Skip to content

Commit a266ab9

Browse files
iurygregoryiurygregory
committed
Change swift authtoken
Update authtoken class with parameters from documentation [1] We cant use the resource because swift does not use keystone_authtoken section. deprecations: - admin_password, use password instead. - admin_user, use username instead. - admin_tenant_name, use project_name instead. - identity_uri, use auth_url instead. - admin_token, no usage. removals: - Old parameters (already deprecated) [1] http://docs.openstack.org/mitaka/config-reference/object-storage/proxy-server.html Change-Id: I1eb4b0712214c059c713001ad991cbe92cd01711
1 parent e2ad11e commit a266ab9

File tree

6 files changed

+155
-160
lines changed

6 files changed

+155
-160
lines changed

‎manifests/proxy/authtoken.pp

Lines changed: 105 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -4,64 +4,79 @@
44
#
55
# == Parameters
66
#
7-
# [*admin_token*]
8-
# Keystone admin token that can serve as a shared secret
9-
# for authenticating. If this is choosen if is used instead of a user,tenant,password.
10-
# Optional. Defaults to false.
11-
#
12-
# [*admin_user*]
13-
# User used to authenticate service.
14-
# Optional. Defaults to 'swift'.
15-
#
16-
# [*admin_tenant_name*]
17-
# Tenant used to authenticate service.
18-
# Optional. Defaults to 'services'.
19-
#
20-
# [*admin_password*]
21-
# Password used with user to authenticate service.
22-
# Optional. Defaults to 'password'.
23-
#
24-
# [*delay_auth_decision*]
25-
# Set to 1 to support token-less access (anonymous access, tempurl, ...)
26-
# Optional, Defaults to 0
27-
#
28-
# [*auth_host*]
29-
# Host providing the keystone service API endpoint. Optional.
30-
# Defaults to 127.0.0.1
31-
#
32-
# [*auth_port*]
33-
# Port where keystone service is listening. Optional.
34-
# Defaults to 3557.
35-
#
36-
# [*auth_protocol*]
37-
# Protocol to use to communicate with keystone. Optional.
38-
# Defaults to https.
39-
#
40-
# [*auth_admin_prefix*]
41-
# Path part of the auth url. Optional.
42-
# This allows admin auth URIs like http://host/keystone/admin/v2.0.
43-
# Defaults to false for empty. It defined, should be a string with a leading '/' and no trailing '/'.
44-
#
45-
# [*auth_uri*]
46-
# The public auth url to redirect unauthenticated requests.
47-
# Defaults to false to be expanded to '${auth_protocol}://${auth_host}:5000'.
48-
# Should be set to your public keystone endpoint (without version).
49-
#
50-
# [*identity_uri*]
51-
# identity_uri points to the Keystone Admin service. This information is
52-
# used by the middleware to actually query Keystone about the validity of the
53-
# authentication tokens. It is not necessary to append any Keystone API version
54-
# number to this URI.
55-
# Defaults to false.
56-
#
57-
# [*signing_dir*]
7+
# [*delay_auth_decision*]
8+
# (Optional) Do not handle authorization requests within the middleware, but
9+
# delegate the authorization decision to downstream WSGI components. Boolean value
10+
# Defaults to 1
11+
#
12+
# [*signing_dir*]
5813
# The cache directory for signing certificates.
5914
# Defaults to '/var/cache/swift'
6015
#
61-
# [*cache*]
16+
# [*cache*]
6217
# The cache backend to use
6318
# Optional. Defaults to 'swift.cache'
6419
#
20+
# [*auth_uri*]
21+
# (Optional) Complete public Identity API endpoint.
22+
# Defaults to 'http://127.0.0.1:5000'
23+
#
24+
# [*auth_url*]
25+
# (Optional) The URL to use for authentication.
26+
# Defaults to 'http://127.0.0.1:35357'
27+
#
28+
# [*auth_plugin*]
29+
# (Optional) The plugin for authentication
30+
# Defaults to 'password'
31+
#
32+
# [*username*]
33+
# (Optional) The name of the service user
34+
# Defaults to 'swift'
35+
#
36+
# [*password*]
37+
# (Optional) The password for the user
38+
# Defaults to 'password'
39+
#
40+
# [*project_name*]
41+
# (Optional) Service project name
42+
# Defaults to 'services'
43+
#
44+
# [*project_domain_id*]
45+
# (Optional) id of domain for $project_name
46+
# Defaults to 'default'
47+
#
48+
# [*user_domain_id*]
49+
# (Optional) id of domain for $username
50+
# Defaults to 'default'
51+
#
52+
# [*include_service_catalog*]
53+
# (Optional) Indicate whether to set the X-Service-Catalog header. If False,
54+
# middleware will not ask for service catalog on token validation and will
55+
# not set the X-Service-Catalog header. Boolean value.
56+
# Defaults to false
57+
#
58+
# == DEPRECATED
59+
#
60+
# [*admin_token*]
61+
# (optional) Depreated.
62+
# Defaults to undef
63+
#
64+
# [*identity_uri*]
65+
# (optional) Deprecated. Use auth_url instead.
66+
# Defaults to undef
67+
#
68+
# [*admin_user*]
69+
# (optional) Deprecated. Use username instead.
70+
# Defaults to undef
71+
#
72+
# [*admin_tenant_name*]
73+
# (optional) Deprecated. Use project_name instead.
74+
# Defaults to undef
75+
#
76+
# [*admin_password*]
77+
# (optional) Deprecated. Use password instead.
78+
# Defaults to undef
79+
#
6580
# == Authors
6681
#
6782
# Dan Bode dan@puppetlabs.com
@@ -71,47 +86,53 @@
7186
# Copyright 2012 Puppetlabs Inc, unless otherwise noted.
7287
#
7388
class swift::proxy::authtoken(
74-
$admin_user = 'swift',
75-
$admin_tenant_name = 'services',
76-
$admin_password = 'password',
77-
$auth_uri = false,
78-
$identity_uri = false,
79-
$delay_auth_decision = 1,
80-
$admin_token = false,
81-
$signing_dir = '/var/cache/swift',
82-
$cache = 'swift.cache',
89+
$delay_auth_decision = 1,
90+
$signing_dir = '/var/cache/swift',
91+
$cache = 'swift.cache',
92+
$auth_uri = 'http://127.0.0.1:5000',
93+
$auth_url = 'http://127.0.0.1:35357',
94+
$auth_plugin = 'password',
95+
$project_domain_id = 'default',
96+
$user_domain_id = 'default',
97+
$project_name = 'services',
98+
$username = 'swift',
99+
$password = 'password',
100+
$include_service_catalog = false,
83101
# DEPRECATED PARAMETERS
84-
$auth_host = '127.0.0.1',
85-
$auth_port = '35357',
86-
$auth_protocol = 'http',
87-
$auth_admin_prefix = false,
102+
$admin_user = undef,
103+
$admin_tenant_name = undef,
104+
$admin_password = undef,
105+
$identity_uri = undef,
106+
$admin_token = undef,
88107
) {
89108

