Keystone Load Complete Configs

This PS loads all the required keystone configuration files into a container for an apache based deployment.

It allows OpenStack-Helm to be image agnosic, meaning operators can use any Apache based Keystone image they want.

keystone/templates/bin/_db-sync.sh.tpl

@@ -1,22 +1,13 @@
 #!/bin/bash
 set -ex
 
-# order of kolla_keystone_bootstrap urls
-# for those of looking for a little expanation
-# to a mysterious blackbox
-# 
-# these will feed into the keystone endpoints
-# so it is important they are correct
-#
-# keystone_admin_url
-# keystone_internal_url 
-# keystone_public_url 
-
-keystone-manage db_sync
-kolla_keystone_bootstrap {{ .Values.keystone.admin_user }} {{ .Values.keystone.admin_password }} \
-  {{ .Values.keystone.admin_project_name }} admin \
-  {{ include "endpoint_keystone_admin" . }} \
-  {{ include "endpoint_keystone_internal" . }} \
-  {{ include "endpoint_keystone_internal" . }} \
-  {{ .Values.keystone.admin_region_name }}
+keystone-manage --config-file=/etc/keystone/keystone.conf db_sync
 
+keystone-manage --config-file=/etc/keystone/keystone.conf bootstrap \
+    --bootstrap-username {{ .Values.keystone.admin_user }} \
+    --bootstrap-password {{ .Values.keystone.admin_password }} \
+    --bootstrap-project-name {{ .Values.keystone.admin_project_name }} \
+    --bootstrap-admin-url {{ include "endpoint_keystone_admin" . }} \
+    --bootstrap-public-url {{ include "endpoint_keystone_internal" . }} \
+    --bootstrap-internal-url {{ include "endpoint_keystone_internal" . }} \
+    --bootstrap-region-id {{ .Values.keystone.admin_region_name }}

keystone/templates/bin/_init.sh.tpl

@@ -2,5 +2,20 @@
 set -ex
 export HOME=/tmp
 
-ansible localhost -vvv -m mysql_db -a "login_host='{{ include "keystone_db_host" . }}' login_port='{{ .Values.database.port }}' login_user='{{ .Values.database.root_user }}' login_password='{{ .Values.database.root_password }}' name='{{ .Values.database.keystone_database_name }}'"
-ansible localhost -vvv -m mysql_user -a "login_host='{{ include "keystone_db_host" . }}' login_port='{{ .Values.database.port }}' login_user='{{ .Values.database.root_user }}' login_password='{{ .Values.database.root_password }}' name='{{ .Values.database.keystone_user }}' password='{{ .Values.database.keystone_password }}' host='%' priv='{{ .Values.database.keystone_database_name }}.*:ALL' append_privs='yes'"
+ansible localhost -vvv \
+  -m mysql_db -a "login_host='{{ include "keystone_db_host" . }}' \
+                  login_port='{{ .Values.database.port }}' \
+                  login_user='{{ .Values.database.root_user }}' \
+                  login_password='{{ .Values.database.root_password }}' \
+                  name='{{ .Values.database.keystone_database_name }}'"
+
+ansible localhost -vvv \
+  -m mysql_user -a "login_host='{{ include "keystone_db_host" . }}' \
+                    login_port='{{ .Values.database.port }}' \
+                    login_user='{{ .Values.database.root_user }}' \
+                    login_password='{{ .Values.database.root_password }}' \
+                    name='{{ .Values.database.keystone_user }}' \
+                    password='{{ .Values.database.keystone_password }}' \
+                    host='%' \
+                    priv='{{ .Values.database.keystone_database_name }}.*:ALL' \
+                    append_privs='yes'"

keystone/templates/bin/_start.sh.tpl

@@ -1,8 +1,10 @@
-#!/bin/bash		
-set -ex		
-
-# Loading Apache2 ENV variables		
-source /etc/apache2/envvars		
+#!/bin/bash
+set -ex
 
-# start apache with any container arguments
-apache2 -DFOREGROUND $*
+if [ -f /etc/apache2/envvars ]; then
+   # Loading Apache2 ENV variables
+   source /etc/apache2/envvars
+fi
+
+# Start Apache2
+exec apache2 -DFOREGROUND

keystone/templates/configmap-etc.yaml

@@ -6,6 +6,12 @@ data:
   keystone.conf: |+
 {{ tuple "etc/_keystone.conf.tpl" . | include "template" | indent 4 }}
   mpm_event.conf: |+
-{{ tuple "etc/_mpm_event.conf.tpl" . | include "template" | indent 4 }}  
+{{ tuple "etc/_mpm_event.conf.tpl" . | include "template" | indent 4 }}
   wsgi-keystone.conf: |+
 {{ tuple "etc/_wsgi-keystone.conf.tpl" . | include "template" | indent 4 }}
+  policy.json: |+
+{{ tuple "etc/_policy.json.tpl" . | include "template" | indent 4 }}
+  keystone-paste.ini: |+
+{{ tuple "etc/_keystone-paste.ini.tpl" . | include "template" | indent 4 }}
+  sso_callback_template.html: |+
+{{ tuple "etc/_sso_callback_template.html.tpl" . | include "template" | indent 4 }}

