From f8b72c7e36a27b4d0998788a0ca7872c27c0c4db Mon Sep 17 00:00:00 2001 From: Sergey Kolekonov Date: Thu, 4 Aug 2016 19:20:02 +0300 Subject: [PATCH] Configure keystone authtoken options In neutron::server, use keystone::resource::authtoken to configure keystone_authtoken section in neutron.conf, with all parameters required to configure keystonemiddleware Change-Id: I036814de364f27ab1c49616d9dd4c00090d88255 Closes-bug: #1604463 --- manifests/keystone/authtoken.pp | 279 ++++++++++++++++++ manifests/server.pp | 216 ++++++++------ .../notes/authtoken-68ad3d80188e9f22.yaml | 15 + .../neutron_keystone_authtoken_spec.rb | 145 +++++++++ spec/classes/neutron_server_spec.rb | 81 +---- 5 files changed, 570 insertions(+), 166 deletions(-) create mode 100644 manifests/keystone/authtoken.pp create mode 100644 releasenotes/notes/authtoken-68ad3d80188e9f22.yaml create mode 100644 spec/classes/neutron_keystone_authtoken_spec.rb diff --git a/manifests/keystone/authtoken.pp b/manifests/keystone/authtoken.pp new file mode 100644 index 000000000..0a2a6bc54 --- /dev/null +++ b/manifests/keystone/authtoken.pp @@ -0,0 +1,279 @@ +# class: neutron::keystone::authtoken +# +# Configure the keystone_authtoken section in the configuration file +# +# === Parameters +# +# [*username*] +# (Optional) The name of the service user +# Defaults to 'neutron' +# +# [*password*] +# (Optional) Password to create for the service user +# Defaults to $::os_service_default +# +# [*auth_url*] +# (Optional) The URL to use for authentication. +# Defaults to 'http://localhost:35357'. +# +# [*project_name*] +# (Optional) Service project name +# Defaults to 'services' +# +# [*user_domain_name*] +# (Optional) Name of domain for $username +# Defaults to 'Default' +# +# [*project_domain_name*] +# (Optional) Name of domain for $project_name +# Defaults to 'Default' +# +# [*insecure*] +# (Optional) If true, explicitly allow TLS without checking server cert +# against any certificate authorities. WARNING: not recommended. Use with +# caution. +# Defaults to $:os_service_default +# +# [*auth_section*] +# (Optional) Config Section from which to load plugin specific options +# Defaults to $::os_service_default. +# +# [*auth_type*] +# (Optional) Authentication type to load +# Defaults to $::os_service_default +# +# [*auth_uri*] +# (Optional) Complete public Identity API endpoint. +# Defaults to 'http://localhost:5000'. +# +# [*auth_version*] +# (Optional) API version of the admin Identity API endpoint. +# Defaults to $::os_service_default. +# +# [*cache*] +# (Optional) Env key for the swift cache. +# Defaults to $::os_service_default. +# +# [*cafile*] +# (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs +# connections. +# Defaults to $::os_service_default. +# +# [*certfile*] +# (Optional) Required if identity server requires client certificate +# Defaults to $::os_service_default. +# +# [*check_revocations_for_cached*] +# (Optional) If true, the revocation list will be checked for cached tokens. +# This requires that PKI tokens are configured on the identity server. +# boolean value. +# Defaults to $::os_service_default. +# +# [*delay_auth_decision*] +# (Optional) Do not handle authorization requests within the middleware, but +# delegate the authorization decision to downstream WSGI components. Boolean +# value +# Defaults to $::os_service_default. +# +# [*enforce_token_bind*] +# (Optional) Used to control the use and type of token binding. Can be set +# to: "disabled" to not check token binding. "permissive" (default) to +# validate binding information if the bind type is of a form known to the +# server and ignore it if not. "strict" like "permissive" but if the bind +# type is unknown the token will be rejected. "required" any form of token +# binding is needed to be allowed. Finally the name of a binding method that +# must be present in tokens. String value. +# Defaults to $::os_service_default. +# +# [*hash_algorithms*] +# (Optional) Hash algorithms to use for hashing PKI tokens. This may be a +# single algorithm or multiple. The algorithms are those supported by Python +# standard hashlib.new(). The hashes will be tried in the order given, so put +# the preferred one first for performance. The result of the first hash will +# be stored in the cache. This will typically be set to multiple values only +# while migrating from a less secure algorithm to a more secure one. Once all +# the old tokens are expired this option should be set to a single value for +# better