# # Module for managing keystone config. # # == Parameters # # [*package_ensure*] # (Optional) Desired ensure state of packages. # accepts latest or specific versions. # Defaults to present. # # [*client_package_ensure*] # (Optional) Desired ensure state of the client package. # accepts latest or specific versions. # Defaults to present. # # [*catalog_type*] # (Optional) Type of catalog that keystone uses to store endpoints,services. # Defaults to sql. (Also accepts template) # # [*catalog_driver*] # (Optional) Catalog driver used by Keystone to store endpoints and services. # Setting this value will override and ignore catalog_type. # Defaults to false. # # [*catalog_template_file*] # (Optional) Path to the catalog used if catalog_type equals 'template'. # Defaults to '/etc/keystone/default_catalog.templates' # # [*token_provider*] # (Optional) Format keystone uses for tokens. # Defaults to 'fernet' # Supports fernet or uuid. # # [*token_expiration*] # (Optional) Amount of time a token should remain valid (seconds). # Defaults to 3600 (1 hour). # # [*password_hash_algorithm*] # (Optional) The password hash algorithm to use. # Defaults to $::os_service_default # # [*password_hash_rounds*] # (Optional) The amount of rounds to do on the hash. # Defaults to $::os_service_default # # [*revoke_driver*] # (Optional) Driver for token revocation. # Defaults to $::os_service_default # # [*revoke_by_id*] # (Optional) Revoke token by token identifier. # Setting revoke_by_id to true enables various forms of enumerating tokens. # These enumerations are processed to determine the list of tokens to revoke. # Only disable if you are switching to using the Revoke extension with a backend # other than KVS, which stores events in memory. # Defaults to true. # # [*manage_service*] # (Optional) If Puppet should manage service startup / shutdown. # Defaults to true. # # [*enabled*] # (Optional) If the keystone services should be enabled. # Default to true. # # [*default_transport_url*] # (Optional) A URL representing the messaging driver to use and its full # configuration. Transport URLs take the form: # transport://user:pass@host1:port[,hostN:portN]/virtual_host # Defaults to $::os_service_default # # [*rabbit_ha_queues*] # (Optional) Use HA queues in RabbitMQ. # Defaults to $::os_service_default # # [*rabbit_heartbeat_timeout_threshold*] # (Optional) Number of seconds after which the RabbitMQ broker is considered # down if the heartbeat keepalive fails. Any value >0 enables heartbeats. # Heartbeating helps to ensure the TCP connection to RabbitMQ isn't silently # closed, resulting in missed or lost messages from the queue. # (Requires kombu >= 3.0.7 and amqp >= 1.4.0) # Defaults to $::os_service_default # # [*rabbit_heartbeat_rate*] # (Optional) How often during the rabbit_heartbeat_timeout_threshold period to # check the heartbeat on RabbitMQ connection. (i.e. rabbit_heartbeat_rate=2 # when rabbit_heartbeat_timeout_threshold=60, the heartbeat will be checked # every 30 seconds. # Defaults to $::os_service_default # # [*rabbit_heartbeat_in_pthread*] # (Optional) EXPERIMENTAL: Run the health check heartbeat thread # through a native python thread. By default if this # option isn't provided the health check heartbeat will # inherit the execution model from the parent process. By # example if the parent process have monkey patched the # stdlib by using eventlet/greenlet then the heartbeat # will be run through a green thread. # Defaults to $::os_service_default # # [*rabbit_use_ssl*] # (Optional) Connect over SSL for RabbitMQ # Defaults to $::os_serice_default # # [*kombu_ssl_ca_certs*] # (Optional) SSL certification authority file (valid only if SSL enabled). # Defaults to $::os_service_default # # [*kombu_ssl_certfile*] # (Optional) SSL cert file (valid only if SSL enabled). # Defaults to $::os_service_default # # [*kombu_ssl_keyfile*] # (Optional) SSL key file (valid only if SSL enabled). # Defaults to $::os_service_default # # [*kombu_ssl_version*] # (Optional) SSL version to use (valid only if SSL enabled). # Valid values are TLSv1, SSLv23 and SSLv3. SSLv2 may be # available on