c0a1195f53
* use selinux_ignore_defaults parameter for directory to avoid this kind of issue: (...) seltype: seltype changed 'swift_var_run_t' to 'var_run_t' * Do not manage ownership for /etc/swift/*-server to avoid this kind of issue: (...) owner changed 'root' to 'swift' * Do not manage /etc/init.d/swift-container-sync file, already managed by packaging: ~ dpkg -S /etc/init.d/swift-container-sync swift-container: /etc/init.d/swift-container-sync Change-Id: I1d742d118943fb0b11c47fd322052f50156e2994
128 lines
3.9 KiB
Puppet
128 lines
3.9 KiB
Puppet
#
|
|
# This class can be used to manage keystone's authtoken middleware
|
|
# for swift proxy
|
|
#
|
|
# == Parameters
|
|
#
|
|
# [*admin_token*]
|
|
# Keystone admin token that can serve as a shared secret
|
|
# for authenticating. If this is choosen if is used instead of a user,tenant,password.
|
|
# Optional. Defaults to false.
|
|
#
|
|
# [*admin_user*]
|
|
# User used to authenticate service.
|
|
# Optional. Defaults to 'swift'.
|
|
#
|
|
# [*admin_tenant_name*]
|
|
# Tenant used to authenticate service.
|
|
# Optional. Defaults to 'services'.
|
|
#
|
|
# [*admin_password*]
|
|
# Password used with user to authenticate service.
|
|
# Optional. Defaults to 'password'.
|
|
#
|
|
# [*delay_auth_decision*]
|
|
# Set to 1 to support token-less access (anonymous access, tempurl, ...)
|
|
# Optional, Defaults to 0
|
|
#
|
|
# [*auth_host*]
|
|
# Host providing the keystone service API endpoint. Optional.
|
|
# Defaults to 127.0.0.1
|
|
#
|
|
# [*auth_port*]
|
|
# Port where keystone service is listening. Optional.
|
|
# Defaults to 3557.
|
|
#
|
|
# [*auth_protocol*]
|
|
# Protocol to use to communicate with keystone. Optional.
|
|
# Defaults to https.
|
|
#
|
|
# [*auth_admin_prefix*]
|
|
# Path part of the auth url. Optional.
|
|
# This allows admin auth URIs like http://host/keystone/admin/v2.0.
|
|
# Defaults to false for empty. It defined, should be a string with a leading '/' and no trailing '/'.
|
|
#
|
|
# [*auth_uri*]
|
|
# The public auth url to redirect unauthenticated requests.
|
|
# Defaults to false to be expanded to '${auth_protocol}://${auth_host}:5000'.
|
|
# Should be set to your public keystone endpoint (without version).
|
|
#
|
|
# [*identity_uri*]
|
|
# identity_uri points to the Keystone Admin service. This information is
|
|
# used by the middleware to actually query Keystone about the validity of the
|
|
# authentication tokens. It is not necessary to append any Keystone API version
|
|
# number to this URI.
|
|
# Defaults to false.
|
|
#
|
|
# [*signing_dir*]
|
|
# The cache directory for signing certificates.
|
|
# Defaults to '/var/cache/swift'
|
|
#
|
|
# [*cache*]
|
|
# The cache backend to use
|
|
# Optional. Defaults to 'swift.cache'
|
|
#
|
|
# == Authors
|
|
#
|
|
# Dan Bode dan@puppetlabs.com
|
|
#
|
|
# == Copyright
|
|
#
|
|
# Copyright 2012 Puppetlabs Inc, unless otherwise noted.
|
|
#
|
|
class swift::proxy::authtoken(
|
|
$admin_user = 'swift',
|
|
$admin_tenant_name = 'services',
|
|
$admin_password = 'password',
|
|
$auth_uri = false,
|
|
$identity_uri = false,
|
|
$delay_auth_decision = 1,
|
|
$admin_token = false,
|
|
$signing_dir = '/var/cache/swift',
|
|
$cache = 'swift.cache',
|
|
# DEPRECATED PARAMETERS
|
|
$auth_host = '127.0.0.1',
|
|
$auth_port = '35357',
|
|
$auth_protocol = 'http',
|
|
$auth_admin_prefix = false,
|
|
) {
|
|
|
|
if $auth_uri {
|
|
$auth_uri_real = $auth_uri
|
|
} else {
|
|
$auth_uri_real = "${auth_protocol}://${auth_host}:5000"
|
|
}
|
|
|
|
# if both auth_uri and identity_uri are set we skip these deprecated warnings
|
|
if !$auth_uri or !$identity_uri {
|
|
if $auth_host {
|
|
warning('The auth_host parameter is deprecated. Please use auth_uri and identity_uri instead.')
|
|
}
|
|
if $auth_port {
|
|
warning('The auth_port parameter is deprecated. Please use auth_uri and identity_uri instead.')
|
|
}
|
|
if $auth_protocol {
|
|
warning('The auth_protocol parameter is deprecated. Please use auth_uri and identity_uri instead.')
|
|
}
|
|
if $auth_admin_prefix {
|
|
warning('The auth_admin_prefix parameter is deprecated. Please use auth_uri and identity_uri instead.')
|
|
validate_re($auth_admin_prefix, '^(/.+[^/])?$')
|
|
}
|
|
}
|
|
|
|
file { $signing_dir:
|
|
ensure => directory,
|
|
mode => '0700',
|
|
owner => 'swift',
|
|
group => 'swift',
|
|
selinux_ignore_defaults => true,
|
|
}
|
|
|
|
concat::fragment { 'swift_authtoken':
|
|
target => '/etc/swift/proxy-server.conf',
|
|
content => template('swift/proxy/authtoken.conf.erb'),
|
|
order => '22',
|
|
}
|
|
|
|
}
|