performance. List value. +# Defaults to $::os_service_default. +# +# [*http_connect_timeout*] +# (Optional) Request timeout value for communicating with Identity API +# server. +# Defaults to $::os_service_default. +# +# [*http_request_max_retries*] +# (Optional) How many times are we trying to reconnect when communicating +# with Identity API Server. Integer value +# Defaults to $::os_service_default. +# +# [*include_service_catalog*] +# (Optional) Indicate whether to set the X-Service-Catalog header. If False, +# middleware will not ask for service catalog on token validation and will +# not set the X-Service-Catalog header. Boolean value. +# Defaults to $::os_service_default. +# +# [*keyfile*] +# (Optional) Required if identity server requires client certificate +# Defaults to $::os_service_default. +# +# [*memcache_pool_conn_get_timeout*] +# (Optional) Number of seconds that an operation will wait to get a memcached +# client connection from the pool. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_dead_retry*] +# (Optional) Number of seconds memcached server is considered dead before it +# is tried again. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_maxsize*] +# (Optional) Maximum total number of open connections to every memcached +# server. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_socket_timeout*] +# (Optional) Number of seconds a connection to memcached is held unused in +# the pool before it is closed. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_unused_timeout*] +# (Optional) Number of seconds a connection to memcached is held unused in +# the pool before it is closed. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_secret_key*] +# (Optional, mandatory if memcache_security_strategy is defined) This string +# is used for key derivation. +# Defaults to $::os_service_default. +# +# [*memcache_security_strategy*] +# (Optional) If defined, indicate whether token data should be authenticated +# or authenticated and encrypted. If MAC, token data is authenticated (with +# HMAC) in the cache. If ENCRYPT, token data is encrypted and authenticated in the +# cache. If the value is not one of these options or empty, auth_token will +# raise an exception on initialization. +# Defaults to $::os_service_default. +# +# [*memcache_use_advanced_pool*] +# (Optional) Use the advanced (eventlet safe) memcached client pool. The +# advanced pool will only work under python 2.x Boolean value +# Defaults to $::os_service_default. +# +# [*memcached_servers*] +# (Optional) Optionally specify a list of memcached server(s) to use for +# caching. If left undefined, tokens will instead be cached in-process. +# Defaults to $::os_service_default. +# +# [*region_name*] +# (Optional) The region in which the identity server can be found. +# Defaults to $::os_service_default. +# +# [*revocation_cache_time*] +# (Optional) Determines the frequency at which the list of revoked tokens is +# retrieved from the Identity service (in seconds). A high number of +# revocation events combined with a low cache duration may significantly +# reduce performance. Only valid for PKI tokens. Integer value +# Defaults to $::os_service_default. +# +# [*signing_dir*] +# (Optional) Directory used to cache files related to PKI tokens. +# Defaults to $::os_service_default. +# +# [*token_cache_time*] +# (Optional) In order to prevent excessive effort spent validating tokens, +# the middleware caches previously-seen tokens for a configurable duration +# (in seconds). Set to -1 to disable caching completely. Integer value +# Defaults to $::os_service_default. +# +class neutron::keystone::authtoken( + $username = 'neutron', + $password = $::os_service_default, + $auth_url = 'http://localhost:35357', + $project_name = 'services', + $user_domain_name = 'Default', + $project_domain_name = 'Default', + $insecure = $::os_service_default, + $auth_section = $::os_service_default, + $auth_type = 'password', + $auth_uri = 'http://localhost:5000', + $auth_version = $::os_service_default, + $cache = $::os_service_default, + $cafile = $::os_service_default, + $certfile = $::os_service_default, + $check_revocations_for_cached = $::os_service_default, + $delay_auth_decision = $::os_service_default, + $enforce_token_bind = $::os_service_default, + $hash_algorithms = $::os_service_default, + $http_connect_timeout = $::os_service_default, + $http_request_max_retries = $::os_service_default, + $include_service_catalog = $::os_service_default, + $keyfile = $::os_service_default, + $memcache_pool_conn_get_timeout = $::os_service_default, + $memcache_pool_dead_retry = $::os_service_default, + $memcache_pool_maxsize = $::os_service_default, + $memcache_pool_socket_timeout = $::os_service_default, + $memcache_pool_unused_timeout = $::os_service_default, + $memcache_secret_key = $::os_service_default, + $memcache_security_strategy = $::os_service_default, + $memcache_use_advanced_pool = $::os_service_default, + $memcached_servers = $::os_service_default, + $region_name = $::os_service_default, + $revocation_cache_time = $::os_service_default, + $signing_dir = $::os_service_default, + $token_cache_time = $::os_service_default, +) { + + if is_service_default($password) and ! $::neutron::server::password { + fail('Please set password for neutron service user') + } + + $auth_uri_real = pick($::neutron::server::auth_uri,$auth_uri) + $auth_url_real = pick($::neutron::server::auth_url,$auth_url) + $auth_type_real = pick($::neutron::server::keystone_auth_type,$auth_type) + $memcached_servers_real = pick($::neutron::server::memcached_servers,$memcached_servers) + $password_real = pick($::neutron::server::password,$password) + $project_domain_name_real = pick($::neutron::server::project_domain_name,$project_domain_name) + $project_name_real = pick($::neutron::server::project_name,$project_name) + $region_name_real = pick($::neutron::server::region_name,$region_name) + $username_real = pick($::neutron::server::username,$username) + $user_domain_name_real = pick($::neutron::server::user_domain_name,$user_domain_name) + + keystone::resource::authtoken { 'neutron_config': + username => $username_real, + password => $password_real, + project_name => $project_name_real, + auth_url => $auth_url_real, + auth_uri => $auth_uri_real, + auth_version => $auth_version, + auth_type => $auth_type_real, + auth_section => $auth_section, + user_domain_name => $user_domain_name_real, + project_domain_name => $project_domain_name_real, + insecure => $insecure, + cache => $cache, + cafile => $cafile, + certfile => $certfile, + check_revocations_for_cached => $check_revocations_for_cached, + delay_auth_decision => $delay_auth_decision, + enforce_token_bind => $enforce_token_bind, + hash_algorithms => $hash_algorithms, + http_connect_timeout => $http_connect_timeout, + http_request_max_retries => $http_request_max_retries, + include_service_catalog => $include_service_catalog, + keyfile => $keyfile, + memcache_pool_conn_get_timeout => $memcache_pool_conn_get_timeout, + memcache_pool_dead_retry => $memcache_pool_dead_retry, + memcache_pool_maxsize => $memcache_pool_maxsize, + memcache_pool_socket_timeout => $memcache_pool_socket_timeout, + memcache_secret_key => $memcache_secret_key, + memcache_security_strategy => $memcache_security_strategy, + memcache_use_advanced_pool => $memcache_use_advanced_pool, + memcache_pool_unused_timeout => $memcache_pool_unused_timeout, + memcached_servers => $memcached_servers_real, + region_name => $region_name_real, + revocation_cache_time => $revocation_cache_time, + signing_dir => $signing_dir, + token_cache_time => $token_cache_time, + } +} + diff --git a/manifests/server.pp b/manifests/server.pp index 686cb4785..fc5af5a10 100644 --- a/manifests/server.pp +++ b/manifests/server.pp @@ -26,56 +26,6 @@ # [*log_dir*] # REMOVED: Use log_dir of neutron class instead. # -# [*auth_type*] -# (optional) What auth system to use -# Defaults to 'keystone'. Can other be 'noauth' -# -# [*keystone_auth_type*] -# (optional) An authentication plugin to use with an OpenStack Identity server. -# Defaults to 'password' -# -# [*auth_uri*] -# (optional) Complete public Identity API endpoint. -# Defaults to: 'http://localhost:5000/' -# -# [*auth_url*] -# (optional) Authorization URL. -# If version independent identity plugin is used available versions will be -# determined using auth_url -# Defaults to 'http://localhost:35357' -# -# [*username*] -# (optional) The name of the auth user -# Defaults to 'neutron' -# -# [*password*] -# The password to use for authentication (keystone) -# Either password or auth_password is required -# -# [*project_domain_id*] -# (optional) Auth user project's domain ID -# Defaults to $::os_service_default -# -# [*project_domain_name*] -# (optional) Auth user project's domain name -# Defaults to 'Default' -# -# [*project_name*] -# (optional) Auth user project's name -# Defaults to 'services' -# -# [*user_domain_id*] -# (optional) Auth user's domain ID -# Defaults