@ -12,10 +12,10 @@ describe 'keystone server running with Apache/WSGI with resources' do
include openstack_integration :: mysql
include openstack_integration :: keystone
:: keystone :: resource :: service_identity { ' beaker- ci':
service_type = > ' beaker ',
service_description = > ' beaker service',
service_name = > ' beaker ',
keystone :: resource :: service_identity { ' ci':
service_type = > ' ci ',
service_description = > ' ci service',
service_name = > ' ci ',
password = > 'secret' ,
public_url = > 'http://127.0.0.1:1234' ,
admin_url = > 'http://127.0.0.1:1234' ,
@ -54,10 +54,10 @@ describe 'keystone server running with Apache/WSGI with resources' do
}
# service user exists only in the service_domain - must
# use v3 api
:: keystone :: resource :: service_identity { ' beaker- civ3::service_domain':
service_type = > ' beaker v3',
service_description = > ' beaker v3 service',
service_name = > ' beaker v3',
keystone :: resource :: service_identity { ' civ3::service_domain':
service_type = > ' ci v3',
service_description = > ' ci v3 service',
service_name = > ' ci v3',
password = > 'secret' ,
tenant = > 'servicesv3::service_domain' ,
public_url = > 'http://127.0.0.1:1234/v3' ,
@ -78,32 +78,32 @@ describe 'keystone server running with Apache/WSGI with resources' do
end
shared_examples_for 'keystone user/tenant/service/role/endpoint resources using v3 API' do | auth_creds |
it 'should find beaker user' do
shell ( " openstack #{ auth_creds } --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 user list " ) do | r |
expect ( r . stdout ) . to match ( / beaker / )
it 'should find ci user' do
command ( " openstack #{ auth_creds } --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 user list " ) do | r |
expect ( r . stdout ) . to match ( / ci / )
expect ( r . stderr ) . to be_empty
end
end
it 'should find services tenant' do
shell ( " openstack #{ auth_creds } --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 project list " ) do | r |
command ( " openstack #{ auth_creds } --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 project list " ) do | r |
expect ( r . stdout ) . to match ( / services / )
expect ( r . stderr ) . to be_empty
end
end
it 'should find beaker service' do
shell ( " openstack #{ auth_creds } --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 service list " ) do | r |
expect ( r . stdout ) . to match ( / beaker / )
it 'should find ci service' do
command ( " openstack #{ auth_creds } --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 service list " ) do | r |
expect ( r . stdout ) . to match ( / ci / )
expect ( r . stderr ) . to be_empty
end
end
it 'should find admin role' do
shell ( " openstack #{ auth_creds } --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 role assignment list --names " ) do | r |
command ( " openstack #{ auth_creds } --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 role assignment list --names " ) do | r |
expect ( r . stdout ) . to match ( / admin / )
expect ( r . stderr ) . to be_empty
end
end
it 'should find beaker endpoints' do
shell ( " openstack #{ auth_creds } --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 endpoint list " ) do | r |
it 'should find ci endpoints' do
command ( " openstack #{ auth_creds } --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 endpoint list " ) do | r |
expect ( r . stdout ) . to match ( / 1234 / )
expect ( r . stderr ) . to be_empty
end
@ -115,7 +115,7 @@ describe 'keystone server running with Apache/WSGI with resources' do
end
describe " with v2 service with v3 credentials " do
include_examples 'keystone user/tenant/service/role/endpoint resources using v3 API' ,
'--os-username beaker- ci --os-password secret --os-project-name services --os-user-domain-name Default --os-project-domain-name Default'
'--os-username ci --os-password secret --os-project-name services --os-user-domain-name Default --os-project-domain-name Default'
end
describe 'with v3 admin with v3 credentials' do
include_examples 'keystone user/tenant/service/role/endpoint resources using v3 API' ,
@ -125,7 +125,7 @@ describe 'keystone server running with Apache/WSGI with resources' do
end
describe " with v3 service with v3 credentials " do
include_examples 'keystone user/tenant/service/role/endpoint resources using v3 API' ,
