From a95b356f0fc7531a61416fea3777b8abf9de0e6b Mon Sep 17 00:00:00 2001 From: Iury Gregory Melo Ferreira Date: Wed, 3 Aug 2016 00:21:13 -0300 Subject: [PATCH] Move authtoken to class Update module to work with the new schema for authtoken Change-Id: If7eca0a769651b13a996558e6318ac682eff24f6 Closes-Bug: #1604463 --- manifests/init.pp | 316 ++---------------- manifests/keystone/authtoken.pp | 278 +++++++++++++++ ...9.yaml => authtoken-4957c02d0d35b01a.yaml} | 11 +- spec/acceptance/zaqar_mongo_spec.rb | 4 +- spec/classes/zaqar_init_spec.rb | 169 ++-------- spec/classes/zaqar_keystone_authtoken_spec.rb | 145 ++++++++ spec/defines/zaqar_server_instance_spec.rb | 2 +- 7 files changed, 484 insertions(+), 441 deletions(-) create mode 100644 manifests/keystone/authtoken.pp rename releasenotes/notes/{authtoken-10653fde75334039.yaml => authtoken-4957c02d0d35b01a.yaml} (59%) create mode 100644 spec/classes/zaqar_keystone_authtoken_spec.rb diff --git a/manifests/init.pp b/manifests/init.pp index d0c6972..3e9c838 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -4,191 +4,6 @@ # # === Parameters # -# [*auth_uri*] -# Specifies the public Identity URI for Zaqar to use. -# Default 'http://localhost:5000/' -# -# [*username*] -# (optional) The name of the service user -# Defaults to 'zaqar' -# -# [*password*] -# (required) Password for the user -# -# [*auth_url*] -# (optional) The URL to use for authentication. -# Defaults to 'http://localhost:35357/' -# -# [*project_name*] -# (optional) Service project name -# Defaults to 'services' -# -# [*user_domain_name*] -# (optional) Name of domain for $username -# Defaults to 'Default' -# -# [*project_domain_name*] -# (optional) Name of domain for $project_name -# Defaults to 'Default' -# -# [*insecure*] -# (optional) If true, explicitly allow TLS without checking server cert -# against any certificate authorities. -# WARNING: not recommended. Use with caution. -# Defaults to $::os_service_default -# -# [*auth_section*] -# (optional) Config Section from which to load plugin specific options -# Defaults to $::os_service_default -# -# [*auth_type*] -# (optional) Authentication type to load -# Defaults to 'password' -# -# [*auth_version*] -# (optional) API version of the admin Identity API endpoint -# for example, use 'v3' for the keystone version 3.0 api -# Defaults to-$::os_service_default -# -# [*cache*] -# (optional) Env key for the swift cache. -# Defaults to $::os_service_default -# -# [*cafile*] -# (optional) A PEM encoded Certificate Authority to use when verifying HTTPs -# connections -# Defaults to $::os_service_default -# -# [*certfile*] -# (optional) Required if identity server requires client certificate -# Defaults to $::os_service_default -# -# [*check_revocations_for_cached*] -# (optional) If true, the revocation list will be checked for cached tokens. -# This requires that PKI tokens are configured on the identity server. -# boolean value. -# Defaults to $::os_service_default -# -# [*delay_auth_decision*] -# (optional) Do not handle authorization requests within the middleware, but -# delegate the authorization decision to downstream WSGI components. Boolean -# value -# Defaults to $::os_service_default -# -# [*enforce_token_bind*] -# (Optional) Used to control the use and type of token binding. Can be set -# to: "disabled" to not check token binding. "permissive" (default) to -# validate binding information if the bind type is of a form known to the -# server and ignore it if not. "strict" like "permissive" but if the bind -# type is unknown the token will be rejected. "required" any form of token -# binding is needed to be allowed. Finally the name of a binding method that -# must be present in tokens. String value. -# Defaults to $::os_service_default. -# -# [*hash_algorithms*] -# (Optional) Hash algorithms to use for hashing PKI tokens. This may be a -# single algorithm or multiple. The algorithms are those supported by Python -# standard hashlib.new(). The hashes will be tried in the order given, so -# put -# the preferred one first for performance. The result of the first hash will -# be stored in the cache. This will typically be set to multiple values only -# while migrating from a less secure algorithm to a more secure one. Once -# all -# the old tokens are expired this option should be set to a single value for -# better performance. List value. -# Defaults to $::os_service_default. -# -# [*http_connect_timeout*] -# (optional) Request timeout value for communicating with Identity API -# server. -# Defaults to $::os_service_default -# -# [*http_request_max_retries*] -# (optional) How many times are we trying to reconnect when communicating -# with Identity API Server. Integer value -# Defaults to $::os_service_default -# -# [*include_service_catalog*] -# (Optional) Indicate whether to set the X-Service-Catalog header. If False, -# middleware will not ask for service catalog on token validation and will -# not -# set the X-Service-Catalog header. Boolean value. -# Defaults to $::os_service_default. -# -# [*keyfile*] -# (Optional) Required if identity server requires client certificate -# Defaults to $::os_service_default. -# -# [*memcache_pool_conn_get_timeout*] -# (Optional) Number of seconds that an operation will wait to get a -# memcached -# client connection from the pool. Integer value -# Defaults to $::os_service_default. -# -# [*memcache_pool_dead_retry*] -# (Optional) Number of seconds memcached server is considered dead before it -# is tried again. Integer value -# Defaults to $::os_service_default. -# -# [*memcache_pool_maxsize*] -# (Optional) Maximum total number of open connections to every memcached -# server. Integer value -# Defaults to $::os_service_default. -# -# [*memcache_pool_socket_timeout*] -# (Optional) Number of seconds a connection to memcached is held unused in -# the pool before it is closed. Integer value -# Defaults to $::os_service_default. -# -# [*memcache_pool_unused_timeout*] -# (Optional) Number of seconds a connection to memcached is held unused in -# the pool before it is closed. Integer value -# Defaults to $::os_service_default. -# -# [*memcache_secret_key*] -# (Optional, mandatory if memcache_security_strategy is defined) This string -# is used for key derivation. -# Defaults to $::os_service_default. -# -# [*memcache_security_strategy*] -# (Optional) If defined, indicate whether token data should be authenticated -# or authenticated and encrypted. If MAC, token data is authenticated (with -# HMAC) in the cache. If ENCRYPT, token data is encrypted and authenticated -# in the cache. If the value is not one of these options or empty, -# auth_token will raise an exception on initialization. -# Defaults to $::os_service_default. -# -# [*memcache_use_advanced_pool*] -# (Optional) Use the advanced (eventlet safe) memcached client pool. The -# advanced pool will only work under python 2.x Boolean value -# Defaults to $::os_service_default. -# -# [*memcached_servers*] -# (Optional) Optionally specify a list of memcached server(s) to use for -# caching. If left undefined, tokens will instead be cached in-process. -# Defaults to $::os_service_default. -# -# [*region_name*] -# (Optional) The region in which the identity server can be found. -# Defaults to $::os_service_default. -# -# [*revocation_cache_time*] -# (Optional) Determines the frequency at which the list of revoked tokens is -# retrieved from the Identity service (in seconds). A high number of -# revocation events combined with a low cache duration may significantly -# reduce performance. Only valid for PKI tokens. Integer value -# Defaults to $::os_service_default. -# -# [*signing_dir*] -# (Optional) Directory used to cache files related to PKI tokens. -# Defaults to $::os_service_default. -# -# [*token_cache_time*] -# (Optional) In order to prevent excessive effort spent validating tokens, -# the middleware caches previously-seen tokens for a configurable duration -# (in seconds). Set to -1 to disable caching completely. Integer value -# Defaults to $::os_service_default. -# # [*auth_strategy*] # Backend to use for authentication. For no auth, keep it empty. # Default 'keystone'. @@ -246,57 +61,26 @@ # = DEPRECATED PARAMETERS # # [*identity_uri*] -# (Optional) DEPRECATED. Use auth_url instead. +# (Optional) DEPRECATED. Use zaqar::keystone::authtoken::auth_url instead. +# Defaults to undef +# +# [*auth_uri*] +# (Optional) DEPRECATED. Use zaqar::keystone::authtoken::auth_uri instead. # Defaults to undef # # [*admin_user*] -# (Optional) DEPRECATED. Use usename instead. +# (Optional) DEPRECATED. Use zaqar::keystone::authtoken::username instead. # Defaults to undef # # [*admin_tenant_name*] -# (Optional) DEPRECATED. Use project_name instead. +# (Optional) DEPRECATED. Use zaqar::keystone::authtoken::project_name instead. # Defaults to undef # # [*admin_password*] -# (Optional) DEPRECATED. Use password instead. +# (Optional) DEPRECATED. Use zaqar::keystone::authtoken::password instead. # Defaults to undef # class zaqar( - $auth_uri = 'http://localhost:5000/', - $username = 'zaqar', - $password = $::os_service_default, - $auth_url = 'http://localhost:35357/', - $auth_version = $::os_service_default, - $project_name = 'services', - $user_domain_name = 'Default', - $project_domain_name = 'Default', - $insecure = $::os_service_default, - $auth_section = $::os_service_default, - $auth_type = 'password', - $cache = $::os_service_default, - $cafile = $::os_service_default, - $certfile = $::os_service_default, - $check_revocations_for_cached = $::os_service_default, - $delay_auth_decision = $::os_service_default, - $enforce_token_bind = $::os_service_default, - $hash_algorithms = $::os_service_default, - $http_connect_timeout = $::os_service_default, - $http_request_max_retries = $::os_service_default, - $include_service_catalog = $::os_service_default, - $keyfile = $::os_service_default, - $memcache_pool_conn_get_timeout = $::os_service_default, - $memcache_pool_dead_retry = $::os_service_default, - $memcache_pool_maxsize = $::os_service_default, - $memcache_pool_socket_timeout = $::os_service_default, - $memcache_secret_key = $::os_service_default, - $memcache_security_strategy = $::os_service_default, - $memcache_use_advanced_pool = $::os_service_default, - $memcache_pool_unused_timeout = $::os_service_default, - $memcached_servers = $::os_service_default, - $region_name = $::os_service_default, - $revocation_cache_time = $::os_service_default, - $signing_dir = $::os_service_default, - $token_cache_time = $::os_service_default, $auth_strategy = 'keystone', $admin_mode = $::os_service_default, $unreliable = $::os_service_default, @@ -310,6 +94,7 @@ class zaqar( $package_ensure = 'present', # Deprecated $identity_uri = undef, + $auth_uri = undef, $admin_user = undef, $admin_password = undef, $admin_tenant_name = undef, @@ -317,34 +102,30 @@ class zaqar( if $identity_uri { - warning('zaqar::identity_uri is deprecated, use zaqar::auth_url instead') - $auth_url_real = $identity_uri - } else { - $auth_url_real = $auth_url + warning('zaqar::identity_uri is deprecated, use zaqar::keystone::authtoken::auth_url instead') + } + + if $auth_uri { + warning('zaqar::auth_uri is deprecated, use zaqar::keystone::authtoken::auth_uri instead') } if $admin_user { - warning('zaqar::admin_user is deprecated, use zaqar::username instead') - $username_real = $admin_user - } else { - $username_real = $username + warning('zaqar::admin_user is deprecated, use