some distributions. # Defaults to $::os_service_default # # [*kombu_reconnect_delay*] # (Optional) How long to wait before reconnecting in response # to an AMQP consumer cancel notification. (floating point value) # Defaults to $::os_service_default # # [*kombu_failover_strategy*] # (Optional) Determines how the next RabbitMQ node is chosen in case the one # we are currently connected to becomes unavailable. Takes effect only if # more than one RabbitMQ node is provided in config. (string value) # Defaults to $::os_service_default # # [*kombu_compression*] # (Optional) Possible values are: gzip, bz2. If not set compression will not # be used. This option may notbe available in future versions. EXPERIMENTAL. # (string value) # Defaults to $::os_service_default # # [*notification_transport_url*] # (Optional) A URL representing the messaging driver to use for notifications # and its full configuration. Transport URLs take the form: # transport://user:pass@host1:port[,hostN:portN]/virtual_host # Defaults to $::os_service_default # # [*notification_driver*] # RPC driver. Not enabled by default (list value) # Defaults to $::os_service_default # # [*notification_topics*] # (Optional) AMQP topics to publish to when using the RPC notification driver. # (list value) # Default to $::os_service_default # # [*notification_format*] # Format for the notifications. Valid values are 'basic' and 'cadf'. # Default to undef # # [*control_exchange*] # (Optional) AMQP exchange to connect to if using RabbitMQ # (string value) # Default to $::os_service_default # # [*rpc_response_timeout*] # (Optional) Seconds to wait for a response from a call. # Defaults to $::os_service_default # # [*log_dir*] # (Optional) Directory where logs should be stored # If set to $::os_service_default, it will not log to any directory # Defaults to undef. # # [*log_file*] # (Optional) Where to log # Defaults to undef. # # [*public_endpoint*] # (Optional) The base public endpoint URL for keystone that are # advertised to clients (NOTE: this does NOT affect how # keystone listens for connections) (string value) # Defaults to $::os_service_default # # [*enable_ssl*] # (Optional) Toggle for SSL support on the keystone eventlet servers. # (boolean value) # Defaults to false # # [*ssl_certfile*] # (Optional) Path of the certfile for SSL. (string value) # Defaults to '/etc/keystone/ssl/certs/keystone.pem' # # [*ssl_keyfile*] # (Optional) Path of the keyfile for SSL. (string value) # Defaults to '/etc/keystone/ssl/private/keystonekey.pem' # # [*ssl_ca_certs*] # (Optional) Path of the ca cert file for SSL. (string value) # Defaults to '/etc/keystone/ssl/certs/ca.pem' # # [*ssl_ca_key*] # (Optional) Path of the CA key file for SSL (string value) # Defaults to '/etc/keystone/ssl/private/cakey.pem' # # [*ssl_cert_subject*] # (Optional) SSL Certificate Subject (auto generated certificate) # (string value) # Defaults to '/C=US/ST=Unset/L=Unset/O=Unset/CN=localhost' # # [*service_name*] # (Optional) Name of the service that will be providing the # server functionality of keystone. For example, the default # is just 'keystone', which means keystone will be run as a # standalone service, and will able to be managed separately # by the operating system's service manager. For example, # under Red Hat based systems, you will be able to use: # systemctl restart openstack-keystone # to restart the service. Under Debian, which uses uwsgi # (as opposed to eventlet), the service name is simply # keystone, so this will work: # systemctl restart keystone # If the value is 'httpd', this means keystone will be a web # service, and you must use another class to configure that # web service. After calling class {'keystone'...} # use class { 'keystone::wsgi::apache'...