991 lines
33 KiB
Puppet
991 lines
33 KiB
Puppet
#
|
|
# Module for managing keystone config.
|
|
#
|
|
# == Parameters
|
|
#
|
|
# [*package_ensure*]
|
|
# (optional) Desired ensure state of packages.
|
|
# accepts latest or specific versions.
|
|
# Defaults to present.
|
|
#
|
|
# [*client_package_ensure*]
|
|
# (optional) Desired ensure state of the client package.
|
|
# accepts latest or specific versions.
|
|
# Defaults to present.
|
|
#
|
|
# [*public_port*]
|
|
# (optional) Port that keystone binds to.
|
|
# Defaults to '5000'
|
|
#
|
|
# [*compute_port*]
|
|
# (optional) DEPRECATED The port for compute servie.
|
|
# Defaults to '8774'
|
|
#
|
|
# [*admin_port*]
|
|
# (optional) Port that can be used for admin tasks.
|
|
# Defaults to '35357'
|
|
#
|
|
# [*admin_token*]
|
|
# Admin token that can be used to authenticate as a keystone
|
|
# admin. Required.
|
|
#
|
|
# [*verbose*]
|
|
# (optional) Rather keystone should log at verbose level.
|
|
# Defaults to false.
|
|
#
|
|
# [*debug*]
|
|
# (optional) Rather keystone should log at debug level.
|
|
# Defaults to False.
|
|
#
|
|
# [*use_syslog*]
|
|
# (optional) Use syslog for logging.
|
|
# Defaults to false.
|
|
#
|
|
# [*log_facility*]
|
|
# (optional) Syslog facility to receive log lines.
|
|
# Defaults to 'LOG_USER'.
|
|
#
|
|
# [*catalog_type*]
|
|
# (optional) Type of catalog that keystone uses to store endpoints,services.
|
|
# Defaults to sql. (Also accepts template)
|
|
#
|
|
# [*catalog_driver*]
|
|
# (optional) Catalog driver used by Keystone to store endpoints and services.
|
|
# Setting this value will override and ignore catalog_type.
|
|
# Defaults to false.
|
|
#
|
|
# [*catalog_template_file*]
|
|
# (optional) Path to the catalog used if catalog_type equals 'template'.
|
|
# Defaults to '/etc/keystone/default_catalog.templates'
|
|
#
|
|
# [*token_provider*]
|
|
# (optional) Format keystone uses for tokens.
|
|
# Defaults to 'keystone.token.providers.uuid.Provider'
|
|
# Supports PKI, PKIZ, Fernet, and UUID.
|
|
#
|
|
# [*token_driver*]
|
|
# (optional) Driver to use for managing tokens.
|
|
# Defaults to 'keystone.token.persistence.backends.sql.Token'
|
|
#
|
|
# [*token_expiration*]
|
|
# (optional) Amount of time a token should remain valid (seconds).
|
|
# Defaults to 3600 (1 hour).
|
|
#
|
|
# [*revoke_driver*]
|
|
# (optional) Driver for token revocation.
|
|
# Defaults to 'keystone.contrib.revoke.backends.sql.Revoke'
|
|
#
|
|
# [*cache_dir*]
|
|
# (optional) Directory created when token_provider is pki.
|
|
# Defaults to /var/cache/keystone.
|
|
#
|
|
# [*memcache_servers*]
|
|
# (optional) List of memcache servers in format of server:port.
|
|
# Used with token_driver 'keystone.token.backends.memcache.Token'.
|
|
# Defaults to false. Example: ['localhost:11211']
|
|
#
|
|
# [*cache_backend*]
|
|
# (optional) Dogpile.cache backend module. It is recommended that Memcache with pooling
|
|
# (keystone.cache.memcache_pool) or Redis (dogpile.cache.redis) be used in production.
|
|
# This has no effects unless 'memcache_servers' is set.
|
|
# Defaults to 'keystone.common.cache.noop'
|
|
#
|
|
# [*cache_backend_argument*]
|
|
# (optional) List of arguments in format of argname:value supplied to the backend module.
|
|
# Specify this option once per argument to be passed to the dogpile.cache backend.
|
|
# This has no effects unless 'memcache_servers' is set.
|
|
# Default to undef.
|
|
#
|
|
# [*debug_cache_backend*]
|
|
# (optional) Extra debugging from the cache backend (cache keys, get/set/delete calls).
|
|
# This has no effects unless 'memcache_servers' is set.
|
|
# Default to false.
|
|
#
|
|
# [*token_caching*]
|
|
# (optional) Toggle for token system caching. This has no effects unless 'memcache_servers' is set.
|
|
# Default to true.
|
|
#
|
|
# [*manage_service*]
|
|
# (Optional) If Puppet should manage service startup / shutdown.
|
|
# Defaults to true.
|
|
#
|
|
# [*enabled*]
|
|
# (optional) If the keystone services should be enabled.
|
|
# Default to true.
|
|
#
|
|
# [*database_connection*]
|
|
# (optional) Url used to connect to database.
|
|
# Defaults to sqlite:////var/lib/keystone/keystone.db
|
|
#
|
|
# [*database_idle_timeout*]
|
|
