlog => '4095', :workers => '5', - :keystone_tenant => 'admin2', - :keystone_user => 'admin2', :keystone_password => 'ChangeMe2', - :token_cache_time => '300', :os_region_name => 'RegionOne2', - :signing_dir => '/path/to/dir', :pipeline => 'keystone2', - :auth_uri => 'http://127.0.0.1:5000/v2.0', - :identity_uri => 'http://127.0.0.1:35357/v2.0', } ].each do |param_set| @@ -98,11 +85,6 @@ describe 'glance::glare' do it 'is_expected.to configure itself for keystone if that is the auth_type' do if params[:auth_type] == 'keystone' is_expected.to contain('paste_deploy/flavor').with_value('keystone+cachemanagement') - is_expected.to contain_glance_glare_config('keystone_authtoken/memcached_servers').with_value(param_hash[:memcached_servers]) - ['admin_tenant_name', 'admin_user', 'admin_password', 'token_cache_time', 'signing_dir', 'auth_uri', 'identity_uri'].each do |config| - is_expected.to contain_glance_glare_config("keystone_authtoken/#{config}").with_value(param_hash[config.intern]) - end - is_expected.to contain_glance_glare_config('keystone_authtoken/admin_password').with_value(param_hash[:keystone_password]).with_secret(true) end end end @@ -250,6 +232,32 @@ describe 'glance::glare' do it { is_expected.to contain_glance_glare_config('glance_store/default_store').with_value('glance.store.filesystem.Store') } it { is_expected.to contain_glance_glare_config('glance_store/stores').with_value('glance.store.filesystem.Store') } end + + describe 'with deprecated auth parameters' do + let :params do + default_params.merge({ + :auth_type => 'keystone', + :keystone_tenant => 'services', + :keystone_user => 'glance', + :keystone_password => 'password', + :token_cache_time => '1000', + :memcached_servers => 'localhost:11211', + :signing_dir => '/tmp/keystone', + :auth_uri => 'http://127.0.0.1:5000', + :identity_uri => 'http://127.0.0.1:35357', + }) + end + it 'deprecated auth parameters' do + is_expected.to contain_glance_glare_config('keystone_authtoken/memcached_servers').with_value(params[:memcached_servers]) + is_expected.to contain_glance_glare_config('keystone_authtoken/username').with_value(params[:keystone_user]) + is_expected.to contain_glance_glare_config('keystone_authtoken/project_name').with_value(params[:keystone_tenant]) + is_expected.to contain_glance_glare_config('keystone_authtoken/password').with_value(params[:keystone_password]) + is_expected.to contain_glance_glare_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time]) + is_expected.to contain_glance_glare_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir]) + is_expected.to contain_glance_glare_config('keystone_authtoken/auth_uri').with_value(params[:auth_uri]) + is_expected.to contain_glance_glare_config('keystone_authtoken/auth_url').with_value(params[:identity_uri]) + end + end end shared_examples_for 'glance::glare Debian' do diff --git a/spec/classes/glance_registry_authtoken_spec.rb b/spec/classes/glance_registry_authtoken_spec.rb new file mode 100644 index 00000000..5387cb17 --- /dev/null +++ b/spec/classes/glance_registry_authtoken_spec.rb @@ -0,0 +1,145 @@ +require 'spec_helper' + +describe 'glance::registry::authtoken' do + + let :params do + { :password => 'glance_registry_password', } + end + + shared_examples 'glance_registry authtoken' do + + context 'with default parameters' do + + it 'configure keystone_authtoken' do + is_expected.to contain_glance_registry_config('keystone_authtoken/username').with_value('glance') + is_expected.to contain_glance_registry_config('keystone_authtoken/password').with_value('glance_registry_password') + is_expected.to contain_glance_registry_config('keystone_authtoken/auth_url').with_value('http://127.0.0.1:35357') + is_expected.to contain_glance_registry_config('keystone_authtoken/project_name').with_value('services') + is_expected.to contain_glance_registry_config('keystone_authtoken/user_domain_name').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/project_domain_name').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/insecure').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/auth_section').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/auth_type').with_value('password') + is_expected.to contain_glance_registry_config('keystone_authtoken/auth_uri').with_value('http://127.0.0.1:5000') + is_expected.to contain_glance_registry_config('keystone_authtoken/auth_version').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/cache').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/cafile').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/certfile').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/check_revocations_for_cached').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/delay_auth_decision').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/enforce_token_bind').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/hash_algorithms').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/http_connect_timeout').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/http_request_max_retries').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/include_service_catalog').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/keyfile').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_dead_retry').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_maxsize').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_socket_timeout').