openstack/puppet-glance
Code Issues Proposed changes

Merge "Remove old authtoken options"

Browse Source
This commit is contained in:
Jenkins 2016-11-19 01:05:50 +00:00 committed by Gerrit Code Review
commit f958cb6d7c
15 changed files with 400 additions and 812 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

121
manifests/api.pp
View File

@ -256,60 +256,6 @@
# Defaults to false. # Defaults to false.
# Example: ['file','http'] # Example: ['file','http']
# #
# [*auth_region*]
# (optional) The region for the authentication service.
# If "use_user_token" is not in effect and using keystone auth,
# then region name can be specified.
# Defaults to undef
#
# [*keystone_password*]
# (Optional) Password used to authentication.
# Deprecated and will be replaced by ::glance::api::authtoken::password
# Defaults to undef.
#
# [*auth_type*]
# (optional) Type is authorization being used.
# Deprecated and replaced by ::glance::api::auth_strategy
# Defaults to undef.
#
# [*auth_uri*]
# (optional) Complete public Identity API endpoint.
# Deprecated and will be replaced by ::glance::api::authtoken::auth_uri
# Defaults to undef.
#
# [*identity_uri*]
# (optional) Complete admin Identity API endpoint.
# Deprecated and will be replaced by ::glance::api::authtoken::auth_url
# Defaults to undef.
#
# [*keystone_tenant*]
# (optional) Tenant to authenticate to.
# Deprecated and will be replaced by ::glance::api::authtoken::project_name
# Defaults to undef.
#
# [*keystone_user*]
# (optional) User to authenticate as with keystone.
# Deprecated and will be replaced by ::glance::api::authtoken::username
# Defaults to undef.
#
# [*signing_dir*]
# (optional) Directory used to cache files related to PKI tokens.
# Deprecated and will be replaced by ::glance::api::authtoken::signing_dir
# Defaults to undef.
#
# [*memcached_servers*]
# (optinal) a list of memcached server(s) to use for caching. If left undefined,
# tokens will instead be cached in-process.
# Deprecated and will be replaced by ::glance::api::authtoken::memcached_servers
# Defaults to undef.
#
# [*token_cache_time*]
# (optional) In order to prevent excessive effort spent validating tokens,
# the middleware caches previously-seen tokens for a configurable duration (in seconds).
# Set to -1 to disable caching completely.
# Deprecated and will be replaced by ::glance::api::authtoken::token_cache_time
# Defaults to undef.
#
class glance::api( class glance::api(
$package_ensure = 'present', $package_ensure = 'present',
$debug = undef, $debug = undef,
@ -366,16 +312,6 @@ class glance::api(
$validation_options = {}, $validation_options = {},
# DEPRECATED PARAMETERS # DEPRECATED PARAMETERS
$known_stores = false, $known_stores = false,
$auth_region = undef,
$keystone_password = undef,
$auth_type = undef,
$auth_uri = undef,
$identity_uri = undef,
$keystone_tenant = undef,
$keystone_user = undef,
$memcached_servers = undef,
$signing_dir = undef,
$token_cache_time = undef,
) inherits glance { ) inherits glance {
include ::glance::deps include ::glance::deps
@ -384,49 +320,6 @@ class glance::api(
include ::glance::api::logging include ::glance::api::logging
include ::glance::cache::logging include ::glance::cache::logging
if $auth_region {
warning('auth_region is deprecated, has no effect and and will be removed in the O release.')
}
if $keystone_password {
warning('glance::api::keystone_password is deprecated, please use glance::api::authtoken::password')
}
if $auth_type {
warning('glance::api::auth_type is deprecated, please use glance::api::auth_strategy')
$auth_strategy_real = $auth_type
} else {
$auth_strategy_real = $auth_strategy
}
if $auth_uri {
warning('glance::api::auth_uri is deprecated, please use glance::api::authtoken::auth_uri')
}
if $identity_uri {
warning('glance::api::identity_uri is deprecated, please use glance::api::authtoken::auth_url')
}
if $keystone_tenant {
warning('glance::api::keystone_tenant is deprecated, please use glance::api::authtoken::project_name')
}
if $keystone_user {
warning('glance::api::keystone_user is deprecated, please use glance::api::authtoken::username')
}
if $memcached_servers {
warning('glance::api::memcached_servers is deprecated, please use glance::api::authtoken::memcached_servers')
}
if $signing_dir {
warning('glance::api::signing_dir is deprecated, please use glance::api::authtoken::signing_dir')
}
if $token_cache_time {
warning('glance::api::token_cache_time is deprecated, please use glance::api::authtoken::token_cache_time')
}
if ( $glance::params::api_package_name != $glance::params::registry_package_name ) { if ( $glance::params::api_package_name != $glance::params::registry_package_name ) {
ensure_packages('glance-api', ensure_packages('glance-api',
{ {
@ -473,8 +366,8 @@ class glance::api(
if $default_store { if $default_store {
$default_store_real = $default_store $default_store_real = $default_store
} }
# determine value for glance_store/stores
if !empty($stores_real) { if !empty($stores_real) {
# determine value for glance_store/stores
if size(any2array($stores_real)) > 1 { if size(any2array($stores_real)) > 1 {
$final_stores_real = join($stores_real, ',') $final_stores_real = join($stores_real, ',')
} else { } else {
@ -548,7 +441,7 @@ class glance::api(
} }
# keystone config # keystone config
if $auth_strategy_real == 'keystone' { if $auth_strategy == 'keystone' {
include ::glance::api::authtoken include ::glance::api::authtoken
} }
@ -584,14 +477,14 @@ class glance::api(
} }
if $validate { if $validate {
$keystone_tenant_real = pick($keystone_tenant, $::glance::api::authtoken::project_name) $keystone_project_name = $::glance::api::authtoken::project_name
$keystone_username_real = pick($keystone_user, $::glance::api::authtoken::username) $keystone_username = $::glance::api::authtoken::username
$keystone_password_real = pick($keystone_password, $::glance::api::authtoken::password) $keystone_password = $::glance::api::authtoken::password
$auth_uri_real = pick($auth_uri, $::glance::api::authtoken::auth_uri) $auth_uri = $::glance::api::authtoken::auth_uri
$defaults = { $defaults = {
'glance-api' => { 'glance-api' => {
# lint:ignore:140chars # lint:ignore:140chars
'command' => "glance --os-auth-url ${auth_uri_real} --os-project-name ${keystone_tenant_real} --os-username ${keystone_username_real} --os-password ${keystone_password_real} image-list", 'command' => "glance --os-auth-url ${auth_uri} --os-project-name ${keystone_project_name} --os-username ${keystone_username} --os-password ${keystone_password} image-list",
# lint:endignore # lint:endignore
} }
} }

