Files
puppet-nova/lib/puppet/provider/nova.rb
Takashi Kajinami 0ed626e146 Use system scope credentials in providers
This change enforces usage of system scope credentials to manage
flavors, aggregates, and services, following the new policy rules for
SRBAC support in nova.

The logic to look up credential for the nova service user from
[keystone_authtoken] is left to keep backward compatibility but is
deprecated and will be removed.

Depends-on: https://review.opendev.org/806474
Depends-on: https://review.opendev.org/828025
Depends-on: https://review.opendev.org/828874
Change-Id: I71779f0f1459d64914589a94a440336386266306
2022-02-21 14:54:47 +00:00

131 lines
4.0 KiB
Ruby

require 'puppet/util/inifile'
require 'puppet/provider/openstack'
require 'puppet/provider/openstack/auth'
require 'puppet/provider/openstack/credentials'
class Puppet::Provider::Nova < Puppet::Provider::Openstack
extend Puppet::Provider::Openstack::Auth
def self.project_request(service, action, properties=nil, options={})
self.request(service, action, properties, options, 'project')
end
def self.system_request(service, action, properties=nil, options={})
self.request(service, action, properties, options, 'system')
end
def self.request(service, action, properties=nil, options={}, scope='project')
begin
super
rescue Puppet::Error::OpenstackAuthInputError => error
nova_request(service, action, error, properties, options)
end
end
def self.nova_request(service, action, error, properties=nil, options={})
warning('Usage of keystone_authtoken parameters is deprecated.')
properties ||= []
@credentials.username = nova_credentials['username']
@credentials.password = nova_credentials['password']
@credentials.project_name = nova_credentials['project_name']
@credentials.auth_url = auth_endpoint
@credentials.user_domain_name = nova_credentials['user_domain_name']
@credentials.project_domain_name = nova_credentials['project_domain_name']
if nova_credentials['region_name']
@credentials.region_name = nova_credentials['region_name']
end
raise error unless @credentials.set?
Puppet::Provider::Openstack.request(service, action, properties, @credentials, options)
end
def self.nova_manage_request(*args)
# Not using the nova-manage command directly,
# so we can disable combining of stderr/stdout output.
args.unshift(Puppet::Util.which('nova-manage'))
# NOTE(mnaser): We pass the arguments as an array to avoid problems with
# symbols in the arguments breaking things.
Puppet::Util::Execution.execute(args, {
:uid => nova_user,
:failonfail => true,
:combine => false,
:custom_environment => {}
})
end
def nova_manage_request(*args)
self.class.nova_manage_request(args)
end
def self.nova_user
'nova'
end
def self.conf_filename
'/etc/nova/nova.conf'
end
def self.nova_conf
return @nova_conf if @nova_conf
@nova_conf = Puppet::Util::IniConfig::File.new
@nova_conf.read(conf_filename)
@nova_conf
end
def self.nova_credentials
@nova_credentials ||= get_nova_credentials
end
def nova_credentials
self.class.nova_credentials
end
def self.get_nova_credentials
#needed keys for authentication
auth_keys = ['auth_url', 'project_name', 'username', 'password']
conf = nova_conf
if conf and conf['keystone_authtoken'] and
auth_keys.all?{|k| !conf['keystone_authtoken'][k].nil?}
creds = Hash[ auth_keys.map \
{ |k| [k, conf['keystone_authtoken'][k].strip] } ]
if !conf['keystone_authtoken']['region_name'].nil?
creds['region_name'] = conf['keystone_authtoken']['region_name'].strip
end
if !conf['keystone_authtoken']['project_domain_name'].nil?
creds['project_domain_name'] = conf['keystone_authtoken']['project_domain_name'].strip
else
creds['project_domain_name'] = 'Default'
end
if !conf['keystone_authtoken']['user_domain_name'].nil?
creds['user_domain_name'] = conf['keystone_authtoken']['user_domain_name'].strip
else
creds['user_domain_name'] = 'Default'
end
return creds
else
raise(Puppet::Error, "File: #{conf_filename} does not contain all " +
"required sections. Nova types will not work if nova is not " +
"correctly configured.")
end
end
def self.get_auth_endpoint
q = nova_credentials
"#{q['auth_url']}"
end
def self.auth_endpoint
@auth_endpoint ||= get_auth_endpoint
end
def self.reset
@auth_endpoint = nil
@nova_conf = nil
@nova_credentials = nil
end
end