There are two sides on this patch, the user facing one, and the
developer's one.
It gives more flexibility for the interface used by the user for the
Keystone_tenant, Keystone_user and Keystone_user_roles resources. For
instance to specify a user and give the admin role, currently you have
to:
keystone_user { 'new_admin::admin_domain':
ensure => present,
enabled => true,
tenant => 'openstackv3::admin_domain',
email => 'test@example.tld',
password => 'a_big_secret',
}
keystone_user_role { 'new_admin::admin_domain@openstackv3::admin_domain':
ensure => present,
roles => ['admin'],
}
Now you can specify it like this:
keystone_user { 'new_admin':
ensure => present,
enabled => true,
domain => 'admin_domain',
tenant => 'openstackv3::admin_domain',
email => 'test@example.tld',
password => 'a_big_secret',
}
keystone_user_role { 'new_admin@openstackv3':
ensure => present,
user_domain => 'admin_domain',
project_domain => 'admin_domain',
roles => ['admin'],
}
For the developer this simplify the code. Puppet is using composite
namevar to make all the resources unique. So guessing what pattern is
used in the title is no longer required. For instance this :
keystone_tenant { 'project_one': ensure => present }
keystone_tenant { 'meaningless': name => 'project_one', domain => 'Default', ensure => present }
is detected as the same tenant by puppet.
The same is true for dependencies. This is working correctly:
keystone_tenant { 'meaningless': name => 'project_one', domain => 'domain_one', ensure => present }
file {'/tmp/needed': ensure => present, require => Keystone_tenant['project_one::domain_one'] }
In autorequire term in type definition, you just have to pass the fully
qualified name (with the domain suffix for user and tenant) of the
resource and puppet will do the matching, whatever the original title
is. See the examples in user and tenant in keystone_user_role type.
Change-Id: I4deb27dc6f71fb7a7ec6a9c72bd0e1412c2e9a30
74799f9e34