openstack/puppet-nova
Code Issues Proposed changes

Use novajoin-specific user and directory

Browse Source 
This uses novajoin's user and directory for the novajoin service instead
of relying on the nova service user and /etc/nova. It also removes some
nova-specific parameters related to auth, to replace them with more
generic names.

Change-Id: I5e02164854542ad08b1b517f52334187913ee4e8
This commit is contained in:
Juan Antonio Osorio Robles 2017-05-23 14:35:03 +03:00
parent 882cacab52
commit db49f73ef9
4 changed files with 77 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
manifests/metadata/novajoin/api.pp
View File

@ -5,8 +5,8 @@
# #
# === Parameters # === Parameters
# #
# [*nova_password*] # [*service_password*]
# (required) Password for the nova service user. # (required) Password for the novajoin service user.
# #
# [*transport_url*] # [*transport_url*]
# (required) Transport URL for notifier service to talk to # (required) Transport URL for notifier service to talk to
@ -18,7 +18,7 @@
# #
# [*api_paste_config*] # [*api_paste_config*]
# (optional) Filename for the paste deploy file. # (optional) Filename for the paste deploy file.
# Defaults to '/etc/nova/join-api-paste.ini'. # Defaults to '/etc/novajoin/join-api-paste.ini'.
# #
# [*auth_strategy*] # [*auth_strategy*]
# (optional) Strategy to use for authentication. # (optional) Strategy to use for authentication.
@ -66,7 +66,7 @@
# #
# [*keytab*] # [*keytab*]
# (optional) Kerberos client keytab file. # (optional) Kerberos client keytab file.
# Defaults to '/etc/nova/krb5.keytab' # Defaults to '/etc/novajoin/krb5.keytab'
# #
# [*log_dir*] # [*log_dir*]
# (optional) log directory. # (optional) log directory.
@ -76,27 +76,35 @@
# (optional) If Puppet should manage service startup / shutdown. # (optional) If Puppet should manage service startup / shutdown.
# Defaults to true. # Defaults to true.
# #
# [*service_user*]
# (optional) User that the novajoin services run as.
# Defaults to 'novajoin'
#
# [*project_domain_name*]
# (optional) Domain name containing project (for novajoin auth).
# Defaults to 'default'
#
# [*project_name*]
# (optional) Project name (for novajoin auth).
# Defaults to 'service'
#
# [*user_domain_id*]
# (optional) Domain for novajoin user.
# Defaults to 'default'
#
# DEPRECATED PARAMETERS
#
# [*nova_user*] # [*nova_user*]
# (optional) User that nova services run as. # (optional) User that nova services run as.
# Defaults to 'nova' # Defaults to 'nova'
# #
# [*project_domain_name*] # [*nova_password*]
# (optional) Domain name containing project (for nova auth). # (required) Password for the nova service user.
# Defaults to 'default'
#
# [*project_name*]
# (optional) Project name (for nova auth).
# Defaults to 'service'
#
# [*user_domain_id*]
# (optional) Domain for nova user.
# Defaults to 'default'
# #
class nova::metadata::novajoin::api ( class nova::metadata::novajoin::api (
$nova_password,
$transport_url, $transport_url,
$bind_address = '127.0.0.1', $bind_address = '127.0.0.1',
$api_paste_config = '/etc/nova/join-api-paste.ini', $api_paste_config = '/etc/novajoin/join-api-paste.ini',
$auth_strategy = $::os_service_default, $auth_strategy = $::os_service_default,
$auth_type = 'password', $auth_type = 'password',
$cacert = '/etc/ipa/ca.crt', $cacert = '/etc/ipa/ca.crt',
@ -108,16 +116,42 @@ class nova::metadata::novajoin::api (
$ipa_domain = undef, $ipa_domain = undef,
$join_listen_port = $::os_service_default, $join_listen_port = $::os_service_default,
$keystone_auth_url = 'http://127.0.0.1:35357/', $keystone_auth_url = 'http://127.0.0.1:35357/',
$keytab = '/etc/nova/krb5.keytab', $keytab = '/etc/novajoin/krb5.keytab',
$log_dir = '/var/log/novajoin', $log_dir = '/var/log/novajoin',
$manage_service = true, $manage_service = true,
$nova_user = 'nova', $service_password = undef,
$service_user = 'novajoin',
$project_domain_name = 'default', $project_domain_name = 'default',
$project_name = 'service', $project_name = 'service',
$user_domain_id = 'default', $user_domain_id = 'default',
# DEPRECATED PARAMETERS
$nova_user = 'nova',
$nova_password = undef,
) { ) {
include ::nova::metadata::novajoin::authtoken include ::nova::metadata::novajoin::authtoken
if $service_user {
$service_user_real = $service_user
} else {
warning('The nova_user parameter is deprecated. use service_user instead')
$service_user_real = $nova_user
}
if ! $service_user_real {
fail('service_user is missing')
}
if $service_password {
$service_password_real = $service_password
} else {
warning('The nova_password parameter is deprecated. use service_password instead')
$service_password_real = $nova_password
}
if ! $service_password_real {
fail('service_password is missing')
}
case $::osfamily { case $::osfamily {
'RedHat': { 'RedHat': {
$package_name = 'python-novajoin' $package_name = 'python-novajoin'
@ -158,8 +192,8 @@ class nova::metadata::novajoin::api (
'DEFAULT/transport_url': value => $transport_url; 'DEFAULT/transport_url': value => $transport_url;
'service_credentials/auth_type': value => $auth_type; 'service_credentials/auth_type': value => $auth_type;
'service_credentials/auth_url': value => $keystone_auth_url; 'service_credentials/auth_url': value => $keystone_auth_url;
'service_credentials/password': value => $nova_password; 'service_credentials/password': value => $service_password_real;
'service_credentials/username': value => $nova_user; 'service_credentials/username': value => $service_user_real;
'service_credentials/project_name': value => $project_name; 'service_credentials/project_name': value => $project_name;
'service_credentials/user_domain_id': value => $user_domain_id; 'service_credentials/user_domain_id': value => $user_domain_id;
'service_credentials/project_domain_name': 'service_credentials/project_domain_name':
@ -199,7 +233,7 @@ class nova::metadata::novajoin::api (
require => Package['python-novajoin'] require => Package['python-novajoin']
} }
ensure_resource('file', $keytab, { owner => $nova_user, require => Exec['get-service-user-keytab'] }) ensure_resource('file', $keytab, { owner => $service_user, require => Exec['get-service-user-keytab'] })
Novajoin_config<||> ~> Service<| title == 'novajoin-server'|> Novajoin_config<||> ~> Service<| title == 'novajoin-server'|>
Novajoin_config<||> ~> Service<| title == 'novajoin-notify'|> Novajoin_config<||> ~> Service<| title == 'novajoin-notify'|>