} to make keystone be # a web app using apache mod_wsgi. # Defaults to '$::keystone::params::service_name' # # [*max_token_size*] # (Optional) maximum allowable Keystone token size # Defaults to $::os_service_default # # [*sync_db*] # (Optional) Run db sync on the node. # Defaults to true # # [*enable_fernet_setup*] # (Optional) Setup keystone for fernet tokens. This is typically only # run on a single node, then the keys are replicated to the other nodes # in a cluster. You would typically also pair this with a fernet token # provider setting. # Defaults to true # # [*fernet_key_repository*] # (Optional) Location for the fernet key repository. This value must # be set if enable_fernet_setup is set to true. # Defaults to '/etc/keystone/fernet-keys' # # [*fernet_max_active_keys*] # (Optional) Number of maximum active Fernet keys. Integer > 0. # Defaults to $::os_service_default # # [*fernet_keys*] # (Optional) Hash of Keystone fernet keys # If you enable this parameter, make sure enable_fernet_setup is set to True. # Example of valid value: # fernet_keys: # /etc/keystone/fernet-keys/0: # content: c_aJfy6At9y-toNS9SF1NQMTSkSzQ-OBYeYulTqKsWU= # /etc/keystone/fernet-keys/1: # content: zx0hNG7CStxFz5KXZRsf7sE4lju0dLYvXdGDIKGcd7k= # Puppet will create a file per key in $fernet_key_repository. # Note: defaults to false so keystone-manage fernet_setup will be executed. # Otherwise Puppet will manage keys with File resource. # Defaults to false # # [*fernet_replace_keys*] # (Optional) Whether or not to replace the fernet keys if they are already in # the filesystem # Defaults to true # # [*enable_credential_setup*] # (Optional) Setup keystone for credentials. # In a cluster environment where multiple Keystone nodes are running, you might # need the same keys everywhere; so you'll have to set credential_keys parameter in # order to let Puppet manage Keystone keys in a consistent way, otherwise # keystone-manage will generate different set of keys on keystone nodes and the # service won't work. # Defaults to False # # [*credential_key_repository*] # (Optional) Location for the Credential key repository. This value must # be set if enable_credential_setup is set to true. # Defaults to '/etc/keystone/credential-keys' # # [*credential_keys*] # (Optional) Hash of Keystone credential keys # If you enable this parameter, make sure enable_credential_setup is set to True. # Example of valid value: # credential_keys: # /etc/keystone/credential-keys/0: # content: t-WdduhORSqoyAykuqWAQSYjg2rSRuJYySgI2xh48CI= # /etc/keystone/credential-keys/1: # content: GLlnyygEVJP4-H2OMwClXn3sdSQUZsM5F194139Unv8= # Puppet will create a file per key in $credential_key_repository. # Note: defaults to false so keystone-manage credential_setup will be executed. # Otherwise Puppet will manage keys with File resource. # Defaults to false # # [*default_domain*] # (Optional) When Keystone v3 support is enabled, v2 clients will need # to have a domain assigned for certain operations. For example, # doing a user create operation must have a domain associated with it. # This is the domain which will be used if a domain is needed and not # explicitly set in the request. Using this means that you will have # to add it to every user/tenant/user_role you create, as without a domain # qualification those resources goes into "Default" domain. See README. # Defaults to undef (will use built-in Keystone default) # # [*policy_driver*] # Policy backend driver. (string value) # Defaults to $::os_service_default. # # [*using_domain_config*] # (Optional) Eases the use of the keystone_domain_config resource type. # It ensures that a directory for holding the domain configuration is present # and the associated configuration in keystone.conf is set up right. # Defaults to false # # [*domain_config_directory*] # (Optional) Specify a domain configuration directory. # For this to work the using_domain_config must be set to true. Raise an # error if it's not the case. # Defaults to '/etc/keystone/domains' # # [*keystone_user*] # (Optional) Specify the keystone system user to be used with keystone-manage. # Defaults to $::keystone::params::keystone_user # # [*keystone_group*] # (Optional) Specify the keystone system group to be used with keystone-manage. # Defaults to $::keystone::params::keystone_group # # [*manage_policyrcd*] # (Optional) Whether to manage the policy-rc.d on debian based systems to # prevent keystone eventlet and apache from auto-starting on package install. # Defaults to false # # [*enable_proxy_headers_parsing*] # (Optional) Enable oslo middleware to parse proxy headers. # Defaults to $::os_service_default. # # [*max_request_body_size*] # (Optional) Set max request body size # Defaults to $::os_service_default. # # [*purge_config*] # (Optional) Whether to set only the specified config options # in the keystone config. # Defaults to false. # # [*amqp_durable_queues*] # (Optional) Whether to use durable queues in AMQP. # Defaults to $::os_service_default. # # DEPRECATED PARAMETERS # # [*database_connection*] # (Optional) Url used to connect to database. # Defaults to undef. # # [*database_idle_timeout*] # (Optional) Timeout when db connections should be reaped. # Defaults to undef. # # [*database_max_retries*] # (Optional) Maximum number of database connection retries during startup. # Setting -1 implies an infinite retry count. # (Defaults to undef) # # [*database_retry_interval*] # (Optional) Interval between retries of opening a database connection. # (Defaults to undef) # # [*database_max_pool_size*] # (Optional) Maximum number of SQL connections to keep open in a pool. # Defaults to: undef # # [*database_max_overflow*] # (Optional) If set, use this value for max_overflow with sqlalchemy. # Defaults to: undef # # [*member_role_id*] # (Optional) Similar to the member_role_name option, this represents the # default role ID used to associate users with their default projects in the # v2 API. This will be used as the explicit role where one is not specified # by the v2 API. # Defaults to undef # # [*member_role_name*] # (Optional) # This is the role name used in combination with the # member_role_id option; see that option for more detail. # Defaults to undef # # [*admin_endpoint*] # (Optional) The base admin endpoint URL for keystone that are # advertised to clients (NOTE: this does NOT affect how keystone listens # for connections) (string value) # If set to false, no admin_endpoint will be defined in keystone.conf. # Sample value: 'http://localhost:5000/' # Defaults to undef # # == Authors # # Dan Bode dan@puppetlabs.com # # == Copyright # # Copyright 2012 Puppetlabs Inc, unless otherwise noted. # class keystone( $package_ensure = 'present', $client_package_ensure = 'present', $log_dir = undef, $log_file = undef, $catalog_type = 'sql', $catalog_driver = false, $catalog_template_file = '/etc/keystone/default_catalog.templates', $token_provider = 'fernet', $token_expiration = 3600, $password_hash_algorithm = $::os_service_default, $password_hash_rounds = $::os_service_default, $revoke_driver = $::os_service_default, $revoke_by_id = true, $public_endpoint = $::os_service_default, $enable_ssl = false, $ssl_certfile = '/etc/keystone/ssl/certs/keystone.pem', $ssl_keyfile = '/etc/keystone/ssl/private/keystonekey.pem', $ssl_ca_certs = '/etc/keystone/ssl/certs/ca.pem', $ssl_ca_key = '/etc/keystone/ssl/private/cakey.pem', $ssl_cert_subject = '/C=US/ST=Unset/L=Unset/O=Unset/CN=localhost', $manage_service = true, $enabled = true, $rabbit_heartbeat_timeout_threshold = $::os_service_default, $rabbit_heartbeat_rate = $::os_service_default, $rabbit_heartbeat_in_pthread = $::os_service_default, $rabbit_use_ssl = $::os_service_default, $default_transport_url = $::os_service_default, $rabbit_ha_queues = $::os_service_default, $kombu_ssl_ca_certs = $::os_service_default, $kombu_ssl_certfile = $::os_service_default, $kombu_ssl_keyfile = $::os_service_default, $kombu_ssl_version = $::os_service_default, $kombu_reconnect_delay = $::os_service_default, $kombu_failover_strategy = $::os_service_default, $kombu_compression = $::os_service_default, $notification_transport_url = $::os_service_default, $notification_driver = $::os_service_default, $notification_topics = $::os_service_default, $notification_format = $::os_service_default, $control_exchange = $::os_service_default, $rpc_response_timeout = $::os_service_default, $service_name = $::keystone::params::service_name, $max_token_size = $::os_service_default, $sync_db = true, $enable_fernet_setup = true, $fernet_key_repository = '/etc/keystone/fernet-keys', $fernet_max_active_keys = $::os_service_default, $fernet_keys = false, $fernet_replace_keys = true, $enable_credential_setup = true, $credential_key_repository = '/etc/keystone/credential-keys', $credential_keys = false, $default_domain = undef, $policy_driver = $::os_service_default, $using_domain_config = false, $domain_config_directory = '/etc/keystone/domains', $keystone_user = $::keystone::params::keystone_user, $keystone_group = $::keystone::params::keystone_group, $manage_policyrcd = false, $enable_proxy_headers_parsing = $::os_service_default, $max_request_body_size = $::os_service_default, $purge_config = false, $amqp_durable_queues = $::os_service_default, # DEPRECATED PARAMETERS $database_connection = undef, $database_idle_timeout = undef, $database_max_retries = undef, $database_retry_interval = undef, $database_max_pool_size = undef, $database_max_overflow = undef, $member_role_id = undef, $member_role_name = undef, $admin_endpoint = undef, ) inherits keystone::params { include keystone::deps include keystone::logging include keystone::policy if ! $catalog_driver { validate_legacy(Enum['template', 'sql'], 'validate_re', $catalog_type) } if $manage_policyrcd { # openstacklib policy_rcd only affects debian based systems. Policy_rcd <| title == 'keystone' |> -> Package['keystone'] Policy_rcd['apache2'] -> Package['httpd'] # we don't have keystone service anymore starting from Newton if ($::operatingsystem == 'Ubuntu') and (versioncmp($::operatingsystemmajrelease, '16') >= 0) { $policy_services = 'apache2' } else { $policy_services = ['keystone', 'apache2'] } ensure_resource('policy_rcd', $policy_services, { ensure => present, 'set_code' => '101' }) } include keystone::db include keystone::params if $database_connection != undef { warning('The database_connection parameter is deprecated and will be \ removed in a future realse. Use keystone::db::database_connection instead') } if $database_idle_timeout != undef { warning('The database_idle_timeout parameter is deprecated and will be \ removed in a future realse. Use keystone::db::database_connection_recycle_time \ instead') } if $database_max_retries!= undef { warning('The database_max_retries parameter is deprecated and will be \ removed in a future realse. Use keystone::db::database_max_retries instead') } if $database_retry_interval != undef { warning('The database_retry_interval parameter is deprecated and will be \ removed in a future realse. Use keystone::db::database_retry_interval instead') } if $database_max_pool_size != undef { warning('The database_max_pool_size parameter is deprecated and will be \ removed in a future realse. Use keystone::db::database_max_pool_size instead') } if $database_max_overflow != undef { warning('The database_max_overflow parameter is deprecated and will be \ removed in a future realse. Use keystone::db::database_max_overflow instead') } if $member_role_id != undef { warning('The keystone::member_role_id parameter is deprecated and has no effect') } if $member_role_name != undef { warning('The keystone::member_role_name parameter is deprecated and has no effect') } # TODO(tkajinam): Remove this when removing member_role_* parameters keystone_config { 'DEFAULT/member_role_id': ensure => absent; 'DEFAULT/member_role_name': ensure => absent; } if $admin_endpoint != undef { warning('The keystone::admin_endpoint parameter is deprecated. This parameter has no effect') } package { 'keystone': ensure => $package_ensure, name => $::keystone::params::package_name, tag => ['openstack', 'keystone-package'], } if $client_package_ensure == 'present' { include keystone::client } else { class { 'keystone::client': ensure => $client_package_ensure, } } resources { 'keystone_config': purge => $purge_config, } # Endpoint configuration keystone_config { 'DEFAULT/public_endpoint': value => $public_endpoint; } keystone_config { 'token/expiration': value => $token_expiration; } keystone_config { 'identity/password_hash_algorithm': value => $password_hash_algorithm; 'identity/password_hash_rounds': value => $password_hash_rounds; } keystone_config { 'revoke/driver': value => $revoke_driver; } keystone_config { 'policy/driver': value => $policy_driver; } # ssl config if ($enable_ssl) { keystone_config { 'ssl/enable': value => true; 'ssl/certfile': value => $ssl_certfile; 'ssl/keyfile': value => $ssl_keyfile; 'ssl/ca_certs': value => $ssl_ca_certs; 'ssl/ca_key': value => $ssl_ca_key; 'ssl/cert_subject': value => $ssl_cert_subject; } } else { keystone_config { 'ssl/enable': value => false; 'ssl/certfile': value => $::os_service_default; 'ssl/keyfile': value => $::os_service_default; 'ssl/ca_certs': value => $::os_service_default; 'ssl/ca_key': value => $::os_service_default; 'ssl/cert_subject': value => $::os_service_default; } } oslo::middleware { 'keystone_config': enable_proxy_headers_parsing => $enable_proxy_headers_parsing, max_request_body_size => $max_request_body_size, } # configure based on the catalog backend if $catalog_driver { $catalog_driver_real = $catalog_driver } elsif ($catalog_type == 'template') { $catalog_driver_real = 'templated' } elsif ($catalog_type == 'sql') { $catalog_driver_real = 'sql' } keystone_config { 'catalog/driver': value => $catalog_driver_real; 'catalog/template_file': value => $catalog_template_file; } keystone_config { 'token/provider': value => $token_provider; 'DEFAULT/max_token_size': value => $max_token_size; 'DEFAULT/notification_format': value => $notification_format; } oslo::messaging::default { 'keystone_config': transport_url => $default_transport_url, control_exchange => $control_exchange, rpc_response_timeout => $rpc_response_timeout, } oslo::messaging::notifications { 'keystone_config': transport_url => $notification_transport_url, driver => $notification_driver, topics => $notification_topics, } oslo::messaging::rabbit { 'keystone_config': kombu_ssl_version => $kombu_ssl_version, kombu_ssl_keyfile => $kombu_ssl_keyfile, kombu_ssl_certfile => $kombu_ssl_certfile, kombu_ssl_ca_certs => $kombu_ssl_ca_certs, kombu_reconnect_delay => $kombu_reconnect_delay, kombu_failover_strategy => $kombu_failover_strategy, kombu_compression => $kombu_compression, rabbit_use_ssl => $rabbit_use_ssl, rabbit_ha_queues => $rabbit_ha_queues, heartbeat_timeout_threshold => $rabbit_heartbeat_timeout_threshold, heartbeat_rate => $rabbit_heartbeat_rate, heartbeat_in_pthread => $rabbit_heartbeat_in_pthread, amqp_durable_queues => $amqp_durable_queues, } if $manage_service { if $enabled { $service_ensure = 'running' } else { $service_ensure = 'stopped' } } else { warning('Execution of db_sync does not depend on $enabled anymore. Please use sync_db instead.') } case $service_name { $::keystone::params::service_name: { $service_name_real = $::keystone::params::service_name class { 'keystone::service': ensure => $service_ensure, service_name => $service_name, enable => $enabled, hasstatus => true, hasrestart => true, } # Note: Debian uses uwsgi if using keystone service, which isn't deprecated # and therefore, no warning should be displayed. if $service_name == $::keystone::params::service_name and $::operatingsystem != 'Debian'{ warning("Keystone under Eventlet has been deprecated during the Kilo cycle. \ Support for deploying under eventlet will be dropped as of the M-release of OpenStack.") } } 'httpd': { include apache::params $service_name_real = $::apache::params::service_name Service <| title == 'httpd' |> { tag +> 'keystone-service' } } default: { fail("Invalid service_name. Either keystone/openstack-keystone for \ running as a standalone service, or httpd for being run by a httpd server") } } if $sync_db { include keystone::db::sync } # Fernet tokens support if $enable_fernet_setup { validate_legacy(String, 'validate_string', $fernet_key_repository) ensure_resource('file', $fernet_key_repository, { ensure => 'directory', owner => $keystone_user, group => $keystone_group, mode => '0600', subscribe => Anchor['keystone::install::end'], }) if $fernet_keys { validate_legacy(Hash, 'validate_hash', $fernet_keys) create_resources('file', $fernet_keys, { 'owner' => $keystone_user, 'group' => $keystone_group, 'mode' => '0600', 'replace' => $fernet_replace_keys, 'subscribe' => 'Anchor[keystone::install::end]', 'tag' => 'keystone-fernet-key', } ) } else { exec { 'keystone-manage