07428d4985
1. Add new option 'use_barbican' in config file [vim_keys] section, default value is False for Pike. 2. Use fernet to encrypt vim password, and save the fernet key into barbican as a secret. 3. Add new fields 'key_type', 'secret_uuid' into VimAuth.auth_cred json string. secret_uuid is masked in vim-show or vim-list response. 4. Set the vim's default 'shared' value to False, vim can only be used by who created it. 5. Add a devref to show how to test. 6. Add a release note. Implements: blueprint encryption-with-barbican Partial-bug: #1667652 Change-Id: I5c779041df5a08a361b9aaefac7d241369732551
52 lines
1.8 KiB
Plaintext
52 lines
1.8 KiB
Plaintext
TACKER_MODE=${TACKER_MODE:-all}
|
|
USE_BARBICAN=True
|
|
|
|
if [ "${TACKER_MODE}" == "all" ]; then
|
|
# Nova
|
|
disable_service n-net
|
|
VIRT_DRIVER=libvirt
|
|
|
|
#enable_service q-lbaas
|
|
#enable_service q-fwaas
|
|
|
|
# TACKER_NEUTRON_AGENTS can be disabled by adding
|
|
# TACKER_NEUTRON_AGENTS='' in local.conf if neutron agents are running on a separate node
|
|
TACKER_NEUTRON_AGENTS=${TACKER_NEUTRON_AGENTS:-q-agt,q-dhcp,q-meta,q-l3}
|
|
for i in $(echo $TACKER_NEUTRON_AGENTS | sed 's/,/ /g')
|
|
do
|
|
enable_service $i
|
|
done
|
|
|
|
enable_service q-svc
|
|
enable_service neutron
|
|
|
|
enable_service tacker
|
|
# enable tacker-conductor will make systemctl enable conductor service
|
|
enable_service tacker-conductor
|
|
# tacker-horizon isn't installable from pip
|
|
LIBS_FROM_GIT=tacker-horizon
|
|
|
|
MGMT_PHYS_NET=${MGMT_PHYS_NET:-mgmtphysnet0}
|
|
BR_MGMT=${BR_MGMT:-br-mgmt0}
|
|
NET_MGMT=${NET_MGMT:-net_mgmt}
|
|
SUBNET_MGMT=${SUBNET_MGMT:-subnet_mgmt}
|
|
FIXED_RANGE_MGMT=${FIXED_RANGE_MGMT:-192.168.120.0/24}
|
|
NETWORK_GATEWAY_MGMT=${NETWORK_GATEWAY_MGMT:-192.168.120.1}
|
|
NETWORK_GATEWAY_MGMT_IP=${NETWORK_GATEWAY_MGMT_IP:-192.168.120.1/24}
|
|
|
|
NET0=${NET0:-net0}
|
|
SUBNET0=${SUBNET0:-subnet0}
|
|
FIXED_RANGE0=${FIXED_RANGE0:-10.10.0.0/24}
|
|
NETWORK_GATEWAY0=${NETWORK_GATEWAY0:-10.10.0.1}
|
|
|
|
NET1=${NET1:-net1}
|
|
SUBNET1=${SUBNET1:-subnet1}
|
|
FIXED_RANGE1=${FIXED_RANGE1:-10.10.1.0/24}
|
|
NETWORK_GATEWAY1=${NETWORK_GATEWAY1:-10.10.1.1}
|
|
elif [ "${TACKER_MODE}" == "standalone" ]; then
|
|
# set the enabled services here. This will need tacker devstack plugin put as the last one in local.conf
|
|
ENABLED_SERVICES=key,horizon,tacker,tacker-conductor,mysql,dstat,barbican,mistral,mistral-api,mistral-engine,mistral-executor,mistral-event-engine
|
|
else
|
|
die $LINENO "invalid value: $TACKER_MODE for TACKER_MODE"
|
|
fi
|