90109
include ::swift::deps
91110

92-
if $auth_uri {
93-
$auth_uri_real = $auth_uri
94-
} else {
95-
$auth_uri_real = "${auth_protocol}://${auth_host}:5000"
111+
if $admin_token {
112+
warning('admin_token is deprecated, has no usage and will be removed in the O release')
113+
}
114+
115+
if $identity_uri {
116+
warning('identity_uri is deprecated and will be removed, please use auth_url instead')
96117
}
97118

98-
# if both auth_uri and identity_uri are set we skip these deprecated warnings
99-
if !$auth_uri or !$identity_uri {
100-
if $auth_host {
101-
warning('The auth_host parameter is deprecated. Please use auth_uri and identity_uri instead.')
102-
}
103-
if $auth_port {
104-
warning('The auth_port parameter is deprecated. Please use auth_uri and identity_uri instead.')
105-
}
106-
if $auth_protocol {
107-
warning('The auth_protocol parameter is deprecated. Please use auth_uri and identity_uri instead.')
108-
}
109-
if $auth_admin_prefix {
110-
warning('The auth_admin_prefix parameter is deprecated. Please use auth_uri and identity_uri instead.')
111-
validate_re($auth_admin_prefix, '^(/.+[^/])?$')
112-
}
119+
if $admin_user {
120+
warning('admin_user is deprecated and will be removed, please use username instead')
113121
}
114122

