80ae141beb
The keystone documentation highly recommends disabling the admin_token authentication after the initial bootstrap because it exposes a major attack vector. This patch adds a new class, keystone::disable_admin_token_auth, which uses ini_subsetting to remove the admin_token_auth keyword from the pipeline lists. After the first puppet run, users who use this class with the default values will need to provide some other way for puppet to authenticate to keystone. The keystone providers can all read from /root/openrc or from OS_* environment variables. The openstack_extras::auth_file class can be used to create the openrc file. This class must be declared after the main keystone class because it uses the restart_keystone exec from the main class. This patch moves this exec out of the $default_domain conditional so that it is available to reference from the keystone::pipeline class. This is safe to do because it is a refreshonly exec, so even though it is unconditionally declared, it will only be activated if the default domain resource activates it, or the keystone::disable_admin_token_auth class activates it, or both. It will only restart keystone once no matter how many times it is activated. Change-Id: If8a7e1639189f46e16fc996fd7919eb784d24971 Depends-On: Idc3b938e37b792636ec7c2702bf8429467b78d66
16 lines
460 B
Ruby
16 lines
460 B
Ruby
require 'spec_helper'
|
|
|
|
describe 'keystone::disable_admin_token_auth' do
|
|
let :facts do
|
|
@default_facts.merge(:osfamily => 'Debian')
|
|
end
|
|
|
|
let :pre_condition do
|
|
'class { "keystone": admin_token => "secret", }'
|
|
end
|
|
|
|
it { is_expected.to contain_ini_subsetting('public_api/admin_token_auth') }
|
|
it { is_expected.to contain_ini_subsetting('admin_api/admin_token_auth') }
|
|
it { is_expected.to contain_ini_subsetting('api_v3/admin_token_auth') }
|
|
end
|