zaqar::keystone::authtoken::username instead') } if $admin_password { - warning('zaqar::admin_password is deprecated, use zaqar::password instead') - $password_real = $admin_password - } else { - $password_real = $password + warning('zaqar::admin_password is deprecated, use zaqar::keystone::authtoken::password instead') } if $admin_tenant_name { - warning('zaqar::admin_tenant_name is deprecated, use zaqar::project_name instead') - $project_name_real = $admin_tenant_name - } else { - $project_name_real = $project_name + warning('zaqar::admin_tenant_name is deprecated, use zaqar::keystone::authtoken::project_name instead') } + if $auth_strategy == 'keystone' { + include ::zaqar::keystone::authtoken + } + package { 'zaqar-common': ensure => $package_ensure, name => $package_name, @@ -352,52 +133,15 @@ class zaqar( } zaqar_config { - 'DEFAULT/auth_strategy' : value => $auth_strategy; - 'DEFAULT/admin_mode' : value => $admin_mode; - 'DEFAULT/unreliable' : value => $unreliable; - 'DEFAULT/pooling' : value => $pooling; - 'storage/queue_pipeline' : value => $queue_pipeline; - 'storage/message_pipeline' : value => $message_pipeline; - 'storage/claim_pipeline' : value => $claim_pipeline; - 'storage/subscription_pipeline' : value => $subscription_pipeline; - 'transport/max_messages_post_size' : value => $max_messages_post_size; + 'DEFAULT/auth_strategy': value => $auth_strategy; + 'DEFAULT/admin_mode': value => $admin_mode; + 'DEFAULT/unreliable': value => $unreliable; + 'DEFAULT/pooling': value => $pooling; + 'storage/queue_pipeline': value => $queue_pipeline; + 'storage/message_pipeline': value => $message_pipeline; + 'storage/claim_pipeline': value => $claim_pipeline; + 'storage/subscription_pipeline': value => $subscription_pipeline; + 'transport/max_messages_post_size': value => $max_messages_post_size; } - keystone::resource::authtoken { 'zaqar_config': - username => $username_real, - password => $password_real, - project_name => $project_name_real, - auth_url => $auth_url_real, - auth_uri => $auth_uri, - auth_version => $auth_version, - auth_type => $auth_type, - auth_section => $auth_section, - user_domain_name => $user_domain_name, - project_domain_name => $project_domain_name, - insecure => $insecure, - cache => $cache, - cafile => $cafile, - certfile => $certfile, - check_revocations_for_cached => $check_revocations_for_cached, - delay_auth_decision => $delay_auth_decision, - enforce_token_bind => $enforce_token_bind, - hash_algorithms => $hash_algorithms, - http_connect_timeout => $http_connect_timeout, - http_request_max_retries => $http_request_max_retries, - include_service_catalog => $include_service_catalog, - keyfile => $keyfile, - memcache_pool_conn_get_timeout => $memcache_pool_conn_get_timeout, - memcache_pool_dead_retry => $memcache_pool_dead_retry, - memcache_pool_maxsize => $memcache_pool_maxsize, - memcache_pool_socket_timeout => $memcache_pool_socket_timeout, - memcache_secret_key => $memcache_secret_key, - memcache_security_strategy => $memcache_security_strategy, - memcache_use_advanced_pool => $memcache_use_advanced_pool, - memcache_pool_unused_timeout => $memcache_pool_unused_timeout, - memcached_servers => $memcached_servers, - region_name => $region_name, - revocation_cache_time => $revocation_cache_time, - signing_dir => $signing_dir, - token_cache_time => $token_cache_time, - } } diff --git a/manifests/keystone/authtoken.pp b/manifests/keystone/authtoken.pp new file mode 100644 index 0000000..4a26381 --- /dev/null +++ b/manifests/keystone/authtoken.pp @@ -0,0 +1,278 @@ +# class: zaqar::keystone::authtoken +# +# Configure the keystone_authtoken section in the configuration file +# +# === Parameters +# +# [*username*] +# (Optional) The name of the service user +# Defaults to 'zaqar' +# +# [*password*] +# (Optional) Password to create for the service user +# Defaults to $::os_service_default +# +# [*auth_url*] +# (Optional) The URL to use for authentication. +# Defaults to 'http://localhost:35357' +# +# [*project_name*] +# (Optional) Service project name +# Defaults to 'services' +# +# [*user_domain_name*] +# (Optional) Name of domain for $username +# Defaults to $::os_service_default +# +# [*project_domain_name*] +# (Optional) Name of domain for $project_name +# Defaults to $::os_service_default +# +# [*insecure*] +# (Optional) If true, explicitly allow TLS without checking server cert +# against any certificate authorities. WARNING: not recommended. Use with +# caution. +# Defaults to $:os_service_default +# +# [*auth_section*] +# (Optional) Config Section from which to load plugin specific options +# Defaults to $::os_service_default. +# +# [*auth_type*] +# (Optional) Authentication type to load +# Defaults to 'password' +# +# [*auth_uri*] +# (Optional) Complete public Identity API endpoint. +# Defaults to 'http://localhost:5000' +# +# [*auth_version*] +# (Optional) API version of the admin Identity API endpoint. +# Defaults to $::os_service_default. +# +# [*cache*] +# (Optional) Env key for the swift cache. +# Defaults to $::os_service_default. +# +# [*cafile*] +# (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs +# connections. +# Defaults to $::os_service_default. +# +# [*certfile*] +# (Optional) Required if identity server requires client certificate +# Defaults to $::os_service_default. +# +# [*check_revocations_for_cached*] +# (Optional) If true, the revocation list will be checked for cached tokens. +# This requires that PKI tokens are configured on the identity server. +# boolean value. +# Defaults to $::os_service_default. +# +# [*delay_auth_decision*] +# (Optional) Do not handle authorization requests within the middleware, but +# delegate the authorization decision to downstream WSGI