47
manifests/api/authtoken.pp
View File

@ -109,8 +109,7 @@
# [*include_service_catalog*] # [*include_service_catalog*]
# (Optional) Indicate whether to set the X-Service-Catalog header. If False, # (Optional) Indicate whether to set the X-Service-Catalog header. If False,
# middleware will not ask for service catalog on token validation and will # middleware will not ask for service catalog on token validation and will
# not # not set the X-Service-Catalog header. Boolean value.
# set the X-Service-Catalog header. Boolean value.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*keyfile*] # [*keyfile*]
@ -134,14 +133,12 @@
# #
# [*memcache_pool_socket_timeout*] # [*memcache_pool_socket_timeout*]
# (Optional) Number of seconds a connection to memcached is held unused in # (Optional) Number of seconds a connection to memcached is held unused in
# the # the pool before it is closed. Integer value
# pool before it is closed. Integer value
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*memcache_pool_unused_timeout*] # [*memcache_pool_unused_timeout*]
# (Optional) Number of seconds a connection to memcached is held unused in # (Optional) Number of seconds a connection to memcached is held unused in
# the # the pool before it is closed. Integer value
# pool before it is closed. Integer value
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*memcache_secret_key*] # [*memcache_secret_key*]
@ -151,12 +148,10 @@
# #
# [*memcache_security_strategy*] # [*memcache_security_strategy*]
# (Optional) If defined, indicate whether token data should be authenticated # (Optional) If defined, indicate whether token data should be authenticated
# or # or authenticated and encrypted. If MAC, token data is authenticated (with
# authenticated and encrypted. If MAC, token data is authenticated (with # HMAC) in the cache. If ENCRYPT, token data is encrypted and authenticated
# HMAC) # in the cache. If the value is not one of these options or empty,
# in the cache. If ENCRYPT, token data is encrypted and authenticated in the # auth_token will raise an exception on initialization.
# cache. If the value is not one of these options or empty, auth_token will
# raise an exception on initialization.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*memcache_use_advanced_pool*] # [*memcache_use_advanced_pool*]
@ -228,26 +223,16 @@ class glance::api::authtoken(
$token_cache_time = $::os_service_default, $token_cache_time = $::os_service_default,
) { ) {
if is_service_default($password) and $::glance::api::keystone_password == undef { if is_service_default($password) {
fail('Please set password for Glance service user') fail('Please set password for Glance service user')
} }
#NOTE(degorenko): Use pick to keep backward compatibility
$username_real = pick($::glance::api::keystone_user, $username)
$password_real = pick($::glance::api::keystone_password, $password)
$project_name_real = pick($::glance::api::keystone_tenant, $project_name)
$auth_url_real = pick($::glance::api::identity_uri, $auth_url)
$auth_uri_real = pick($::glance::api::auth_uri, $auth_uri)
$memcached_servers_real = pick($::glance::api::memcached_servers, $memcached_servers)
$token_cache_time_real = pick($::glance::api::token_cache_time, $token_cache_time)
$signing_dir_real = pick($::glance::api::signing_dir, $signing_dir)
keystone::resource::authtoken { 'glance_api_config': keystone::resource::authtoken { 'glance_api_config':
username => $username_real, username => $username,
password => $password_real, password => $password,
project_name => $project_name_real, project_name => $project_name,
auth_url => $auth_url_real, auth_url => $auth_url,
auth_uri => $auth_uri_real, auth_uri => $auth_uri,
auth_version => $auth_version, auth_version => $auth_version,
auth_type => $auth_type, auth_type => $auth_type,
auth_section => $auth_section, auth_section => $auth_section,
@ -273,10 +258,10 @@ class glance::api::authtoken(
memcache_security_strategy => $memcache_security_strategy, memcache_security_strategy => $memcache_security_strategy,
memcache_use_advanced_pool => $memcache_use_advanced_pool, memcache_use_advanced_pool => $memcache_use_advanced_pool,
memcache_pool_unused_timeout => $memcache_pool_unused_timeout, memcache_pool_unused_timeout => $memcache_pool_unused_timeout,
memcached_servers => $memcached_servers_real, memcached_servers => $memcached_servers,
region_name => $region_name, region_name => $region_name,
revocation_cache_time => $revocation_cache_time, revocation_cache_time => $revocation_cache_time,
signing_dir => $signing_dir_real, signing_dir => $signing_dir,
token_cache_time => $token_cache_time_real, token_cache_time => $token_cache_time,
} }
} }

