openstack/puppet-neutron
Code Issues Proposed changes

Accept system scope credential for Nova API request

Browse Source 
Currently Neutron uses the user credential in [nova] section to use
External Event API in Nova but this API is available only for system
admin when SRBAC is enforced.

This change allows usage of system-scoped credential instead of
project-scoped one.

Change-Id: I3f90e59f1daa06e41b1f29434feb0b8d85ac6753
This commit is contained in:
Takashi Kajinami 2021-11-26 22:26:24 +09:00
parent 8decdbaeff
commit 0d92d0a9d6
3 changed files with 58 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
manifests/server/notifications/nova.pp
View File

@ -33,6 +33,10 @@
# The value should contain auth plugin name # The value should contain auth plugin name
# Defaults to 'password' # Defaults to 'password'
# #
# [*user_domain_name*]
# (Optional) Name of domain for $username
# Defaults to 'Default'
#
# [*username*] # [*username*]
# (optional) Username for connection to nova in admin context # (optional) Username for connection to nova in admin context
# Defaults to 'nova' # Defaults to 'nova'
@ -45,9 +49,9 @@
# (optional) Nova project's name # (optional) Nova project's name
# Defaults to 'services' # Defaults to 'services'
# #
# [*user_domain_name*] # [*system_scope*]
# (Optional) Name of domain for $username # (Optional) Scope for system operations
# Defaults to 'Default' # Defaults to $::os_service_default
# #
# [*auth_url*] # [*auth_url*]
# (optional) Authorization URL for connection to nova in admin context. # (optional) Authorization URL for connection to nova in admin context.
@ -70,10 +74,11 @@ class neutron::server::notifications::nova (
$notify_nova_on_port_status_changes = $::os_service_default, $notify_nova_on_port_status_changes = $::os_service_default,
$notify_nova_on_port_data_changes = $::os_service_default, $notify_nova_on_port_data_changes = $::os_service_default,
$auth_type = 'password', $auth_type = 'password',
$user_domain_name = 'Default',
$username = 'nova', $username = 'nova',
$project_domain_name = 'Default', $project_domain_name = 'Default',
$project_name = 'services', $project_name = 'services',
$user_domain_name = 'Default', $system_scope = $::os_service_default,
$auth_url = 'http://127.0.0.1:5000', $auth_url = 'http://127.0.0.1:5000',
$region_name = $::os_service_default, $region_name = $::os_service_default,
$endpoint_type = $::os_service_default, $endpoint_type = $::os_service_default,
@ -81,16 +86,25 @@ class neutron::server::notifications::nova (
include neutron::deps include neutron::deps
if is_service_default($system_scope) {
$project_name_real = $project_name
$project_domain_name_real = $project_domain_name
} else {
$project_name_real = $::os_service_default
$project_domain_name_real = $::os_service_default
}
neutron_config { neutron_config {
'nova/auth_url': value => $auth_url; 'nova/auth_type': value => $auth_type;
'nova/user_domain_name': value => $user_domain_name;
'nova/username': value => $username; 'nova/username': value => $username;
'nova/password': value => $password, secret => true; 'nova/password': value => $password, secret => true;
'nova/project_domain_name': value => $project_domain_name; 'nova/project_domain_name': value => $project_domain_name_real;
'nova/project_name': value => $project_name; 'nova/project_name': value => $project_name_real;
'nova/user_domain_name': value => $user_domain_name; 'nova/system_scope': value => $system_scope;
'nova/auth_url': value => $auth_url;
'nova/region_name': value => $region_name; 'nova/region_name': value => $region_name;
'nova/endpoint_type': value => $endpoint_type; 'nova/endpoint_type': value => $endpoint_type;
'nova/auth_type': value => $auth_type;
} }
neutron_config { neutron_config {

6
releasenotes/notes/system_scope-nova-c5fd722cf46244bb.yaml Normal file
View File

@ -0,0 +1,6 @@
---
features:
- |
The new ``sysem_scope`` parameter has been added to
the ``neutron::server::notifications::nova`` class.

