Skip to content

Commit ff4043b

Browse files
xbezdickxbezdick
committed
Update keystone to 821cc4a
821cc4a Allow disabling or delaying the token_flush cron d1000fb Merge "Release 5.0.0 - Juno" 50efef4 Release 5.0.0 - Juno 4477c63 Merge "Add memcache configs for backend and token" 776006f Merge "Add keystone::resource::service_identity" e1d96ec Merge "keystone_user_role fix for when user not granted roles yet" 183650c Add keystone::resource::service_identity 1c5f655 Merge "Fix config options deprecated in Juno" a0e8e9a Remove duplicate entries from endpoint.pp comments c38e7a6 fix apache::vhost concat test breakage 8548a52 Fix config options deprecated in Juno b97447c Add memcache configs for backend and token 5a3ba40 keystone_user_role fix for when user not granted roles yet
1 parent fdeb774 commit ff4043b

13 files changed

Lines changed: 603 additions & 234 deletions

File tree

‎Puppetfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ mod 'ipa',
6363
:git => 'https://github.com/xbezdick/puppet-ipa.git'
6464

6565
mod 'keystone',
66-
:commit => '38518cbcb3ef8ad3bb068730a21d790b27a29b74',
66+
:commit => '821cc4ada1f50b5a6c6244cd5c689a467d06d736',
6767
:git => 'https://github.com/stackforge/puppet-keystone.git'
6868

6969
mod 'memcached',

‎keystone/README.md‎

Lines changed: 40 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
keystone
22
=======
33

4-
4.0.0 - 2014.1.0 - Icehouse
4+
5.0.0 - 2014.2.0 - Juno
55

66
#### Table of Contents
77

@@ -163,6 +163,45 @@ Contributors
163163
Release Notes
164164
-------------
165165

166+
**5.0.0**
167+
168+
* Stable Juno release
169+
* Updated token driver, logging, and ldap config parameters for Juno
170+
* Changed admin_roles parameter to accept an array in order to configure multiple admin roles
171+
* Installs python-ldappool package for ldap
172+
* Added new parameters to keystone class to configure pki signing
173+
* Changed keystone class to inherit from keystone::params
174+
* Changed pki_setup to run regardless of token provider
175+
* Made UUID the default token provider
176+
* Made keystone_user_role idempotent
177+
* Added parameters to control whether to configure users
178+
* Stopped managing _member_ role since it is created automatically
179+
* Stopped overriding token_flush log file
180+
* Changed the usage of admin_endpoint to not include the API version
181+
* Allowed keystone_user_role to accept email as username
182+
* Added ability to set up keystone using Apache mod_wsgi
183+
* Migrated the keystone::db::mysql class to use openstacklib::db::mysql and deprecated the mysql_module parameter
184+
* Installs python-memcache when using token driver memcache
185+
* Enabled setting cert and key paths for PKI token signing
186+
* Added parameters for SSL communication between keystone and rabbitmq
187+
* Added parameter ignore_default_tenant to keystone::role::admin
188+
* Added parameter service_provider to keystone class
189+
* Added parameters for service validation to keystone class
190+
191+
**4.2.0**
192+
193+
* Added class for extended logging options
194+
* Fixed rabbit password leaking
195+
* Added parameters to set tenant descriptions
196+
* Fixed keystone user authorization error handling
197+
198+
**4.1.0**
199+
200+
* Added token flushing with cron.
201+
* Updated database api for consistency with other projects.
202+
* Fixed admin_token with secret parameter.
203+
* Fixed deprecated catalog driver.
204+
166205
**4.0.0**
167206

168207
* Stable Icehouse release.

‎keystone/lib/puppet/provider/keystone_user_role/keystone.rb‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,11 @@ def self.get_user(tenant_id, name)
183183
@users["#{user[1]}@#{tenant_id}"] = user[0]
184184
end
185185
end
186+
# If the user doesn't already have a role on this tenant,
187+
# we need to look them up specifically
188+
unless @users[user_key]
189+
@users[user_key] = get_keystone_object('user', name, 'id')
190+
end
186191
@users[user_key]
187192
end
188193

‎keystone/manifests/cron/token_flush.pp‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@
2121
#
2222
# === Parameters
2323
#
24+
# [*ensure*]
25+
# (optional) Defaults to present.
26+
# Valid values are present, absent.
27+
#
2428
# [*minute*]
2529
# (optional) Defaults to '1'.
2630
#
@@ -36,16 +40,30 @@
3640
# [*weekday*]
3741
# (optional) Defaults to '*'.
3842
#
43+
# [*maxdelay*]
44+
# (optional) Seconds. Defaults to 0. Should be a positive integer.
45+
# Induces a random delay before running the cronjob to avoid running all
46+
# cron jobs at the same time on all hosts this job is configured.
47+
#
3948
class keystone::cron::token_flush (
49+
$ensure = present,
4050
$minute = 1,
4151
$hour = 0,
4252
$monthday = '*',
4353
$month = '*',
4454
$weekday = '*',
55+
$maxdelay = 0,
4556
) {
4657