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_unused_timeout').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_secret_key').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_security_strategy').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_use_advanced_pool').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/memcached_servers').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/region_name').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/revocation_cache_time').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/signing_dir').with_value('') + is_expected.to contain_glance_registry_config('keystone_authtoken/token_cache_time').with_value('') + end + end + + context 'when overriding parameters' do + before do + params.merge!({ + :auth_uri => 'https://10.0.0.1:9999/', + :username => 'myuser', + :password => 'mypasswd', + :auth_url => 'http://:127.0.0.1:35357', + :project_name => 'service_project', + :user_domain_name => 'domainX', + :project_domain_name => 'domainX', + :insecure => false, + :auth_section => 'new_section', + :auth_type => 'password', + :auth_version => 'v3', + :cache => 'somevalue', + :cafile => '/opt/stack/data/cafile.pem', + :certfile => 'certfile.crt', + :check_revocations_for_cached => false, + :delay_auth_decision => false, + :enforce_token_bind => 'permissive', + :hash_algorithms => 'md5', + :http_connect_timeout => '300', + :http_request_max_retries => '3', + :include_service_catalog => true, + :keyfile => 'keyfile', + :memcache_pool_conn_get_timeout => '9', + :memcache_pool_dead_retry => '302', + :memcache_pool_maxsize => '11', + :memcache_pool_socket_timeout => '2', + :memcache_pool_unused_timeout => '61', + :memcache_secret_key => 'secret_key', + :memcache_security_strategy => 'ENCRYPT', + :memcache_use_advanced_pool => true, + :memcached_servers => ['memcached01:11211','memcached02:11211'], + :region_name => 'region2', + :revocation_cache_time => '11', + :signing_dir => '/var/cache', + :token_cache_time => '301', + }) + end + + it 'configure keystone_authtoken' do + is_expected.to contain_glance_registry_config('keystone_authtoken/auth_uri').with_value('https://10.0.0.1:9999/') + is_expected.to contain_glance_registry_config('keystone_authtoken/username').with_value(params[:username]) + is_expected.to contain_glance_registry_config('keystone_authtoken/password').with_value(params[:password]).with_secret(true) + is_expected.to contain_glance_registry_config('keystone_authtoken/auth_url').with_value(params[:auth_url]) + is_expected.to contain_glance_registry_config('keystone_authtoken/project_name').with_value(params[:project_name]) + is_expected.to contain_glance_registry_config('keystone_authtoken/user_domain_name').with_value(params[:user_domain_name]) + is_expected.to contain_glance_registry_config('keystone_authtoken/project_domain_name').with_value(params[:project_domain_name]) + is_expected.to contain_glance_registry_config('keystone_authtoken/insecure').with_value(params[:insecure]) + is_expected.to contain_glance_registry_config('keystone_authtoken/auth_section').with_value(params[:auth_section]) + is_expected.to contain_glance_registry_config('keystone_authtoken/auth_type').with_value(params[:auth_type]) + is_expected.to contain_glance_registry_config('keystone_authtoken/auth_version').with_value(params[:auth_version]) + is_expected.to contain_glance_registry_config('keystone_authtoken/cache').with_value(params[:cache]) + is_expected.to contain_glance_registry_config('keystone_authtoken/cafile').with_value(params[:cafile]) + is_expected.to contain_glance_registry_config('keystone_authtoken/certfile').with_value(params[:certfile]) + is_expected.to contain_glance_registry_config('keystone_authtoken/check_revocations_for_cached').with_value(params[:check_revocations_for_cached]) + is_expected.to contain_glance_registry_config('keystone_authtoken/delay_auth_decision').with_value(params[:delay_auth_decision]) + is_expected.to contain_glance_registry_config('keystone_authtoken/enforce_token_bind').with_value(params[:enforce_token_bind]) + is_expected.to contain_glance_registry_config('keystone_authtoken/hash_algorithms').with_value(params[:hash_algorithms]) + is_expected.to contain_glance_registry_config('keystone_authtoken/http_connect_timeout').with_value(params[:http_connect_timeout]) + is_expected.to contain_glance_registry_config('keystone_authtoken/http_request_max_retries').with_value(params[:http_request_max_retries]) + is_expected.to contain_glance_registry_config('keystone_authtoken/include_service_catalog').with_value(params[:include_service_catalog]) + is_expected.to contain_glance_registry_config('keystone_authtoken/keyfile').with_value(params[:keyfile]) + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value(params[:memcache_pool_conn_get_timeout]) + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_dead_retry').with_value(params[:memcache_pool_dead_retry]) + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_maxsize').with_value(params[:memcache_pool_maxsize]) + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_socket_timeout').with_value(params[:memcache_pool_socket_timeout]) + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_unused_timeout').with_value(params[:memcache_pool_unused_timeout]) + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_secret_key').with_value(params[:memcache_secret_key]) + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_security_strategy').with_value(params[:memcache_security_strategy]) + is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_use_advanced_pool').with_value(params[:memcache_use_advanced_pool]) + is_expected.to