# (optional) Timeout when db connections should be reaped.
|
|
# Defaults to 200.
|
|
#
|
|
# [*enable_pki_setup*]
|
|
# (optional) Enable call to pki_setup to generate the cert for signing pki tokens and
|
|
# revocation lists if it doesn't already exist. This generates a cert and key stored in file
|
|
# locations based on the signing_certfile and signing_keyfile paramters below. If you are
|
|
# providing your own signing cert, make this false.
|
|
# Default to true.
|
|
#
|
|
# [*signing_certfile*]
|
|
# (optional) Location of the cert file for signing pki tokens and revocation lists.
|
|
# Note that if this file already exists (i.e. you are providing your own signing cert),
|
|
# the file will not be overwritten, even if enable_pki_setup is set to true.
|
|
# Default: /etc/keystone/ssl/certs/signing_cert.pem
|
|
#
|
|
# [*signing_keyfile*]
|
|
# (optional) Location of the key file for signing pki tokens and revocation lists.
|
|
# Note that if this file already exists (i.e. you are providing your own signing cert), the file
|
|
# will not be overwritten, even if enable_pki_setup is set to true.
|
|
# Default: /etc/keystone/ssl/private/signing_key.pem
|
|
#
|
|
# [*signing_ca_certs*]
|
|
# (optional) Use this CA certs file along with signing_certfile/signing_keyfile for
|
|
# signing pki tokens and revocation lists.
|
|
# Default: /etc/keystone/ssl/certs/ca.pem
|
|
#
|
|
# [*signing_ca_key*]
|
|
# (optional) Use this CA key file along with signing_certfile/signing_keyfile for signing
|
|
# pki tokens and revocation lists.
|
|
# Default: /etc/keystone/ssl/private/cakey.pem
|
|
#
|
|
# [*signing_cert_subject*]
|
|
# (optional) Certificate subject (auto generated certificate) for token signing.
|
|
# Defaults to '/C=US/ST=Unset/L=Unset/O=Unset/CN=www.example.com'
|
|
#
|
|
# [*signing_key_size*]
|
|
# (optional) Key size (in bits) for token signing cert (auto generated certificate)
|
|
# Defaults to 2048
|
|
#
|
|
# [*rabbit_host*]
|
|
# (optional) Location of rabbitmq installation.
|
|
# Defaults to localhost.
|
|
#
|
|
# [*rabbit_port*]
|
|
# (optional) Port for rabbitmq instance.
|
|
# Defaults to 5672.
|
|
#
|
|
# [*rabbit_hosts*]
|
|
# (optional) Location of rabbitmq installation.
|
|
# Defaults to undef.
|
|
#
|
|
# [*rabbit_password*]
|
|
# (optional) Password used to connect to rabbitmq.
|
|
# Defaults to guest.
|
|
#
|
|
# [*rabbit_userid*]
|
|
# (optional) User used to connect to rabbitmq.
|
|
# Defaults to guest.
|
|
#
|
|
# [*rabbit_virtual_host*]
|
|
# (optional) The RabbitMQ virtual host.
|
|
# Defaults to /.
|
|
#
|
|
# [*rabbit_heartbeat_timeout_threshold*]
|
|
# (optional) Number of seconds after which the RabbitMQ broker is considered
|
|
# down if the heartbeat keepalive fails. Any value >0 enables heartbeats.
|
|
# Heartbeating helps to ensure the TCP connection to RabbitMQ isn't silently
|
|
# closed, resulting in missed or lost messages from the queue.
|
|
# (Requires kombu >= 3.0.7 and amqp >= 1.4.0)
|
|
# Defaults to 0
|
|
#
|
|
# [*rabbit_heartbeat_rate*]
|
|
# (optional) How often during the rabbit_heartbeat_timeout_threshold period to
|
|
# check the heartbeat on RabbitMQ connection. (i.e. rabbit_heartbeat_rate=2
|
|
# when rabbit_heartbeat_timeout_threshold=60, the heartbeat will be checked
|
|
# every 30 seconds.
|
|
# Defaults to 2
|
|
#
|
|
# [*rabbit_use_ssl*]
|
|
# (optional) Connect over SSL for RabbitMQ
|
|
# Defaults to false
|
|
#
|
|
# [*kombu_ssl_ca_certs*]
|
|
# (optional) SSL certification authority file (valid only if SSL enabled).
|
|
# Defaults to undef
|
|
#
|
|
# [*kombu_ssl_certfile*]
|
|
# (optional) SSL cert file (valid only if SSL enabled).
|
|
# Defaults to undef
|
|
#
|
|
# [*kombu_ssl_keyfile*]
|
|
# (optional) SSL key file (valid only if SSL enabled).
|
|
# Defaults to undef
|
|
#
|
|
# [*kombu_ssl_version*]
|
|
# (optional) SSL version to use (valid only if SSL enabled).
|
|
# Valid values are TLSv1, SSLv23 and SSLv3. SSLv2 may be
|
|
# available on some distributions.
|
|
# Defaults to 'TLSv1'
|
|
#
|
|
# [*notification_driver*]
|
|
# RPC driver. Not enabled by default
|
|
#
|
|
# [*notification_topics*]
|
|
# (optional) AMQP topics to publish to when using the RPC notification driver.
|
|