fernet_setup': command => "keystone-manage fernet_setup --keystone-user ${keystone_user} --keystone-group ${keystone_group}", path => '/usr/bin', user => $keystone_user, refreshonly => true, creates => "${fernet_key_repository}/0", notify => Anchor['keystone::service::begin'], subscribe => [Anchor['keystone::install::end'], Anchor['keystone::config::end']], require => File[$fernet_key_repository], tag => 'keystone-exec', } } } # Credential support if $enable_credential_setup { validate_legacy(String, 'validate_string', $credential_key_repository) ensure_resource('file', $credential_key_repository, { ensure => 'directory', owner => $keystone_user, group => $keystone_group, mode => '0600', subscribe => Anchor['keystone::install::end'], }) if $credential_keys { validate_legacy(Hash, 'validate_hash', $credential_keys) create_resources('file', $credential_keys, { 'owner' => $keystone_user, 'group' => $keystone_group, 'mode' => '0600', 'subscribe' => 'Anchor[keystone::install::end]', } ) } else { exec { 'keystone-manage credential_setup': command => "keystone-manage credential_setup --keystone-user ${keystone_user} --keystone-group ${keystone_group}", path => '/usr/bin', user => $keystone_user, refreshonly => true, creates => "${credential_key_repository}/0", notify => Anchor['keystone::service::begin'], subscribe => [Anchor['keystone::install::end'], Anchor['keystone::config::end']], require => File[$credential_key_repository], tag => 'keystone-exec', } } } if $fernet_key_repository { keystone_config { 'fernet_tokens/key_repository': value => $fernet_key_repository; } } else { keystone_config { 'fernet_tokens/key_repository': ensure => absent; } } keystone_config { 'token/revoke_by_id': value => $revoke_by_id; 'fernet_tokens/max_active_keys': value => $fernet_max_active_keys; 'credential/key_repository': value => $credential_key_repository; } # Update this code when https://bugs.launchpad.net/keystone/+bug/1472285 is addressed. # 1/ Keystone needs to be started before creating the default domain # 2/ Once the default domain is created, we can query Keystone to get the default domain ID # 3/ The Keystone_domain provider has in charge of doing the query and configure keystone.conf # 4/ After such a change, we need to restart Keystone service. # restart_keystone exec is doing 4/, it restart Keystone if we have a new default domain setted # and if we manage the service to be enabled. if $manage_service and $enabled { exec { 'restart_keystone': path => ['/usr/sbin', '/usr/bin', '/sbin', '/bin/'], command => "service ${service_name_real} restart", refreshonly => true, } } if $default_domain { keystone_domain { $default_domain: ensure => present, enabled => true, is_default => true, require => Service[$service_name], } ~> Exec<| title == 'restart_keystone' |> anchor { 'default_domain_created': require => Keystone_domain[$default_domain], } } if $domain_config_directory != '/etc/keystone/domains' and !$using_domain_config { fail('You must activate domain configuration using "using_domain_config" parameter to keystone class.') } if $using_domain_config { validate_legacy(Stdlib::Absolutepath, 'validate_absolute_path', $domain_config_directory) # Better than ensure resource. We don't want to conflict with any # user definition even if they don't match exactly our parameters. # The error catching mechanism in the provider will remind them if # they did something silly, like defining a file rather than a # directory. For the permission it's their choice. if (!defined(File[$domain_config_directory])) { file { $domain_config_directory: ensure => directory, owner => $keystone_user, group => $keystone_group, mode => '0750', notify => Service[$service_name], require => Anchor['keystone::install::end'], } } # Here we want the creation to fail if the user has created those # resources with different values. That means that the user # wrongly uses using_domain_config parameter. ensure_resource( 'keystone_config', 'identity/domain_specific_drivers_enabled', {'value' => true} ) ensure_resource( 'keystone_config', 'identity/domain_config_dir', {'value' => $domain_config_directory} ) } }