openstack/puppet-nova
Code Issues Proposed changes

Accept system scope credential for Keystone API request

Browse Source 
When SRBAC is enforced, obtaining detail of a project requires system
reader, domain reader of the user who actually belongs to the project.
This allows using system scope credential so that a system reader role
can be leveraged.

Change-Id: If2a95361e20c8829c64aa6a27e6fb1d0dc5c1ff2
This commit is contained in:
Takashi Kajinami 2022-01-12 22:16:00 +09:00
parent ab3a58f014
commit 63966683df
3 changed files with 37 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
manifests/keystone.pp
View File

@ -49,6 +49,10 @@
# admin context through the OpenStack Identity service.
# Defaults to 'Default'
#
# [*system_scope*]
# (Optional) Scope for system operations
# Defaults to $::os_service_default
#
# [*username*]
# (optional) Username for connecting to Keystone services in admin context
# through the OpenStack Identity service.
@ -72,12 +76,21 @@ class nova::keystone (
$region_name = $::os_service_default,
$project_name = 'services',
$project_domain_name = 'Default',
$system_scope = $::os_service_default,
$username = 'nova',
$user_domain_name = 'Default',
) {
include nova::deps
if is_service_default($system_scope) {
$project_name_real = $project_name
$project_domain_name_real = $project_domain_name
} else {
$project_name_real = $::os_service_default
$project_domain_name_real = $::os_service_default
}
nova_config {
'keystone/password': value => $password, secret => true;
'keystone/auth_type': value => $auth_type;
@ -87,8 +100,9 @@ class nova::keystone (
'keystone/endpoint_override': value => $endpoint_override;
'keystone/region_name': value => $region_name;
'keystone/timeout': value => $timeout;
'keystone/project_name': value => $project_name;
'keystone/project_domain_name': value => $project_domain_name;
'keystone/project_name': value => $project_name_real;
'keystone/project_domain_name': value => $project_domain_name_real;
'keystone/system_scope': value => $system_scope;
'keystone/username': value => $username;
'keystone/user_domain_name': value => $user_domain_name;
}

5
releasenotes/notes/system_scope-keystone-ed62f90dc93ea10d.yaml Normal file
View File

@ -0,0 +1,5 @@
---
features:
- |
The new ``system_scope`` parameter has been added to the ``nova::keystone``
class.

16
spec/classes/nova_keystone_spec.rb
View File

@ -54,12 +54,28 @@ describe 'nova::keystone' do
should contain_nova_config('keystone/valid_interfaces').with_value('internal,public')
should contain_nova_config('keystone/endpoint_override').with_value('http://10.0.0.11:5000/')
should contain_nova_config('keystone/region_name').with_value('RegionOne')
should contain_nova_config('keystone/system_scope').with_value('<SERVICE DEFAULT>')
should contain_nova_config('keystone/project_name').with_value('alt_service')
should contain_nova_config('keystone/project_domain_name').with_value('DomainX')
should contain_nova_config('keystone/username').with_value('alt_nova')
should contain_nova_config('keystone/user_domain_name').with_value('DomainY')
end
end
context 'when specified parameters' do
before do
params.merge!({
:system_scope => 'all',
:project_name => 'alt_service',
:project_domain_name => 'DomainX',
})
end
it 'configures system_scope' do
should contain_nova_config('keystone/system_scope').with_value('all')
should contain_nova_config('keystone/project_name').with_value('<SERVICE DEFAULT>')
should contain_nova_config('keystone/project_domain_name').with_value('<SERVICE DEFAULT>')
end
end
end