to $::os_service_default -# -# [*user_domain_name*] -# (optional) Auth user's domain name -# Defaults to 'Default' -# -# [*region_name*] -# (optional) The authentication region -# Defaults to $::os_service_default -# # [*database_connection*] # (optional) Connection url for the neutron database. # (Defaults to undef) @@ -254,6 +204,10 @@ # ] # } # +# [*auth_strategy*] +# (optional) The strategy to use for authentication. +# Defaults to 'keystone' +# # === Deprecated Parameters # # [*ensure_lbaas_package*] @@ -265,23 +219,68 @@ # Deprecated. (optional) Minimum number of l3 agents which a HA router will be scheduled on. # Defaults to undef # +# [*keystone_auth_type*] +# (optional) Deprecated Use neutron::keystone::authtoken::auth_type instead. +# Defaults to undef +# +# [*auth_uri*] +# (optional) Deprecated Use neutron::keystone::authtoken::auth_uri +# Defaults to undef +# +# [*auth_url*] +# (optional) Deprecated Use neutron::keystone::authtoken::auth_url instead +# Defaults to undef +# +# [*username*] +# (optional) Deprecated Use neutron::keystone::authtoken::username instead +# Defaults to undef +# +# [*password*] +# (optional) Deprecated Use neutron::keystone::authtoken::password +# Defaults to undef +# +# [*project_domain_id*] +# Deprecated. Auth user project's domain ID +# Defaults to $::os_service_default +# +# [*project_domain_name*] +# (optional) Deprecated +# Use neutron::keystone::authtoken::project_domain_name instead +# Defaults to undef +# +# [*project_name*] +# (optional) Deprecated Use neutron::keystone::authtoken::project_name +# instead +# Defaults to undef +# +# [*user_domain_id*] +# (optional) Deprecated Use neutron::keystone::authtoken:: +# Defaults to $::os_service_default +# +# [*user_domain_name*] +# (optional) Deprecated Use neutron::keystone::authtoken::user_domain_name +# instead +# Defaults to undef +# +# [*region_name*] +# (optional) Deprecated Use neutron::keystone::authtoken::region_name +# instead. +# Defaults to undef +# +# [*memcached_servers*] +# (optional) Deprecated Use neutron::keystone::authtoken::memcached_servers +# instead +# Defaults to undef +# +# [*auth_type*] +# (optional) Deprecated Use auth_strategy instead. +# Defaults to undef +# class neutron::server ( $package_ensure = 'present', $enabled = true, $manage_service = true, $service_name = $::neutron::params::server_service, - $auth_type = 'keystone', - $keystone_auth_type = 'password', - $auth_uri = 'http://localhost:5000/', - $auth_url = 'http://localhost:35357/', - $username = 'neutron', - $password = false, - $region_name = $::os_service_default, - $project_domain_id = $::os_service_default, - $project_domain_name = 'Default', - $project_name = 'services', - $user_domain_id = $::os_service_default, - $user_domain_name = 'Default', $database_connection = undef, $database_max_retries = undef, $database_idle_timeout = undef, @@ -309,7 +308,7 @@ class neutron::server ( $ensure_fwaas_package = false, $vpnaas_agent_package = false, $service_providers = $::os_service_default, - $memcached_servers = $::os_service_default, + $auth_strategy = 'keystone', # DEPRECATED PARAMETERS $log_dir = undef, $log_file = undef, @@ -318,6 +317,19 @@ class neutron::server ( $lock_path = undef, $ensure_lbaas_package = false, $min_l3_agents_per_router = undef, + $keystone_auth_type = undef, + $auth_uri = undef, + $auth_url = undef, + $username = undef, + $password = undef, + $region_name = undef, + $project_domain_name = undef, + $project_name = undef, + $user_domain_name = undef, + $memcached_servers = undef, + $project_domain_id = $::os_service_default, + $user_domain_id = $::os_service_default, + $auth_type = undef, ) inherits ::neutron::params { include ::neutron::deps @@ -326,6 +338,58 @@ class neutron::server ( # Work-around LP#1551974. neutron requires the keystoneclient to auth tokens include ::keystone::client + if $auth_type { + warning('neutron::server::auth_type is deprecated, use neutron::server::auth_strategy instead.') + } + + if $keystone_auth_type { + warning('neutron::server::keystone_auth_type is deprecated, use neutron::keystone::authtoken::auth_type instead.') + } + + if $auth_uri { + warning('neutron::server::auth_uri is deprecated, use neutron::keystone::authtoken::auth_uri instead.') + } + + if $auth_url { + warning('neutron::server::auth_url is deprecated, use neutron::keystone::authtoken::auth_url instead.') + } + + if $username { + warning('neutron::server::username is deprecated, use neutron::keystone::authtoken::username