components. Boolean +# value +# Defaults to $::os_service_default. +# +# [*enforce_token_bind*] +# (Optional) Used to control the use and type of token binding. Can be set +# to: "disabled" to not check token binding. "permissive" (default) to +# validate binding information if the bind type is of a form known to the +# server and ignore it if not. "strict" like "permissive" but if the bind +# type is unknown the token will be rejected. "required" any form of token +# binding is needed to be allowed. Finally the name of a binding method that +# must be present in tokens. String value. +# Defaults to $::os_service_default. +# +# [*hash_algorithms*] +# (Optional) Hash algorithms to use for hashing PKI tokens. This may be a +# single algorithm or multiple. The algorithms are those supported by Python +# standard hashlib.new(). The hashes will be tried in the order given, so put +# the preferred one first for performance. The result of the first hash will +# be stored in the cache. This will typically be set to multiple values only +# while migrating from a less secure algorithm to a more secure one. Once all +# the old tokens are expired this option should be set to a single value for +# better performance. List value. +# Defaults to $::os_service_default. +# +# [*http_connect_timeout*] +# (Optional) Request timeout value for communicating with Identity API +# server. +# Defaults to $::os_service_default. +# +# [*http_request_max_retries*] +# (Optional) How many times are we trying to reconnect when communicating +# with Identity API Server. Integer value +# Defaults to $::os_service_default. +# +# [*include_service_catalog*] +# (Optional) Indicate whether to set the X-Service-Catalog header. If False, +# middleware will not ask for service catalog on token validation and will +# not +# set the X-Service-Catalog header. Boolean value. +# Defaults to $::os_service_default. +# +# [*keyfile*] +# (Optional) Required if identity server requires client certificate +# Defaults to $::os_service_default. +# +# [*memcache_pool_conn_get_timeout*] +# (Optional) Number of seconds that an operation will wait to get a memcached +# client connection from the pool. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_dead_retry*] +# (Optional) Number of seconds memcached server is considered dead before it +# is tried again. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_maxsize*] +# (Optional) Maximum total number of open connections to every memcached +# server. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_socket_timeout*] +# (Optional) Number of seconds a connection to memcached is held unused in +# the +# pool before it is closed. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_pool_unused_timeout*] +# (Optional) Number of seconds a connection to memcached is held unused in +# the +# pool before it is closed. Integer value +# Defaults to $::os_service_default. +# +# [*memcache_secret_key*] +# (Optional, mandatory if memcache_security_strategy is defined) This string +# is used for key derivation. +# Defaults to $::os_service_default. +# +# [*memcache_security_strategy*] +# (Optional) If defined, indicate whether token data should be authenticated +# or +# authenticated and encrypted. If MAC, token data is authenticated (with +# HMAC) +# in the cache. If ENCRYPT, token data is encrypted and authenticated in the +# cache. If the value is not one of these options or empty, auth_token will +# raise an exception on initialization. +# Defaults to $::os_service_default. +# +# [*memcache_use_advanced_pool*] +# (Optional) Use the advanced (eventlet safe) memcached client pool. The +# advanced pool will only work under python 2.x Boolean value +# Defaults to $::os_service_default. +# +# [*memcached_servers*] +# (Optional) Optionally specify a list of memcached server(s) to use for +# caching. If left undefined, tokens will instead be cached in-process. +# Defaults to $::os_service_default. +# +# [*region_name*] +# (Optional) The region in which the identity server can be found. +# Defaults to $::os_service_default. +# +# [*revocation_cache_time*] +# (Optional) Determines the frequency at which the list of revoked tokens is +# retrieved from the Identity service (in seconds). A high number of +# revocation events combined with a low cache duration may significantly +# reduce performance. Only valid for PKI tokens. Integer value +# Defaults to $::os_service_default. +# +# [*signing_dir*] +# (Optional) Directory used to cache files related to PKI tokens. +# Defaults to $::os_service_default. +# +# [*token_cache_time*] +# (Optional) In order to prevent excessive effort spent validating tokens, +# the middleware caches previously-seen tokens for a configurable duration +# (in seconds). Set to -1 to disable caching completely. Integer value +# Defaults to $::os_service_default. +# +class zaqar::keystone::authtoken( + $username = 'zaqar', + $password = $::os_service_default, + $auth_url = 'http://localhost:35357', + $project_name = 'services', + $user_domain_name = $::os_service_default, + $project_domain_name = $::os_service_default, + $insecure = $::os_service_default, + $auth_section = $::os_service_default, + $auth_type = 'password', + $auth_uri = 'http://localhost:5000', + $auth_version = $::os_service_default, + $cache = $::os_service_default, + $cafile = $::os_service_default, + $certfile = $::os_service_default, + $check_revocations_for_cached = $::os_service_default, + $delay_auth_decision = $::os_service_default, + $enforce_token_bind = $::os_service_default, + $hash_algorithms = $::os_service_default, + $http_connect_timeout = $::os_service_default, + $http_request_max_retries = $::os_service_default, + $include_service_catalog = $::os_service_default, + $keyfile = $::os_service_default, + $memcache_pool_conn_get_timeout = $::os_service_default, + $memcache_pool_dead_retry = $::os_service_default, + $memcache_pool_maxsize = $::os_service_default, + $memcache_pool_socket_timeout = $::os_service_default, + $memcache_pool_unused_timeout = $::os_service_default, + $memcache_secret_key = $::os_service_default, + $memcache_security_strategy = $::os_service_default, + $memcache_use_advanced_pool = $::os_service_default, + $memcached_servers = $::os_service_default, + $region_name = $::os_service_default, + $revocation_cache_time = $::os_service_default, + $signing_dir = $::os_service_default, + $token_cache_time = $::os_service_default, +) { + + if is_service_default($password) and ! $::zaqar::admin_password { + fail('Please set password for Zaqar service user') + } + + $username_real = pick($::zaqar::admin_user, $username) + $password_real = pick($::zaqar::admin_password, $password) + $project_name_real = pick($::zaqar::admin_tenant_name, $project_name) + $auth_url_real = pick($::zaqar::identity_uri, $auth_url) + $auth_uri_real = pick($::zaqar::auth_uri, $auth_uri) + + keystone::resource::authtoken { 'zaqar_config': + username => $username_real, + password => $password_real, + project_name => $project_name_real, + auth_url => $auth_url_real, + auth_uri => $auth_uri_real, + auth_version => $auth_version, + auth_type => $auth_type, + auth_section => $auth_section, + user_domain_name => $user_domain_name, + project_domain_name => $project_domain_name, + insecure => $insecure, + cache => $cache, + cafile => $cafile, + certfile => $certfile, + check_revocations_for_cached => $check_revocations_for_cached, + delay_auth_decision => $delay_auth_decision, + enforce_token_bind => $enforce_token_bind, + hash_algorithms => $hash_algorithms, + http_connect_timeout => $http_connect_timeout, + http_request_max_retries => $http_request_max_retries, + include_service_catalog => $include_service_catalog, + keyfile => $keyfile, + memcache_pool_conn_get_timeout => $memcache_pool_conn_get_timeout, + memcache_pool_dead_retry => $memcache_pool_dead_retry, + memcache_pool_maxsize => $memcache_pool_maxsize, + memcache_pool_socket_timeout => $memcache_pool_socket_timeout, + memcache_secret_key => $memcache_secret_key, + memcache_security_strategy => $memcache_security_strategy, + memcache_use_advanced_pool => $memcache_use_advanced_pool, + memcache_pool_unused_timeout => $memcache_pool_unused_timeout, + memcached_servers => $memcached_servers, + region_name => $region_name, + revocation_cache_time => $revocation_cache_time, + signing_dir => $signing_dir, + token_cache_time => $token_cache_time, + } +} diff --git a/releasenotes/notes/authtoken-10653fde75334039.yaml b/releasenotes/notes/authtoken-4957c02d0d35b01a.yaml similarity index 59% rename from releasenotes/notes/authtoken-10653fde75334039.yaml rename to releasenotes/notes/authtoken-4957c02d0d35b01a.yaml index 4c0a2bd..e4c7f27 100644 --- a/releasenotes/notes/authtoken-10653fde75334039.yaml +++ b/releasenotes/notes/authtoken-4957c02d0d35b01a.yaml @@ -1,13 +1,12 @@ --- features: - - Configure keystonemiddleware in a consistent way with all options required - for Keystone v3 + - Configure keystonemiddleware in a consistent way with all options required for Keystone v3 deprecations: - zaqar::identity_uri is deprecated in favor of - zaqar::auth_url + zaqar::keystone::authtoken::auth_url - zaqar::admin_user is deprecated in favor of - zaqar::username + zaqar::keystone::authtoken::username - zaqar::admin_password is deprecated in favor of - zaqar::password + zaqar::keystone::authtoken::password - zaqar::admin_tenant_name is deprecated in favor of - zaqar::project_name + zaqar::keystone::authtoken::project_name diff --git a/spec/acceptance/zaqar_mongo_spec.rb b/spec/acceptance/zaqar_mongo_spec.rb index b0bf56e..a5abd53 100644 --- a/spec/acceptance/zaqar_mongo_spec.rb +++ b/spec/acceptance/zaqar_mongo_spec.rb @@ -39,8 +39,10 @@ describe 'basic zaqar' do class {'::zaqar::messaging::mongodb': uri => $zaqar_mongodb_conn_string } + class {'::zaqar::keystone::authtoken': + password => 'a_big_secret', + } class {'::zaqar': - password => 'a_big_secret', unreliable => true, } include ::zaqar::server diff --git a/spec/classes/zaqar_init_spec.rb b/spec/classes/zaqar_init_spec.rb index d5b73ed..e3eae3e 100644 --- a/spec/classes/zaqar_init_spec.rb +++ b/spec/classes/zaqar_init_spec.rb @@ -3,7 +3,7 @@ describe 'zaqar' do shared_examples 'zaqar' do let :req_params do { - :password => 'foo', + :admin_password => 'foo', } end @@ -21,58 +21,34 @@ describe 'zaqar' do it { is_expected.to contain_class('zaqar::params') } it 'should contain default config' do - is_expected.to contain_zaqar_config('keystone_authtoken/auth_uri').with( - :value => 'http://localhost:5000/' - ) - is_expected.to contain_zaqar_config('keystone_authtoken/auth_url').with( - :value => 'http://localhost:35357/' - ) - is_expected.to contain_zaqar_config('keystone_authtoken/project_name').with( - :value => 'services' - ) - is_expected.to contain_zaqar_config('keystone_authtoken/username').with( - :value => 'zaqar' - ) - is_expected.to contain_zaqar_config('keystone_authtoken/password').with( - :value => 'foo' - ) is_expected.to contain_zaqar_config('DEFAULT/auth_strategy').with( :value => 'keystone' ) - is_expected.to contain_zaqar_config('keystone_authtoken/project_domain_name').with_value('Default') - is_expected.to contain_zaqar_config('keystone_authtoken/user_domain_name').with_value('Default') - is_expected.to contain_zaqar_config('keystone_authtoken/auth_type').with(:value => 'password') - is_expected.to contain_zaqar_config('keystone_authtoken/auth_version').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/insecure').