Enable service user token for interaction with nova/barbican

This enables usage of service user token for interaction with nova and
barbican to avoid failure caused by token expiration during operations.

This also enables service_token_roles_required option in authtoken
middleware to allow only users with the service role to use this
feature.

Change-Id: Id6b0aad7aa24af2b6d03d484ada23357828c4325

manifests/aodh.pp

@@ -68,6 +68,7 @@ class openstack_integration::aodh (
     public_url   => "${::openstack_integration::config::base_url}:8042",
     internal_url => "${::openstack_integration::config::base_url}:8042",
     admin_url    => "${::openstack_integration::config::base_url}:8042",
+    roles        => ['admin', 'service'],
     password     => 'a_big_secret',
   }
   class { 'aodh::keystone::authtoken':
@@ -77,6 +78,7 @@ class openstack_integration::aodh (
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'aodh::api':
     enabled      => true,

manifests/barbican.pp

@@ -38,6 +38,7 @@ class openstack_integration::barbican {
     public_url   => "${::openstack_integration::config::base_url}:9311",
     internal_url => "${::openstack_integration::config::base_url}:9311",
     admin_url    => "${::openstack_integration::config::base_url}:9311",
+    roles        => ['admin', 'service'],
     password     => 'a_big_secret',
   }
   include barbican::quota
@@ -54,6 +55,7 @@ class openstack_integration::barbican {
     user_domain_name             => 'Default',
     project_domain_name          => 'Default',
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'barbican::api':
     default_transport_url       => os_transport_url({

manifests/ceilometer.pp

@@ -60,6 +60,7 @@ class openstack_integration::ceilometer (
     amqp_sasl_mechanisms       => 'PLAIN',
   }
   class { 'ceilometer::keystone::auth':
+    roles    => ['admin', 'service'],
     password => 'a_big_secret',
   }
 

manifests/cinder.pp

@@ -51,6 +51,7 @@ class openstack_integration::cinder (
     public_url_v3   => "${::openstack_integration::config::base_url}:8776/v3",
     internal_url_v3 => "${::openstack_integration::config::base_url}:8776/v3",
     admin_url_v3    => "${::openstack_integration::config::base_url}:8776/v3",
+    roles           => ['admin', 'service'],
     password        => 'a_big_secret',
   }
   class { 'cinder::logging':
@@ -64,6 +65,12 @@ class openstack_integration::cinder (
       barbican_endpoint => "${::openstack_integration::config::base_url}:9311",
       auth_endpoint     => "${::openstack_integration::config::keystone_auth_uri}/v3"
     }
+    class { 'cinder::key_manager::barbican::service_user':
+      password            => 'a_big_secret',
+      user_domain_name    => 'Default',
+      project_domain_name => 'Default',
+      auth_url            => $::openstack_integration::config::keystone_admin_uri,
+    }
   }
   class { 'cinder::db':
     database_connection => os_database_connection({
@@ -105,6 +112,13 @@ class openstack_integration::cinder (
     memcached_servers            => $::openstack_integration::config::memcached_servers,
     service_token_roles_required => true,
   }
+  class { 'cinder::keystone::service_user':
+    send_service_user_token => true,
+    password                => 'a_big_secret',
+    user_domain_name        => 'Default',
+    project_domain_name     => 'Default',
+    auth_url                => $::openstack_integration::config::keystone_admin_uri,
+  }
   class { 'cinder::api':
     default_volume_type => 'BACKEND_1',
     public_endpoint     => "${::openstack_integration::config::base_url}:8776",

manifests/designate.pp

@@ -57,10 +57,11 @@ class openstack_integration::designate {
   include 'designate::client'
 
   class { 'designate::keystone::auth':
-    password     => 'a_big_secret',
     public_url   => "${::openstack_integration::config::base_url}:9001",
     internal_url => "${::openstack_integration::config::base_url}:9001",
     admin_url    => "${::openstack_integration::config::base_url}:9001",
+    roles        => ['admin', 'service'],
+    password     => 'a_big_secret',
   }
   class { 'designate::keystone::authtoken':
     password                     => 'a_big_secret',
@@ -69,6 +70,7 @@ class openstack_integration::designate {
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
 
   class { 'designate::api':

manifests/ec2api.pp

@@ -18,6 +18,7 @@ class openstack_integration::ec2api {
     internal_url => "${::openstack_integration::config::base_url}:8788",
     admin_url    => "${::openstack_integration::config::base_url}:8788",
     password     => 'a_big_secret',
+    roles        => ['admin', 'service'],
   }
   class { 'ec2api::db::mysql':
     charset  => $::openstack_integration::params::mysql_charset,
@@ -51,6 +52,7 @@ class openstack_integration::ec2api {
         auth_url                     => $::openstack_integration::config::keystone_admin_uri,
         www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
         memcached_servers            => $::openstack_integration::config::memcached_servers,
+        service_token_roles_required => true,
       }
       class { 'ec2api::api':
         my_ip                   => $::openstack_integration::config::host,