# Default to false.
|
|
#
|
|
# [*notification_format*]
|
|
# Format for the notifications. Valid values are 'basic' and 'cadf'.
|
|
# Default to undef
|
|
#
|
|
# [*control_exchange*]
|
|
# (optional) AMQP exchange to connect to if using RabbitMQ or Qpid
|
|
# Default to false.
|
|
#
|
|
# [*public_bind_host*]
|
|
# (optional) The IP address of the public network interface to listen on
|
|
# Default to '0.0.0.0'.
|
|
#
|
|
# [*admin_bind_host*]
|
|
# (optional) The IP address of the public network interface to listen on
|
|
# Default to '0.0.0.0'.
|
|
#
|
|
# [*log_dir*]
|
|
# (optional) Directory where logs should be stored
|
|
# If set to boolean false, it will not log to any directory
|
|
# Defaults to '/var/log/keystone'
|
|
#
|
|
# [*log_file*]
|
|
# (optional) Where to log
|
|
# Defaults to false
|
|
#
|
|
# [*public_endpoint*]
|
|
# (optional) The base public endpoint URL for keystone that are
|
|
# advertised to clients (NOTE: this does NOT affect how
|
|
# keystone listens for connections) (string value)
|
|
# If set to false, no public_endpoint will be defined in keystone.conf.
|
|
# Sample value: 'http://localhost:5000/'
|
|
# Defaults to false
|
|
#
|
|
# [*admin_endpoint*]
|
|
# (optional) The base admin endpoint URL for keystone that are
|
|
# advertised to clients (NOTE: this does NOT affect how keystone listens
|
|
# for connections) (string value)
|
|
# If set to false, no admin_endpoint will be defined in keystone.conf.
|
|
# Sample value: 'http://localhost:35357/'
|
|
# Defaults to false
|
|
#
|
|
# [*enable_ssl*]
|
|
# (optional) Toggle for SSL support on the keystone eventlet servers.
|
|
# (boolean value)
|
|
# Defaults to false
|
|
#
|
|
# [*ssl_certfile*]
|
|
# (optional) Path of the certfile for SSL. (string value)
|
|
# Defaults to '/etc/keystone/ssl/certs/keystone.pem'
|
|
#
|
|
# [*ssl_keyfile*]
|
|
# (optional) Path of the keyfile for SSL. (string value)
|
|
# Defaults to '/etc/keystone/ssl/private/keystonekey.pem'
|
|
#
|
|
# [*ssl_ca_certs*]
|
|
# (optional) Path of the ca cert file for SSL. (string value)
|
|
# Defaults to '/etc/keystone/ssl/certs/ca.pem'
|
|
#
|
|
# [*ssl_ca_key*]
|
|
# (optional) Path of the CA key file for SSL (string value)
|
|
# Defaults to '/etc/keystone/ssl/private/cakey.pem'
|
|
#
|
|
# [*ssl_cert_subject*]
|
|
# (optional) SSL Certificate Subject (auto generated certificate)
|
|
# (string value)
|
|
# Defaults to '/C=US/ST=Unset/L=Unset/O=Unset/CN=localhost'
|
|
#
|
|
# [*mysql_module*]
|
|
# (optional) Deprecated. Does nothing.
|
|
#
|
|
# [*validate_service*]
|
|
# (optional) Whether to validate keystone connections after
|
|
# the service is started.
|
|
# Defaults to false
|
|
#
|
|
# [*validate_insecure*]
|
|
# (optional) Whether to validate keystone connections
|
|
# using the --insecure option with keystone client.
|
|
# Defaults to false
|
|
#
|
|
# [*validate_cacert*]
|
|
# (optional) Whether to validate keystone connections
|
|
# using the specified argument with the --os-cacert option
|
|
# with keystone client.
|
|
# Defaults to undef
|
|
#
|
|
# [*validate_auth_url*]
|
|
# (optional) The url to validate keystone against
|
|
# Defaults to undef
|
|
#
|
|
# [*service_provider*]
|
|
# (optional) Provider, that can be used for keystone service.
|
|
# Default value defined in keystone::params for given operation system.
|
|
# If you use Pacemaker or another Cluster Resource Manager, you can make
|
|
# custom service provider for changing start/stop/status behavior of service,
|
|
# and set it here.
|
|
#
|
|
# [*service_name*]
|
|
# (optional) Name of the service that will be providing the
|
|
# server functionality of keystone. For example, the default
|
|
# is just 'keystone', which means keystone will be run as a
|
|
# standalone eventlet service, and will able to be managed
|
|
# separately by the operating system's service manager. For
|
|
# example, you will be able to use
|
|
# service openstack-keystone restart
|
|
# to restart the service.
|
|
# If the value is 'httpd', this means keystone will be a web
|
|
# service, and you must use another class to configure that
|
|
# web service. For example, after calling class {'keystone'...}
|
|