110
manifests/glare.pp
View File

@ -73,62 +73,6 @@
# (optional) Sets the keystone region to use. # (optional) Sets the keystone region to use.
# Defaults to 'RegionOne'. # Defaults to 'RegionOne'.
# #
# == DEPRECATED PARAMETERS
#
# [*auth_region*]
# (optional) The region for the authentication service.
# If "use_user_token" is not in effect and using keystone auth,
# then region name can be specified.
# Defaults to $::os_service_default.
#
# [*auth_type*]
# (optional) Type is authorization being used.
# Deprecated and replaced by ::glance::glare::auth_strategy
# Defaults to undef.
#
# [*auth_uri*]
# (optional) Complete public Identity API endpoint.
# Deprecated and will be replaced by ::glance::glare::authtoken::auth_uri
# Defaults to undef.
#
# [*identity_uri*]
# (optional) Complete admin Identity API endpoint.
# Deprecated and will be replaced by ::glance::glare::authtoken::auth_url
# Defaults to undef.
#
# [*keystone_tenant*]
# (optional) Tenant to authenticate to.
# Deprecated and will be replaced by ::glance::glare::authtoken::project_name
# Defaults to undef.
#
# [*keystone_user*]
# (optional) User to authenticate as with keystone.
# Deprecated and will be replaced by ::glance::glare::authtoken::username
# Defaults to undef.
#
# [*keystone_password*]
# (optional) Password used to authentication.
# Deprecated and will be replaced by ::glance::glare::authtoken::password
# Defaults to undef.
#
# [*signing_dir*]
# (optional) Directory used to cache files related to PKI tokens.
# Deprecated and will be replaced by ::glance::glare::authtoken::signing_dir
# Defaults to undef.
#
# [*memcached_servers*]
# (optinal) a list of memcached server(s) to use for caching. If left undefined,
# tokens will instead be cached in-process.
# Deprecated and will be replaced by ::glance::glare::authtoken::memcached_servers
# Defaults to undef.
#
# [*token_cache_time*]
# (optional) In order to prevent excessive effort spent validating tokens,
# the middleware caches previously-seen tokens for a configurable duration (in seconds).
# Set to -1 to disable caching completely.
# Deprecated and will be replaced by ::glance::glare::authtoken::token_cache_time
# Defaults to undef.
#
class glance::glare( class glance::glare(
$package_ensure = 'present', $package_ensure = 'present',
$bind_host = '0.0.0.0', $bind_host = '0.0.0.0',
@ -146,17 +90,6 @@ class glance::glare(
$default_store = undef, $default_store = undef,
$multi_store = false, $multi_store = false,
$os_region_name = 'RegionOne', $os_region_name = 'RegionOne',
# DEPRECATED PARAMETERS
$auth_region = undef,
$auth_type = undef,
$auth_uri = undef,
$identity_uri = undef,
$memcached_servers = undef,
$keystone_tenant = undef,
$keystone_user = undef,
$keystone_password = undef,
$signing_dir = undef,
$token_cache_time = undef,
) inherits glance { ) inherits glance {
include ::glance::deps include ::glance::deps
@ -164,49 +97,6 @@ class glance::glare(
include ::glance::glare::db include ::glance::glare::db
include ::glance::glare::logging include ::glance::glare::logging
if $auth_region {
warning('auth_region is deprecated, has no effect and and will be removed in the O release.')
}
if $keystone_password {
warning('glance::glare::keystone_password is deprecated, please use glance::glare::authtoken::password')
}
if $auth_type {
warning('glance::glare::auth_type is deprecated, please use glance::glare::auth_strategy')
$auth_strategy_real = $auth_type
} else {
$auth_strategy_real = $auth_strategy
}
if $auth_uri {
warning('glance::glare::auth_uri is deprecated, please use glance::glare::authtoken::auth_uri')
}
if $identity_uri {
warning('glance::glare::identity_uri is deprecated, please use glance::glare::authtoken::auth_url')
}
if $keystone_tenant {
warning('glance::glare::keystone_tenant is deprecated, please use glance::glare::authtoken::project_name')
}
if $keystone_user {
warning('glance::glare::keystone_user is deprecated, please use glance::glare::authtoken::username')
}
if $memcached_servers {
warning('glance::glare::memcached_servers is deprecated, please use glance::glare::authtoken::memcached_servers')
}
if $signing_dir {
warning('glance::glare::signing_dir is deprecated, please use glance::glare::authtoken::signing_dir')
}
if $token_cache_time {
warning('glance::glare::token_cache_time is deprecated, please use glance::glare::authtoken::token_cache_time')
}
if ( $glance::params::glare_package_name != $glance::params::registry_package_name ) { if ( $glance::params::glare_package_name != $glance::params::registry_package_name ) {
ensure_packages('glance-glare', { ensure_packages('glance-glare', {
ensure => $package_ensure, ensure => $package_ensure,