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/auth_section').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/cache').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/cafile').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/certfile').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/check_revocations_for_cached').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/delay_auth_decision').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/enforce_token_bind').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/hash_algorithms').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/http_connect_timeout').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/http_request_max_retries').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/include_service_catalog').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/keyfile').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_dead_retry').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_maxsize').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_socket_timeout').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/memcache_secret_key').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/memcache_security_strategy').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/memcache_use_advanced_pool').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_unused_timeout').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/memcached_servers').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/region_name').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/revocation_cache_time').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/signing_dir').with_value('') - is_expected.to contain_zaqar_config('keystone_authtoken/token_cache_time').with_value('') end end + describe 'with deprecated parameters set' do + let :params do + req_params.delete(:admin_password) + req_params.merge!({ + 'identity_uri' => 'https://localhost:35357/deprecated', + 'auth_uri' => 'https://localhost:5000/deprecated', + 'admin_user' => 'dummy', + 'admin_password' => 'mypassword', + 'admin_tenant_name' => 'mytenant', + }) + end + + it 'configures authtoken section' do + is_expected.to contain_zaqar_config('keystone_authtoken/auth_url').with(:value => 'https://localhost:35357/deprecated') + is_expected.to contain_zaqar_config('keystone_authtoken/auth_uri').with(:value => 'https://localhost:5000/deprecated') + is_expected.to contain_zaqar_config('keystone_authtoken/username').with(:value => 'dummy') + is_expected.to contain_zaqar_config('keystone_authtoken/password').with(:value => 'mypassword') + is_expected.to contain_zaqar_config('keystone_authtoken/project_name').with(:value => 'mytenant') + end + end + describe 'with custom values' do let :params do req_params.merge!({ @@ -84,41 +60,6 @@ describe 'zaqar' do :claim_pipeline => 'zaqar_pipeline3', :subscription_pipeline => 'zaqar_pipeline4', :max_messages_post_size => '1234', - :auth_uri => 'https://10.0.0.1:9999/', - :username => 'myuser', - :password => 'mypasswd', - :auth_url => 'http://:127.0.0.1:35357', - :project_name => 'service_project', - :user_domain_name => 'domainX', - :project_domain_name => 'domainX', - :insecure => false, - :auth_section => 'new_section', - :auth_type => 'password', - :auth_version => 'v3', - :cache => 'somevalue', - :cafile => '/opt/stack/data/cafile.pem', - :certfile => 'certfile.crt', - :check_revocations_for_cached => false, - :delay_auth_decision => false, - :enforce_token_bind => 'permissive', - :hash_algorithms => 'md5', - :http_connect_timeout => '300', - :http_request_max_retries => '3', - :include_service_catalog => true, - :keyfile => '', - :memcache_pool_conn_get_timeout => '9', - :memcache_pool_dead_retry => '302', - :memcache_pool_maxsize => '11', - :memcache_pool_socket_timeout => '2', - :memcache_pool_unused_timeout => '61', - :memcache_secret_key => 'secret_key', - :memcache_security_strategy => 'ENCRYPT', - :memcache_use_advanced_pool => true, - :memcached_servers => ['memcached01:11211','memcached02:11211'], - :region_name => 'region2', - :revocation_cache_time => '11', - :signing_dir => '/var/cache', - :token_cache_time => '301', }) end @@ -131,72 +72,6 @@ describe 'zaqar' do is_expected.to contain_zaqar_config('storage/claim_pipeline').with_value('zaqar_pipeline3') is_expected.to contain_zaqar_config('storage/subscription_pipeline').with_value('zaqar_pipeline4') is_expected.to contain_zaqar_config('transport/max_messages_post_size').with_value('1234') - is_expected.to contain_zaqar_config( - 'keystone_authtoken/auth_uri').with_value('https://10.0.0.1:9999/') - is_expected.to contain_zaqar_config( - 'keystone_authtoken/username').with_value(params[:username]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/password').with_value(params[:password]).with_secret(true) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/auth_url').with_value(params[:auth_url]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/project_name').with_value(params[:project_name]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/user_domain_name').with_value(params[:user_domain_name]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/project_domain_name').with_value(params[:project_domain_name]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/insecure').with_value(params[:insecure]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/auth_section').with_value(params[:auth_section]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/auth_type').with_value(params[:auth_type]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/cache').with_value(params[:cache]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/cafile').with_value(params[:cafile