'--os-username beaker- civ3 --os-password secret --os-project-name servicesv3 --os-user-domain-name service_domain --os-project-domain-name service_domain'
'--os-username civ3 --os-password secret --os-project-name servicesv3 --os-user-domain-name service_domain --os-project-domain-name service_domain'
end
end
@ -197,19 +197,21 @@ describe 'keystone server running with Apache/WSGI with resources' do
end
describe 'puppet service are created' do
it 'for service' do
shell ( 'puppet resource keystone_service' ) do | result |
command ( 'puppet resource keystone_service' ) do | result |
expect ( result . stdout )
. to include_regexp ( [ / keystone_service { 'service_1::type_1': / ,
/ keystone_service { 'service_1::type_2': / ] )
. to match ( / keystone_service { 'service_1::type_1': / )
expect ( result . stdout )
. to match ( / keystone_service { 'service_1::type_2': / )
end
end
end
describe 'puppet endpoints are created' do
it 'for service' do
shell ( 'puppet resource keystone_endpoint' ) do | result |
command ( 'puppet resource keystone_endpoint' ) do | result |
expect ( result . stdout )
. to match ( / keystone_endpoint { 'RegionOne \/ service_1::type_1': / )
expect ( result . stdout )
. to include_regexp ( [ / keystone_endpoint { 'RegionOne \/ service_1::type_1': / ,
/ keystone_endpoint { 'RegionOne \/ service_1::type_2': / ] )
. to match ( / keystone_endpoint { 'RegionOne \/ service_1::type_2': / )
end
end
end
@ -219,97 +221,114 @@ describe 'keystone server running with Apache/WSGI with resources' do
# make sure everything is clean before playing the manifest
shared_examples 'clean_domain_configuration' , :clean_domain_cfg = > true do
before ( :context ) do
hosts . each do | host |
on host , 'rm -rf /etc/keystone/domains >/dev/null 2>&1'
on host , 'rm -rf /tmp/keystone.*.conf >/dev/null 2>&1'
end
run_shell ( 'rm -rf /etc/keystone/domains' )
run_shell ( 'rm -rf /tmp/keystone.*.conf' )
end
end
context 'one domain configuration' , :clean_domain_cfg = > true do
context 'simple use case' do
it_behaves_like 'puppet_apply_success' , << - EOM
file { '/etc/keystone/domains' : ensure = > directory }
keystone_domain_config { 'services::ldap/url' :
value = > 'http://auth.com/1' ,
}
EOM
context '/etc/keystone/domains/keystone.services.conf' do
# the idiom
let ( :pp ) do
<< - EOM
file { '/etc/keystone/domains' : ensure = > directory }
keystone_domain_config { 'services::ldap/url' :
value = > 'http://auth.com/1' ,
}
EOM
end
# note: cannot use neither instance variable nor let on
# parameter for shared_example
it_behaves_like 'a_valid_configuration' , << - EOC
it 'should apply and be idempotent' do
apply_manifest ( pp , :catch_failures = > true )
apply_manifest ( pp , :catch_changes = > true )
end
[ ldap ]
url = http : / / auth . com / 1
EOC
describe file ( '/etc/keystone/domains/keystone.services.conf' ) do
it { is_expected . to be_file }
it { is_expected . to exist }
its ( :content ) { should match / \ [ldap \ ] \ nurl=http: \/ \/ auth.com \/ 1 / }
end
end
context 'with a non default identity/domain_config_dir' do
it_behaves_like 'puppet_apply_success' , << - EOM
keystone_config { 'identity/domain_config_dir' : value = > '/tmp' }
keystone_domain_config { 'services::ldap/url' :
value = > 'http://auth.com/1' ,
}
EOM
let ( :pp ) do
<< - EOM
keystone_config { 'identity/domain_config_dir' : value = > '/tmp' }
keystone_domain_config { 'services::ldap/url' :
value = > 'http://auth.com/1' ,
}
EOM
end
context '/tmp/keystone.services.conf' do
it_behaves_like 'a_valid_configuration' , << - EOC
it 'should apply and be idempotent' do
apply_manifest ( pp , :catch_failures = > true )
apply_manifest ( pp , :catch_changes = > true )
end
[ ldap ]
url = http : / / auth . com / 1
EOC
describe file ( '/tmp/keystone.services.conf' ) do
it { is_expected . to be_file }
it { is_expected . to exist }
its ( :content ) { should match / \ [ldap \ ] \ nurl=http: \/ \/ auth.com \/ 1 / }
end
end
end
context 'with a multiple configurations' , :clean_domain_cfg = > true do
it_behaves_like 'puppet_apply_success' , << - EOM
file { '/etc/keystone/domains' : ensure = > directory }
keystone_config { 'identity/domain_config_dir' : value = > '/etc/keystone/domains' }
keystone_domain_config { 'services::ldap/url' :
value = > 'http://auth.com/1' ,
}
keystone_domain_config { 'services::http/url' :