123+
if $admin_tenant_name {
124+
warning('admin_tenant_name is deprecated and will be removed, please use project_name instead')
125+
}
126+
127+
if $admin_password {
128+
warning('admin_password is deprecated and will be removed, please use password isntead')
129+
}
130+
131+
$auth_url_real = pick($identity_uri, $auth_url)
132+
$username_real = pick($admin_user, $username)
133+
$project_name_real = pick($admin_tenant_name, $project_name)
134+
$password_real = pick($admin_password, $password)
135+
115136
file { $signing_dir:
116137
ensure => directory,
117138
mode => '0700',

‎releasenotes/notes/authtoken-b49c75db4b7429cb.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
features:
3+
- add new parameters to configure authtoken for swift, like
4+
username, password, project_name, auth_url, auth_plugin,
5+
project_domain_id, user_domain_id, include_service_catalog
6+
deprecations:
7+
- admin_token
8+
- admin_tenant_name in favor of project_name
9+
- admin_password in favor of password
10+
- admin_user in favor of username
11+
- identity_uri in favor of auth_url
12+
fixes:
13+
- remove auth_host, auth_port, auth_protocol, auth_admin_prefix

‎spec/acceptance/basic_swift_spec.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ class { '::swift::proxy':
5757
account_autocreate => true,
5858
}
5959
class { '::swift::proxy::authtoken':
60-
admin_password => 'a_big_secret',
60+
password => 'a_big_secret',
6161
}
6262
class { '::swift::keystone::dispersion': } -> class { '::swift::dispersion': }
6363
class {'::swift::objectexpirer':

‎spec/classes/swift_proxy_authtoken_spec.rb

Lines changed: 23 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -32,39 +32,27 @@
3232
signing_dir = /var/cache/swift
3333
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
3434
35-
auth_host = 127.0.0.1
36-
auth_port = 35357
37-
auth_protocol = http
3835
auth_uri = http://127.0.0.1:5000
39-
admin_tenant_name = services
40-
admin_user = swift
41-
admin_password = password
36+
auth_url = http://127.0.0.1:35357
37+
auth_plugin = password
38+
project_domain_id = default
39+
user_domain_id = default
40+
project_name = services
41+
username = swift
42+
password = password
43+
4244
delay_auth_decision = 1
45+
4346
cache = swift.cache
44-
include_service_catalog = False
47+
include_service_catalog = false
4548
')
4649
end
4750
end
4851

49-
describe "when overriding admin_token" do
50-
let :params do
51-
{
52-
:admin_token => 'ADMINTOKEN'
53-
}
54-
end
55-
56-
it 'should build the fragment with correct parameters' do
57-
is_expected.to contain_concat_fragment('swift_authtoken').with_content(/admin_token = ADMINTOKEN/)
58-
end
59-
end
6052

6153
describe "when overriding parameters" do
6254
let :params do
6355
{
64-
:auth_host => 'some.host',
65-
:auth_port => '443',
66-
:auth_protocol => 'https',
67-
:auth_admin_prefix => '/keystone/admin',
6856
:admin_tenant_name => 'admin',
6957
:admin_user => 'swiftuser',
7058
:admin_password => 'swiftpassword',
@@ -81,17 +69,19 @@
8169
signing_dir = /home/swift/keystone-signing
8270
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
8371
84-
auth_host = some.host
85-
auth_port = 443
86-
auth_protocol = https
87-
auth_admin_prefix = /keystone/admin
88-
auth_uri = https://some.host:5000
89-
admin_tenant_name = admin
90-
admin_user = swiftuser
91-
admin_password = swiftpassword
72+
auth_uri = http://127.0.0.1:5000
73+
auth_url = http://127.0.0.1:35357
74+
auth_plugin = password
75+
project_domain_id = default
76+
user_domain_id = default
77+
project_name = admin
78+
username = swiftuser
79+
password = swiftpassword
80+
9281
delay_auth_decision = 0
82+
9383
cache = foo
94-
include_service_catalog = False
84+
include_service_catalog = false
9585
')
9686
end
9787
end
@@ -104,24 +94,6 @@
10494
it { is_expected.to contain_concat_fragment('swift_authtoken').with_content(/auth_uri = http:\/\/public\.host\/keystone\/main/)}
10595
end
10696