instead.') + } + + if $password { + warning('neutron::server::password is deprecated, use neutron::keystone::authtoken::password instead.') + } + + if ! is_service_default($project_domain_id) { + warning('neutron::server::project_domain_id is deprecated, use neutron::keystone::authtoken::project_domain_name instead.') + } + + if $project_domain_name { + warning('neutron::server::project_domain_name is deprecated, use neutron::keystone::authtoken::project_domain_name instead.') + } + + if $project_name { + warning('neutron::server::project_name is deprecated, use neutron::keystone::authtoken::project_name instead.') + } + + if ! is_service_default($user_domain_id) { + warning('neutron::server::user_domain_id is deprecated, use neutron::keystone::authtoken::user_domain_name instead.') + } + + if $user_domain_name { + warning('neutron::server::user_domain_name is deprecated, use neutron::keystone::authtoken::user_domain_name instead.') + } + + if $region_name { + warning('neutron::server::region_name is deprecated, use neutron::keystone::authtoken::region_name instead.') + } + + if $memcached_servers { + warning('neutron::server::memcached_servers is deprecated, use neutron::keystone::authtoken::memcached_servers instead') + } + if !is_service_default($default_availability_zones) { validate_array($default_availability_zones) } @@ -443,31 +507,11 @@ class neutron::server ( 'DEFAULT/auth_type': value => $auth_type; } - if ($auth_type == 'keystone') { + $auth_strategy_real = pick($auth_type, $auth_strategy) + if ($auth_strategy_real == 'keystone') { - if $password == false { - fail('password must be set when using keystone authentication.') - } + include ::neutron::keystone::authtoken - neutron_config { - 'keystone_authtoken/auth_type': value => $keystone_auth_type; - 'keystone_authtoken/auth_url': value => $auth_url; - 'keystone_authtoken/auth_uri': value => $auth_uri; - 'keystone_authtoken/username': value => $username; - 'keystone_authtoken/password': value => $password, secret => true; - 'keystone_authtoken/region_name': value => $region_name; - 'keystone_authtoken/project_domain_id': value => $project_domain_id; - 'keystone_authtoken/project_domain_name': value => $project_domain_name; - 'keystone_authtoken/project_name': value => $project_name; - 'keystone_authtoken/user_domain_id': value => $user_domain_id; - 'keystone_authtoken/user_domain_name': value => $user_domain_name; - 'keystone_authtoken/memcached_servers': value => join(any2array($memcached_servers), ','); - 'keystone_authtoken/admin_tenant_name': ensure => absent; - 'keystone_authtoken/admin_user': ensure => absent; - 'keystone_authtoken/admin_password': ensure => absent; - 'keystone_authtoken/auth_region': ensure => absent; - 'keystone_authtoken/identity_uri': ensure => absent; - } neutron_api_config { 'filter:authtoken/admin_tenant_name': ensure => absent; 'filter:authtoken/admin_user': ensure => absent; diff --git a/releasenotes/notes/authtoken-68ad3d80188e9f22.yaml b/releasenotes/notes/authtoken-68ad3d80188e9f22.yaml new file mode 100644 index 000000000..9c0df6b87 --- /dev/null +++ b/releasenotes/notes/authtoken-68ad3d80188e9f22.yaml @@ -0,0 +1,15 @@ +--- +features: + - Configure keystonemiddleware in a consistent way using modern parameters +deprecations: + - neutron::server::keystone_auth_type is deprecated, use neutron::keystone::authtoken::auth_type instead + - neutron::server::auth_uri is deprecated, use neutron::keystone::authtoken::auth_uri instead + - neutron::server::auth_url is deprecated, use neutron::keystone::authtoken::auth_url instead + - neutron::server::username is deprecated, use neutron::keystone::authtoken::username instead + - neutron::server::password is deprecated, use neutron::keystone::authtoken::password instead + - neutron::server::project_domain_id is deprecated, use neutron::keystone::authtoken::project_domain_name instead + - neutron::server::project_domain_name is deprecated, use neutron::keystone::authtoken::project_domain_name instead + - neutron::server::project_name is deprecated, use neutron::keystone::authtoken::project_name instead + - neutron::server::user_domain_id is deprecated, use neutron::keystone::authtoken::user_domain_name instead + - neutron::server::user_domain_name is deprecated, use neutron::keystone::authtoken::user_domain_name instead + - neutron::server::region_name is deprecated, use neutron::keystone::authtoken::region_name instead diff --git a/spec/classes/neutron_keystone_authtoken_spec.rb