value = > 'http://auth.com/2' ,
}
keystone_domain_config { 'external::ldap/url' :
value = > 'http://ext-auth.com/1' ,
}
EOM
let ( :pp ) do
<< - EOM
file { '/etc/keystone/domains' : ensure = > directory }
keystone_config { 'identity/domain_config_dir' : value = > '/etc/keystone/domains' }
keystone_domain_config { 'services::ldap/url' :
value = > 'http://auth.com/1' ,
}
keystone_domain_config { 'services::http/url' :
value = > 'http://auth.com/2' ,
}
keystone_domain_config { 'external::ldap/url' :
value = > 'http://ext-auth.com/1' ,
}
EOM
end
describe command ( 'puppet resource keystone_domain_config' ) do
its ( :exit_status ) { is_expected . to eq ( 0 ) }
it 'should apply and be idempotent' do
apply_manifest ( pp , :catch_failures = > true )
apply_manifest ( pp , :catch_changes = > true )
end
describe '/etc/keystone/domains/keystone.external.conf' do
it_behaves_like 'a_valid_configuration' , << EOC
it 'should list puppet resources' do
command ( 'puppet resource keystone_domain_config' ) do | r |
expect ( r . exit_code ) . to eq 0
end
end
[ ldap ]
url = http : / /ex t - auth . com / 1
EOC
describe file ( '/etc/keystone/domains/keystone.external.conf' ) do
it { is_expected . to be_file }
it { is_expected . to exist }
its ( :content ) { should match / \ [ldap \ ] \ nurl=http: \/ \/ ext-auth.com \/ 1 / }
end
end
context 'checking that the purge is working' do
it_behaves_like 'puppet_apply_success' , << - EOM
resources { 'keystone_domain_config' : purge = > true }
keystone_domain_config { 'services::ldap/url' :
value = > 'http://auth.com/1' ,
}
EOM
let ( :pp ) do
<< - EOM
resources { 'keystone_domain_config' : purge = > true }
keystone_domain_config { 'services::ldap/url' :
value = > 'http://auth.com/1' ,
}
EOM
end
context '/etc/keystone/domains/keystone.services.conf' do
it_behaves_like 'a_valid_configuration' , << - EOC
it 'should apply and be idempotent' do
apply_manifest ( pp , :catch_failures = > true )
apply_manifest ( pp , :catch_changes = > true )
end
[ ldap ]
url = http : / / auth . com / 1
EOC
describe file ( '/etc/keystone/domains/keystone.services.conf' ) do
it { is_expected . to be_file }
it { is_expected . to exist }
its ( :content ) { should match / \ [ldap \ ] \ nurl=http: \/ \/ auth.com \/ 1 / }
end
end
context '#ldap_backend' , :clean_domain_cfg = > true do
context 'manifest' do
let ( :pp ) do
@ -342,37 +361,39 @@ EOC
# TODO: Sould we add a working ldap server ?
end
context '/etc/keystone/domains/keystone.domain_1_ldap_backend.conf' do
it_behaves_like 'a_valid_configuration' , << - EOC
[ ldap ]
url = ldap : / / foo
user = cn = foo , dc = example , dc = com
EOC
describe file ( '/etc/keystone/domains/keystone.domain_1_ldap_backend.conf' ) do
it { is_expected . to be_file }
it { is_expected . to exist }
its ( :content ) { should match / \ [ldap \ ] \ nurl=ldap: \/ \/ foo \ nuser=cn=foo,dc=example,dc=com / }
end
context '/etc/keystone/domains/keystone.domain_2_ldap_backend.conf' do
it_behaves_like 'a_valid_configuration' , << - EOC
[ ldap ]
url = ldap : / / bar
user = cn = bar , dc = test , dc = com
EOC
describe file ( '/etc/keystone/domains/keystone.domain_2_ldap_backend.conf' ) do
it { is_expected . to be_file }
it { is_expected . to exist }
its ( :content ) { should match / \ [ldap \ ] \ nurl=ldap: \/ \/ bar \ nuser=cn=bar,dc=test,dc=com / }
end
end
context 'clean up' , :clean_domain_cfg = > true do
# we must revert the changes as ldap backend is not fully
# functional and are "domain read only". All subsequent tests
# will fail without this.
it_behaves_like 'puppet_apply_success' , << - EOM
keystone_config {
'identity/driver' : value = > 'sql' ;
'credential/driver' : ensure = > absent ;
'assignment/driver' : ensure = > absent ;
'identity/domain_specific_drivers_enabled' : ensure = > absent ;
'identity/domain_config_dir' : ensure = > absent ;
}
EOM
let ( :pp ) do
<< - EOM
keystone_config {
'identity/driver' : value = > 'sql' ;
'credential/driver' : ensure = > absent ;
'assignment/driver' : ensure = > absent ;
'identity/domain_specific_drivers_enabled' : ensure = > absent ;
'identity/domain_config_dir' : ensure = > absent ;
}
EOM
end
it 'should apply and be idempotent' do
apply_manifest ( pp , :catch_failures = > true )
apply_manifest ( pp , :catch_changes = > true )
end
end
end
end
Tobias Urdin
3 years ago