]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/certfile').with_value(params[:certfile]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/check_revocations_for_cached').with_value(params[:check_revocations_for_cached]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/delay_auth_decision').with_value(params[:delay_auth_decision]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/enforce_token_bind').with_value(params[:enforce_token_bind]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/hash_algorithms').with_value(params[:hash_algorithms]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/http_connect_timeout').with_value(params[:http_connect_timeout]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/http_request_max_retries').with_value(params[:http_request_max_retries]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/include_service_catalog').with_value(params[:include_service_catalog]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/keyfile').with_value(params[:keyfile]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/memcache_pool_conn_get_timeout').with_value(params[:memcache_pool_conn_get_timeout]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/memcache_pool_dead_retry').with_value(params[:memcache_pool_dead_retry]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/memcache_pool_maxsize').with_value(params[:memcache_pool_maxsize]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/memcache_pool_socket_timeout').with_value(params[:memcache_pool_socket_timeout]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/memcache_secret_key').with_value(params[:memcache_secret_key]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/memcache_security_strategy').with_value(params[:memcache_security_strategy]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/memcache_use_advanced_pool').with_value(params[:memcache_use_advanced_pool]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211') - is_expected.to contain_zaqar_config( - 'keystone_authtoken/region_name').with_value(params[:region_name]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/revocation_cache_time').with_value(params[:revocation_cache_time]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/signing_dir').with_value(params[:signing_dir]) - is_expected.to contain_zaqar_config( - 'keystone_authtoken/token_cache_time').with_value(params[:token_cache_time]) end end end diff --git a/spec/classes/zaqar_keystone_authtoken_spec.rb b/spec/classes/zaqar_keystone_authtoken_spec.rb new file mode 100644 index 0000000..9da02df --- /dev/null +++ b/spec/classes/zaqar_keystone_authtoken_spec.rb @@ -0,0 +1,145 @@ +require 'spec_helper' + +describe 'zaqar::keystone::authtoken' do + + let :params do + { :password => 'zaqar_password', } + end + + shared_examples 'zaqar authtoken' do + + context 'with default parameters' do + + it 'configure keystone_authtoken' do + is_expected.to contain_zaqar_config('keystone_authtoken/username').with_value('zaqar') + is_expected.to contain_zaqar_config('keystone_authtoken/password').with_value('zaqar_password') + is_expected.to contain_zaqar_config('keystone_authtoken/auth_url').with_value('http://localhost:35357') + is_expected.to contain_zaqar_config('keystone_authtoken/project_name').with_value('services') + is_expected.to contain_zaqar_config('keystone_authtoken/user_domain_name').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/project_domain_name').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/insecure').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/auth_section').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/auth_type').with_value('password') + is_expected.to contain_zaqar_config('keystone_authtoken/auth_uri').with_value('http://localhost:5000') + is_expected.to contain_zaqar_config('keystone_authtoken/auth_version').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/cache').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/cafile').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/certfile').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/check_revocations_for_cached').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/delay_auth_decision').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/enforce_token_bind').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/hash_algorithms').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/http_connect_timeout').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/http_request_max_retries').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/include_service_catalog').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/keyfile').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_dead_retry').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_maxsize').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_socket_timeout').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_unused_timeout').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_secret_key').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_security_strategy').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_use_advanced_pool').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/memcached_servers').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/region_name').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/revocation_cache_time').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/signing_dir').with_value('') + is_expected.to contain_zaqar_config('keystone_authtoken/token_cache_time').with_value('') + end + end + + context 'when overriding parameters' do + before do + params.merge!