# use class { 'keystone::wsgi::apache'...} to make keystone be
|
|
# a web app using apache mod_wsgi.
|
|
# Defaults to '$::keystone::params::service_name'
|
|
# NOTE: validate_service only applies if the default value is used.
|
|
#
|
|
# [*paste_config*]
|
|
# (optional) Name of the paste configuration file that defines the
|
|
# available pipelines. (string value)
|
|
# Defaults to '/usr/share/keystone/keystone-dist-paste.ini' on RedHat and
|
|
# undef on other platforms.
|
|
#
|
|
# [*max_token_size*]
|
|
# (optional) maximum allowable Keystone token size
|
|
# Defaults to undef
|
|
#
|
|
# [*admin_workers*]
|
|
# (optional) The number of worker processes to serve the admin WSGI application.
|
|
# Defaults to max($::processorcount, 2)
|
|
#
|
|
# [*public_workers*]
|
|
# (optional) The number of worker processes to serve the public WSGI application.
|
|
# Defaults to max($::processorcount, 2)
|
|
#
|
|
# [*sync_db*]
|
|
# (Optional) Run db sync on the node.
|
|
# Defaults to true
|
|
#
|
|
# [*enable_fernet_setup*]
|
|
# (Optional) Setup keystone for fernet tokens. This is typically only
|
|
# run on a single node, then the keys are replicated to the other nodes
|
|
# in a cluster. You would typically also pair this with a fernet token
|
|
# provider setting.
|
|
# Defaults to false
|
|
#
|
|
# [*fernet_key_repository*]
|
|
# (Optional) Location for the fernet key repository. This value must
|
|
# be set if enable_fernet_setup is set to true.
|
|
# Defaults to '/etc/keystone/fernet-keys'
|
|
#
|
|
# [*fernet_max_active_keys*]
|
|
# (Optional) Number of maximum active Fernet keys. Integer > 0.
|
|
# Defaults to undef
|
|
#
|
|
# [*default_domain*]
|
|
# (optional) When Keystone v3 support is enabled, v2 clients will need
|
|
# to have a domain assigned for certain operations. For example,
|
|
# doing a user create operation must have a domain associated with it.
|
|
# This is the domain which will be used if a domain is needed and not
|
|
# explicitly set in the request.
|
|
# Defaults to undef (will use built-in Keystone default)
|
|
#
|
|
# == Dependencies
|
|
# None
|
|
#
|
|
# == Examples
|
|
#
|
|
# class { 'keystone':
|
|
# log_verbose => 'True',
|
|
# admin_token => 'my_special_token',
|
|
# }
|
|
#
|
|
# OR
|
|
#
|
|
# class { 'keystone':
|
|
# ...
|
|
# service_name => 'httpd',
|
|
# ...
|
|
# }
|
|
# class { 'keystone::wsgi::apache':
|
|
# ...
|
|
# }
|
|
#
|
|
# == Authors
|
|
#
|
|
# Dan Bode dan@puppetlabs.com
|
|
#
|
|
# == Copyright
|
|
#
|
|
# Copyright 2012 Puppetlabs Inc, unless otherwise noted.
|
|
#
|
|
class keystone(
|
|
$admin_token,
|
|
$package_ensure = 'present',
|
|
$client_package_ensure = 'present',
|
|
$public_bind_host = '0.0.0.0',
|
|
$admin_bind_host = '0.0.0.0',
|
|
$public_port = '5000',
|
|
$admin_port = '35357',
|
|
$verbose = false,
|
|
$debug = false,
|
|
$log_dir = '/var/log/keystone',
|
|
$log_file = false,
|
|
$use_syslog = false,
|
|
$log_facility = 'LOG_USER',
|
|
$catalog_type = 'sql',
|
|
$catalog_driver = false,
|
|
$catalog_template_file = '/etc/keystone/default_catalog.templates',
|
|
$token_provider = 'keystone.token.providers.uuid.Provider',
|
|
$token_driver = 'keystone.token.persistence.backends.sql.Token',
|
|
$token_expiration = 3600,
|
|
$revoke_driver = 'keystone.contrib.revoke.backends.sql.Revoke',
|
|
$public_endpoint = false,
|
|
$admin_endpoint = false,
|
|
$enable_ssl = false,
|
|
$ssl_certfile = '/etc/keystone/ssl/certs/keystone.pem',
|
|
$ssl_keyfile = '/etc/keystone/ssl/private/keystonekey.pem',
|
|
$ssl_ca_certs = '/etc/keystone/ssl/certs/ca.pem',
|
|
$ssl_ca_key = '/etc/keystone/ssl/private/cakey.pem',
|
|
$ssl_cert_subject = '/C=US/ST=Unset/L=Unset/O=Unset/CN=localhost',
|
|
$cache_dir = '/var/cache/keystone',
|
|
$memcache_servers = false,
|
|
$manage_service = true,
|
|
$cache_backend = 'keystone.common.cache.noop',
|
|
$cache_backend_argument = undef,
|
|
$debug_cache_backend = false,
|
|
$token_caching = true,
|
|
$enabled = true,
|
|
$database_connection = 'sqlite:////var/lib/keystone/keystone.db',
|
|
$database_idle_timeout = '200',
|
|
$enable_pki_setup = true,
|
|
$signing_certfile = '/etc/keystone/ssl/certs/signing_cert.pem',
|
|
$signing_keyfile = '/etc/keystone/ssl/private/signing_key.pem',