41
manifests/glare/authtoken.pp
View File

@ -109,8 +109,7 @@
# [*include_service_catalog*] # [*include_service_catalog*]
# (Optional) Indicate whether to set the X-Service-Catalog header. If False, # (Optional) Indicate whether to set the X-Service-Catalog header. If False,
# middleware will not ask for service catalog on token validation and will # middleware will not ask for service catalog on token validation and will
# not # not set the X-Service-Catalog header. Boolean value.
# set the X-Service-Catalog header. Boolean value.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*keyfile*] # [*keyfile*]
@ -134,14 +133,12 @@
# #
# [*memcache_pool_socket_timeout*] # [*memcache_pool_socket_timeout*]
# (Optional) Number of seconds a connection to memcached is held unused in # (Optional) Number of seconds a connection to memcached is held unused in
# the # the pool before it is closed. Integer value
# pool before it is closed. Integer value
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*memcache_pool_unused_timeout*] # [*memcache_pool_unused_timeout*]
# (Optional) Number of seconds a connection to memcached is held unused in # (Optional) Number of seconds a connection to memcached is held unused in
# the # the pool before it is closed. Integer value
# pool before it is closed. Integer value
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*memcache_secret_key*] # [*memcache_secret_key*]
@ -150,10 +147,8 @@
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*memcache_security_strategy*] # [*memcache_security_strategy*]
# (Optional) If defined, indicate whether token data should be authenticated # (Optional) If defined, indicate whether token data should be authenticated or
# or # authenticated and encrypted. If MAC, token data is authenticated (with HMAC)
# authenticated and encrypted. If MAC, token data is authenticated (with
# HMAC)
# in the cache. If ENCRYPT, token data is encrypted and authenticated in the # in the cache. If ENCRYPT, token data is encrypted and authenticated in the
# cache. If the value is not one of these options or empty, auth_token will # cache. If the value is not one of these options or empty, auth_token will
# raise an exception on initialization. # raise an exception on initialization.
@ -232,22 +227,12 @@ class glance::glare::authtoken(
fail('Please set password for Glance service user') fail('Please set password for Glance service user')
} }
#NOTE(degorenko): Use pick to keep backward compatibility
$username_real = pick($::glance::glare::keystone_user, $username)
$password_real = pick($::glance::glare::keystone_password, $password)
$project_name_real = pick($::glance::glare::keystone_tenant, $project_name)
$auth_url_real = pick($::glance::glare::identity_uri, $auth_url)
$auth_uri_real = pick($::glance::glare::auth_uri, $auth_uri)
$memcached_servers_real = pick($::glance::glare::memcached_servers, $memcached_servers)
$token_cache_time_real = pick($::glance::glare::token_cache_time, $token_cache_time)
$signing_dir_real = pick($::glance::glare::signing_dir, $signing_dir)
keystone::resource::authtoken { 'glance_glare_config': keystone::resource::authtoken { 'glance_glare_config':
username => $username_real, username => $username,
password => $password_real, password => $password,
project_name => $project_name_real, project_name => $project_name,
auth_url => $auth_url_real, auth_url => $auth_url,
auth_uri => $auth_uri_real, auth_uri => $auth_uri,
auth_version => $auth_version, auth_version => $auth_version,
auth_type => $auth_type, auth_type => $auth_type,
auth_section => $auth_section, auth_section => $auth_section,
@ -273,10 +258,10 @@ class glance::glare::authtoken(
memcache_security_strategy => $memcache_security_strategy, memcache_security_strategy => $memcache_security_strategy,
memcache_use_advanced_pool => $memcache_use_advanced_pool, memcache_use_advanced_pool => $memcache_use_advanced_pool,
memcache_pool_unused_timeout => $memcache_pool_unused_timeout, memcache_pool_unused_timeout => $memcache_pool_unused_timeout,
memcached_servers => $memcached_servers_real, memcached_servers => $memcached_servers,
region_name => $region_name, region_name => $region_name,
revocation_cache_time => $revocation_cache_time, revocation_cache_time => $revocation_cache_time,
signing_dir => $signing_dir_real, signing_dir => $signing_dir,
token_cache_time => $token_cache_time_real, token_cache_time => $token_cache_time,
} }
} }

100
manifests/registry.pp
View File

@ -117,55 +117,6 @@
# (optional) Sets the keystone region to use. # (optional) Sets the keystone region to use.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# DEPRECATED PARAMETERS
#
# [*keystone_password*]
# (optional) The keystone password for administrative user.
# Deprecated and will be replaced by ::glance::registry::authtoken::password
# Default to undef.
#
# [*auth_type*]
# (optional) Authentication type. Defaults to undef.
# Deprecated and will be replaced by ::glance::registry::auth_strategy
#
# [*auth_uri*]
# (optional) Complete public Identity API endpoint.
# Deprecated and will be replaced by ::glance::registry::authtoken::auth_uri
# Defaults to undef.
#
# [*identity_uri*]
# (optional) Complete admin Identity API endpoint.
# Deprecated and will be replaced by ::glance::registry::authtoken::auth_url
# Defaults to undef.
#
# [*keystone_tenant*]
# (optional) administrative tenant name to connect to keystone.
# Deprecated and will be replaced by ::glance::registry::authtoken::project_name
# Defaults to undef.
#
# [*keystone_user*]
# (optional) administrative user name to connect to keystone.
# Deprecated and will be replaced by ::glance::registry::authtoken::username
# Defaults to undef.
#
# [*signing_dir*]
# Directory used to cache files related to PKI tokens.
# Deprecated and will be replaced by ::glance::registry::authtoken::signing_dir
# Defaults to undef.
#
# [*memcached_servers*]
# (optinal) a list of memcached server(s) to use for caching. If left undefined,
# tokens will instead be cached in-process.
# Deprecated and will be replaced by ::glance::registry::authtoken::memcached_servers
# Defaults to undef.
#
# [*token_cache_time*]
# In order to prevent excessive effort spent validating tokens,
# the middleware caches previously-seen tokens for a configurable duration (in seconds).
# Set to -1 to disable caching completely.
# Deprecated and will be replaced by ::glance::registry::authtoken::token_cache_time
# Defaults to undef.
#
class glance::registry( class glance::registry(
$package_ensure = 'present', $package_ensure = 'present',
$debug = undef, $debug = undef,
@ -194,61 +145,12 @@ class glance::registry(
$ca_file = $::os_service_default, $ca_file = $::os_service_default,
$sync_db = true, $sync_db = true,
$os_region_name = $::os_service_default, $os_region_name = $::os_service_default,
# Deprecated
$keystone_password = undef,
$auth_type = undef,
$auth_uri = undef,
$identity_uri = undef,
$keystone_tenant = undef,
$keystone_user = undef,
$signing_dir = undef,
$memcached_servers = undef,
$token_cache_time = undef,
) inherits glance { ) inherits glance {
include ::glance::deps include ::glance::deps
include ::glance::registry::logging include ::glance::registry::logging
include ::glance::registry::db include ::glance::registry::db
if $keystone_password {
warning('glance::registry::keystone_password is deprecated, please use glance::registry::authtoken::password')
}
if $auth_type {
warning('glance::registry::auth_type is deprecated, please use glance::registry::auth_strategy')
$auth_strategy_real = $auth_type
} else {
$auth_strategy_real = $auth_strategy
}
if $auth_uri {
warning('glance::registry::auth_uri is deprecated, please use glance::registry::authtoken::auth_uri')
}
if $identity_uri {
warning('glance::registry::identity_uri is deprecated, please use glance::registry::authtoken::auth_url')
}
if $keystone_tenant {
warning('glance::registry::keystone_tenant is deprecated, please use glance::registry::authtoken::project_name')
}
if $keystone_user {
warning('glance::registry::keystone_user is deprecated, please use glance::registry::authtoken::username')
}
if $memcached_servers {
warning('glance::registry::memcached_servers is deprecated, please use glance::registry::authtoken::memcached_servers')
}
if $signing_dir {
warning('glance::registry::signing_dir is deprecated, please use glance::registry::authtoken::signing_dir')
}
if $token_cache_time {
warning('glance::registry::token_cache_time is deprecated, please use glance::registry::authtoken::token_cache_time')
}
if ( $glance::params::api_package_name != $glance::params::registry_package_name ) { if ( $glance::params::api_package_name != $glance::params::registry_package_name ) {
ensure_packages( 'glance-registry', ensure_packages( 'glance-registry',
{ {
@ -282,7 +184,7 @@ class glance::registry(
} }
# keystone config # keystone config
if $auth_strategy_real == 'keystone' { if $auth_strategy == 'keystone' {
include ::glance::registry::authtoken include ::glance::registry::authtoken
} }

