openstack
/
puppet-ironic
Code Issues Proposed changes

Accept system scope credential for Nova API request 

Currently Ironic uses the user credential in [nova] section to use
External Event API in Nova but this API is available only for system
admin when SRBAC is enforced.

This change allows usage of system-scoped credential instead of
project-scoped one.

Change-Id: Ib5020f4bd01a18580aa765248ea29e132862d57c
This commit is contained in:
Takashi Kajinami 2022-01-25 16:41:38 +09:00
parent f017521d93
commit bb714ff15a
3 changed files with 48 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
manifests/nova.pp
View File

@ -40,6 +40,10 @@
# The name of project's domain (required for Identity V3).
# Defaults to 'Default'
#
# [*system_scope*]
# (Optional) Scope for system operations
# Defaults to $::os_service_default
#
# [*region_name*]
# (optional) Region name for connecting to nova in admin context
# through the OpenStack Identity service.
@ -61,19 +65,31 @@ class ironic::nova (
$password = $::os_service_default,
$user_domain_name = 'Default',
$project_domain_name = 'Default',
$system_scope = $::os_service_default,
$region_name = $::os_service_default,
$endpoint_override = $::os_service_default,
$send_power_notifications = $::os_service_default,
) {
include ironic::deps
if is_service_default($system_scope) {
$project_name_real = $project_name
$project_domain_name_real = $project_domain_name
} else {
$project_name_real = $::os_service_default
$project_domain_name_real = $::os_service_default
}
ironic_config {
'nova/auth_type': value => $auth_type;
'nova/username': value => $username;
'nova/password': value => $password, secret => true;
'nova/auth_url': value => $auth_url;
'nova/project_name': value => $project_name;
'nova/project_name': value => $project_name_real;
'nova/user_domain_name': value => $user_domain_name;
'nova/project_domain_name': value => $project_domain_name;
'nova/project_domain_name': value => $project_domain_name_real;
'nova/system_scope': value => $system_scope;
'nova/region_name': value => $region_name;
'nova/endpoint_override': value => $endpoint_override;
'nova/send_power_notifications': value => $send_power_notifications;

5
releasenotes/notes/system_scope-nova-52a51f6b7863a8b7.yaml Normal file
View File

@ -0,0 +1,5 @@
---
features:
- |
The new ``sysem_scope`` parameter has been added to the ``ironic::nova``
class.

15
spec/classes/ironic_nova_spec.rb
View File

@ -41,6 +41,7 @@ describe 'ironic::nova' do
is_expected.to contain_ironic_config('nova/password').with_value('<SERVICE DEFAULT>').with_secret(true)
is_expected.to contain_ironic_config('nova/user_domain_name').with_value('Default')
is_expected.to contain_ironic_config('nova/project_domain_name').with_value('Default')
is_expected.to contain_ironic_config('nova/system_scope').with_value('<SERVICE DEFAULT>')
is_expected.to contain_ironic_config('nova/region_name').with_value('<SERVICE DEFAULT>')
is_expected.to contain_ironic_config('nova/endpoint_override').with_value('<SERVICE DEFAULT>')
is_expected.to contain_ironic_config('nova/send_power_notifications').with_value('<SERVICE DEFAULT>')
@ -71,11 +72,25 @@ describe 'ironic::nova' do
is_expected.to contain_ironic_config('nova/user_domain_name').with_value(p[:user_domain_name])
is_expected.to contain_ironic_config('nova/project_domain_name').with_value(p[:project_domain_name])
is_expected.to contain_ironic_config('nova/region_name').with_value(p[:region_name])
is_expected.to contain_ironic_config('nova/system_scope').with_value('<SERVICE DEFAULT>')
is_expected.to contain_ironic_config('nova/endpoint_override').with_value(p[:endpoint_override])
is_expected.to contain_ironic_config('nova/send_power_notifications').with_value(p[:send_power_notifications])
end
end
context 'when system_scope is set' do
before :each do
params.merge!(
:system_scope => 'all',
)
end
it 'configures system-scoped credential' do
is_expected.to contain_ironic_config('nova/project_name').with_value('<SERVICE DEFAULT>')
is_expected.to contain_ironic_config('nova/project_domain_name').with_value('<SERVICE DEFAULT>')
is_expected.to contain_ironic_config('nova/system_scope').with_value('all')
end
end
end
on_supported_os({