|
|
$signing_ca_certs = '/etc/keystone/ssl/certs/ca.pem',
|
|
$signing_ca_key = '/etc/keystone/ssl/private/cakey.pem',
|
|
$signing_cert_subject = '/C=US/ST=Unset/L=Unset/O=Unset/CN=www.example.com',
|
|
$signing_key_size = 2048,
|
|
$rabbit_host = 'localhost',
|
|
$rabbit_hosts = false,
|
|
$rabbit_password = 'guest',
|
|
$rabbit_port = '5672',
|
|
$rabbit_userid = 'guest',
|
|
$rabbit_virtual_host = '/',
|
|
$rabbit_heartbeat_timeout_threshold = 0,
|
|
$rabbit_heartbeat_rate = 2,
|
|
$rabbit_use_ssl = false,
|
|
$kombu_ssl_ca_certs = undef,
|
|
$kombu_ssl_certfile = undef,
|
|
$kombu_ssl_keyfile = undef,
|
|
$kombu_ssl_version = 'TLSv1',
|
|
$notification_driver = false,
|
|
$notification_topics = false,
|
|
$notification_format = undef,
|
|
$control_exchange = false,
|
|
$validate_service = false,
|
|
$validate_insecure = false,
|
|
$validate_auth_url = false,
|
|
$validate_cacert = undef,
|
|
$paste_config = $::keystone::params::paste_config,
|
|
$service_provider = $::keystone::params::service_provider,
|
|
$service_name = $::keystone::params::service_name,
|
|
$max_token_size = undef,
|
|
$admin_workers = max($::processorcount, 2),
|
|
$public_workers = max($::processorcount, 2),
|
|
$sync_db = true,
|
|
$enable_fernet_setup = false,
|
|
$fernet_key_repository = '/etc/keystone/fernet-keys',
|
|
$fernet_max_active_keys = undef,
|
|
$default_domain = undef,
|
|
# DEPRECATED PARAMETERS
|
|
$mysql_module = undef,
|
|
$compute_port = undef,
|
|
) inherits keystone::params {
|
|
|
|
if ! $catalog_driver {
|
|
validate_re($catalog_type, 'template|sql')
|
|
}
|
|
|
|
if $mysql_module {
|
|
warning('The mysql_module parameter is deprecated. The latest 2.x mysql module will be used.')
|
|
}
|
|
|
|
if ($admin_endpoint and 'v2.0' in $admin_endpoint) {
|
|
warning('Version string /v2.0/ should not be included in keystone::admin_endpoint')
|
|
}
|
|
|
|
if ($public_endpoint and 'v2.0' in $public_endpoint) {
|
|
warning('Version string /v2.0/ should not be included in keystone::public_endpoint')
|
|
}
|
|
|
|
if $rabbit_use_ssl {
|
|
if !$kombu_ssl_ca_certs {
|
|
fail('The kombu_ssl_ca_certs parameter is required when rabbit_use_ssl is set to true')
|
|
}
|
|
if !$kombu_ssl_certfile {
|
|
fail('The kombu_ssl_certfile parameter is required when rabbit_use_ssl is set to true')
|
|
}
|
|
if !$kombu_ssl_keyfile {
|
|
fail('The kombu_ssl_keyfile parameter is required when rabbit_use_ssl is set to true')
|
|
}
|
|
}
|
|
|
|
File['/etc/keystone/keystone.conf'] -> Keystone_config<||> ~> Service[$service_name]
|
|
Keystone_config<||> ~> Exec<| title == 'keystone-manage db_sync'|>
|
|
Keystone_config<||> ~> Exec<| title == 'keystone-manage pki_setup'|>
|
|
Keystone_config<||> ~> Exec<| title == 'keystone-manage fernet_setup'|>
|
|
|
|
include ::keystone::params
|
|
|
|
package { 'keystone':
|
|
ensure => $package_ensure,
|
|
name => $::keystone::params::package_name,
|
|
tag => ['openstack', 'keystone-package'],
|
|
}
|
|
if $client_package_ensure == 'present' {
|
|
include '::openstacklib::openstackclient'
|
|
} else {
|
|
class { '::openstacklib::openstackclient':
|
|
package_ensure => $client_package_ensure,
|
|
}
|
|
}
|
|
|
|
group { 'keystone':
|
|
ensure => present,
|
|
system => true,
|
|
require => Package['keystone'],
|
|
}
|
|
|
|
user { 'keystone':
|
|
ensure => 'present',
|
|
gid => 'keystone',
|
|
system => true,
|
|
require => Package['keystone'],
|
|
}
|
|
|
|
file { ['/etc/keystone', '/var/log/keystone', '/var/lib/keystone']:
|
|
ensure => directory,
|
|
mode => '0750',
|
|
owner => 'keystone',
|
|
group => 'keystone',
|
|
require => Package['keystone'],
|
|
notify => Service[$service_name],
|
|
}
|
|
|
|
file { '/etc/keystone/keystone.conf':
|
|
ensure => present,
|
|
mode => '0600',
|
|
owner => 'keystone',
|
|
group => 'keystone',
|
|
require => Package['keystone'],
|
|
notify => Service[$service_name],
|
|
}
|
|
|
|
keystone_config {
|
|
'DEFAULT/admin_token': value => $admin_token, secret => true;
|
|
'DEFAULT/public_bind_host': value => $public_bind_host;
|
|
'DEFAULT/admin_bind_host': value => $admin_bind_host;
|
|
'DEFAULT/public_port': value => $public_port;
|
|
'DEFAULT/admin_port': value => $admin_port;
|
|