43
manifests/registry/authtoken.pp
View File

@ -109,8 +109,7 @@
# [*include_service_catalog*] # [*include_service_catalog*]
# (Optional) Indicate whether to set the X-Service-Catalog header. If False, # (Optional) Indicate whether to set the X-Service-Catalog header. If False,
# middleware will not ask for service catalog on token validation and will # middleware will not ask for service catalog on token validation and will
# not # not set the X-Service-Catalog header. Boolean value.
# set the X-Service-Catalog header. Boolean value.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*keyfile*] # [*keyfile*]
@ -134,14 +133,12 @@
# #
# [*memcache_pool_socket_timeout*] # [*memcache_pool_socket_timeout*]
# (Optional) Number of seconds a connection to memcached is held unused in # (Optional) Number of seconds a connection to memcached is held unused in
# the # the pool before it is closed. Integer value
# pool before it is closed. Integer value
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*memcache_pool_unused_timeout*] # [*memcache_pool_unused_timeout*]
# (Optional) Number of seconds a connection to memcached is held unused in # (Optional) Number of seconds a connection to memcached is held unused in
# the # the pool before it is closed. Integer value
# pool before it is closed. Integer value
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*memcache_secret_key*] # [*memcache_secret_key*]
@ -151,10 +148,8 @@
# #
# [*memcache_security_strategy*] # [*memcache_security_strategy*]
# (Optional) If defined, indicate whether token data should be authenticated # (Optional) If defined, indicate whether token data should be authenticated
# or # or authenticated and encrypted. If MAC, token data is authenticated (with
# authenticated and encrypted. If MAC, token data is authenticated (with # HMAC) in the cache. If ENCRYPT, token data is encrypted and authenticated in the
# HMAC)
# in the cache. If ENCRYPT, token data is encrypted and authenticated in the
# cache. If the value is not one of these options or empty, auth_token will # cache. If the value is not one of these options or empty, auth_token will
# raise an exception on initialization. # raise an exception on initialization.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
@ -228,26 +223,16 @@ class glance::registry::authtoken(
$token_cache_time = $::os_service_default, $token_cache_time = $::os_service_default,
) { ) {
if is_service_default($password) and $::glance::registry::keystone_password == undef { if is_service_default($password) {
fail('Please set password for Glance service user') fail('Please set password for Glance service user')
} }
#NOTE(degorenko): Use pick to keep backward compatibility
$username_real = pick($::glance::registry::keystone_user, $username)
$password_real = pick($::glance::registry::keystone_password, $password)
$project_name_real = pick($::glance::registry::keystone_tenant, $project_name)
$auth_url_real = pick($::glance::registry::identity_uri, $auth_url)
$auth_uri_real = pick($::glance::registry::auth_uri, $auth_uri)
$memcached_servers_real = pick($::glance::registry::memcached_servers, $memcached_servers)
$token_cache_time_real = pick($::glance::registry::token_cache_time, $token_cache_time)
$signing_dir_real = pick($::glance::registry::signing_dir, $signing_dir)
keystone::resource::authtoken { 'glance_registry_config': keystone::resource::authtoken { 'glance_registry_config':
username => $username_real, username => $username,
password => $password_real, password => $password,
project_name => $project_name_real, project_name => $project_name,
auth_url => $auth_url_real, auth_url => $auth_url,
auth_uri => $auth_uri_real, auth_uri => $auth_uri,
auth_version => $auth_version, auth_version => $auth_version,
auth_type => $auth_type, auth_type => $auth_type,
auth_section => $auth_section, auth_section => $auth_section,
@ -273,10 +258,10 @@ class glance::registry::authtoken(
memcache_security_strategy => $memcache_security_strategy, memcache_security_strategy => $memcache_security_strategy,
memcache_use_advanced_pool => $memcache_use_advanced_pool, memcache_use_advanced_pool => $memcache_use_advanced_pool,
memcache_pool_unused_timeout => $memcache_pool_unused_timeout, memcache_pool_unused_timeout => $memcache_pool_unused_timeout,
memcached_servers => $memcached_servers_real, memcached_servers => $memcached_servers,
region_name => $region_name, region_name => $region_name,
revocation_cache_time => $revocation_cache_time, revocation_cache_time => $revocation_cache_time,
signing_dir => $signing_dir_real, signing_dir => $signing_dir,
token_cache_time => $token_cache_time_real, token_cache_time => $token_cache_time,
} }
} }

29
releasenotes/notes/remove_old_authtoken_options-954b592223d48e6e.yaml Normal file
View File

