64100bb284
In keystone when the multi-domain configuration is enable, listing all the user is no longer supported. You have to specify the domain. The rational is that some domain will have LDAP backend (possibly AD) with tons of users. Listing them all would not be reliable. The prefetch feature in puppet needs to know all users and create an associated object. This is not a good idea when the number of user is too high. Thus the removal of this is necessary. The rational for using prefetch is that checking all items in one go "cost" less than fetching individual information. As the number of user defined in the catalog is likely to be less than the number of user in the keystone db, this seems dubious that this would be case here, hence the removal. As a consequence the keystone_user_role needs prefetch removal as well. It actually greatly simplify the code. A cache is made for user and project id to minimize the number of requests to the minimum. Closes-Bug: 1554555 Closes-Bug: 1485508 Depends-On: I5b334e3ffd26df4ba8584d77a5e41b56e73536c8 Change-Id: I8e117a9ddbd2ed5b3df739a0b27a66ad07a33e29
84 lines
2.9 KiB
Ruby
84 lines
2.9 KiB
Ruby
require 'spec_helper_acceptance'
|
|
|
|
describe 'basic keystone server with changed domain id' do
|
|
after(:context) do
|
|
clean_up_manifest = <<-EOM
|
|
include ::openstack_integration::keystone
|
|
|
|
keystone_config { 'identity/default_domain_id': ensure => absent}
|
|
EOM
|
|
apply_manifest(clean_up_manifest, :catch_failures => true)
|
|
end
|
|
|
|
context 'new domain id' do
|
|
let(:pp) do
|
|
<<-EOM
|
|
include ::openstack_integration
|
|
include ::openstack_integration::repos
|
|
include ::openstack_integration::mysql
|
|
|
|
class { '::openstack_integration::keystone':
|
|
default_domain => 'my_default_domain',
|
|
}
|
|
|
|
keystone_tenant { 'project_in_my_default_domain':
|
|
ensure => present,
|
|
enabled => true,
|
|
description => 'Project in another default domain',
|
|
}
|
|
keystone_user { 'user_in_my_default_domain':
|
|
ensure => present,
|
|
enabled => true,
|
|
email => 'test@example.tld',
|
|
password => 'a_big_secret',
|
|
}
|
|
keystone_user_role { 'user_in_my_default_domain@project_in_my_default_domain':
|
|
ensure => present,
|
|
roles => ['admin'],
|
|
}
|
|
keystone_domain { 'other_domain': ensure => present }
|
|
keystone_user { 'user_in_my_default_domain::other_domain':
|
|
ensure => present,
|
|
enabled => true,
|
|
email => 'test@example.tld',
|
|
password => 'a_big_secret',
|
|
}
|
|
keystone_tenant { 'project_in_my_default_domain::other_domain':
|
|
ensure => present,
|
|
enabled => true,
|
|
description => 'Project in other domain',
|
|
}
|
|
keystone_user_role { 'user_in_my_default_domain@::other_domain':
|
|
ensure => present,
|
|
user_domain => 'other_domain',
|
|
roles => ['admin'],
|
|
}
|
|
EOM
|
|
end
|
|
|
|
describe 'puppet apply' do
|
|
it 'should work with no errors and catch deprecation warning' do
|
|
apply_manifest(pp, :catch_failures => true) do |result|
|
|
expect(result.stderr)
|
|
.to include_regexp([/Puppet::Type::Keystone_tenant::ProviderOpenstack: Support for a resource without the domain.*using 'Default'.*default domain id is '/])
|
|
end
|
|
end
|
|
it 'should be idempotent' do
|
|
apply_manifest(pp, :catch_changes => true) do |result|
|
|
expect(result.stderr)
|
|
.to include_regexp([/Puppet::Type::Keystone_tenant::ProviderOpenstack: Support for a resource without the domain.*using 'Default'.*default domain id is '/])
|
|
end
|
|
end
|
|
end
|
|
describe 'puppet resources are successful created' do
|
|
it 'for tenant' do
|
|
shell('puppet resource keystone_tenant') do |result|
|
|
expect(result.stdout)
|
|
.to include_regexp([/keystone_tenant { 'project_in_my_default_domain':/,
|
|
/keystone_tenant { 'project_in_my_default_domain::other_domain':/])
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|