openstack/puppet-openstack-integration
Code Issues Proposed changes

Use service token in nova's requests

Browse Source 
This patch makes Nova send service tokens to other OpenStack services
and tells Cinder to expect and validate them.

This is necessary because in the recent CVE fix it has become mandatory
for Nova to send service tokens to Cinder to be able to detach volumes.

Related-Bug: #2004555
Change-Id: Ib39ec8738f56b381d9fe22f41c54b14e796a66c3
This commit is contained in:
Gorka Eguileor 2023-05-19 11:12:37 +02:00 committed by Takashi Kajinami
parent 8ceae6efef
commit b78f3fc900
2 changed files with 15 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
manifests/cinder.pp
View File

@ -97,12 +97,13 @@ class openstack_integration::cinder (
amqp_sasl_mechanisms => 'PLAIN',
}
class { 'cinder::keystone::authtoken':
password => 'a_big_secret',
user_domain_name => 'Default',
project_domain_name => 'Default',
auth_url => $::openstack_integration::config::keystone_admin_uri,
www_authenticate_uri => $::openstack_integration::config::keystone_auth_uri,
memcached_servers => $::openstack_integration::config::memcached_servers,
password => 'a_big_secret',
user_domain_name => 'Default',
project_domain_name => 'Default',
auth_url => $::openstack_integration::config::keystone_admin_uri,
www_authenticate_uri => $::openstack_integration::config::keystone_auth_uri,
memcached_servers => $::openstack_integration::config::memcached_servers,
service_token_roles_required => true,
}
class { 'cinder::api':
default_volume_type => 'BACKEND_1',

8
manifests/nova.pp
View File

@ -101,6 +101,7 @@ class openstack_integration::nova (
public_url => "${::openstack_integration::config::base_url}:8774/v2.1",
internal_url => "${::openstack_integration::config::base_url}:8774/v2.1",
admin_url => "${::openstack_integration::config::base_url}:8774/v2.1",
roles => ['admin', 'service'],
password => 'a_big_secret',
}
class { 'nova::keystone::authtoken':
@ -111,6 +112,13 @@ class openstack_integration::nova (
www_authenticate_uri => $::openstack_integration::config::keystone_auth_uri,
memcached_servers => $::openstack_integration::config::memcached_servers,
}
class { 'nova::keystone::service_user':
send_service_user_token => true,
password => 'a_big_secret',
user_domain_name => 'Default',
project_domain_name => 'Default',
auth_url => $::openstack_integration::config::keystone_admin_uri,
}
class { 'nova::logging':
debug => true,
}