manifests/glance.pp

@@ -46,6 +46,7 @@ class openstack_integration::glance (
     public_url   => "http://${::openstack_integration::config::ip_for_url}:9292",
     internal_url => "http://${::openstack_integration::config::ip_for_url}:9292",
     admin_url    => "http://${::openstack_integration::config::ip_for_url}:9292",
+    roles        => ['admin', 'service'],
     password     => 'a_big_secret',
   }
   class { 'glance::api::authtoken':
@@ -55,6 +56,7 @@ class openstack_integration::glance (
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   case $backend {
     'file': {
@@ -144,5 +146,11 @@ class openstack_integration::glance (
       barbican_endpoint => "${::openstack_integration::config::base_url}:9311",
       auth_endpoint     => "${::openstack_integration::config::keystone_auth_uri}/v3"
     }
+    class { 'glance::key_manager::barbican::service_user':
+      password            => 'a_big_secret',
+      user_domain_name    => 'Default',
+      project_domain_name => 'Default',
+      auth_url            => $::openstack_integration::config::keystone_admin_uri,
+    }
   }
 }

manifests/gnocchi.pp

@@ -72,6 +72,7 @@ class openstack_integration::gnocchi (
     public_url   => "${::openstack_integration::config::base_url}:8041",
     internal_url => "${::openstack_integration::config::base_url}:8041",
     admin_url    => "${::openstack_integration::config::base_url}:8041",
+    roles        => ['admin', 'service'],
     password     => 'a_big_secret',
   }
   class { 'gnocchi::keystone::authtoken':
@@ -81,6 +82,7 @@ class openstack_integration::gnocchi (
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'gnocchi::api':
     enabled      => true,

manifests/heat.pp

@@ -36,6 +36,7 @@ class openstack_integration::heat (
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'heat::trustee':
     password         => 'a_big_secret',
@@ -83,11 +84,12 @@ class openstack_integration::heat (
     host     => $::openstack_integration::config::host,
   }
   class { 'heat::keystone::auth':
-    password                  => 'a_big_secret',
-    configure_delegated_roles => true,
     public_url                => "${::openstack_integration::config::base_url}:8004/v1/%(tenant_id)s",
     internal_url              => "${::openstack_integration::config::base_url}:8004/v1/%(tenant_id)s",
     admin_url                 => "${::openstack_integration::config::base_url}:8004/v1/%(tenant_id)s",
+    roles                     => ['admin', 'service'],
+    password                  => 'a_big_secret',
+    configure_delegated_roles => true,
   }
   class { 'heat::keystone::auth_cfn':
     password            => 'a_big_secret',

manifests/ironic.pp

@@ -50,6 +50,7 @@ class openstack_integration::ironic {
     public_url   => "${::openstack_integration::config::base_url}:6385",
     internal_url => "${::openstack_integration::config::base_url}:6385",
     admin_url    => "${::openstack_integration::config::base_url}:6385",
+    roles        => ['admin', 'service'],
     password     => 'a_big_secret',
   }
   class { 'ironic::api::authtoken':
@@ -59,11 +60,13 @@ class openstack_integration::ironic {
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'ironic::keystone::auth_inspector':
     public_url   => "http://${::openstack_integration::config::ip_for_url}:5050",
     internal_url => "http://${::openstack_integration::config::ip_for_url}:5050",
     admin_url    => "http://${::openstack_integration::config::ip_for_url}:5050",
+    roles        => ['admin', 'service'],
     password     => 'a_big_secret',
   }
   class { 'ironic::client': }
@@ -104,6 +107,7 @@ class openstack_integration::ironic {
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'ironic::pxe': }
   class { 'ironic::inspector::db':

manifests/magnum.pp

@@ -35,6 +35,7 @@ class openstack_integration::magnum (
     public_url   => "${::openstack_integration::config::base_url}:9511",
     internal_url => "${::openstack_integration::config::base_url}:9511",
     admin_url    => "${::openstack_integration::config::base_url}:9511",
+    roles        => ['admin', 'service'],
     password     => 'a_big_secret',
   }
 