b/spec/classes/neutron_keystone_authtoken_spec.rb new file mode 100644 index 000000000..5fc0ef372 --- /dev/null +++ b/spec/classes/neutron_keystone_authtoken_spec.rb @@ -0,0 +1,145 @@ +require 'spec_helper' + +describe 'neutron::keystone::authtoken' do + + let :params do + { :password => 'neutron_password', } + end + + shared_examples 'neutron authtoken' do + + context 'with default parameters' do + + it 'configure keystone_authtoken' do + is_expected.to contain_neutron_config('keystone_authtoken/username').with_value('neutron') + is_expected.to contain_neutron_config('keystone_authtoken/password').with_value('neutron_password') + is_expected.to contain_neutron_config('keystone_authtoken/auth_url').with_value('http://localhost:35357') + is_expected.to contain_neutron_config('keystone_authtoken/project_name').with_value('services') + is_expected.to contain_neutron_config('keystone_authtoken/user_domain_name').with_value('Default') + is_expected.to contain_neutron_config('keystone_authtoken/project_domain_name').with_value('Default') + is_expected.to contain_neutron_config('keystone_authtoken/insecure').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/auth_section').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/auth_type').with_value('password') + is_expected.to contain_neutron_config('keystone_authtoken/auth_uri').with_value('http://localhost:5000') + is_expected.to contain_neutron_config('keystone_authtoken/auth_version').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/cache').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/cafile').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/certfile').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/check_revocations_for_cached').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/delay_auth_decision').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/enforce_token_bind').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/hash_algorithms').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/http_connect_timeout').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/http_request_max_retries').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/include_service_catalog').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/keyfile').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/memcache_pool_dead_retry').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/memcache_pool_maxsize').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/memcache_pool_socket_timeout').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/memcache_pool_unused_timeout').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/memcache_secret_key').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/memcache_security_strategy').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/memcache_use_advanced_pool').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/memcached_servers').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/region_name').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/revocation_cache_time').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/signing_dir').with_value('') + is_expected.to contain_neutron_config('keystone_authtoken/token_cache_time').with_value('') + end + end + + context 'when overriding parameters' do + before do + params.merge!({ + :auth_uri => 'https://10.0.0.1:9999/', + :username => 'myuser', + :password => 'mypasswd', + :auth_url => 'https://127.0.0.1:35357', + :project_name => 'service_project', + :user_domain_name => 'domainX', + :project_domain_name => 'domainX', + :insecure => false, + :auth_section => 'new_section', + :auth_type => 'password', + :auth_version => 'v3', + :cache => 'somevalue', + :cafile => '/opt/stack/data/cafile.pem', + :certfile => 'certfile.crt', + :check_revocations_for_cached => false, + :delay_auth_decision => false, + :enforce_token_bind => 'permissive', + :hash_algorithms => 'md5', + :http_connect_timeout => '300', + :http_request_max_retries => '3', + :include_service_catalog => true, + :keyfile => 'keyfile', + :memcache_pool_conn_get_timeout => '9', + :memcache_pool_dead_retry => '302', + :memcache_pool_maxsize => '11', + :memcache_pool_socket_timeout => '2', + :memcache_pool_unused_timeout => '61', + :memcache_secret_key => 'secret_key', + :memcache_security_strategy => 'ENCRYPT', + :memcache_use_advanced_pool => true, + :memcached_servers => ['memcached01:11211','memcached02:11211'], + :region_name => 'region2', + :revocation_cache_time => '11', + :signing_dir => '/var/cache', + :token_cache_time => '301', + }) + end + + it 'configure keystone_authtoken' do + is_expected.to contain_neutron_config('keystone_authtoken/auth_uri').with_value('https://10.0.0.1:9999/') + is_expected.to contain_neutron_config('keystone_authtoken/username').with_value(params[:username]) + is_expected.to contain_neutron_config('keystone_authtoken/password').with_value(params[:password]).with_secret(true) + is_expected.to contain_neutron_config('keystone_authtoken/auth_url').with_value(params[:auth_url]) + is_expected.to contain_neutron_config('keystone_authtoken/project_name').with_value(params[:project_name]) + is_expected.to contain_neutron_config('keystone_authtoken/user_domain_name').with_value(params[:user_domain_name]) + is_expected.to contain_neutron_config('keystone_authtoken/project_domain_name').with_value(params[:project_domain_name]) + is_expected.to contain_neutron_config('keystone_authtoken/insecure').with_value(params[:insecure]) + is_expected.to contain_neutron_config('keystone_authtoken/auth_section').with_value(params[:auth_section]) + is_expected.to contain_neutron_config('keystone_authtoken/auth_type').with_value(params[:auth_type]) + is_expected.to contain_neutron_config('keystone_authtoken/auth_version').with_value(params[:auth_version]) + is_expected.to contain_neutron_config('keystone_authtoken/cache').with_value(params[:cache]) + is_expected.to contain_neutron_config('keystone_authtoken/cafile').with_value(params[:cafile]) + is_expected.to contain_neutron_config('keystone_authtoken/certfile').with_value(params[:certfile]) + is_expected.to contain_neutron_config('keystone_authtoken/check_revocations_for_cached').with_value(params[:check_revocations_for_cached]) + is_expected.to contain_neutron_config('keystone_authtoken/delay_auth_decision').with_value(params[:delay_auth_decision]) + is_expected.to contain_neutron_config('keystone_authtoken/enforce_token_bind').with_value(params[:enforce_token_bind]) + is_expected.to contain_neutron_config('keystone_authtoken/hash_algorithms').with_value(params[:hash_algorithms]) + is_expected.to contain_neutron_config('keystone_authtoken/http_connect_timeout').with_value(params[:http_connect_timeout]) + is_expected.to contain_neutron_config('keystone_authtoken/http_request_max_retries').with_value(params[:http_request_max_retries]) + is_expected.to contain_neutron_config('keystone_authtoken/include_service_catalog').with_value(params[:include_service_catalog]) + is_expected.to contain_neutron_config('keystone_authtoken/keyfile').with_value(params[:keyfile]) + is_expected.to contain_neutron_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value(params[:memcache_pool_conn_get_timeout]) + is_expected.to contain_neutron_config('keystone_authtoken/memcache_pool_dead_retry').with_value(params[:memcache_pool_dead_retry]) + is_expected.to contain_neutron_config('keystone_authtoken/memcache_pool_maxsize').with_value(params[:memcache_pool_maxsize]) + is_expected.to contain_neutron_config('keystone_authtoken/memcache_pool_socket_timeout').with_value(params[:memcache_pool_socket_timeout]) + is_expected.to contain_neutron_config('keystone_authtoken/memcache_pool_unused_timeout').with_value(params[:memcache_pool_unused_timeout]) + is_expected.to contain_neutron_config('keystone_authtoken/memcache_secret_key').with_value(params[:memcache_secret_key]) + is_expected.to contain_neutron_config('keystone_authtoken/memcache_security_strategy').with_value(params[:memcache_security_strategy]) + is_expected.to contain_neutron_config('keystone_authtoken/memcache_use_advanced_pool').with_value(params[:memcache_use_advanced_pool]) + is_expected.to contain_neutron_config('keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211') + is_expected.to contain_neutron_config('keystone_authtoken/region_name').with_value(params[:region_name]) + is_expected.to contain_neutron_config('keystone_authtoken/revocation_cache_time').with_value(params[:revocation_cache_time]) + is_expected.to contain_neutron_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir]) + is_expected.to contain_neutron_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time]) + end + end + end + + on_supported_os({ + :supported_os => OSDefaults.get_supported_os + }).each do |os,facts| + context "on #{os}" do + let (:facts) do + facts.merge!