5
releasenotes/notes/Use-novajoin-specific-user-and-directory-2141e8c0bfc68c24.yaml Normal file
View File

@ -0,0 +1,5 @@
---
other:
- Novajoin now uses it's own user and configuration directory by default. As
to separate from the nova user and have it easier to use in containerized
environments.

22
spec/classes/nova_metadata_novajoin_api_spec.rb
View File

@ -16,7 +16,7 @@ describe 'nova::metadata::novajoin::api' do
let :default_params do let :default_params do
{ {
:bind_address => '127.0.0.1', :bind_address => '127.0.0.1',
:api_paste_config => '/etc/nova/join-api-paste.ini', :api_paste_config => '/etc/novajoin/join-api-paste.ini',
:auth_strategy => '<SERVICE DEFAULT>', :auth_strategy => '<SERVICE DEFAULT>',
:auth_type => 'password', :auth_type => 'password',
:cacert => '/etc/ipa/ca.crt', :cacert => '/etc/ipa/ca.crt',
@ -26,16 +26,16 @@ describe 'nova::metadata::novajoin::api' do
:enable_ipa_client_install => true, :enable_ipa_client_install => true,
:ensure_package => 'present', :ensure_package => 'present',
:join_listen_port => '<SERVICE DEFAULT>', :join_listen_port => '<SERVICE DEFAULT>',
:keytab => '/etc/nova/krb5.keytab', :keytab => '/etc/novajoin/krb5.keytab',
:log_dir => '/var/log/novajoin', :log_dir => '/var/log/novajoin',
:manage_service => true, :manage_service => true,
:nova_user => 'nova', :service_user => 'novajoin',
:project_domain_name => 'default', :project_domain_name => 'default',
:project_name => 'service', :project_name => 'service',
:user_domain_id => 'default', :user_domain_id => 'default',
:ipa_domain => 'EXAMPLE.COM', :ipa_domain => 'EXAMPLE.COM',
:keystone_auth_url => 'https://keystone.example.com:35357', :keystone_auth_url => 'https://keystone.example.com:35357',
:nova_password => 'my_secret_password', :service_password => 'my_secret_password',
:transport_url => 'rabbit:rabbit_pass@rabbit_host', :transport_url => 'rabbit:rabbit_pass@rabbit_host',
} }
end end
@ -43,7 +43,7 @@ describe 'nova::metadata::novajoin::api' do
[{}, [{},
{ {
:bind_address => '0.0.0.0', :bind_address => '0.0.0.0',
:api_paste_config => '/etc/nova/join-api-paste.ini', :api_paste_config => '/etc/novajoin/join-api-paste.ini',
:auth_strategy => 'noauth2', :auth_strategy => 'noauth2',
:auth_type => 'password', :auth_type => 'password',
:cacert => '/etc/ipa/ca.crt', :cacert => '/etc/ipa/ca.crt',
@ -56,13 +56,13 @@ describe 'nova::metadata::novajoin::api' do
:keytab => '/etc/krb5.conf', :keytab => '/etc/krb5.conf',
:log_dir => '/var/log/novajoin', :log_dir => '/var/log/novajoin',
:manage_service => true, :manage_service => true,
:nova_user => 'nova1', :service_user => 'novajoin1',
:project_domain_name => 'default', :project_domain_name => 'default',
:project_name => 'service', :project_name => 'service',
:user_domain_id => 'default', :user_domain_id => 'default',
:ipa_domain => 'EXAMPLE2.COM', :ipa_domain => 'EXAMPLE2.COM',
:keystone_auth_url => 'https://keystone2.example.com:35357', :keystone_auth_url => 'https://keystone2.example.com:35357',
:nova_password => 'my_secret_password2', :service_password => 'my_secret_password2',
:transport_url => 'rabbit:rabbit_pass2@rabbit_host', :transport_url => 'rabbit:rabbit_pass2@rabbit_host',