@ -0,0 +1,29 @@
---
other:
- removed deprecated glance::api::keystone_user
- removed deprecated glance::api::keystone_password
- removed deprecated glance::api::keystone_tenant
- removed deprecatedglance::api::identity_uri
- removed deprecated glance::api::auth_uri
- removed deprecated glance::api::memcached_servers
- removed deprecated glance::api::token_cache_time
- removed deprecated glance::api::signing_dir
- removed deprecated glance::api::auth_type
- removed deprecated glance::glare::keystone_user
- removed deprecated glance::glare::keystone_password
- removed deprecated glance::glare::keystone_tenant
- removed deprecated glance::glare::identity_uri
- removed deprecated glance::glare::auth_uri
- removed deprecated glance::glare::memcached_servers
- removed deprecated glance::glare::token_cache_time
- removed deprecated glance::glare::signing_dir
- removed deprecated glance::glare::auth_type
- removed deprecated glance::registry::keystone_user
- removed deprecated glance::registry::keystone_password
- removed deprecated glance::registry::keystone_tenant
- removed deprecated glance::registry::identity_uri
- removed deprecated glance::registry::auth_uri
- removed deprecated glance::registry::memcached_servers
- removed deprecated glance::registry::token_cache_time
- removed deprecated glance::registry::signing_dir
- removed deprecated glance::registry::auth_type

39
spec/classes/glance_api_spec.rb
View File

@ -1,6 +1,11 @@
require 'spec_helper' require 'spec_helper'
describe 'glance::api' do describe 'glance::api' do
let :pre_condition do
"class { '::glance::api::authtoken':
password => 'ChangeMe',
}"
end
let :default_params do let :default_params do
{ {
@ -18,7 +23,6 @@ describe 'glance::api' do
:manage_service => true, :manage_service => true,
:backlog => '<SERVICE DEFAULT>', :backlog => '<SERVICE DEFAULT>',
:workers => '7', :workers => '7',
:keystone_password => 'ChangeMe',
:show_image_direct_url => '<SERVICE DEFAULT>', :show_image_direct_url => '<SERVICE DEFAULT>',
:show_multiple_locations => '<SERVICE DEFAULT>', :show_multiple_locations => '<SERVICE DEFAULT>',
:location_strategy => '<SERVICE DEFAULT>', :location_strategy => '<SERVICE DEFAULT>',
@ -43,8 +47,7 @@ describe 'glance::api' do
shared_examples_for 'glance::api' do shared_examples_for 'glance::api' do
[{:keystone_password => 'ChangeMe'}, [{
{
:debug => true, :debug => true,
:bind_host => '127.0.0.1', :bind_host => '127.0.0.1',
:bind_port => '9222', :bind_port => '9222',
@ -55,7 +58,6 @@ describe 'glance::api' do
:enabled => false, :enabled => false,
:backlog => '4095', :backlog => '4095',
:workers => '5', :workers => '5',
:keystone_password => 'ChangeMe',
:show_image_direct_url => true, :show_image_direct_url => true,
:show_multiple_locations => true, :show_multiple_locations => true,
:location_strategy => 'store_type', :location_strategy => 'store_type',
@ -164,7 +166,6 @@ describe 'glance::api' do
describe 'with disabled service managing' do describe 'with disabled service managing' do
let :params do let :params do
{ {
:keystone_password => 'ChangeMe',
:manage_service => false, :manage_service => false,
:enabled => false, :enabled => false,
} }
@ -182,7 +183,6 @@ describe 'glance::api' do
describe 'with overridden pipeline' do describe 'with overridden pipeline' do
let :params do let :params do
{ {
:keystone_password => 'ChangeMe',
:pipeline => 'something', :pipeline => 'something',
} }
end end
@ -193,7 +193,6 @@ describe 'glance::api' do
describe 'with blank pipeline' do describe 'with blank pipeline' do
let :params do let :params do
{ {
:keystone_password => 'ChangeMe',
:pipeline => '', :pipeline => '',
} }
end end
@ -389,32 +388,6 @@ describe 'glance::api' do
:require => 'Exec[execute glance-api validation]', :require => 'Exec[execute glance-api validation]',
)} )}
end end
describe 'with deprecated auth parameters' do
let :params do
default_params.merge({
:auth_type => 'keystone',
:keystone_tenant => 'services',
:keystone_user => 'glance',
:keystone_password => 'password',
:token_cache_time => '1000',
:memcached_servers => 'localhost:11211',
:signing_dir => '/tmp/keystone',
:auth_uri => 'http://127.0.0.1:5000',
:identity_uri => 'http://127.0.0.1:35357',
})
end
it 'deprecated auth parameters' do
is_expected.to contain_glance_api_config('keystone_authtoken/memcached_servers').with_value(params[:memcached_servers])
is_expected.to contain_glance_api_config('keystone_authtoken/username').with_value(params[:keystone_user])
is_expected.to contain_glance_api_config('keystone_authtoken/project_name').with_value(params[:keystone_tenant])
is_expected.to contain_glance_api_config('keystone_authtoken/password').with_value(params[:keystone_password])
is_expected.to contain_glance_api_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time])
is_expected.to contain_glance_api_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir])
is_expected.to contain_glance_api_config('keystone_authtoken/auth_uri').with_value(params[:auth_uri])
is_expected.to contain_glance_api_config('keystone_authtoken/auth_url').with_value(params[:identity_uri])
end
end
end end
shared_examples_for 'glance::api Debian' do shared_examples_for 'glance::api Debian' do

2
spec/classes/glance_backend_cinder_spec.rb
View File

@ -23,7 +23,7 @@ require 'spec_helper'
describe 'glance::backend::cinder' do describe 'glance::backend::cinder' do
let :pre_condition do let :pre_condition do
'class { "glance::api": keystone_password => "pass" }' 'class { "glance::api::authtoken": password => "pass" }'
end end
shared_examples_for 'glance with cinder backend' do shared_examples_for 'glance with cinder backend' do

3
spec/classes/glance_backend_swift_spec.rb
View File

@ -10,7 +10,8 @@ describe 'glance::backend::swift' do
end end
let :pre_condition do let :pre_condition do
'class { "glance::api": keystone_password => "pass" }' 'class { "glance::api::authtoken": password => "pass" }
include ::glance::api'
end end
describe 'when default parameters' do describe 'when default parameters' do

2
spec/classes/glance_backend_vsphere_spec.rb
View File

@ -23,7 +23,7 @@ require 'spec_helper'
describe 'glance::backend::vsphere' do describe 'glance::backend::vsphere' do
let :pre_condition do let :pre_condition do
'class { "glance::api": keystone_password => "pass" }' 'class { "glance::api::authtoken": password => "pass" }'
end end
shared_examples_for 'glance with vsphere backend' do shared_examples_for 'glance with vsphere backend' do

