diff --git a/defaults/main.yml b/defaults/main.yml index 5152ac06..f0a7581c 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -16,6 +16,9 @@ # Defines that the role will be deployed on a host machine is_metal: true +# Enable/Disable Ceilometer +swift_ceilometer_enabled: False + ## Verbosity Options debug: False verbose: True @@ -73,6 +76,13 @@ swift_allow_versions: True # This will allow all users to create containers and upload to swift if set to True swift_allow_all_users: False +## Swift ceilometer variables +swift_reselleradmin_role: ResellerAdmin + +## Swift Auth +swift_service_admin_tenant_name: "service" +swift_service_admin_username: "swift" + swift_account_server_program_config_options: /etc/swift/account-server/account-server.conf swift_account_replicator_program_config_options: /etc/swift/account-server/account-server-replicator.conf @@ -114,6 +124,7 @@ swift_proxy_server_program_config_options: /etc/swift/proxy-server/proxy-server. # swift_proxy_server_workers: 16 swift_pip_packages: + - ceilometermiddleware - dnspython - ecdsa - keystonemiddleware diff --git a/tasks/swift_service_setup.yml b/tasks/swift_service_setup.yml index 08ef02ce..88a58e3f 100644 --- a/tasks/swift_service_setup.yml +++ b/tasks/swift_service_setup.yml @@ -99,6 +99,38 @@ - swift-service-add - swift-setup +- name: "Create keystone role for ResellerAdmin" + keystone: + command: "ensure_role" + token: "{{ keystone_auth_admin_token }}" + endpoint: "{{ keystone_service_adminurl }}" + role_name: "ResellerAdmin" + register: add_role + until: add_role|success + retries: 5 + delay: 10 + when: swift_ceilometer_enabled + tags: + - swift-ceilometer-setup + - swift-ceilometer-role + +- name: "Add ResellerAdmin role to the service tenant and ceilometer user" + keystone: + command: "ensure_user_role" + token: "{{ keystone_auth_admin_token }}" + endpoint: "{{ keystone_service_adminurl }}" + user_name: "{{ ceilometer_service_user_name }}" + tenant_name: "{{ ceilometer_service_tenant_name }}" + role_name: "{{ swift_reselleradmin_role }}" + register: ensure_role + until: ensure_role|success + retries: 5 + delay: 10 + when: swift_ceilometer_enabled + tags: + - swift-ceilometer-setup + - swift-ceilometer-role + - name: "Add swiftoperator role to swift-dispersion user" keystone: command: "ensure_user_role" diff --git a/templates/proxy-server.conf.j2 b/templates/proxy-server.conf.j2 index af34dc3f..4046c36a 100644 --- a/templates/proxy-server.conf.j2 +++ b/templates/proxy-server.conf.j2 @@ -13,10 +13,18 @@ log_facility = LOG_LOCAL1 [pipeline:main] {% if swift_authtoken_active %} +{% if swift_ceilometer_enabled %} +pipeline = catch_errors gatekeeper healthcheck proxy-logging ceilometer cache container_sync bulk tempurl ratelimit authtoken keystoneauth container-quotas account-quotas slo dlo proxy-server +{% else %} pipeline = catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk tempurl ratelimit authtoken keystoneauth container-quotas account-quotas slo dlo proxy-logging proxy-server +{% endif %} +{% else %} +{% if swift_ceilometer_enabled %} +pipeline = catch_errors gatekeeper healthcheck proxy-logging ceilometer cache container_sync bulk tempurl ratelimit tempauth container-quotas account-quotas slo dlo proxy-server {% else %} pipeline = catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk tempurl ratelimit tempauth container-quotas account-quotas slo dlo proxy-logging proxy-server {% endif %} +{% endif %} [app:proxy-server] use = egg:swift#proxy log_facility = LOG_LOCAL1 @@ -60,10 +68,18 @@ delay_auth_decision = {{ swift_delay_auth_decision }} [filter:keystoneauth] use = egg:swift#keystoneauth {% if swift_allow_all_users is defined and swift_allow_all_users == True %} +{% if swift_ceilometer_enabled %} +operator_roles = admin, swiftoperator, _member_, ResellerAdmin +{% else %} operator_roles = admin, swiftoperator, _member_ +{% endif %} +{% else %} +{% if swift_ceilometer_enabled %} +operator_roles = admin, swiftoperator, ResellerAdmin {% else %} operator_roles = admin, swiftoperator {% endif %} +{% endif %} # The reseller admin role has the ability to create and delete accounts reseller_admin_role = reseller_admin @@ -128,3 +144,13 @@ use = egg:swift#container_sync [filter:xprofile] use = egg:swift#xprofile + +{% if swift_ceilometer_enabled %} +[filter:ceilometer] +paste.filter_factory = ceilometermiddleware.swift:filter_factory +control_exchange = swift +driver = messagingv2 +url = rabbit://openstack:{{ rabbitmq_password }}@{{ groups['rabbitmq_all'][0] }} +topic = notifications +log_level = WARN +{% endif %}