(OSDefaults.get_facts()) + end + + it_configures 'neutron authtoken' + end + end + +end diff --git a/spec/classes/neutron_server_spec.rb b/spec/classes/neutron_server_spec.rb index dc6c6726a..151874ed5 100644 --- a/spec/classes/neutron_server_spec.rb +++ b/spec/classes/neutron_server_spec.rb @@ -48,25 +48,6 @@ describe 'neutron::server' do it { is_expected.to contain_class('neutron::params') } it { is_expected.to contain_class('neutron::policy') } - it 'configures authentication middleware' do - is_expected.to contain_neutron_config('keystone_authtoken/auth_type').with_value(p[:keystone_auth_type]); - is_expected.to contain_neutron_config('keystone_authtoken/username').with_value(p[:username]); - is_expected.to contain_neutron_config('keystone_authtoken/password').with_value(p[:password]); - is_expected.to contain_neutron_config('keystone_authtoken/password').with_secret( true ) - is_expected.to contain_neutron_config('keystone_authtoken/auth_uri').with_value("http://localhost:5000/"); - is_expected.to contain_neutron_config('keystone_authtoken/auth_url').with_value("http://localhost:35357/"); - is_expected.to contain_neutron_config('keystone_authtoken/project_domain_name').with_value(p[:project_domain_name]); - is_expected.to contain_neutron_config('keystone_authtoken/project_domain_id').with_value(''); - is_expected.to contain_neutron_config('keystone_authtoken/project_name').with_value(p[:project_name]); - is_expected.to contain_neutron_config('keystone_authtoken/user_domain_name').with_value(p[:user_domain_name]); - is_expected.to contain_neutron_config('keystone_authtoken/user_domain_id').with_value(''); - is_expected.to contain_neutron_config('keystone_authtoken/admin_tenant_name').with_ensure('absent'); - is_expected.to contain_neutron_config('keystone_authtoken/admin_user').with_ensure('absent'); - is_expected.to contain_neutron_config('keystone_authtoken/admin_password').with_ensure('absent'); - is_expected.to contain_neutron_config('keystone_authtoken/identity_uri').with_ensure('absent'); - is_expected.to contain_neutron_config('keystone_authtoken/memcached_servers').with_value(''); - end - it 'installs neutron server package' do if platform_params.has_key?(:server_package) is_expected.to contain_package('neutron-server').with( @@ -242,7 +223,7 @@ describe 'neutron::server' do before do params.delete(:password) end - it_raises 'a Puppet::Error', /password must be set when using keystone authentication/ + it_raises 'a Puppet::Error', /Please set password for neutron service user/ end shared_examples_for 'VPNaaS, FWaaS and LBaaS package installation' do @@ -271,66 +252,6 @@ describe 'neutron::server' do end end - describe "with custom keystone authentication params" do - let :facts do - @default_facts.merge(test_facts.merge({ - :osfamily => 'RedHat', - :operatingsystemrelease => '7' - })) - end - before do - params.merge!({ - :auth_uri => 'https://foo.bar:5000/', - :auth_url => 'https://foo.bar:35357/v3', - :keystone_auth_type => 'v3password', - :project_domain_name => 'non_default', - :project_name => 'new_services', - :user_domain_name => 'non_default' - }) - end - it 'configures keystone authentication params' do - is_expected.to contain_neutron_config('keystone_authtoken/auth_uri').with_value("https://foo.bar:5000/"); - is_expected.to contain_neutron_config('keystone_authtoken/auth_url').with_value("https://foo.bar:35357/v3"); - is_expected.to contain_neutron_config('keystone_authtoken/project_domain_name').with_value("non_default"); - is_expected.to contain_neutron_config('keystone_authtoken/project_name').with_value("new_services"); - is_expected.to contain_neutron_config('keystone_authtoken/user_domain_name').with_value("non_default"); - end - end - - describe "with keystoneauth memcache servers" do - let :facts do - @default_facts.merge(test_facts.merge({ - :osfamily => 'RedHat', - :operatingsystemrelease => '7' - })) - end - before do - params.merge!({ - :memcached_servers => '1.1.1.1:11211' - }) - end - it 'configures keystone authentication memached servers' do - is_expected.to contain_neutron_config('keystone_authtoken/memcached_servers').with_value('1.1.1.1:11211'); - end - end - - describe "with custom auth region" do - let :facts do - @default_facts.merge(test_facts.merge({ - :osfamily => 'RedHat', - :operatingsystemrelease => '7' - })) - end - before do - params.merge!({ - :region_name => 'MyRegion', - }) - end - it 'configures region_name' do - is_expected.to contain_neutron_config('keystone_authtoken/region_name').with_value('MyRegion'); - end - end - context 'on Debian platforms' do let :facts do @default_facts.merge(test_facts.merge({