107-
[
108-
'keystone',
109-
'keystone/',
110-
'/keystone/',
111-
'/keystone/admin/',
112-
'keystone/admin/',
113-
'keystone/admin'
114-
].each do |auth_admin_prefix|
115-
describe "when overriding auth_admin_prefix with incorrect value #{auth_admin_prefix}" do
116-
let :params do
117-
{ :auth_admin_prefix => auth_admin_prefix }
118-
end
119-
120-
it { expect { is_expected.to contain_concat_fragment('swift_authtoken').with_content(/auth_admin_prefix = #{auth_admin_prefix}/) }.to \
121-
raise_error(Puppet::Error, /validate_re\(\): "#{auth_admin_prefix}" does not match/) }
122-
end
123-
end
124-
12597
describe "when identity_uri is set" do
12698
let :params do
12799
{
@@ -130,7 +102,7 @@
130102
end
131103

132104
it 'should build the fragment with correct parameters' do
133-
is_expected.to contain_concat_fragment('swift_authtoken').with_content(/identity_uri = https:\/\/foo\.bar:35357\//)
105+
is_expected.to contain_concat_fragment('swift_authtoken').with_content(/auth_url = https:\/\/foo\.bar:35357\//)
134106
end
135107
end
136108

@@ -144,7 +116,7 @@
144116

145117
it 'should build the fragment with correct parameters' do
146118
is_expected.to contain_concat_fragment('swift_authtoken').with_content(/auth_uri = https:\/\/foo\.bar:5000\/v2\.0\//)
147-
is_expected.to contain_concat_fragment('swift_authtoken').with_content(/identity_uri = https:\/\/foo\.bar:35357\//)
119+
is_expected.to contain_concat_fragment('swift_authtoken').with_content(/auth_url = https:\/\/foo\.bar:35357\//)
148120
end
149121
end
150122

‎templates/proxy/authtoken.conf.erb

Lines changed: 11 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -4,25 +4,16 @@ log_name = swift
44
signing_dir = <%= @signing_dir %>
55
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
66

7-
<% if not @identity_uri or not @auth_uri then -%>
8-
auth_host = <%= @auth_host %>
9-
auth_port = <%= @auth_port %>
10-
auth_protocol = <%= @auth_protocol %>
11-
<% if @auth_admin_prefix -%>
12-
auth_admin_prefix = <%= @auth_admin_prefix %>
13-
<% end -%>
14-
<% end -%>
15-
auth_uri = <%= @auth_uri_real %>
16-
<% if @identity_uri -%>
17-
identity_uri = <%= @identity_uri %>
18-
<% end -%>
19-
<% if @admin_token -%>
20-
admin_token = <%= @admin_token %>
21-
<% else -%>
22-
admin_tenant_name = <%= @admin_tenant_name %>
23-
admin_user = <%= @admin_user %>
24-
admin_password = <%= @admin_password %>
25-
<% end -%>
7+
auth_uri = <%= @auth_uri %>
8+
auth_url = <%= @auth_url_real %>
9+
auth_plugin = <%= @auth_plugin %>
10+
project_domain_id = <%= @project_domain_id %>
11+
user_domain_id = <%= @user_domain_id %>
12+
project_name = <%= @project_name_real %>
13+
username = <%= @username_real %>
14+
password = <%= @password_real %>
15+
2616
delay_auth_decision = <%= @delay_auth_decision %>
17+
2718
cache = <%= @cache %>
28-
include_service_catalog = False
19+
include_service_catalog = <%= @include_service_catalog %>

0 commit comments

Comments
 (0)