50
spec/classes/glance_glare_spec.rb
View File

@ -1,17 +1,20 @@
require 'spec_helper' require 'spec_helper'
describe 'glance::glare' do describe 'glance::glare' do
let :pre_condition do
"class {'::glance::glare::authtoken':
password => 'ChangeMe',
}"
end
let :default_params do let :default_params do
{ {
:bind_host => '0.0.0.0', :bind_host => '0.0.0.0',
:bind_port => '9494', :bind_port => '9494',
:auth_type => 'keystone', :auth_strategy => 'keystone',
:enabled => true, :enabled => true,
:manage_service => true, :manage_service => true,
:backlog => '4096', :backlog => '4096',
:workers => '7', :workers => '7',
:keystone_password => 'ChangeMe',
:stores => false, :stores => false,
:default_store => false, :default_store => false,
:os_region_name => 'RegionOne', :os_region_name => 'RegionOne',
@ -24,17 +27,16 @@ describe 'glance::glare' do
{ {
:bind_host => '127.0.0.1', :bind_host => '127.0.0.1',
:bind_port => '9222', :bind_port => '9222',
:auth_type => 'not_keystone', :auth_strategy => 'not_keystone',
:enabled => false, :enabled => false,
:backlog => '4095', :backlog => '4095',
:workers => '5', :workers => '5',
:keystone_password => 'ChangeMe2',
:os_region_name => 'RegionOne2', :os_region_name => 'RegionOne2',
:pipeline => 'keystone2', :pipeline => 'keystone2',
} }
].each do |param_set| ].each do |param_set|
describe "when #{param_set == {:keystone_password => 'ChangeMe'} ? "using default" : "specifying"} class parameters" do describe "when not using default class parameters" do
let :param_hash do let :param_hash do
default_params.merge(param_set) default_params.merge(param_set)
@ -82,8 +84,8 @@ describe 'glance::glare' do
is_expected.to contain_glance_glare_config('DEFAULT/key_file').with_value('<SERVICE DEFAULT>') is_expected.to contain_glance_glare_config('DEFAULT/key_file').with_value('<SERVICE DEFAULT>')
end end
it 'is_expected.to configure itself for keystone if that is the auth_type' do it 'is_expected.to configure itself for keystone if that is the auth_strategy' do
if params[:auth_type] == 'keystone' if params[:auth_strategy] == 'keystone'
is_expected.to contain('paste_deploy/flavor').with_value('keystone+cachemanagement') is_expected.to contain('paste_deploy/flavor').with_value('keystone+cachemanagement')
end end
end end
@ -94,7 +96,6 @@ describe 'glance::glare' do
describe 'with disabled service managing' do describe 'with disabled service managing' do
let :params do let :params do
{ {
:keystone_password => 'ChangeMe',
:manage_service => false, :manage_service => false,
:enabled => false, :enabled => false,
} }
@ -112,7 +113,6 @@ describe 'glance::glare' do
describe 'with overridden pipeline' do describe 'with overridden pipeline' do
let :params do let :params do
{ {
:keystone_password => 'ChangeMe',
:pipeline => 'something', :pipeline => 'something',
} }
end end
@ -123,7 +123,6 @@ describe 'glance::glare' do
describe 'with blank pipeline' do describe 'with blank pipeline' do
let :params do let :params do
{ {
:keystone_password => 'ChangeMe',
:pipeline => '', :pipeline => '',
} }
end end
@ -141,7 +140,6 @@ describe 'glance::glare' do
describe "with pipeline incorrect value #{pipeline}" do describe "with pipeline incorrect value #{pipeline}" do
let :params do let :params do
{ {
:keystone_password => 'ChangeMe',
:pipeline => pipeline :pipeline => pipeline
} }
end end
@ -232,33 +230,7 @@ describe 'glance::glare' do
it { is_expected.to contain_glance_glare_config('glance_store/default_store').with_value('glance.store.filesystem.Store') } it { is_expected.to contain_glance_glare_config('glance_store/default_store').with_value('glance.store.filesystem.Store') }
it { is_expected.to contain_glance_glare_config('glance_store/stores').with_value('glance.store.filesystem.Store') } it { is_expected.to contain_glance_glare_config('glance_store/stores').with_value('glance.store.filesystem.Store') }
end end
end
describe 'with deprecated auth parameters' do
let :params do
default_params.merge({
:auth_type => 'keystone',
:keystone_tenant => 'services',
:keystone_user => 'glance',
:keystone_password => 'password',
:token_cache_time => '1000',
:memcached_servers => 'localhost:11211',
:signing_dir => '/tmp/keystone',
:auth_uri => 'http://127.0.0.1:5000',
:identity_uri => 'http://127.0.0.1:35357',
})
end
it 'deprecated auth parameters' do
is_expected.to contain_glance_glare_config('keystone_authtoken/memcached_servers').with_value(params[:memcached_servers])
is_expected.to contain_glance_glare_config('keystone_authtoken/username').with_value(params[:keystone_user])
is_expected.to contain_glance_glare_config('keystone_authtoken/project_name').with_value(params[:keystone_tenant])
is_expected.to contain_glance_glare_config('keystone_authtoken/password').with_value(params[:keystone_password])
is_expected.to contain_glance_glare_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time])
is_expected.to contain_glance_glare_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir])
is_expected.to contain_glance_glare_config('keystone_authtoken/auth_uri').with_value(params[:auth_uri])
is_expected.to contain_glance_glare_config('keystone_authtoken/auth_url').with_value(params[:identity_uri])
end
end
end
shared_examples_for 'glance::glare Debian' do shared_examples_for 'glance::glare Debian' do
let(:params) { default_params } let(:params) { default_params }