} }
].each do |param_set| ].each do |param_set|
@ -122,11 +122,11 @@ describe 'nova::metadata::novajoin::api' do
it 'is_expected.to configure service credentials' do it 'is_expected.to configure service credentials' do
is_expected.to contain_novajoin_config('service_credentials/auth_type').with_value(param_hash[:auth_type]) is_expected.to contain_novajoin_config('service_credentials/auth_type').with_value(param_hash[:auth_type])
is_expected.to contain_novajoin_config('service_credentials/auth_url').with_value(param_hash[:keystone_auth_url]) is_expected.to contain_novajoin_config('service_credentials/auth_url').with_value(param_hash[:keystone_auth_url])
is_expected.to contain_novajoin_config('service_credentials/password').with_value(param_hash[:nova_password]) is_expected.to contain_novajoin_config('service_credentials/password').with_value(param_hash[:service_password])
is_expected.to contain_novajoin_config('service_credentials/project_name').with_value(param_hash[:project_name]) is_expected.to contain_novajoin_config('service_credentials/project_name').with_value(param_hash[:project_name])
is_expected.to contain_novajoin_config('service_credentials/user_domain_id').with_value(param_hash[:user_domain_id]) is_expected.to contain_novajoin_config('service_credentials/user_domain_id').with_value(param_hash[:user_domain_id])
is_expected.to contain_novajoin_config('service_credentials/project_domain_name').with_value(param_hash[:project_domain_name]) is_expected.to contain_novajoin_config('service_credentials/project_domain_name').with_value(param_hash[:project_domain_name])
is_expected.to contain_novajoin_config('service_credentials/username').with_value(param_hash[:nova_user]) is_expected.to contain_novajoin_config('service_credentials/username').with_value(param_hash[:service_user])
end end
it 'is_expected.to get service user keytab' do it 'is_expected.to get service user keytab' do
@ -137,7 +137,7 @@ describe 'nova::metadata::novajoin::api' do
end end
it { is_expected.to contain_file("#{param_hash[:keytab]}").with( it { is_expected.to contain_file("#{param_hash[:keytab]}").with(
'owner' => "#{param_hash[:nova_user]}", 'owner' => "#{param_hash[:service_user]}",
'require' => 'Exec[get-service-user-keytab]', 'require' => 'Exec[get-service-user-keytab]',
)} )}
@ -158,7 +158,7 @@ describe 'nova::metadata::novajoin::api' do
:manage_service => false, :manage_service => false,
:enabled => false, :enabled => false,
:ipa_domain => 'EXAMPLE.COM', :ipa_domain => 'EXAMPLE.COM',
:nova_password => 'my_secret_password', :service_password => 'my_secret_password',
:transport_url => 'rabbit:rabbit_pass@rabbit_host', :transport_url => 'rabbit:rabbit_pass@rabbit_host',
} }
end end

2
spec/classes/nova_metadata_novajoin_auth_spec.rb
View File

@ -128,7 +128,7 @@ describe 'nova::metadata::novajoin::auth' do
} }
class { '::ipaclient': password => 'join_otp', } class { '::ipaclient': password => 'join_otp', }
class { '::nova::metadata::novajoin::api': class { '::nova::metadata::novajoin::api':
nova_password => 'secrete', service_password => 'secrete',
transport_url => 'rabbit://127.0.0.1//', transport_url => 'rabbit://127.0.0.1//',
}" }"
end end