58+
if $maxdelay == 0 {
59+
$sleep = ''
60+
} else {
61+
$sleep = "sleep `expr \${RANDOM} \\% ${maxdelay}`; "
62+
}
63+
4764
cron { 'keystone-manage token_flush':
48-
command => 'keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1',
65+
ensure => $ensure,
66+
command => "${sleep}keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1",
4967
environment => 'PATH=/bin:/usr/bin:/usr/sbin',
5068
user => 'keystone',
5169
minute => $minute,

‎keystone/manifests/endpoint.pp‎

Lines changed: 14 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -6,31 +6,22 @@
66
#
77
# [*public_url*]
88
# (optional) Public url for keystone endpoint. (Defaults to 'http://127.0.0.1:5000')
9+
# This url should *not* contain any version or trailing '/'.
910
#
1011
# [*internal_url*]
1112
# (optional) Internal url for keystone endpoint. (Defaults to $public_url)
13+
# This url should *not* contain any version or trailing '/'.
1214
#
1315
# [*admin_url*]
1416
# (optional) Admin url for keystone endpoint. (Defaults to 'http://127.0.0.1:35357')
17+
# This url should *not* contain any version or trailing '/'.
1518
#
1619
# [*region*]
1720
# (optional) Region for endpoint. (Defaults to 'RegionOne')
1821
#
1922
# [*version*]
2023
# (optional) API version for endpoint. Appended to all endpoint urls. (Defaults to 'v2.0')
2124
#
22-
# [*public_url*]
23-
# (optional) The endpoint's public url. (Defaults to 'http://127.0.0.1:5000')
24-
# This url should *not* contain any version or trailing '/'.
25-
#
26-
# [*admin_url*]
27-
# (optional) The endpoint's admin url. (Defaults to 'http://127.0.0.1:5000')
28-
# This url should *not* contain any version or trailing '/'.
29-
#
30-
# [*internal_url*]
31-
# (optional) The endpoint's internal url. (Defaults to 'http://127.0.0.1:35357')
32-
# This url should *not* contain any version or trailing '/'.
33-
#
3425
# [*public_protocol*]
3526
# (optional) DEPRECATED: Use public_url instead.
3627
# Protocol for public access to keystone endpoint. (Defaults to 'http')
@@ -95,6 +86,8 @@
9586
$admin_port = undef,
9687
) {
9788

89+
warning('keystone::endpoint class is deprecated, use keystone::resource::service_identity instead.')
90+
9891
if $public_port {
9992
warning('The public_port parameter is deprecated, use public_url instead.')
10093
}
@@ -153,17 +146,15 @@
153146
"#{@admin_url}/#{@version}"
154147
end %>')
155148

156-
keystone_service { 'keystone':
157-
ensure => present,
158-
type => 'identity',
159-
description => 'OpenStack Identity Service',
149+
keystone::resource::service_identity { 'keystone':
150+
configure_user => false,
151+
configure_user_role => false,
152+
service_type => 'identity',
153+
service_description => 'OpenStack Identity Service',
154+
public_url => $public_url_real,
155+
admin_url => $admin_url_real,
156+
internal_url => $internal_url_real,
157+
region => $region,
160158
}
161159

162-
keystone_endpoint { "${region}/keystone":
163-
ensure => present,
164-
public_url => $public_url_real,
165-
admin_url => $admin_url_real,
166-
internal_url => $internal_url_real,
167-
region => $region,
168-
}
169160
}