'DEFAULT/verbose': value => $verbose;
|
|
'DEFAULT/debug': value => $debug;
|
|
}
|
|
|
|
if $compute_port {
|
|
warning('The compute_port parameter is deprecated and will be removed in L')
|
|
keystone_config {
|
|
'DEFAULT/compute_port': value => $compute_port;
|
|
}
|
|
} else {
|
|
keystone_config {
|
|
'DEFAULT/compute_port': ensure => absent;
|
|
}
|
|
}
|
|
|
|
# Endpoint configuration
|
|
if $public_endpoint {
|
|
keystone_config {
|
|
'DEFAULT/public_endpoint': value => $public_endpoint;
|
|
}
|
|
} else {
|
|
keystone_config {
|
|
'DEFAULT/public_endpoint': ensure => absent;
|
|
}
|
|
}
|
|
if $admin_endpoint {
|
|
keystone_config {
|
|
'DEFAULT/admin_endpoint': value => $admin_endpoint;
|
|
}
|
|
} else {
|
|
keystone_config {
|
|
'DEFAULT/admin_endpoint': ensure => absent;
|
|
}
|
|
}
|
|
# requirements for memcache token driver
|
|
if ($token_driver =~ /memcache/ ) {
|
|
package { 'python-memcache':
|
|
ensure => present,
|
|
name => $::keystone::params::python_memcache_package_name,
|
|
}
|
|
}
|
|
|
|
# token driver config
|
|
keystone_config {
|
|
'token/driver': value => $token_driver;
|
|
'token/expiration': value => $token_expiration;
|
|
}
|
|
|
|
if $revoke_driver {
|
|
keystone_config {
|
|
'revoke/driver': value => $revoke_driver;
|
|
}
|
|
} else {
|
|
keystone_config {
|
|
'revoke/driver': ensure => absent;
|
|
}
|
|
}
|
|
|
|
# ssl config
|
|
if ($enable_ssl) {
|
|
keystone_config {
|
|
'ssl/enable': value => true;
|
|
'ssl/certfile': value => $ssl_certfile;
|
|
'ssl/keyfile': value => $ssl_keyfile;
|
|
'ssl/ca_certs': value => $ssl_ca_certs;
|
|
'ssl/ca_key': value => $ssl_ca_key;
|
|
'ssl/cert_subject': value => $ssl_cert_subject;
|
|
}
|
|
} else {
|
|
keystone_config {
|
|
'ssl/enable': value => false;
|
|
}
|
|
}
|
|
|
|
if($database_connection =~ /mysql:\/\/\S+:\S+@\S+\/\S+/) {
|
|
require 'mysql::bindings'
|
|
require 'mysql::bindings::python'
|
|
} elsif($database_connection =~ /postgresql:\/\/\S+:\S+@\S+\/\S+/) {
|
|
|
|
} elsif($database_connection =~ /sqlite:\/\//) {
|
|
|
|
} else {
|
|
fail("Invalid db connection ${database_connection}")
|
|
}
|
|
|
|
# memcache connection config
|
|
if $memcache_servers {
|
|
validate_array($memcache_servers)
|
|
Service<| title == 'memcached' |> -> Service['keystone']
|
|
keystone_config {
|
|
'cache/enabled': value => true;
|
|
'cache/backend': value => $cache_backend;
|
|
'cache/debug_cache_backend': value => $debug_cache_backend;
|
|
'token/caching': value => $token_caching;
|
|
'memcache/servers': value => join($memcache_servers, ',');
|
|
}
|
|
if $cache_backend_argument {
|
|
validate_array($cache_backend_argument)
|
|
keystone_config {
|
|
'cache/backend_argument': value => join($cache_backend_argument, ',');
|
|
}
|
|
} else {
|
|
keystone_config {
|
|
'cache/backend_argument': ensure => absent;
|
|
}
|
|
}
|
|
} else {
|
|
keystone_config {
|
|
'cache/enabled': ensure => absent;
|
|
'cache/backend': ensure => absent;
|
|
'cache/backend_argument': ensure => absent;
|
|
'cache/debug_cache_backend': ensure => absent;
|
|
'token/caching': ensure => absent;
|
|
'memcache/servers': ensure => absent;
|
|
}
|
|
}
|
|
|
|
# db connection config
|
|
keystone_config {
|
|
'database/connection': value => $database_connection, secret => true;
|
|
'database/idle_timeout': value => $database_idle_timeout;
|
|
}
|
|
|
|
# configure based on the catalog backend
|
|
if $catalog_driver {
|
|
$catalog_driver_real = $catalog_driver
|
|
}
|
|
elsif ($catalog_type == 'template') {
|
|
$catalog_driver_real = 'keystone.catalog.backends.templated.Catalog'
|
|
}
|
|
elsif ($catalog_type == 'sql') {
|
|
$catalog_driver_real = 'keystone.catalog.backends.sql.Catalog'
|
|
}
|
|
|
|
keystone_config {
|
|
'catalog/driver': value => $catalog_driver_real;
|
|
'catalog/template_file': value => $catalog_template_file;
|
|
}
|
|
|
|
# Set the signing key/cert configuration values.
|
|
keystone_config {
|
|
'signing/certfile': value => $signing_certfile;
|
|
'signing/keyfile': value => $signing_keyfile;
|
|
'signing/ca_certs': value => $signing_ca_certs;
|
|
'signing/ca_key': value => $signing_ca_key;
|
|
'signing/cert_subject': value => $signing_cert_subject;
|
|
'signing/key_size': value => $signing_key_size;
