openstack/kolla.git/ansible/roles/keystone/tasks/config.yml, branch master

Remove Ansible from Kolla

2016-11-16T04:34:17+00:00

Change-Id: I5396e4b9927d3e65b6aa4185238a43a4765a996b

Fix placement of policy.json

2016-11-12T15:09:22+00:00

Currently, policy.json is put in "{{ node_config_directory }}/{{ service_name }}" in target nodes. Relocation policy.json to "{{ node_config_directory }}/{{ item }}" with item is corresponding service compoment config directory. Currently, the policy.json is copied to all services, but it should be reviewed and left only in neccesary service (at many cases, only API service needs that). Redundant files will be removed in follow up patchset. Change-Id: I0e997dccf4ec438c9c0436db71ec2fd06650f50d Closes-Bug: #1639686

Custom policy files

2016-10-28T09:47:05+00:00

Allow operators to use their custom policy files. Avoid maintain policy files in kolla repos, only copying the files when an operator add their custom config. Implements: blueprint custom-policies Change-Id: Icf3c961b87cbc7a1f1dd2ffbfffcf271d151d862

Fix keystone fernet file exchange via ssh

2016-10-12T16:29:34+00:00

* install openssh client in keystone-fernet container * install rsync in keystone-ssh container * fix syntax issue in ssh configuration * copy ssh configuration into keystone-fernet container * copy id_rsa.pub into keystone-ssh container * copy id_rsa into keystone-fernet container * use full path to ssh binary in used scripts * add missing newlines at EOF * when using type source set /var/lib/keystone as home directory for the user keystone Co-Authored-By: Jeffrey Zhang Change-Id: Id6b41030056a69f6516a054beb2fc0e08226e876 Closes-bug: #1623013

Use keystone-paste.ini template for keystone

2016-09-26T15:04:44+00:00

The use of the admin_token_auth middleware presents a security risk and was removed from [pipeline:api_v3], [pipeline:admin_api], and [pipeline:public_api]. Change-Id: I3a3ca2e74c0ae341105d3481f97956c6da473046 Closes-bug: #1587747

Add full support for fernet

2016-08-25T10:08:22+00:00

This addresses the ansible aspects of fernet key bootstrapping as well as distributed key rotation. - Bootstrapping is handled in the same way as keystone bootstrap. - A new keystone-fernet and keystone-ssh container is created to allow the nodes to communicate with each other (taken from nova-ssh). - The keystone-fernet is a keystone container with crontab installed. This will handle key rotations through keystone-manage and trigger an rsync to push new tokens to other nodes. - Key rotation is setup to be balanced across the keystone nodes using a round-robbin style. This ensures that any node failures will not stop the keys from rotating. This is configured by a desired token expiration time which then determines the cron scheduling for each node as well as the number of fernet tokens in rotation. - Ability for recovered node to resync with the cluster. When a node starts it will run sanity checks to ensure that its fernet tokens are not stale. If they are it will rsync with other nodes to ensure its tokens are up to date. The Docker component is implemented in: https://review.openstack.org/#/c/349366 Change-Id: I15052c25a1d1149d364236f10ced2e2346119738 Implements: blueprint keystone-fernet-token

Replace keystone's wsgi config with custom config

2016-08-04T07:41:40+00:00

Ansible's template action supports replacing keystone's wsgi default config with custom config, it should only add with_first_found param to config.yml to support this. Change-Id: Id66302802db9a57188067982ea697f16faa1d8eb Closes-Bug: #1609655

Configurable policy.json for keystone

2016-07-19T13:53:44+00:00

Copy custom policy.json into keystone container Change-Id: I58787c3dd7adbeff47d0898c23db95f5919510d3 Closes-Bug: #1604431

Support Keystone Domain specific files

2016-07-14T07:53:41+00:00

Currently, it is not possible to make use of Keystone Domain specific settings. Such as different domains using different LDAP servers or SQL. To enable for example domain ACME - domain settings would be put into: {{ node_custom_config }}keystone/domains/keystone.ACME.conf Change-Id: I23620978c618dd4a3598d7cb74c3e9cf8c2394ac Closes-Bug: #1599868 Signed-off-by: Dave Walker (Daviey)

Make configurable the location where config files are merged

2016-05-23T07:23:06+00:00

An operator may want to specify the location of custom config files so that kolla can detect their location and merge them with the default configs generated. Partially implements: blueprint multi-project-config Change-Id: Ibfb38d07a36dfa7fe25381adc34cc1d3cbe7d1e1