@@ -52,6 +53,7 @@ class openstack_integration::magnum (
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
 
   class { 'magnum::db::mysql':

manifests/manila.pp

@@ -43,6 +43,7 @@ class openstack_integration::manila (
     public_url_v2          => "${::openstack_integration::config::base_url}:8786/v2",
     internal_url_v2        => "${::openstack_integration::config::base_url}:8786/v2",
     admin_url_v2           => "${::openstack_integration::config::base_url}:8786/v2",
+    roles                  => ['admin', 'service'],
     password               => 'a_big_secret',
     configure_user_v2      => false,
     configure_user_role_v2 => false,
@@ -88,6 +89,7 @@ class openstack_integration::manila (
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'manila::api':
     service_name => 'httpd',

manifests/mistral.pp

@@ -21,6 +21,7 @@ class openstack_integration::mistral {
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'mistral::logging':
     debug => true,
@@ -50,6 +51,7 @@ class openstack_integration::mistral {
     public_url   => "${::openstack_integration::config::base_url}:8989/v2",
     admin_url    => "${::openstack_integration::config::base_url}:8989/v2",
     internal_url => "${::openstack_integration::config::base_url}:8989/v2",
+    roles        => ['admin', 'service'],
     password     => 'a_big_secret',
   }
   class { 'mistral::db::mysql':

manifests/murano.pp

@@ -71,6 +71,7 @@ class openstack_integration::murano {
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'murano':
     default_transport_url => os_transport_url({
@@ -99,10 +100,11 @@ class openstack_integration::murano {
   class { 'murano::engine': }
 
   class { 'murano::keystone::auth':
-    password     => 'a_big_secret',
     public_url   => "${::openstack_integration::config::base_url}:8082",
     internal_url => "${::openstack_integration::config::base_url}:8082",
     admin_url    => "${::openstack_integration::config::base_url}:8082",
+    roles        => ['admin', 'service'],
+    password     => 'a_big_secret',
   }
   -> murano_application { 'io.murano':
     package_path => "${application_package_path}/io.murano.zip",

manifests/neutron.pp

@@ -157,6 +157,7 @@ class openstack_integration::neutron (
     public_url   => "${::openstack_integration::config::base_url}:9696",
     internal_url => "${::openstack_integration::config::base_url}:9696",
     admin_url    => "${::openstack_integration::config::base_url}:9696",
+    roles        => ['admin', 'service'],
     password     => 'a_big_secret',
   }
 
@@ -246,6 +247,7 @@ class openstack_integration::neutron (
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
 
   if $facts['os']['family'] == 'Debian' {

manifests/nova.pp

@@ -111,6 +111,7 @@ class openstack_integration::nova (
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'nova::keystone::service_user':
     send_service_user_token => true,
@@ -199,6 +200,12 @@ class openstack_integration::nova (
       auth_endpoint     => "${::openstack_integration::config::keystone_auth_uri}/v3",
       barbican_endpoint => "${::openstack_integration::config::base_url}:9311"
     }
+    class { 'nova::key_manager::barbican::service_user':
+      password            => 'a_big_secret',
+      user_domain_name    => 'Default',
+      project_domain_name => 'Default',
+      auth_url            => $::openstack_integration::config::keystone_admin_uri,
+    }
   }
   class { 'nova::compute':
     vnc_enabled                 => true,

manifests/octavia.pp

@@ -103,6 +103,7 @@ class openstack_integration::octavia (
     public_url   => "${::openstack_integration::config::base_url}:9876",
     internal_url => "${::openstack_integration::config::base_url}:9876",
     admin_url    => "${::openstack_integration::config::base_url}:9876",
+    roles        => ['admin', 'service'],
     password     => 'a_big_secret',
   }
   class { 'octavia::keystone::authtoken':
@@ -112,6 +113,7 @@ class openstack_integration::octavia (
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
 
   File { '/etc/octavia/certs':

manifests/placement.pp

@@ -27,6 +27,7 @@ class openstack_integration::placement {
     public_url   => "${::openstack_integration::config::base_url}:8778",
     internal_url => "${::openstack_integration::config::base_url}:8778",
     admin_url    => "${::openstack_integration::config::base_url}:8778",
+    roles        => ['admin', 'service'],
     password     => 'a_big_secret',
   }
   class { 'placement::keystone::authtoken':
@@ -36,6 +37,7 @@ class openstack_integration::placement {
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'placement::logging':
     debug => true,

manifests/sahara.pp

@@ -35,6 +35,7 @@ class openstack_integration::sahara (
     public_url   => "${::openstack_integration::config::base_url}:8386",
     internal_url => "${::openstack_integration::config::base_url}:8386",
     admin_url    => "${::openstack_integration::config::base_url}:8386",
+    roles        => ['admin', 'service'],
     password     => 'a_big_secret',
   }
   class { 'sahara::logging':
@@ -70,6 +71,7 @@ class openstack_integration::sahara (
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'sahara::service::api':
     service_name => 'httpd',

