Browse Source

barbican_service_user: Accept system scope credential

This change allows usage of system scope credentials in addition to
project scope credentials, to use service user token when accessing
Barbican API.

Change-Id: I3ab30adbae3e805aee36bd32854e5490b19b0097
changes/83/823883/3
Takashi Kajinami 5 months ago
parent
commit
f91cf63560
  1. 25
      manifests/key_manager/barbican/service_user.pp
  2. 5
      releasenotes/notes/system_scope-barbican_service_user-3e9cba1bba4f22b8.yaml
  3. 24
      spec/defines/oslo_key_manager_barbican_service_user_spec.rb

25
manifests/key_manager/barbican/service_user.pp

@ -20,7 +20,8 @@
# (Required) The URL to use for authentication.
#
# [*project_name*]
# (Required) Service project name
# (Optional) Service project name
# Defaults to $::os_service_default
#
# [*user_domain_name*]
# (Optional) Name of domain for $username
@ -30,6 +31,10 @@
# (Optional) Name of domain for $project_name
# Defaults to $::os_service_default
#
# [*system_scope*]
# (Optional) Scope for system operations.
# Defaults to $::os_service_default
#
# [*insecure*]
# (Optional) If true, explicitly allow TLS without checking server cert
# against any certificate authorities. WARNING: not recommended. Use with
@ -65,9 +70,10 @@ define oslo::key_manager::barbican::service_user(
$username,
$password,
$auth_url,
$project_name,
$project_name = $::os_service_default,
$user_domain_name = $::os_service_default,
$project_domain_name = $::os_service_default,
$system_scope = $::os_service_default,
$insecure = $::os_service_default,
$auth_type = $::os_service_default,
$auth_version = $::os_service_default,
@ -77,6 +83,16 @@ define oslo::key_manager::barbican::service_user(
$region_name = $::os_service_default,
) {
if is_service_default($system_scope) {
$project_name_real = $project_name
$project_domain_name_real = $project_domain_name
} else {
# When system scope is used, project parameters should be removed otherwise
# project scope is used.
$project_name_real = $::os_service_default
$project_domain_name_real = $::os_service_default
}
$service_user_options = {
'barbican_service_user/auth_type' => {'value' => $auth_type},
'barbican_service_user/auth_version' => {'value' => $auth_version},
@ -88,8 +104,9 @@ define oslo::key_manager::barbican::service_user(
'barbican_service_user/username' => {'value' => $username},
'barbican_service_user/password' => {'value' => $password, 'secret' => true},
'barbican_service_user/user_domain_name' => {'value' => $user_domain_name},
'barbican_service_user/project_name' => {'value' => $project_name},
'barbican_service_user/project_domain_name' => {'value' => $project_domain_name},
'barbican_service_user/project_name' => {'value' => $project_name_real},
'barbican_service_user/project_domain_name' => {'value' => $project_domain_name_real},
'barbican_service_user/system_scope' => {'value' => $system_scope},
'barbican_service_user/insecure' => {'value' => $insecure},
}

5
releasenotes/notes/system_scope-barbican_service_user-3e9cba1bba4f22b8.yaml

@ -0,0 +1,5 @@
---
features:
- |
The ``oslo::key_manager::barbican::service_user`` resource type now
supports the ``system_scope`` parameter.

24
spec/defines/oslo_key_manager_barbican_service_user_spec.rb

@ -7,8 +7,7 @@ describe 'oslo::key_manager::barbican::service_user' do
let :params do
{ :username => 'keystone',
:password => 'secret',
:auth_url => 'http://127.0.0.1:5000',
:project_name => 'services' }
:auth_url => 'http://127.0.0.1:5000' }
end
shared_examples 'oslo::key_manager::barbican::service_user' do
@ -17,8 +16,9 @@ describe 'oslo::key_manager::barbican::service_user' do
is_expected.to contain_keystone_config('barbican_service_user/username').with_value('keystone')
is_expected.to contain_keystone_config('barbican_service_user/password').with_value('secret').with_secret(true)
is_expected.to contain_keystone_config('barbican_service_user/auth_url').with_value( params[:auth_url] )
is_expected.to contain_keystone_config('barbican_service_user/project_name').with_value( params[:project_name] )
is_expected.to contain_keystone_config('barbican_service_user/project_name').with_value('<SERVICE DEFAULT>')
is_expected.to contain_keystone_config('barbican_service_user/project_domain_name').with_value('<SERVICE DEFAULT>')
is_expected.to contain_keystone_config('barbican_service_user/system_scope').with_value('<SERVICE DEFAULT>')
is_expected.to contain_keystone_config('barbican_service_user/user_domain_name').with_value('<SERVICE DEFAULT>')
is_expected.to contain_keystone_config('barbican_service_user/insecure').with_value('<SERVICE DEFAULT>')
is_expected.to contain_keystone_config('barbican_service_user/auth_type').with_value('<SERVICE DEFAULT>')
@ -55,6 +55,7 @@ describe 'oslo::key_manager::barbican::service_user' do
is_expected.to contain_keystone_config('barbican_service_user/project_name').with_value( params[:project_name] )
is_expected.to contain_keystone_config('barbican_service_user/user_domain_name').with_value(params[:user_domain_name])
is_expected.to contain_keystone_config('barbican_service_user/project_domain_name').with_value(params[:project_domain_name])
is_expected.to contain_keystone_config('barbican_service_user/system_scope').with_value('<SERVICE DEFAULT>')
is_expected.to contain_keystone_config('barbican_service_user/insecure').with_value(params[:insecure])
is_expected.to contain_keystone_config('barbican_service_user/auth_version').with_value(params[:auth_version])
is_expected.to contain_keystone_config('barbican_service_user/cafile').with_value(params[:cafile])
@ -71,11 +72,20 @@ describe 'oslo::key_manager::barbican::service_user' do
it { expect { is_expected.to raise_error(Puppet::Error) } }
end
context 'without specify project' do
let :params do
params.delete(:project_name)
context 'with system_scope' do
before do
params.merge!({
:project_name => 'NoProject',
:project_domain_name => 'OurDomain',
:system_scope => 'all',
})
end
it 'configures system_scope' do
is_expected.to contain_keystone_config('barbican_service_user/project_name').with_value('<SERVICE DEFAULT>')
is_expected.to contain_keystone_config('barbican_service_user/project_domain_name').with_value('<SERVICE DEFAULT>')
is_expected.to contain_keystone_config('barbican_service_user/system_scope').with_value(params[:system_scope])
end
it { expect { is_expected.to raise_error(Puppet::Error) } }
end
end

Loading…
Cancel
Save