|
|
}
|
|
|
|
# Create cache directory used for signing.
|
|
file { $cache_dir:
|
|
ensure => directory,
|
|
}
|
|
|
|
# Only do pki_setup if we were asked to do so. This is needed
|
|
# regardless of the token provider since token revocation lists
|
|
# are always signed.
|
|
if $enable_pki_setup {
|
|
exec { 'keystone-manage pki_setup':
|
|
path => '/usr/bin',
|
|
user => 'keystone',
|
|
refreshonly => true,
|
|
creates => $signing_keyfile,
|
|
notify => Service[$service_name],
|
|
subscribe => Package['keystone'],
|
|
require => User['keystone'],
|
|
}
|
|
}
|
|
|
|
keystone_config { 'token/provider': value => $token_provider }
|
|
|
|
if $max_token_size {
|
|
keystone_config { 'DEFAULT/max_token_size': value => $max_token_size }
|
|
} else {
|
|
keystone_config { 'DEFAULT/max_token_size': ensure => absent }
|
|
}
|
|
|
|
if $notification_driver {
|
|
keystone_config { 'DEFAULT/notification_driver': value => $notification_driver }
|
|
} else {
|
|
keystone_config { 'DEFAULT/notification_driver': ensure => absent }
|
|
}
|
|
if $notification_topics {
|
|
keystone_config { 'DEFAULT/notification_topics': value => $notification_topics }
|
|
} else {
|
|
keystone_config { 'DEFAULT/notification_topics': ensure => absent }
|
|
}
|
|
if $notification_format {
|
|
keystone_config { 'DEFAULT/notification_format': value => $notification_format }
|
|
} else {
|
|
keystone_config { 'DEFAULT/notification_format': ensure => absent }
|
|
}
|
|
if $control_exchange {
|
|
keystone_config { 'DEFAULT/control_exchange': value => $control_exchange }
|
|
} else {
|
|
keystone_config { 'DEFAULT/control_exchange': ensure => absent }
|
|
}
|
|
|
|
keystone_config {
|
|
'oslo_messaging_rabbit/rabbit_password': value => $rabbit_password, secret => true;
|
|
'oslo_messaging_rabbit/rabbit_userid': value => $rabbit_userid;
|
|
'oslo_messaging_rabbit/rabbit_virtual_host': value => $rabbit_virtual_host;
|
|
'oslo_messaging_rabbit/heartbeat_timeout_threshold': value => $rabbit_heartbeat_timeout_threshold;
|
|
'oslo_messaging_rabbit/heartbeat_rate': value => $rabbit_heartbeat_rate;
|
|
}
|
|
|
|
if $rabbit_hosts {
|
|
keystone_config { 'oslo_messaging_rabbit/rabbit_hosts': value => join($rabbit_hosts, ',') }
|
|
keystone_config { 'oslo_messaging_rabbit/rabbit_ha_queues': value => true }
|
|
} else {
|
|
keystone_config { 'oslo_messaging_rabbit/rabbit_host': value => $rabbit_host }
|
|
keystone_config { 'oslo_messaging_rabbit/rabbit_port': value => $rabbit_port }
|
|
keystone_config { 'oslo_messaging_rabbit/rabbit_hosts': value => "${rabbit_host}:${rabbit_port}" }
|
|
keystone_config { 'oslo_messaging_rabbit/rabbit_ha_queues': value => false }
|
|
}
|
|
|
|
keystone_config { 'oslo_messaging_rabbit/rabbit_use_ssl': value => $rabbit_use_ssl }
|
|
if $rabbit_use_ssl {
|
|
keystone_config {
|
|
'oslo_messaging_rabbit/kombu_ssl_ca_certs': value => $kombu_ssl_ca_certs;
|
|
'oslo_messaging_rabbit/kombu_ssl_certfile': value => $kombu_ssl_certfile;
|
|
'oslo_messaging_rabbit/kombu_ssl_keyfile': value => $kombu_ssl_keyfile;
|
|
'oslo_messaging_rabbit/kombu_ssl_version': value => $kombu_ssl_version;
|
|
}
|
|
} else {
|
|
keystone_config {
|
|
'oslo_messaging_rabbit/kombu_ssl_ca_certs': ensure => absent;
|
|
'oslo_messaging_rabbit/kombu_ssl_certfile': ensure => absent;
|
|
'oslo_messaging_rabbit/kombu_ssl_keyfile': ensure => absent;
|
|
'oslo_messaging_rabbit/kombu_ssl_version': ensure => absent;
|
|
}
|
|
}
|
|
|
|
keystone_config {
|
|
'DEFAULT/admin_workers': value => $admin_workers;
|
|
'DEFAULT/public_workers': value => $public_workers;
|
|
}
|
|
|
|
if $manage_service {
|
|
if $enabled {
|
|
$service_ensure = 'running'
|
|
} else {
|
|
$service_ensure = 'stopped'
|
|
}
|
|
} else {
|
|
warning('Execution of db_sync does not depend on $enabled anymore. Please use sync_db instead.')