({ + :auth_uri => 'https://10.0.0.1:9999/', + :username => 'myuser', + :password => 'mypasswd', + :auth_url => 'http://:127.0.0.1:35357', + :project_name => 'service_project', + :user_domain_name => 'domainX', + :project_domain_name => 'domainX', + :insecure => false, + :auth_section => 'new_section', + :auth_type => 'password', + :auth_version => 'v3', + :cache => 'somevalue', + :cafile => '/opt/stack/data/cafile.pem', + :certfile => 'certfile.crt', + :check_revocations_for_cached => false, + :delay_auth_decision => false, + :enforce_token_bind => 'permissive', + :hash_algorithms => 'md5', + :http_connect_timeout => '300', + :http_request_max_retries => '3', + :include_service_catalog => true, + :keyfile => 'keyfile', + :memcache_pool_conn_get_timeout => '9', + :memcache_pool_dead_retry => '302', + :memcache_pool_maxsize => '11', + :memcache_pool_socket_timeout => '2', + :memcache_pool_unused_timeout => '61', + :memcache_secret_key => 'secret_key', + :memcache_security_strategy => 'ENCRYPT', + :memcache_use_advanced_pool => true, + :memcached_servers => ['memcached01:11211','memcached02:11211'], + :region_name => 'region2', + :revocation_cache_time => '11', + :signing_dir => '/var/cache', + :token_cache_time => '301', + }) + end + + it 'configure keystone_authtoken' do + is_expected.to contain_zaqar_config('keystone_authtoken/auth_uri').with_value('https://10.0.0.1:9999/') + is_expected.to contain_zaqar_config('keystone_authtoken/username').with_value(params[:username]) + is_expected.to contain_zaqar_config('keystone_authtoken/password').with_value(params[:password]).with_secret(true) + is_expected.to contain_zaqar_config('keystone_authtoken/auth_url').with_value(params[:auth_url]) + is_expected.to contain_zaqar_config('keystone_authtoken/project_name').with_value(params[:project_name]) + is_expected.to contain_zaqar_config('keystone_authtoken/user_domain_name').with_value(params[:user_domain_name]) + is_expected.to contain_zaqar_config('keystone_authtoken/project_domain_name').with_value(params[:project_domain_name]) + is_expected.to contain_zaqar_config('keystone_authtoken/insecure').with_value(params[:insecure]) + is_expected.to contain_zaqar_config('keystone_authtoken/auth_section').with_value(params[:auth_section]) + is_expected.to contain_zaqar_config('keystone_authtoken/auth_type').with_value(params[:auth_type]) + is_expected.to contain_zaqar_config('keystone_authtoken/auth_version').with_value(params[:auth_version]) + is_expected.to contain_zaqar_config('keystone_authtoken/cache').with_value(params[:cache]) + is_expected.to contain_zaqar_config('keystone_authtoken/cafile').with_value(params[:cafile]) + is_expected.to contain_zaqar_config('keystone_authtoken/certfile').with_value(params[:certfile]) + is_expected.to contain_zaqar_config('keystone_authtoken/check_revocations_for_cached').with_value(params[:check_revocations_for_cached]) + is_expected.to contain_zaqar_config('keystone_authtoken/delay_auth_decision').with_value(params[:delay_auth_decision]) + is_expected.to contain_zaqar_config('keystone_authtoken/enforce_token_bind').with_value(params[:enforce_token_bind]) + is_expected.to contain_zaqar_config('keystone_authtoken/hash_algorithms').with_value(params[:hash_algorithms]) + is_expected.to contain_zaqar_config('keystone_authtoken/http_connect_timeout').with_value(params[:http_connect_timeout]) + is_expected.to contain_zaqar_config('keystone_authtoken/http_request_max_retries').with_value(params[:http_request_max_retries]) + is_expected.to contain_zaqar_config('keystone_authtoken/include_service_catalog').with_value(params[:include_service_catalog]) + is_expected.to contain_zaqar_config('keystone_authtoken/keyfile').with_value(params[:keyfile]) + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value(params[:memcache_pool_conn_get_timeout]) + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_dead_retry').with_value(params[:memcache_pool_dead_retry]) + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_maxsize').with_value(params[:memcache_pool_maxsize]) + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_socket_timeout').with_value(params[:memcache_pool_socket_timeout]) + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_pool_unused_timeout').with_value(params[:memcache_pool_unused_timeout]) + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_secret_key').with_value(params[:memcache_secret_key]) + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_security_strategy').with_value(params[:memcache_security_strategy]) + is_expected.to contain_zaqar_config('keystone_authtoken/memcache_use_advanced_pool').with_value(params[:memcache_use_advanced_pool]) + is_expected.to contain_zaqar_config('keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211') + is_expected.to contain_zaqar_config('keystone_authtoken/region_name').with_value(params[:region_name]) + is_expected.to contain_zaqar_config('keystone_authtoken/revocation_cache_time').with_value(params[:revocation_cache_time]) + is_expected.to contain_zaqar_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir]) + is_expected.to contain_zaqar_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time]) + end + end + end + + on_supported_os({ + :supported_os => OSDefaults.get_supported_os + }).each do |os,facts| + context "on #{os}" do + let (:facts) do + facts.merge!(OSDefaults.get_facts()) + end + + it_configures 'zaqar authtoken' + end + end + +end diff --git a/spec/defines/zaqar_server_instance_spec.rb b/spec/defines/zaqar_server_instance_spec.rb index 27036eb..d5be950 100644 --- a/spec/defines/zaqar_server_instance_spec.rb +++ b/spec/defines/zaqar_server_instance_spec.rb @@ -5,7 +5,7 @@ describe 'zaqar::server_instance' do let(:title) { '1' } let :pre_condition do - "class { 'zaqar': password => 'foo' }" + "class { 'zaqar': admin_password => 'foo' }" end let :params do