manifests/swift.pp

@@ -75,6 +75,7 @@ class openstack_integration::swift {
     www_authenticate_uri         => "${::openstack_integration::config::keystone_auth_uri}/v3",
     auth_url                     => "${::openstack_integration::config::keystone_admin_uri}/",
     password                     => 'a_big_secret',
+    service_token_roles_required => true,
   }
   class { 'swift::proxy::keystone':
     operator_roles => ['member', 'admin', 'SwiftOperator']
@@ -99,6 +100,7 @@ class openstack_integration::swift {
     public_url_s3   => "http://${::openstack_integration::config::ip_for_url}:8080",
     admin_url_s3    => "http://${::openstack_integration::config::ip_for_url}:8080",
     internal_url_s3 => "http://${::openstack_integration::config::ip_for_url}:8080",
+    roles           => ['admin', 'service'],
     password        => 'a_big_secret',
     operator_roles  => ['admin', 'SwiftOperator', 'ResellerAdmin'],
   }

manifests/trove.pp

@@ -55,10 +55,11 @@ class openstack_integration::trove {
     host     => $::openstack_integration::config::host,
   }
   class { 'trove::keystone::auth':
-    password     => 'a_big_secret',
     public_url   => "${::openstack_integration::config::base_url}:8779/v1.0/%(tenant_id)s",
     internal_url => "${::openstack_integration::config::base_url}:8779/v1.0/%(tenant_id)s",
     admin_url    => "${::openstack_integration::config::base_url}:8779/v1.0/%(tenant_id)s",
+    roles        => ['admin', 'service'],
+    password     => 'a_big_secret',
   }
   class { 'trove::keystone::authtoken':
     password                     => 'a_big_secret',
@@ -67,6 +68,7 @@ class openstack_integration::trove {
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'trove::api::service_credentials':
     password => 'a_big_secret',

manifests/vitrage.pp

@@ -83,6 +83,7 @@ class openstack_integration::vitrage {
     public_url   => "${::openstack_integration::config::base_url}:8999",
     internal_url => "${::openstack_integration::config::base_url}:8999",
     admin_url    => "${::openstack_integration::config::base_url}:8999",
+    roles        => ['admin', 'service'],
     password     => 'a_big_secret',
   }
   class { 'vitrage::keystone::authtoken':
@@ -92,6 +93,7 @@ class openstack_integration::vitrage {
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'vitrage::api':
     enabled      => true,

manifests/watcher.pp

@@ -33,10 +33,11 @@ class openstack_integration::watcher {
     }),
   }
   class { 'watcher::keystone::auth':
-    password     => 'a_big_secret',
     public_url   => "${::openstack_integration::config::base_url}:9322",
     admin_url    => "${::openstack_integration::config::base_url}:9322",
     internal_url => "${::openstack_integration::config::base_url}:9322",
+    roles        => ['admin', 'service'],
+    password     => 'a_big_secret',
   }
   class {'watcher::keystone::authtoken':
     password                     => 'a_big_secret',
@@ -46,6 +47,7 @@ class openstack_integration::watcher {
     auth_url                     => "${::openstack_integration::config::keystone_admin_uri}/v3",
     www_authenticate_uri         => "${::openstack_integration::config::keystone_auth_uri}/v3",
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class { 'watcher::logging':
     debug => true,

manifests/zaqar.pp

@@ -19,11 +19,11 @@ class openstack_integration::zaqar {
     host     => $::openstack_integration::config::host,
   }
   class { 'zaqar::keystone::auth':
-    password     => 'a_big_secret',
-    roles        => ['admin', 'ResellerAdmin'],
     public_url   => "${::openstack_integration::config::base_url}:8888",
     internal_url => "${::openstack_integration::config::base_url}:8888",
     admin_url    => "${::openstack_integration::config::base_url}:8888",
+    roles        => ['admin', 'service'],
+    password     => 'a_big_secret',
   }
   class { 'zaqar::keystone::auth_websocket':
     public_url   => "ws://${::openstack_integration::config::ip_for_url}:8888",
@@ -52,6 +52,7 @@ class openstack_integration::zaqar {
     auth_url                     => $::openstack_integration::config::keystone_admin_uri,
     www_authenticate_uri         => $::openstack_integration::config::keystone_auth_uri,
     memcached_servers            => $::openstack_integration::config::memcached_servers,
+    service_token_roles_required => true,
   }
   class {'zaqar':
     unreliable       => true,