|
|
}
|
|
|
|
if $service_name == $::keystone::params::service_name {
|
|
$service_name_real = $::keystone::params::service_name
|
|
if $validate_service {
|
|
if $validate_auth_url {
|
|
$v_auth_url = $validate_auth_url
|
|
} else {
|
|
$v_auth_url = $admin_endpoint
|
|
}
|
|
|
|
class { '::keystone::service':
|
|
ensure => $service_ensure,
|
|
service_name => $service_name,
|
|
enable => $enabled,
|
|
hasstatus => true,
|
|
hasrestart => true,
|
|
provider => $service_provider,
|
|
validate => true,
|
|
admin_endpoint => $v_auth_url,
|
|
admin_token => $admin_token,
|
|
insecure => $validate_insecure,
|
|
cacert => $validate_cacert,
|
|
}
|
|
} else {
|
|
class { '::keystone::service':
|
|
ensure => $service_ensure,
|
|
service_name => $service_name,
|
|
enable => $enabled,
|
|
hasstatus => true,
|
|
hasrestart => true,
|
|
provider => $service_provider,
|
|
validate => false,
|
|
}
|
|
}
|
|
} elsif $service_name == 'httpd' {
|
|
include ::apache::params
|
|
class { '::keystone::service':
|
|
ensure => 'stopped',
|
|
service_name => $::keystone::params::service_name,
|
|
enable => false,
|
|
provider => $service_provider,
|
|
validate => false,
|
|
}
|
|
$service_name_real = $::apache::params::service_name
|
|
} else {
|
|
fail('Invalid service_name. Either keystone/openstack-keystone for running as a standalone service, or httpd for being run by a httpd server')
|
|
}
|
|
|
|
if $sync_db {
|
|
include ::keystone::db::sync
|
|
Class['::keystone::db::sync'] ~> Service[$service_name]
|
|
}
|
|
|
|
# Syslog configuration
|
|
if $use_syslog {
|
|
keystone_config {
|
|
'DEFAULT/use_syslog': value => true;
|
|
'DEFAULT/syslog_log_facility': value => $log_facility;
|
|
}
|
|
} else {
|
|
keystone_config {
|
|
'DEFAULT/use_syslog': value => false;
|
|
}
|
|
}
|
|
|
|
if $log_file {
|
|
keystone_config {
|
|
'DEFAULT/log_file': value => $log_file;
|
|
'DEFAULT/log_dir': value => $log_dir;
|
|
}
|
|
} else {
|
|
if $log_dir {
|
|
keystone_config {
|
|
'DEFAULT/log_dir': value => $log_dir;
|
|
'DEFAULT/log_file': ensure => absent;
|
|
}
|
|
} else {
|
|
keystone_config {
|
|
'DEFAULT/log_dir': ensure => absent;
|
|
'DEFAULT/log_file': ensure => absent;
|
|
}
|
|
}
|
|
}
|
|
|
|
if $paste_config {
|
|
keystone_config {
|
|
'paste_deploy/config_file': value => $paste_config;
|
|
}
|
|
} else {
|
|
keystone_config {
|
|
'paste_deploy/config_file': ensure => absent;
|
|
}
|
|
}
|
|
|
|
# Fernet tokens support
|
|
if $enable_fernet_setup {
|
|
validate_string($fernet_key_repository)
|
|
|
|
exec { 'keystone-manage fernet_setup':
|
|
path => '/usr/bin',
|
|
user => 'keystone',
|
|
refreshonly => true,
|
|
creates => "${fernet_key_repository}/0",
|
|
notify => Service[$service_name],
|
|
subscribe => [Package['keystone'], Keystone_config['fernet_tokens/key_repository']],
|
|
}
|
|
}
|
|
|
|
if $fernet_key_repository {
|
|
keystone_config {
|
|
'fernet_tokens/key_repository': value => $fernet_key_repository;
|
|
}
|
|
} else {
|
|
keystone_config {
|
|
'fernet_tokens/key_repository': ensure => absent;
|
|
}
|
|
}
|
|
|
|
if $fernet_max_active_keys {
|
|
keystone_config {
|
|
'fernet_tokens/max_active_keys': value => $fernet_max_active_keys;
|
|
}
|
|
} else {
|
|
keystone_config {
|
|
'fernet_tokens/max_active_keys': ensure => absent;
|
|
}
|
|
}
|
|
|
|
if $default_domain {
|
|
keystone_domain { $default_domain:
|
|
ensure => present,
|
|
enabled => true,
|
|
is_default => true,
|
|
require => File['/etc/keystone/keystone.conf'],
|
|
notify => Exec['restart_keystone'],
|
|
}
|
|
anchor { 'default_domain_created':
|
|
require => Keystone_domain[$default_domain],
|
|
}
|
|
# Update this code when https://bugs.launchpad.net/keystone/+bug/1472285 is addressed.
|
|
# 1/ Keystone needs to be started before creating the default domain
|
|
# 2/ Once the default domain is created, we can query Keystone to get the default domain ID
|
|
# 3/ The Keystone_domain provider has in charge of doing the query and configure keystone.conf
|
|
# 4/ After such a change, we need to restart Keystone service.
|
|
# restart_keystone exec is doing 4/, it restart Keystone if we have a new default domain setted
|
|
# and if we manage the service to be enabled.
|
|
if $manage_service and $enabled {
|
|
exec { 'restart_keystone':
|
|
path => ['/usr/sbin', '/usr/bin', '/sbin', '/bin/'],
|
|
command => "service ${service_name_real} restart",
|
|
refreshonly => true,
|
|
}
|
|
}
|
|
}
|
|
anchor { 'keystone_started':
|
|
require => Service[$service_name]
|
|
}
|
|
}
|