openstack
/
puppet-tripleo
Code Issues Proposed changes

Merge "Refactor how key manager backend is set"

This commit is contained in:
Zuul 2021-02-01 20:05:07 +00:00 committed by Gerrit Code Review
parent 5bf3422a54 c376d64e5f
commit 84b9371403
5 changed files with 53 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
manifests/profile/base/cinder/api.pp
View File

@ -43,12 +43,6 @@
# (Optional) Whether TLS in the internal network is enabled or not.
# Defaults to hiera('enable_internal_tls', false)
#
# [*keymgr_backend*]
# (Optional) The encryption key manager backend. The default value
# ensures Cinder's legacy key manager is enabled when no hiera value is
# specified.
# Defaults to hiera('cinder::api::keymgr_backend', 'cinder.keymgr.conf_key_mgr.ConfKeyManager')
#
# [*default_volume_type*]
# (Optional) The name of the default volume type.
# Defaults to hiera('cinder::api::default_volume_type', '')
@ -58,14 +52,23 @@
# for more details.
# Defaults to hiera('step')
#
# DEPRECATED PARAMETERS
#
# [*keymgr_backend*]
# (Optional) The encryption key manager backend. The default value
# ensures Cinder's legacy key manager is enabled when no hiera value is
# specified.
# Defaults to undef
#
class tripleo::profile::base::cinder::api (
$bootstrap_node = hiera('cinder_api_short_bootstrap_node_name', undef),
$certificates_specs = hiera('apache_certificates_specs', {}),
$cinder_api_network = hiera('cinder_api_network', undef),
$enable_internal_tls = hiera('enable_internal_tls', false),
$keymgr_backend = hiera('cinder::api::keymgr_backend', 'cinder.keymgr.conf_key_mgr.ConfKeyManager'),
$default_volume_type = hiera('cinder::api::default_volume_type', ''),
$step = Integer(hiera('step')),
# DEPRECATED PARAMETERS
$keymgr_backend = undef,
) {
if $bootstrap_node and $::hostname == downcase($bootstrap_node) {
$sync_db = true
@ -88,9 +91,16 @@ class tripleo::profile::base::cinder::api (
}
if $step >= 4 or ($step >= 3 and $sync_db) {
class { 'cinder::api':
sync_db => $sync_db,
keymgr_backend => $keymgr_backend,
if keymgr_backend != undef {
warning('The keymgr_backend parameter has been deprecated')
class { 'cinder::api':
sync_db => $sync_db,
keymgr_backend => $keymgr_backend,
}
} else {
class { 'cinder::api':
sync_db => $sync_db,
}
}
include tripleo::profile::base::apache
class { 'cinder::wsgi::apache':

28
manifests/profile/base/nova/compute.pp
View File

@ -31,16 +31,10 @@
# (Optional) Whether or not Nova is backed by NFS.
# Defaults to false
#
# [*keymgr_backend*]
# (Optional) The encryption key manager backend. The default value
# ensures Nova's legacy key manager is enabled when no hiera value is
# specified.
# Defaults to hiera('nova::compute::keymgr_backend', 'nova.keymgr.conf_key_mgr.ConfKeyManager')
#
# DEPRECATED PARAMETERS
#
# [*keymgr_api_class*]
# (Optional) Deprecated. The encryption key manager API class. The default value
# [*keymgr_backend*]
# (Optional) The encryption key manager backend. The default value
# ensures Nova's legacy key manager is enabled when no hiera value is
# specified.
# Defaults to undef.
@ -49,9 +43,8 @@ class tripleo::profile::base::nova::compute (
$step = Integer(hiera('step')),
$cinder_nfs_backend = hiera('cinder_enable_nfs_backend', false),
$nova_nfs_enabled = hiera('nova_nfs_enabled', false),
$keymgr_backend = hiera('nova::compute::keymgr_backend', 'nova.keymgr.conf_key_mgr.ConfKeyManager'),
# DEPRECATED PARAMETERS
$keymgr_api_class = undef,
$keymgr_backend = undef
) {
if $step >= 4 {
@ -61,17 +54,16 @@ class tripleo::profile::base::nova::compute (
include nova::vendordata
include nova::glance
if $keymgr_api_class {
warning('The keymgr_api_class parameter is deprecated, use keymgr_backend')
$keymgr_backend_real = $keymgr_api_class
# deploy basic bits for nova-compute
if keymgr_backend != undef {
warning('The keymgr_backend parameter has been deprecated')
class { 'nova::compute':
keymgr_backend => $keymgr_backend
}
} else {
$keymgr_backend_real = $keymgr_backend
class { 'nova::compute': }
}
# deploy basic bits for nova-compute
class { 'nova::compute':
keymgr_backend => $keymgr_backend_real,
}
include nova::compute::pci
# If Service['nova-conductor'] is in catalog, make sure we start it
# before nova-compute.