contain_glance_registry_config('keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211') + is_expected.to contain_glance_registry_config('keystone_authtoken/region_name').with_value(params[:region_name]) + is_expected.to contain_glance_registry_config('keystone_authtoken/revocation_cache_time').with_value(params[:revocation_cache_time]) + is_expected.to contain_glance_registry_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir]) + is_expected.to contain_glance_registry_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time]) + end + end + end + + on_supported_os({ + :supported_os => OSDefaults.get_supported_os + }).each do |os,facts| + context "on #{os}" do + let (:facts) do + facts.merge!(OSDefaults.get_facts()) + end + + it_configures 'glance_registry authtoken' + end + end + +end diff --git a/spec/classes/glance_registry_spec.rb b/spec/classes/glance_registry_spec.rb index 6366a104..6bef35b2 100644 --- a/spec/classes/glance_registry_spec.rb +++ b/spec/classes/glance_registry_spec.rb @@ -1,3 +1,4 @@ +require 'spec_helper' describe 'glance::registry' do let :default_params do @@ -12,17 +13,10 @@ describe 'glance::registry' do :enabled => true, :manage_service => true, :auth_type => 'keystone', - :auth_uri => 'http://127.0.0.1:5000/', - :identity_uri => 'http://127.0.0.1:35357/', - :keystone_tenant => 'services', - :keystone_user => 'glance', :keystone_password => 'ChangeMe', :purge_config => false, :sync_db => true, :os_region_name => '', - :signing_dir => '', - :token_cache_time => '', - :memcached_servers => '', :ca_file => '', :cert_file => '', :key_file => '', @@ -38,15 +32,9 @@ describe 'glance::registry' do :workers => '5', :enabled => false, :auth_type => 'keystone', - :auth_uri => 'http://127.0.0.1:5000/v2.0', - :identity_uri => 'http://127.0.0.1:35357/v2.0', - :keystone_tenant => 'admin', - :keystone_user => 'admin', :keystone_password => 'ChangeMe', :sync_db => false, :os_region_name => 'RegionOne2', - :signing_dir => '/path/to/dir', - :token_cache_time => '300', } ].each do |param_set| @@ -92,21 +80,8 @@ describe 'glance::registry' do ].each do |config| is_expected.to contain_glance_registry_config("DEFAULT/#{config}").with_value(param_hash[config.intern]) end - [ - 'auth_uri', - 'identity_uri' - ].each do |config| - is_expected.to contain_glance_registry_config("keystone_authtoken/#{config}").with_value(param_hash[config.intern]) - end if param_hash[:auth_type] == 'keystone' is_expected.to contain_glance_registry_config("paste_deploy/flavor").with_value('keystone') - is_expected.to contain_glance_registry_config('keystone_authtoken/memcached_servers').with_value(param_hash[:memcached_servers]) - is_expected.to contain_glance_registry_config("keystone_authtoken/admin_tenant_name").with_value(param_hash[:keystone_tenant]) - is_expected.to contain_glance_registry_config("keystone_authtoken/admin_user").with_value(param_hash[:keystone_user]) - is_expected.to contain_glance_registry_config("keystone_authtoken/admin_password").with_value(param_hash[:keystone_password]) - is_expected.to contain_glance_registry_config("keystone_authtoken/admin_password").with_value(param_hash[:keystone_password]).with_secret(true) - is_expected.to contain_glance_registry_config("keystone_authtoken/token_cache_time").with_value(param_hash[:token_cache_time]) - is_expected.to contain_glance_registry_config("keystone_authtoken/signing_dir").with_value(param_hash[:signing_dir]) end end it 'is_expected.to lay down default glance_store registry config' do @@ -208,6 +183,32 @@ describe 'glance::registry' do it { is_expected.to contain_glance_registry_config('DEFAULT/key_file').with_value('/tmp/key_file') } end end + + describe 'with deprecated auth parameters' do + let :params do + default_params.merge({ + :auth_type => 'keystone', + :keystone_tenant => 'services', + :keystone_user => 'glance', + :keystone_password => 'password', + :token_cache_time => '1000', + :memcached_servers => 'localhost:11211', + :signing_dir => '/tmp/keystone', + :auth_uri => 'http://127.0.0.1:5000', + :identity_uri => 'http://127.0.0.1:35357', + }) + end + it 'deprecated auth parameters' do + is_expected.to contain_glance_registry_config('keystone_authtoken/memcached_servers').with_value(params[:memcached_servers]) + is_expected.to contain_glance_registry_config('keystone_authtoken/username').with_value(params[:keystone_user]) + is_expected.to contain_glance_registry_config('keystone_authtoken/project_name').with_value(params[:keystone_tenant]) + is_expected.to contain_glance_registry_config('keystone_authtoken/password').with_value(params[:keystone_password]) + is_expected.to contain_glance_registry_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time]) + is_expected.to contain_glance_registry_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir]) + is_expected.to contain_glance_registry_config('keystone_authtoken/auth_uri').with_value(params[:auth_uri]) + is_expected.to contain_glance_registry_config('keystone_authtoken/auth_url').with_value(params[:identity_uri]) + end + end end shared_examples_for 'glance::registry Debian' do