‎keystone/manifests/init.pp‎

Lines changed: 116 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,33 @@
3636
# [token_format] Deprecated: Use token_provider instead.
3737
# [cache_dir] Directory created when token_provider is pki. Optional.
3838
# Defaults to /var/cache/keystone.
39-
# [memcache_servers] List of memcache servers/ports. Optional. Used with
40-
# token_driver keystone.token.backends.memcache.Token. Defaults to false.
39+
#
40+
# [memcache_servers]
41+
# List of memcache servers in format of server:port.
42+
# Used with token_driver 'keystone.token.backends.memcache.Token'.
43+
# Optional. Defaults to false. Example: ['localhost:11211']
44+
#
45+
# [cache_backend]
46+
# Dogpile.cache backend module. It is recommended that Memcache with pooling
47+
# (keystone.cache.memcache_pool) or Redis (dogpile.cache.redis) be used in production.
48+
# This has no effects unless 'memcache_servers' is set.
49+
# Optional. Defaults to 'keystone.common.cache.noop'
50+
#
51+
# [cache_backend_argument]
52+
# List of arguments in format of argname:value supplied to the backend module.
53+
# Specify this option once per argument to be passed to the dogpile.cache backend.
54+
# This has no effects unless 'memcache_servers' is set.
55+
# Optional. Default to undef.
56+
#
57+
# [debug_cache_backend]
58+
# Extra debugging from the cache backend (cache keys, get/set/delete calls).
59+
# This has no effects unless 'memcache_servers' is set.
60+
# Optional. Default to false.
61+
#
62+
# [token_caching]
63+
# Toggle for token system caching. This has no effects unless 'memcache_servers' is set.
64+
# Optional. Default to true.
65+
#
4166
# [enabled] If the keystone services should be enabled. Optional. Default to true.
4267
#
4368
# [*database_connection*]
@@ -251,70 +276,74 @@
251276
#
252277
class keystone(
253278
$admin_token,
254-
$package_ensure = 'present',
255-
$bind_host = false,
256-
$public_bind_host = '0.0.0.0',
257-
$admin_bind_host = '0.0.0.0',
258-
$public_port = '5000',
259-
$admin_port = '35357',
260-
$compute_port = '8774',
261-
$verbose = false,
262-
$debug = false,
263-
$log_dir = '/var/log/keystone',
264-
$log_file = false,
265-
$use_syslog = false,
266-
$log_facility = 'LOG_USER',
267-
$catalog_type = 'sql',
268-
$catalog_driver = false,
269-
$catalog_template_file = '/etc/keystone/default_catalog.templates',
270-
$token_format = false,
271-
$token_provider = 'keystone.token.providers.uuid.Provider',
272-
$token_driver = 'keystone.token.persistence.backends.sql.Token',
273-
$token_expiration = 3600,
274-
$public_endpoint = false,
275-
$admin_endpoint = false,
276-
$enable_ssl = false,
277-
$ssl_certfile = '/etc/keystone/ssl/certs/keystone.pem',
278-
$ssl_keyfile = '/etc/keystone/ssl/private/keystonekey.pem',
279-
$ssl_ca_certs = '/etc/keystone/ssl/certs/ca.pem',
280-
$ssl_ca_key = '/etc/keystone/ssl/private/cakey.pem',
281-
$ssl_cert_subject = '/C=US/ST=Unset/L=Unset/O=Unset/CN=localhost',
282-
$cache_dir = '/var/cache/keystone',
283-
$memcache_servers = false,
284-
$enabled = true,
285-
$database_connection = 'sqlite:////var/lib/keystone/keystone.db',
286-
$database_idle_timeout = '200',
287-
$enable_pki_setup = true,
288-
$signing_certfile = '/etc/keystone/ssl/certs/signing_cert.pem',
289-
$signing_keyfile = '/etc/keystone/ssl/private/signing_key.pem',
290-
$signing_ca_certs = '/etc/keystone/ssl/certs/ca.pem',
291-
$signing_ca_key = '/etc/keystone/ssl/private/cakey.pem',
292-
$signing_cert_subject = '/C=US/ST=Unset/L=Unset/O=Unset/CN=www.example.com',
293-
$signing_key_size = 2048,
294-
$rabbit_host = 'localhost',
295-
$rabbit_hosts = false,
296-
$rabbit_password = 'guest',
297-
$rabbit_port = '5672',
298-
$rabbit_userid = 'guest',
299-
$rabbit_virtual_host = '/',
300-
$rabbit_use_ssl = false,
301-
$kombu_ssl_ca_certs = undef,
302-
$kombu_ssl_certfile = undef,
303-
$kombu_ssl_keyfile = undef,
304-
$kombu_ssl_version = 'SSLv3',
305-
$notification_driver = false,
306-
$notification_topics = false,
307-
$control_exchange = false,
308-
$validate_service = false,
309-
$validate_insecure = false,
310-
$validate_auth_url = false,
311-
$validate_cacert = undef,
312-
$service_provider = $::keystone::params::service_provider,
313-
$service_name = 'keystone',
279+
$package_ensure = 'present',
280+
$bind_host = false,
281+
$public_bind_host = '0.0.0.0',
282+
$admin_bind_host = '0.0.0.0',
283+
$public_port = '5000',
284+
$admin_port = '35357',
285+
$compute_port = '8774',
286+
$verbose = false,
287+
$debug = false,
288+
$log_dir = '/var/log/keystone',
289+
$log_file = false,
290+
$use_syslog = false,
291+
$log_facility = 'LOG_USER',
292+
$catalog_type = 'sql',
293+
$catalog_driver = false,
294+
$catalog_template_file = '/etc/keystone/default_catalog.templates',
295+
$token_format = false,
296+
$token_provider = 'keystone.token.providers.uuid.Provider',
297+
$token_driver = 'keystone.token.persistence.backends.sql.Token',
298+
$token_expiration = 3600,
299+
$public_endpoint = false,
300+
$admin_endpoint = false,
301+
$enable_ssl = false,
302+
$ssl_certfile = '/etc/keystone/ssl/certs/keystone.pem',
303+
$ssl_keyfile = '/etc/keystone/ssl/private/keystonekey.pem',
304+
$ssl_ca_certs = '/etc/keystone/ssl/certs/ca.pem',
305+
$ssl_ca_key = '/etc/keystone/ssl/private/cakey.pem',
306+
$ssl_cert_subject = '/C=US/ST=Unset/L=Unset/O=Unset/CN=localhost',
307+
$cache_dir = '/var/cache/keystone',
308+
$memcache_servers = false,
309+
$cache_backend = 'keystone.common.cache.noop',
310+
$cache_backend_argument = undef,
311+
$debug_cache_backend = false,
312+
$token_caching = true,
313+
$enabled = true,
314+
$database_connection = 'sqlite:////var/lib/keystone/keystone.db',
315+
$database_idle_timeout = '200',
316+
$enable_pki_setup = true,
317+
$signing_certfile = '/etc/keystone/ssl/certs/signing_cert.pem',
318+
$signing_keyfile = '/etc/keystone/ssl/private/signing_key.pem',
319+
$signing_ca_certs = '/etc/keystone/ssl/certs/ca.pem',
320+
$signing_ca_key = '/etc/keystone/ssl/private/cakey.pem',
321+
$signing_cert_subject = '/C=US/ST=Unset/L=Unset/O=Unset/CN=www.example.com',
322+
$signing_key_size = 2048,
323+
$rabbit_host = 'localhost',
324+
$rabbit_hosts = false,
325+
$rabbit_password = 'guest',
326+
$rabbit_port = '5672',
327+
$rabbit_userid = 'guest',
328+
$rabbit_virtual_host = '/',
329+
$rabbit_use_ssl = false,
330+
$kombu_ssl_ca_certs = undef,
331+
$kombu_ssl_certfile = undef,
332+
$kombu_ssl_keyfile = undef,
333+
$kombu_ssl_version = 'SSLv3',
334+
$notification_driver = false,
335+
$notification_topics = false,
336+
$control_exchange = false,
337+
$validate_service = false,
338+
$validate_insecure = false,
339+
$validate_auth_url = false,
340+
$validate_cacert = undef,
341+
$service_provider = $::keystone::params::service_provider,
342+
$service_name = 'keystone',
314343
# DEPRECATED PARAMETERS
315-
$mysql_module = undef,
316-
$sql_connection = undef,
317-
$idle_timeout = undef,
344+
$mysql_module = undef,
345+
$sql_connection = undef,
346+
$idle_timeout = undef,
318347
) inherits keystone::params {
319348

320349
if ! $catalog_driver {
@@ -484,12 +513,32 @@
484513
# memcache connection config
485514
if $memcache_servers {
486515
validate_array($memcache_servers)
516+
Service<| title == 'memcached' |> -> Service['keystone']
487517
keystone_config {
488-
'memcache/servers': value => join($memcache_servers, ',');
518+
'cache/enabled': value => true;
519+
'cache/backend': value => $cache_backend;
520+
'cache/debug_cache_backend': value => $debug_cache_backend;
521+
'token/caching': value => $token_caching;
522+
'memcache/servers': value => join($memcache_servers, ',');
523+
}
524+
if $cache_backend_argument {
525+
validate_array($cache_backend_argument)
526+
keystone_config {
527+
'cache/backend_argument': value => join($cache_backend_argument, ',');
528+
}
529+
} else {
530+
keystone_config {
531+
'cache/backend_argument': ensure => absent;
532+
}
489533
}
490534
} else {
491535
keystone_config {
492-
'memcache/servers': ensure => absent;
536+
'cache/enabled': ensure => absent;
537+
'cache/backend': ensure => absent;
538+
'cache/backend_argument': ensure => absent;
539+
'cache/debug_cache_backend': ensure => absent;
540+
'token/caching': ensure => absent;
541+
'memcache/servers': ensure => absent;
493542
}
494543
}
495544

0 commit comments

Comments
 (0)