3
spec/classes/glance_keystone_auth_spec.rb
View File

@ -128,7 +128,8 @@ describe 'glance::keystone::auth' do
describe 'when configuring glance-api and the keystone endpoint' do describe 'when configuring glance-api and the keystone endpoint' do
let :pre_condition do let :pre_condition do
"class { 'glance::api': keystone_password => 'test' }" "class { 'glance::api::authtoken': password => 'test' }
include ::glance::api"
end end
let :params do let :params do

2
spec/classes/glance_keystone_glare_auth_spec.rb
View File

@ -128,7 +128,7 @@ describe 'glance::keystone::glare_auth' do
describe 'when configuring glance-glare and the keystone endpoint' do describe 'when configuring glance-glare and the keystone endpoint' do
let :pre_condition do let :pre_condition do
"class { 'glance::glare': keystone_password => 'test' }" "class { 'glance::glare::authtoken': password => 'test' }"
end end
let :params do let :params do

46
spec/classes/glance_registry_spec.rb
View File

@ -1,6 +1,12 @@
require 'spec_helper' require 'spec_helper'
describe 'glance::registry' do describe 'glance::registry' do
let :pre_condition do
"class { 'glance::registry::authtoken':
password => 'ChangeMe',
}"
end
let :default_params do let :default_params do
{ {
:debug => false, :debug => false,
@ -12,8 +18,6 @@ describe 'glance::registry' do
:log_dir => '/var/log/glance', :log_dir => '/var/log/glance',
:enabled => true, :enabled => true,
:manage_service => true, :manage_service => true,
:auth_type => 'keystone',
:keystone_password => 'ChangeMe',
:purge_config => false, :purge_config => false,
:sync_db => true, :sync_db => true,
:os_region_name => '<SERVICE DEFAULT>', :os_region_name => '<SERVICE DEFAULT>',
@ -25,20 +29,17 @@ describe 'glance::registry' do
shared_examples_for 'glance::registry' do shared_examples_for 'glance::registry' do
[ [
{:keystone_password => 'ChangeMe'},
{ {
:bind_host => '127.0.0.1', :bind_host => '127.0.0.1',
:bind_port => '9111', :bind_port => '9111',
:workers => '5', :workers => '5',
:enabled => false, :enabled => false,
:auth_type => 'keystone',
:keystone_password => 'ChangeMe',
:sync_db => false, :sync_db => false,
:os_region_name => 'RegionOne2', :os_region_name => 'RegionOne2',
} }
].each do |param_set| ].each do |param_set|
describe "when #{param_set == {:keystone_password => 'ChangeMe'} ? "using default" : "specifying"} class parameters" do describe "when using default class parameters" do
let :param_hash do let :param_hash do
default_params.merge(param_set) default_params.merge(param_set)
end end
@ -80,7 +81,7 @@ describe 'glance::registry' do
].each do |config| ].each do |config|
is_expected.to contain_glance_registry_config("DEFAULT/#{config}").with_value(param_hash[config.intern]) is_expected.to contain_glance_registry_config("DEFAULT/#{config}").with_value(param_hash[config.intern])
end end
if param_hash[:auth_type] == 'keystone' if param_hash[:auth_strategy] == 'keystone'
is_expected.to contain_glance_registry_config("paste_deploy/flavor").with_value('keystone') is_expected.to contain_glance_registry_config("paste_deploy/flavor").with_value('keystone')
end end
end end
@ -106,7 +107,6 @@ describe 'glance::registry' do
describe 'with disabled service managing' do describe 'with disabled service managing' do
let :params do let :params do
{ {
:keystone_password => 'ChangeMe',
:manage_service => false, :manage_service => false,
:enabled => false, :enabled => false,
} }
@ -128,7 +128,6 @@ describe 'glance::registry' do
# but there is no reason that there can't be more options in the future. # but there is no reason that there can't be more options in the future.
let :params do let :params do
{ {
:keystone_password => 'ChangeMe',
:pipeline => 'validoptionstring', :pipeline => 'validoptionstring',
} }
end end
@ -139,7 +138,6 @@ describe 'glance::registry' do
describe 'with blank pipeline' do describe 'with blank pipeline' do
let :params do let :params do
{ {
:keystone_password => 'ChangeMe',
:pipeline => '', :pipeline => '',
} }
end end
@ -157,8 +155,7 @@ describe 'glance::registry' do
describe "with pipeline incorrect value #{pipeline}" do describe "with pipeline incorrect value #{pipeline}" do
let :params do let :params do
{ {
:keystone_password => 'ChangeMe', :auth_strategy => 'keystone',
:auth_type => 'keystone',
:pipeline => pipeline :pipeline => pipeline
} }
end end
@ -184,31 +181,6 @@ describe 'glance::registry' do
end end
end end
describe 'with deprecated auth parameters' do
let :params do
default_params.merge({
:auth_type => 'keystone',
:keystone_tenant => 'services',
:keystone_user => 'glance',
:keystone_password => 'password',
:token_cache_time => '1000',
:memcached_servers => 'localhost:11211',
:signing_dir => '/tmp/keystone',
:auth_uri => 'http://127.0.0.1:5000',
:identity_uri => 'http://127.0.0.1:35357',
})
end
it 'deprecated auth parameters' do
is_expected.to contain_glance_registry_config('keystone_authtoken/memcached_servers').with_value(params[:memcached_servers])
is_expected.to contain_glance_registry_config('keystone_authtoken/username').with_value(params[:keystone_user])
is_expected.to contain_glance_registry_config('keystone_authtoken/project_name').with_value(params[:keystone_tenant])
is_expected.to contain_glance_registry_config('keystone_authtoken/password').with_value(params[:keystone_password])
is_expected.to contain_glance_registry_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time])
is_expected.to contain_glance_registry_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir])
is_expected.to contain_glance_registry_config('keystone_authtoken/auth_uri').with_value(params[:auth_uri])
is_expected.to contain_glance_registry_config('keystone_authtoken/auth_url').with_value(params[:identity_uri])
end
end
end end
shared_examples_for 'glance::registry Debian' do shared_examples_for 'glance::registry Debian' do