46
spec/classes/neutron_server_notifications_nova_spec.rb
View File

@ -18,13 +18,7 @@ require 'spec_helper'
describe 'neutron::server::notifications::nova' do describe 'neutron::server::notifications::nova' do
let :params do let :params do
{ {
:auth_type => 'password', :password => 'secrete',
:username => 'nova',
:password => 'secrete',
:project_domain_name => 'Default',
:project_name => 'services',
:user_domain_name => 'Default',
:auth_url => 'http://127.0.0.1:5000',
} }
end end
@ -32,13 +26,15 @@ describe 'neutron::server::notifications::nova' do
it 'configure neutron.conf' do it 'configure neutron.conf' do
should contain_neutron_config('DEFAULT/notify_nova_on_port_status_changes').with_value('<SERVICE DEFAULT>') should contain_neutron_config('DEFAULT/notify_nova_on_port_status_changes').with_value('<SERVICE DEFAULT>')
should contain_neutron_config('DEFAULT/notify_nova_on_port_data_changes').with_value('<SERVICE DEFAULT>') should contain_neutron_config('DEFAULT/notify_nova_on_port_data_changes').with_value('<SERVICE DEFAULT>')
should contain_neutron_config('nova/auth_url').with_value('http://127.0.0.1:5000')
should contain_neutron_config('nova/auth_type').with_value('password') should contain_neutron_config('nova/auth_type').with_value('password')
should contain_neutron_config('nova/user_domain_name').with_value('Default')
should contain_neutron_config('nova/username').with_value('nova') should contain_neutron_config('nova/username').with_value('nova')
should contain_neutron_config('nova/password').with_value('secrete').with_secret( true ) should contain_neutron_config('nova/password').with_value('secrete').with_secret( true )
should contain_neutron_config('nova/region_name').with_value('<SERVICE DEFAULT>')
should contain_neutron_config('nova/project_domain_name').with_value('Default') should contain_neutron_config('nova/project_domain_name').with_value('Default')
should contain_neutron_config('nova/user_domain_name').with_value('Default') should contain_neutron_config('nova/project_name').with_value('services')
should contain_neutron_config('nova/system_scope').with_value('<SERVICE DEFAULT>')
should contain_neutron_config('nova/auth_url').with_value('http://127.0.0.1:5000')
should contain_neutron_config('nova/region_name').with_value('<SERVICE DEFAULT>')
should contain_neutron_config('nova/endpoint_type').with_value('<SERVICE DEFAULT>') should contain_neutron_config('nova/endpoint_type').with_value('<SERVICE DEFAULT>')
end end
@ -47,12 +43,13 @@ describe 'neutron::server::notifications::nova' do
params.merge!( params.merge!(
:notify_nova_on_port_status_changes => false, :notify_nova_on_port_status_changes => false,
:notify_nova_on_port_data_changes => false, :notify_nova_on_port_data_changes => false,
:auth_url => 'http://keystone:5000/v3',
:auth_type => 'password', :auth_type => 'password',
:username => 'joe',
:region_name => 'MyRegion',
:project_domain_name => 'Default_1',
:user_domain_name => 'Default_2', :user_domain_name => 'Default_2',
:username => 'joe',
:project_domain_name => 'Default_1',
:project_name => 'alt_services',
:auth_url => 'http://keystone:5000/v3',
:region_name => 'MyRegion',
:endpoint_type => 'internal', :endpoint_type => 'internal',
) )
end end
@ -60,17 +57,32 @@ describe 'neutron::server::notifications::nova' do
it 'should configure neutron server with overrided parameters' do it 'should configure neutron server with overrided parameters' do
should contain_neutron_config('DEFAULT/notify_nova_on_port_status_changes').with_value(false) should contain_neutron_config('DEFAULT/notify_nova_on_port_status_changes').with_value(false)
should contain_neutron_config('DEFAULT/notify_nova_on_port_data_changes').with_value(false) should contain_neutron_config('DEFAULT/notify_nova_on_port_data_changes').with_value(false)
should contain_neutron_config('nova/auth_url').with_value('http://keystone:5000/v3')
should contain_neutron_config('nova/auth_type').with_value('password') should contain_neutron_config('nova/auth_type').with_value('password')
should contain_neutron_config('nova/user_domain_name').with_value('Default_2')
should contain_neutron_config('nova/username').with_value('joe') should contain_neutron_config('nova/username').with_value('joe')
should contain_neutron_config('nova/password').with_value('secrete').with_secret( true ) should contain_neutron_config('nova/password').with_value('secrete').with_secret( true )
should contain_neutron_config('nova/region_name').with_value('MyRegion')
should contain_neutron_config('nova/project_domain_name').with_value('Default_1') should contain_neutron_config('nova/project_domain_name').with_value('Default_1')
should contain_neutron_config('nova/user_domain_name').with_value('Default_2') should contain_neutron_config('nova/project_name').with_value('alt_services')
should contain_neutron_config('nova/system_scope').with_value('<SERVICE DEFAULT>')
should contain_neutron_config('nova/auth_url').with_value('http://keystone:5000/v3')
should contain_neutron_config('nova/region_name').with_value('MyRegion')
should contain_neutron_config('nova/endpoint_type').with_value('internal') should contain_neutron_config('nova/endpoint_type').with_value('internal')
end end
end end
context 'when system_scope is set' do
before :each do
params.merge!(
:system_scope => 'all'
)
end
it 'should configure system scope credential' do
should contain_neutron_config('nova/project_domain_name').with_value('<SERVICE DEFAULT>')
should contain_neutron_config('nova/project_name').with_value('<SERVICE DEFAULT>')
should contain_neutron_config('nova/system_scope').with_value('all')
end
end
end end
on_supported_os({ on_supported_os({