---
prelude: >
    This release puppet-keystone no longer deploys keystone with separated
    ports (admin and public as they were called in v2.0). By default keystone
    will only listen to port 5000, you need to make sure all your services are
    configured to use the correct port to talk to keystone.
features:
  - |
    Added new parameter keystone::federation::openidc::keystone_url that can be
    used to set the keystone url for federation, if not provided it will use
    keystone::public_endpoint.
upgrade:
  - |
    Keystone is now deployed with only port 5000, you can change this with
    keystone::wsgi::apache::api_port, you need to make sure all your services are
    configured to talk to keystone on this port. If you want to keep backward
    compatibility with port 35357 you should pass an array to api_port with
    both port 35357 and 5000.
  - |
    Now that keystone::wsgi::apache::admin_bind_host is deprecated and has no effect
    if you are deploying separated networks that was used by specifying admin_bind_host
    and bind_host you must now merge the value set in admin_bind_host and set it together
    with the value bind_host parameter. The default value for parameter bind_host has not
    changed and is still undef which will the Keystone vhost listen to 0.0.0.0
  - |
    The providers has been updated to read DEFAULT/public_port which defaults
    to 5000 and use that port to talk to Keystone when managing resources.
    You need to make sure that keystone::public_port is set to *one* port that
    Keystone is listening to that is configured with keystone::wsgi::apache::api_port
    if you are deploying Keystone with Apache WSGI.
  - |
    If you are setting keystone::admin_bind_host and/or keystone::public_bind_host you
    need to make sure they are properly set to networks which both have access to the port
    specified in the new param keystone::wsgi::apache::api_port which is what Apache should
    listen to and to the port configured with keystone::public_port that is used by providers.
  - |
    keystone::federation::mellon is now added to Keystone WSGI for port 5000 by
    default and admin_port and main_port parameters does not do anything and is
    deprecated.
  - |
    keystone::federation::shibboleth is now added to Keystone WSGI for port 5000
    by default and admin_port and main_port parameters does not do anything and is
    deprecated.
  - |
    keystone::federation::openidc is now added to Keystone WSGI for port 5000
    by default and admin_port and main_port parameters does not do anything and is
    deprecated.
  - |
    keystone::federation::openidc::keystone_url parameter has been added to give the
    keystone endpoint, if it's not provided keystone::public_endpoint will be used.
    We recommend that you set this since keystone::public_endpoint might be deprecated
    in a future release.
deprecations:
  - |
    As of the removal of port 35357 the following parameters are deprecated
    in the keystone::wsgi::apache class and has no effect:

      - ``servername_admin`` please use ``servername``
      - ``public_port`` and ``admin_port`` please use ``api_port``
      - ``admin_bind_host`` please use ``bind_host``
      - ``public_path`` and ``admin_path`` please use ``path``
      - ``ssl_cert_admin`` and ``ssl_key_admin`` please use ``ssl_cert`` and ``ssl_key``
      - ``wsgi_admin_script_source`` and ``wsgi_public_script_source`` please use ``wsgi_script_source``
      - ``custom_wsgi_process_options_main`` and ``custom_wsgi_process_options_admin`` please use ``custom_wsgi_process_options``
  - |
    keystone::federation::mellon::admin_port and main_port is deprecated and has no effect
    and will be removed in a future release.
  - |
    keystone::federation::shibboleth::admin_port and main_port is deprecated and has no effect
    and will be removed in a future release.
  - |
    keystone::federation::openidc::admin_port and main_port is deprecated and has no effect
    and will be removed in a future release.
  - |
    keystone::federation::openidc_httpd_configuration is deprecated and will be removed in
    a future release.