keystone/templates/deployment.yaml

@@ -11,14 +11,14 @@ spec:
     rollingUpdate:
       maxUnavailable: {{ .Values.upgrades.rolling_update.max_unavailable }}
       maxSurge: {{ .Values.upgrades.rolling_update.max_surge }}
-    {{ end }}    
+    {{ end }}
   template:
     metadata:
       labels:
         app: keystone-api
       annotations:
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "hash" }}
-        configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "hash" }}        
+        configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "hash" }}
         pod.beta.kubernetes.io/init-containers: '[
           {
             "name": "init",
@@ -44,7 +44,7 @@ spec:
               {
                 "name": "COMMAND",
                 "value": "echo done"
-              }              
+              }
             ]
           }
         ]'
@@ -61,26 +61,62 @@ spec:
           ports:
             - containerPort: {{ .Values.network.port.public }}
             - containerPort: {{ .Values.network.port.admin }}
+          lifecycle:
+            preStop:
+              exec:
+                command:
+                  - apachectl
+                  - -k
+                  - graceful-stop
           readinessProbe:
             tcpSocket:
               port: {{ .Values.network.port.public }}
           volumeMounts:
+            - name: pod-etc-keystone
+              mountPath: /etc/keystone
             - name: keystoneconf
               mountPath: /etc/keystone/keystone.conf
               subPath: keystone.conf
+              readOnly: true
+            - name: keystonepaste
+              mountPath: /etc/keystone/keystone-paste.ini
+              subPath: keystone-paste.ini
+              readOnly: true
+            - name: keystonepolicy
+              mountPath: /etc/keystone/policy.json
+              subPath: policy.json
+              readOnly: true
+            - name: keystonessotemplate
+              mountPath: /etc/keystone/sso_callback_template.html
+              subPath: sso_callback_template.html
+              readOnly: true
             - name: wsgikeystone
               mountPath: /etc/apache2/conf-enabled/wsgi-keystone.conf
               subPath: wsgi-keystone.conf
+              readOnly: true
             - name: mpmeventconf
               mountPath: /etc/apache2/mods-available/mpm_event.conf
               subPath: mpm_event.conf
+              readOnly: true
             - name: startsh
               mountPath: /tmp/start.sh
               subPath: start.sh
+              readOnly: true
       volumes:
+        - name: pod-etc-keystone
+          emptyDir: {}
         - name: keystoneconf
           configMap:
             name: keystone-etc
+        - name: keystonepaste
+          configMap:
+            name: keystone-etc
+        - name: keystonepolicy
+          configMap:
+            name: keystone-etc
+        - name: keystonessotemplate
+          configMap:
+            name: keystone-etc
         - name: wsgikeystone
           configMap:
             name: keystone-etc
@@ -90,4 +126,3 @@ spec:
         - name: startsh
           configMap:
             name: keystone-bin
-

keystone/templates/etc/_keystone-paste.ini.tpl

@@ -0,0 +1,97 @@
+# Keystone PasteDeploy configuration file.
+
+[filter:debug]
+use = egg:oslo.middleware#debug
+
+[filter:request_id]
+use = egg:oslo.middleware#request_id
+
+[filter:build_auth_context]
+use = egg:keystone#build_auth_context
+
+[filter:token_auth]
+use = egg:keystone#token_auth
+
+[filter:admin_token_auth]
+# This is deprecated in the M release and will be removed in the O release.
+# Use `keystone-manage bootstrap` and remove this from the pipelines below.
+use = egg:keystone#admin_token_auth
+
+[filter:json_body]
+use = egg:keystone#json_body
+
+[filter:cors]
+use = egg:oslo.middleware#cors
+oslo_config_project = keystone
+
+[filter:http_proxy_to_wsgi]
+use = egg:oslo.middleware#http_proxy_to_wsgi
+
+[filter:healthcheck]
+use = egg:oslo.middleware#healthcheck
+
+[filter:ec2_extension]
+use = egg:keystone#ec2_extension
+
+[filter:ec2_extension_v3]
+use = egg:keystone#ec2_extension_v3
+
+[filter:s3_extension]
+use = egg:keystone#s3_extension
+
+[filter:url_normalize]
+use = egg:keystone#url_normalize
+
+[filter:sizelimit]
+use = egg:oslo.middleware#sizelimit
+
+[filter:osprofiler]
+use = egg:osprofiler#osprofiler
+
+[app:public_service]
+use = egg:keystone#public_service
+
+[app:service_v3]
+use = egg:keystone#service_v3
+
+[app:admin_service]
+use = egg:keystone#admin_service
+
+[pipeline:public_api]
+# The last item in this pipeline must be public_service or an equivalent
+# application. It cannot be a filter.
+pipeline = healthcheck cors sizelimit http_proxy_to_wsgi osprofiler url_normalize request_id build_auth_context token_auth json_body ec2_extension public_service
+
+[pipeline:admin_api]
+# The last item in this pipeline must be admin_service or an equivalent
+# application. It cannot be a filter.
+pipeline = healthcheck cors sizelimit http_proxy_to_wsgi osprofiler url_normalize request_id build_auth_context token_auth json_body ec2_extension s3_extension admin_service
+
+[pipeline:api_v3]
+# The last item in this pipeline must be service_v3 or an equivalent
+# application. It cannot be a filter.
+pipeline = healthcheck cors sizelimit http_proxy_to_wsgi osprofiler url_normalize request_id build_auth_context token_auth json_body ec2_extension_v3 s3_extension service_v3
+
+[app:public_version_service]
+use = egg:keystone#public_version_service
+
+[app:admin_version_service]
+use = egg:keystone#admin_version_service
+
+[pipeline:public_version_api]
+pipeline = healthcheck cors sizelimit osprofiler url_normalize public_version_service
+
+[pipeline:admin_version_api]
+pipeline = healthcheck cors sizelimit osprofiler url_normalize admin_version_service
+
+[composite:main]
+use = egg:Paste#urlmap
+/v2.0 = public_api
+/v3 = api_v3
+/ = public_version_api
+
+[composite:admin]
+use = egg:Paste#urlmap
+/v2.0 = admin_api
+/v3 = api_v3
+/ = admin_version_api