25
spec/classes/tripleo_profile_base_cinder_api_spec.rb
View File

@ -49,9 +49,7 @@ describe 'tripleo::profile::base::cinder::api' do
is_expected.to contain_class('tripleo::profile::base::cinder')
is_expected.to contain_class('tripleo::profile::base::cinder::authtoken')
is_expected.to contain_class('cinder::api').with(
:sync_db => true,
# Verify legacy key manager is enabled when none is set in hiera.
:keymgr_backend => 'cinder.keymgr.conf_key_mgr.ConfKeyManager',
:sync_db => true,
)
is_expected.to contain_class('tripleo::profile::base::apache')
end
@ -83,8 +81,7 @@ describe 'tripleo::profile::base::cinder::api' do
is_expected.to contain_class('tripleo::profile::base::cinder')
is_expected.to contain_class('tripleo::profile::base::cinder::authtoken')
is_expected.to contain_class('cinder::api').with(
:sync_db => true,
:keymgr_backend => 'castellan.key_manager.barbican_key_manager.BarbicanKeyManager',
:sync_db => true,
)
is_expected.to contain_class('tripleo::profile::base::apache')
end
@ -101,12 +98,26 @@ describe 'tripleo::profile::base::cinder::api' do
is_expected.to contain_class('tripleo::profile::base::cinder')
is_expected.to contain_class('tripleo::profile::base::cinder::authtoken')
is_expected.to contain_class('cinder::api').with(
:sync_db => false,
:keymgr_backend => 'castellan.key_manager.barbican_key_manager.BarbicanKeyManager',
:sync_db => false,
)
is_expected.to contain_class('tripleo::profile::base::apache')
end
end
context 'with step 4 and deprecated keymgr parameters' do
let(:params) { {
:step => 4,
:bootstrap_node => 'other.example.com',
:keymgr_backend => 'some.other.key_manager',
} }
it 'should set keymgr_backend' do
is_expected.to contain_class('cinder::api').with(
:sync_db => false,
:keymgr_backend => 'some.other.key_manager',
)
end
end
end
on_supported_os.each do |os, facts|

19
spec/classes/tripleo_profile_base_nova_compute_spec.rb
View File

@ -26,11 +26,7 @@ describe 'tripleo::profile::base::nova::compute' do
let(:params) { { :step => 1, } }
it {
is_expected.to contain_class('tripleo::profile::base::nova::compute').with(
# Verify legacy key manager is enabled when none is set in hiera.
:keymgr_backend => 'nova.keymgr.conf_key_mgr.ConfKeyManager',
)
is_expected.to contain_class('tripleo::profile::base::nova::compute')
is_expected.to_not contain_class('tripleo::profile::base::nova')
is_expected.to_not contain_class('nova::cinder')
is_expected.to_not contain_class('nova::vendordata')
@ -59,16 +55,11 @@ eos
let(:params) { { :step => 4, } }
it {
is_expected.to contain_class('tripleo::profile::base::nova::compute').with(
# Verify proper key manager is enabled when value is set in hiera.
:keymgr_backend => 'castellan.key_manager.barbican_key_manager.BarbicanKeyManager',
)
is_expected.to contain_class('tripleo::profile::base::nova::compute')
is_expected.to contain_class('tripleo::profile::base::nova')
is_expected.to contain_class('nova::cinder')
is_expected.to contain_class('nova::vendordata')
is_expected.to contain_class('nova::compute').with(
:keymgr_backend => 'castellan.key_manager.barbican_key_manager.BarbicanKeyManager',
)
is_expected.to contain_class('nova::compute')
is_expected.to contain_class('nova::network::neutron')
is_expected.to_not contain_package('nfs-utils')
}
@ -76,8 +67,8 @@ eos
context 'with deprecated keymgr parameters' do
let(:params) { {
:step => 4,
:keymgr_api_class => 'some.other.key_manager',
:step => 4,
:keymgr_backend => 'some.other.key_manager',
} }
it 'should use deprecated keymgr parameters' do

2
spec/fixtures/hieradata/step4.yaml vendored
View File

@ -1,8 +1,6 @@
---
step: 4
cinder::api::default_volume_type: 'tripleo'
cinder::api::keymgr_backend: 'castellan.key_manager.barbican_key_manager.BarbicanKeyManager'
nova::compute::keymgr_backend: 'castellan.key_manager.barbican_key_manager.BarbicanKeyManager'
# items needed for tripleo::profile::base::cinder::volume
tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_address: '127.0.0.1'
tripleo::profile::base::cinder::volume::nfs::cinder_nfs_servers: