diff options
Diffstat (limited to 'ansible/roles/keystone')
29 files changed, 0 insertions, 864 deletions
diff --git a/ansible/roles/keystone/defaults/main.yml b/ansible/roles/keystone/defaults/main.yml deleted file mode 100644 index 0fda77a9a..000000000 --- a/ansible/roles/keystone/defaults/main.yml +++ /dev/null @@ -1,40 +0,0 @@ ---- -project_name: "keystone" - -#################### -# Database -#################### -keystone_database_name: "keystone" -keystone_database_user: "keystone" -keystone_database_address: "{{ kolla_internal_fqdn }}:{{ database_port }}" - - -#################### -# Fernet -#################### -keystone_username: "keystone" -keystone_groupname: "keystone" - - -#################### -# Docker -#################### -keystone_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ kolla_base_distro }}-{{ kolla_install_type }}-keystone" -keystone_tag: "{{ openstack_release }}" -keystone_image_full: "{{ keystone_image }}:{{ keystone_tag }}" - -keystone_fernet_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ kolla_base_distro }}-{{ kolla_install_type }}-keystone-fernet" -keystone_fernet_tag: "{{ openstack_release }}" -keystone_fernet_image_full: "{{ keystone_fernet_image }}:{{ keystone_fernet_tag }}" - -keystone_ssh_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ kolla_base_distro }}-{{ kolla_install_type }}-keystone-ssh" -keystone_ssh_tag: "{{ openstack_release }}" -keystone_ssh_image_full: "{{ keystone_ssh_image }}:{{ keystone_ssh_tag }}" - - -#################### -# OpenStack -#################### -keystone_logging_debug: "{{ openstack_logging_debug }}" - -openstack_keystone_auth: "{'auth_url':'{{ openstack_auth.auth_url }}','username':'{{ openstack_auth.username }}','password':'{{ openstack_auth.password }}','project_name':'{{ openstack_auth.project_name }}','domain_name':'default'}" diff --git a/ansible/roles/keystone/files/fernet_rotate_cron_generator.py b/ansible/roles/keystone/files/fernet_rotate_cron_generator.py deleted file mode 100644 index da468a851..000000000 --- a/ansible/roles/keystone/files/fernet_rotate_cron_generator.py +++ /dev/null @@ -1,107 +0,0 @@ -#!/usr/bin/python - -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# This module creates a list of cron intervals for a node in a group of nodes -# to ensure each node runs a cron in round robbin style. - -from __future__ import print_function -import argparse -import json -import sys - -MINUTE_SPAN = 1 -HOUR_SPAN = 60 -DAY_SPAN = 24 * HOUR_SPAN -WEEK_SPAN = 7 * DAY_SPAN - - -def json_exit(msg=None, failed=False, changed=False): - if type(msg) is not dict: - msg = {'msg': str(msg)} - msg.update({'failed': failed, 'changed': changed}) - print(json.dumps(msg)) - sys.exit() - - -def generate(host_index, total_hosts, total_rotation_mins): - min = '*' - hour = '*' - day = '*' - crons = [] - - if host_index >= total_hosts: - return crons - - rotation_frequency = total_rotation_mins // total_hosts - cron_min = rotation_frequency * host_index - - # Build crons for a week period - if total_rotation_mins == WEEK_SPAN: - day = cron_min // DAY_SPAN - hour = (cron_min % DAY_SPAN) // HOUR_SPAN - min = cron_min % HOUR_SPAN - crons.append({'min': min, 'hour': hour, 'day': day}) - - # Build crons for a day period - elif total_rotation_mins == DAY_SPAN: - hour = cron_min // HOUR_SPAN - min = cron_min % HOUR_SPAN - crons.append({'min': min, 'hour': hour, 'day': day}) - - # Build crons for multiple of an hour - elif total_rotation_mins % HOUR_SPAN == 0: - for multiple in range(1, DAY_SPAN // total_rotation_mins + 1): - time = cron_min - if multiple > 1: - time += total_rotation_mins * (multiple - 1) - - hour = time // HOUR_SPAN - min = time % HOUR_SPAN - crons.append({'min': min, 'hour': hour, 'day': day}) - - # Build crons for multiple of a minute - elif total_rotation_mins % MINUTE_SPAN == 0: - for multiple in range(1, HOUR_SPAN // total_rotation_mins + 1): - time = cron_min - if multiple > 1: - time += total_rotation_mins * (multiple - 1) - - min = time // MINUTE_SPAN - crons.append({'min': min, 'hour': hour, 'day': day}) - - return crons - - -def main(): - parser = argparse.ArgumentParser(description='''Creates a list of cron - intervals for a node in a group of nodes to ensure each node runs - a cron in round robbin style.''') - parser.add_argument('-t', '--time', - help='Time in seconds for a token rotation cycle', - required=True, - type=int) - parser.add_argument('-i', '--index', - help='Index of host starting from 0', - required=True, - type=int) - parser.add_argument('-n', '--number', - help='Number of tokens that should exist', - required=True, - type=int) - args = parser.parse_args() - json_exit({'cron_jobs': generate(args.index, args.number, args.time)}) - - -if __name__ == "__main__": - main() diff --git a/ansible/roles/keystone/meta/main.yml b/ansible/roles/keystone/meta/main.yml deleted file mode 100644 index 6b4fff8fe..000000000 --- a/ansible/roles/keystone/meta/main.yml +++ /dev/null @@ -1,3 +0,0 @@ ---- -dependencies: - - { role: common } diff --git a/ansible/roles/keystone/tasks/bootstrap.yml b/ansible/roles/keystone/tasks/bootstrap.yml deleted file mode 100644 index 301933e47..000000000 --- a/ansible/roles/keystone/tasks/bootstrap.yml +++ /dev/null @@ -1,41 +0,0 @@ ---- -- name: Creating Keystone database - command: docker exec -t kolla_toolbox /usr/bin/ansible localhost - -m mysql_db - -a "login_host='{{ database_address }}' - login_port='{{ database_port }}' - login_user='{{ database_user }}' - login_password='{{ database_password }}' - name='{{ keystone_database_name }}'" - register: database - changed_when: "{{ database.stdout.find('localhost | SUCCESS => ') != -1 and - (database.stdout.split('localhost | SUCCESS => ')[1]|from_json).changed }}" - failed_when: database.stdout.split()[2] != 'SUCCESS' - run_once: True - delegate_to: "{{ groups['keystone'][0] }}" - -- name: Reading json from variable - set_fact: - database_created: "{{ (database.stdout.split('localhost | SUCCESS => ')[1]|from_json).changed }}" - -- name: Creating Keystone database user and setting permissions - command: docker exec -t kolla_toolbox /usr/bin/ansible localhost - -m mysql_user - -a "login_host='{{ database_address }}' - login_port='{{ database_port }}' - login_user='{{ database_user }}' - login_password='{{ database_password }}' - name='{{ keystone_database_name }}' - password='{{ keystone_database_password }}' - host='%' - priv='{{ keystone_database_name }}.*:ALL' - append_privs='yes'" - register: database_user_create - changed_when: "{{ database_user_create.stdout.find('localhost | SUCCESS => ') != -1 and - (database_user_create.stdout.split('localhost | SUCCESS => ')[1]|from_json).changed }}" - failed_when: database_user_create.stdout.split()[2] != 'SUCCESS' - run_once: True - delegate_to: "{{ groups['keystone'][0] }}" - -- include: bootstrap_service.yml - when: database_created diff --git a/ansible/roles/keystone/tasks/bootstrap_service.yml b/ansible/roles/keystone/tasks/bootstrap_service.yml deleted file mode 100644 index cce78e7ce..000000000 --- a/ansible/roles/keystone/tasks/bootstrap_service.yml +++ /dev/null @@ -1,20 +0,0 @@ ---- -- name: Running Keystone bootstrap container - kolla_docker: - action: "start_container" - common_options: "{{ docker_common_options }}" - detach: False - environment: - KOLLA_BOOTSTRAP: - KOLLA_CONFIG_STRATEGY: "{{ config_strategy }}" - image: "{{ keystone_image_full }}" - labels: - BOOTSTRAP: - name: "bootstrap_keystone" - restart_policy: "never" - volumes: - - "{{ node_config_directory }}/keystone/:{{ container_config_directory }}/:ro" - - "/etc/localtime:/etc/localtime:ro" - - "kolla_logs:/var/log/kolla/" - run_once: True - delegate_to: "{{ groups['keystone'][0] }}" diff --git a/ansible/roles/keystone/tasks/check.yml b/ansible/roles/keystone/tasks/check.yml deleted file mode 100644 index 56d000aeb..000000000 --- a/ansible/roles/keystone/tasks/check.yml +++ /dev/null @@ -1,19 +0,0 @@ ---- -- name: Keystone sanity checks - command: docker exec -t kolla_toolbox /usr/bin/ansible localhost - -m kolla_sanity - -a "service=keystone - project=service - user=admin - password={{ keystone_admin_password }} - role=admin - region_name={{ openstack_region_name }} - auth={{ '{{ openstack_keystone_auth }}' }}" - -e "{'openstack_keystone_auth':{{ openstack_keystone_auth }}}" - register: keystone_sanity - changed_when: "{{ keystone_sanity.stdout.find('localhost | SUCCESS => ') != -1 and (keystone_sanity.stdout.split('localhost | SUCCESS => ')[1]|from_json).changed }}" - until: keystone_sanity.stdout.split()[2] == 'SUCCESS' - retries: 10 - delay: 5 - run_once: True - when: kolla_enable_sanity_keystone | bool diff --git a/ansible/roles/keystone/tasks/config.yml b/ansible/roles/keystone/tasks/config.yml deleted file mode 100644 index 695154571..000000000 --- a/ansible/roles/keystone/tasks/config.yml +++ /dev/null @@ -1,118 +0,0 @@ ---- -- name: Check if policies shall be overwritten - local_action: stat path="{{ node_custom_config }}/keystone/policy.json" - register: keystone_policy - -- name: Check if Keystone Domain specific settings enabled - local_action: stat path="{{ node_custom_config }}/keystone/domains" - register: keystone_domain_cfg - -- name: Ensuring config directories exist - file: - path: "{{ node_config_directory }}/{{ item }}" - state: "directory" - recurse: yes - with_items: - - "keystone" - - "keystone-fernet" - - "keystone-ssh" - -- name: Creating Keystone Domain directory - file: - dest: "{{ node_config_directory }}/{{ item }}/domains/" - state: "directory" - when: - keystone_domain_cfg.stat.exists - with_items: - - "keystone" - -- name: Copying over config.json files for services - template: - src: "{{ item }}.json.j2" - dest: "{{ node_config_directory }}/{{ item }}/config.json" - with_items: - - "keystone" - - "keystone-fernet" - - "keystone-ssh" - -- name: Copying over keystone.conf - merge_configs: - vars: - service_name: "{{ item }}" - sources: - - "{{ role_path }}/templates/keystone.conf.j2" - - "{{ node_custom_config }}/global.conf" - - "{{ node_custom_config }}/database.conf" - - "{{ node_custom_config }}/messaging.conf" - - "{{ node_custom_config }}/keystone.conf" - - "{{ node_custom_config }}/keystone/{{ inventory_hostname }}/keystone.conf" - dest: "{{ node_config_directory }}/{{ item }}/keystone.conf" - with_items: - - "keystone" - - "keystone-fernet" - - "keystone-ssh" - -- name: Copying Keystone Domain specific settings - copy: - src: "{{ item }}" - dest: "{{ node_config_directory }}/keystone/domains/" - with_fileglob: - - "{{ node_custom_config }}/keystone/domains/*" - -- name: Copying over existing policy.json - template: - src: "{{ node_custom_config }}/keystone/policy.json" - dest: "{{ node_config_directory }}/{{ item }}/policy.json" - with_items: - - "keystone" - - "keystone-fernet" - when: - keystone_policy.stat.exists - -- name: Copying over wsgi-keystone.conf - template: - src: "{{ item }}" - dest: "{{ node_config_directory }}/keystone/wsgi-keystone.conf" - with_first_found: - - "{{ node_custom_config }}/keystone/{{ inventory_hostname }}/wsgi-keystone.conf" - - "{{ node_custom_config }}/keystone/wsgi-keystone.conf" - - "wsgi-keystone.conf.j2" - -- name: Copying over keystone-paste.ini - merge_configs: - sources: - - "{{ role_path }}/templates/keystone-paste.ini.j2" - - "{{ node_custom_config }}/keystone/keystone-paste.ini" - - "{{ node_custom_config }}/keystone/{{ inventory_hostname }}/keystone-paste.ini" - dest: "{{ node_config_directory }}/keystone/keystone-paste.ini" - -- name: Generate the required cron jobs for the node - local_action: "command python {{ role_path }}/files/fernet_rotate_cron_generator.py -t {{ (fernet_token_expiry | int) // 60 }} -i {{ groups['keystone'].index(inventory_hostname) }} -n {{ (groups['keystone'] | length) }}" - register: cron_jobs_json - when: keystone_token_provider == 'fernet' - -- name: Save the returned from cron jobs for building the crontab - set_fact: - cron_jobs: "{{ (cron_jobs_json.stdout | from_json).cron_jobs }}" - when: keystone_token_provider == 'fernet' - -- name: Copying files for keystone-fernet - template: - src: "{{ item.src }}" - dest: "{{ node_config_directory }}/keystone-fernet/{{ item.dest }}" - with_items: - - { src: "crontab.j2", dest: "crontab" } - - { src: "fernet-rotate.sh.j2", dest: "fernet-rotate.sh" } - - { src: "fernet-node-sync.sh.j2", dest: "fernet-node-sync.sh" } - - { src: "id_rsa", dest: "id_rsa" } - - { src: "ssh_config.j2", dest: "ssh_config" } - when: keystone_token_provider == 'fernet' - -- name: Copying files for keystone-ssh - template: - src: "{{ item.src }}" - dest: "{{ node_config_directory }}/keystone-ssh/{{ item.dest }}" - with_items: - - { src: "sshd_config.j2", dest: "sshd_config" } - - { src: "id_rsa.pub", dest: "id_rsa.pub" } - when: keystone_token_provider == 'fernet' diff --git a/ansible/roles/keystone/tasks/deploy.yml b/ansible/roles/keystone/tasks/deploy.yml deleted file mode 100644 index 9ccf17b9a..000000000 --- a/ansible/roles/keystone/tasks/deploy.yml +++ /dev/null @@ -1,19 +0,0 @@ ---- -- include: config.yml - when: inventory_hostname in groups['keystone'] - -- include: bootstrap.yml - when: inventory_hostname in groups['keystone'] - -- include: start.yml - when: inventory_hostname in groups['keystone'] - -- include: init_fernet.yml - when: - - inventory_hostname in groups['keystone'] - - keystone_token_provider == 'fernet' - -- include: register.yml - when: inventory_hostname in groups['keystone'] - -- include: check.yml diff --git a/ansible/roles/keystone/tasks/init_fernet.yml b/ansible/roles/keystone/tasks/init_fernet.yml deleted file mode 100644 index c608202ab..000000000 --- a/ansible/roles/keystone/tasks/init_fernet.yml +++ /dev/null @@ -1,15 +0,0 @@ ---- -- name: Initialise fernet key authentication - command: "docker exec -t keystone_fernet kolla_keystone_bootstrap {{ keystone_username }} {{ keystone_groupname }}" - register: fernet_create - changed_when: "{{ fernet_create.stdout.find('localhost | SUCCESS => ') != -1 and (fernet_create.stdout.split('localhost | SUCCESS => ')[1]|from_json).changed }}" - until: "(fernet_create.stdout.split()[2] == 'SUCCESS') or (fernet_create.stdout.find('Key repository is already initialized') != -1)" - retries: 10 - delay: 5 - run_once: True - delegate_to: "{{ groups['keystone'][0] }}" - -- name: Run key distribution - command: docker exec -t keystone_fernet /usr/bin/fernet-rotate.sh - run_once: True - delegate_to: "{{ groups['keystone'][0] }}" diff --git a/ansible/roles/keystone/tasks/main.yml b/ansible/roles/keystone/tasks/main.yml deleted file mode 100644 index b017e8b4a..000000000 --- a/ansible/roles/keystone/tasks/main.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -- include: "{{ action }}.yml" diff --git a/ansible/roles/keystone/tasks/precheck.yml b/ansible/roles/keystone/tasks/precheck.yml deleted file mode 100644 index ed97d539c..000000000 --- a/ansible/roles/keystone/tasks/precheck.yml +++ /dev/null @@ -1 +0,0 @@ ---- diff --git a/ansible/roles/keystone/tasks/pull.yml b/ansible/roles/keystone/tasks/pull.yml deleted file mode 100644 index c9152b148..000000000 --- a/ansible/roles/keystone/tasks/pull.yml +++ /dev/null @@ -1,25 +0,0 @@ ---- -- name: Pulling keystone image - kolla_docker: - action: "pull_image" - common_options: "{{ docker_common_options }}" - image: "{{ keystone_image_full }}" - when: inventory_hostname in groups['keystone'] - -- name: Pulling keystone_fernet image - kolla_docker: - action: "pull_image" - common_options: "{{ docker_common_options }}" - image: "{{ keystone_fernet_image_full }}" - when: - - inventory_hostname in groups['keystone'] - - keystone_token_provider == 'fernet' - -- name: Pulling keystone_ssh image - kolla_docker: - action: "pull_image" - common_options: "{{ docker_common_options }}" - image: "{{ keystone_ssh_image_full }}" - when: - - inventory_hostname in groups['keystone'] - - keystone_token_provider == 'fernet' diff --git a/ansible/roles/keystone/tasks/reconfigure.yml b/ansible/roles/keystone/tasks/reconfigure.yml deleted file mode 100644 index 6ef22ad9f..000000000 --- a/ansible/roles/keystone/tasks/reconfigure.yml +++ /dev/null @@ -1,79 +0,0 @@ ---- -- name: Set variable for keystone components used in reconfigure - set_fact: - keystone_items: - - { name: keystone, group: keystone } - -- name: Create fernet related components for variable if fernet is enabled - set_fact: - keystone_fernet_items: - - { name: keystone_fernet, group: keystone } - - { name: keystone_ssh, group: keystone } - when: keystone_token_provider == 'fernet' - -- name: Merge fernet related components to variable if fernet is enabled - set_fact: - keystone_items: "{{ keystone_items + keystone_fernet_items }}" - when: keystone_token_provider == 'fernet' - -- name: Ensuring the containers up - kolla_docker: - name: "{{ item.name }}" - action: "get_container_state" - register: container_state - failed_when: container_state.Running == false - when: inventory_hostname in groups[item.group] - with_items: "{{ keystone_items }}" - -- include: config.yml - -- name: Check the configs - command: docker exec {{ item.name }} /usr/local/bin/kolla_set_configs --check - changed_when: false - failed_when: false - register: check_results - when: inventory_hostname in groups[item.group] - with_items: "{{ keystone_items }}" - -# NOTE(jeffrey4l): when config_strategy == 'COPY_ALWAYS' -# and container env['KOLLA_CONFIG_STRATEGY'] == 'COPY_ONCE', -# just remove the container and start again -- name: Containers config strategy - kolla_docker: - name: "{{ item.name }}" - action: "get_container_env" - register: container_envs - when: inventory_hostname in groups[item.group] - with_items: "{{ keystone_items }}" - - -- name: Remove the containers - kolla_docker: - name: "{{ item[0]['name'] }}" - action: "remove_container" - register: remove_containers - when: - - config_strategy == "COPY_ONCE" or item[1]['KOLLA_CONFIG_STRATEGY'] == 'COPY_ONCE' - - item[2]['rc'] == 1 - - inventory_hostname in groups[item[0]['group']] - with_together: - - "{{ keystone_items }}" - - "{{ container_envs.results }}" - - "{{ check_results.results }}" - -- include: start.yml - when: remove_containers.changed - -- name: Restart containers - kolla_docker: - name: "{{ item[0]['name'] }}" - action: "restart_container" - when: - - config_strategy == 'COPY_ALWAYS' - - item[1]['KOLLA_CONFIG_STRATEGY'] != 'COPY_ONCE' - - item[2]['rc'] == 1 - - inventory_hostname in groups[item[0]['group']] - with_together: - - "{{ keystone_items }}" - - "{{ container_envs.results }}" - - "{{ check_results.results }}" diff --git a/ansible/roles/keystone/tasks/register.yml b/ansible/roles/keystone/tasks/register.yml deleted file mode 100644 index 08875907d..000000000 --- a/ansible/roles/keystone/tasks/register.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Creating admin project, user, role, service, and endpoint - command: docker exec keystone kolla_keystone_bootstrap {{ openstack_auth.username }} {{ openstack_auth.password }} {{ openstack_auth.project_name }} admin {{ keystone_admin_url }} {{ keystone_internal_url }} {{ keystone_public_url }} {{ openstack_region_name }} - register: keystone_bootstrap - changed_when: "{{ (keystone_bootstrap.stdout | from_json).changed }}" - failed_when: "{{ (keystone_bootstrap.stdout | from_json).failed }}" - run_once: True diff --git a/ansible/roles/keystone/tasks/start.yml b/ansible/roles/keystone/tasks/start.yml deleted file mode 100644 index 382a0d1e6..000000000 --- a/ansible/roles/keystone/tasks/start.yml +++ /dev/null @@ -1,49 +0,0 @@ ---- -- name: Set variable for initial keystone volumes - set_fact: - keystone_volumes: - - "{{ node_config_directory }}/keystone/:{{ container_config_directory }}/:ro" - - "/etc/localtime:/etc/localtime:ro" - - "kolla_logs:/var/log/kolla/" - -- name: Add fernet volume to keystone volumes variable if fernet enabled - set_fact: - keystone_volumes: "{{ keystone_volumes + [\"keystone_fernet_tokens:/etc/keystone/fernet-keys\"] }}" - when: keystone_token_provider == 'fernet' - -- name: Starting keystone container - kolla_docker: - action: "start_container" - common_options: "{{ docker_common_options }}" - image: "{{ keystone_image_full }}" - name: "keystone" - volumes: "{{ keystone_volumes }}" - -- name: Wait for keystone startup - wait_for: host={{ kolla_internal_fqdn }} port={{ keystone_admin_port }} - -- name: Starting keystone-ssh container - kolla_docker: - action: "start_container" - common_options: "{{ docker_common_options }}" - image: "{{ keystone_ssh_image_full }}" - name: "keystone_ssh" - volumes: - - "{{ node_config_directory }}/keystone-ssh/:{{ container_config_directory }}/:ro" - - "/etc/localtime:/etc/localtime:ro" - - "kolla_logs:/var/log/kolla/" - - "keystone_fernet_tokens:/etc/keystone/fernet-keys" - when: keystone_token_provider == 'fernet' - -- name: Starting keystone-fernet container - kolla_docker: - action: "start_container" - common_options: "{{ docker_common_options }}" - image: "{{ keystone_fernet_image_full }}" - name: "keystone_fernet" - volumes: - - "{{ node_config_directory }}/keystone-fernet/:{{ container_config_directory }}/:ro" - - "/etc/localtime:/etc/localtime:ro" - - "kolla_logs:/var/log/kolla/" - - "keystone_fernet_tokens:/etc/keystone/fernet-keys" - when: keystone_token_provider == 'fernet' diff --git a/ansible/roles/keystone/tasks/upgrade.yml b/ansible/roles/keystone/tasks/upgrade.yml deleted file mode 100644 index 308053080..000000000 --- a/ansible/roles/keystone/tasks/upgrade.yml +++ /dev/null @@ -1,6 +0,0 @@ ---- -- include: config.yml - -- include: bootstrap_service.yml - -- include: start.yml diff --git a/ansible/roles/keystone/templates/crontab.j2 b/ansible/roles/keystone/templates/crontab.j2 deleted file mode 100644 index af16e114f..000000000 --- a/ansible/roles/keystone/templates/crontab.j2 +++ /dev/null @@ -1,3 +0,0 @@ -{% for cron_job in cron_jobs %} -{{ cron_job['min'] }} {{ cron_job['hour'] }} * * {{ cron_job['day'] }} /usr/bin/fernet-rotate.sh -{% endfor %} diff --git a/ansible/roles/keystone/templates/fernet-node-sync.sh.j2 b/ansible/roles/keystone/templates/fernet-node-sync.sh.j2 deleted file mode 100644 index a100f2377..000000000 --- a/ansible/roles/keystone/templates/fernet-node-sync.sh.j2 +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/bash - -# Get data on the fernet tokens -TOKEN_CHECK=$(/usr/bin/fetch_fernet_tokens.py -t {{ fernet_token_expiry }} -n {{ (groups['keystone'] | length) + 1 }}) - -# Ensure the primary token exists and is not stale -if $(echo "$TOKEN_CHECK" | grep -q '"update_required":"false"'); then - exit 0; -fi - -# For each host node sync tokens -{% for host in groups['keystone'] %} -{% if inventory_hostname != host %} -/usr/bin/rsync -azu --delete -e 'ssh -i /var/lib/keystone/.ssh/id_rsa -p {{ keystone_ssh_port }} -F /var/lib/keystone/.ssh/config' keystone@{{ host }}:/etc/keystone/fernet-keys/ /etc/keystone/fernet-keys -{% endif %} -{% endfor %} diff --git a/ansible/roles/keystone/templates/fernet-rotate.sh.j2 b/ansible/roles/keystone/templates/fernet-rotate.sh.j2 deleted file mode 100644 index 28c5b6f67..000000000 --- a/ansible/roles/keystone/templates/fernet-rotate.sh.j2 +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash - -keystone-manage --config-file /etc/keystone/keystone.conf fernet_rotate --keystone-user {{ keystone_username }} --keystone-group {{ keystone_groupname }} - -{% for host in groups['keystone'] %} -{% if inventory_hostname != host %} -/usr/bin/rsync -az -e 'ssh -i /var/lib/keystone/.ssh/id_rsa -p {{ keystone_ssh_port }} -F /var/lib/keystone/.ssh/config' --delete /etc/keystone/fernet-keys/ keystone@{{ host }}:/etc/keystone/fernet-keys -{% endif %} -{% endfor %} diff --git a/ansible/roles/keystone/templates/id_rsa b/ansible/roles/keystone/templates/id_rsa deleted file mode 100644 index 3e2716616..000000000 --- a/ansible/roles/keystone/templates/id_rsa +++ /dev/null @@ -1 +0,0 @@ -{{ keystone_ssh_key.private_key }} diff --git a/ansible/roles/keystone/templates/id_rsa.pub b/ansible/roles/keystone/templates/id_rsa.pub deleted file mode 100644 index 529f98ab8..000000000 --- a/ansible/roles/keystone/templates/id_rsa.pub +++ /dev/null @@ -1 +0,0 @@ -{{ keystone_ssh_key.public_key }} diff --git a/ansible/roles/keystone/templates/keystone-fernet.json.j2 b/ansible/roles/keystone/templates/keystone-fernet.json.j2 deleted file mode 100644 index 9078977b5..000000000 --- a/ansible/roles/keystone/templates/keystone-fernet.json.j2 +++ /dev/null @@ -1,41 +0,0 @@ -{% set cron_cmd = 'cron -f' if kolla_base_distro in ['ubuntu', 'debian'] else 'crond -s -n' %} -{ - "command": "{{ cron_cmd }}", - "config_files": [{ - "source": "{{ container_config_directory }}/keystone.conf", - "dest": "/etc/keystone/keystone.conf", - "owner": "keystone", - "perm": "0600" - }, - { - "source": "{{ container_config_directory }}/crontab", - "dest": "/var/spool/cron/crontabs/root/fernet-cron", - "owner": "root", - "perm": "0644" - }, - { - "source": "{{ container_config_directory }}/fernet-rotate.sh", - "dest": "/usr/bin/fernet-rotate.sh", - "owner": "root", - "perm": "0755" - }, - { - "source": "{{ container_config_directory }}/fernet-node-sync.sh", - "dest": "/usr/bin/fernet-node-sync.sh", - "owner": "root", - "perm": "0755" - }, - { - "source": "{{ container_config_directory }}/ssh_config", - "dest": "/var/lib/keystone/.ssh/config", - "owner": "keystone", - "perm": "0600" - }, - { - "source": "{{ container_config_directory }}/id_rsa", - "dest": "/var/lib/keystone/.ssh/id_rsa", - "owner": "keystone", - "perm": "0600" - } - ] -} diff --git a/ansible/roles/keystone/templates/keystone-paste.ini.j2 b/ansible/roles/keystone/templates/keystone-paste.ini.j2 deleted file mode 100644 index 0e2ee368e..000000000 --- a/ansible/roles/keystone/templates/keystone-paste.ini.j2 +++ /dev/null @@ -1,83 +0,0 @@ -# Keystone PasteDeploy configuration file. - -[filter:debug] -use = egg:oslo.middleware#debug - -[filter:request_id] -use = egg:oslo.middleware#request_id - -[filter:build_auth_context] -use = egg:keystone#build_auth_context - -[filter:token_auth] -use = egg:keystone#token_auth - -[filter:json_body] -use = egg:keystone#json_body - -[filter:cors] -use = egg:oslo.middleware#cors -oslo_config_project = keystone - -[filter:ec2_extension] -use = egg:keystone#ec2_extension - -[filter:ec2_extension_v3] -use = egg:keystone#ec2_extension_v3 - -[filter:s3_extension] -use = egg:keystone#s3_extension - -[filter:url_normalize] -use = egg:keystone#url_normalize - -[filter:sizelimit] -use = egg:oslo.middleware#sizelimit - -[app:public_service] -use = egg:keystone#public_service - -[app:service_v3] -use = egg:keystone#service_v3 - -[app:admin_service] -use = egg:keystone#admin_service - -[pipeline:public_api] -# The last item in this pipeline must be public_service or an equivalent -# application. It cannot be a filter. -pipeline = cors sizelimit url_normalize request_id build_auth_context token_auth json_body ec2_extension public_service - -[pipeline:admin_api] -# The last item in this pipeline must be admin_service or an equivalent -# application. It cannot be a filter. -pipeline = cors sizelimit url_normalize request_id build_auth_context token_auth json_body ec2_extension s3_extension admin_service - -[pipeline:api_v3] -# The last item in this pipeline must be service_v3 or an equivalent -# application. It cannot be a filter. -pipeline = cors sizelimit url_normalize request_id build_auth_context token_auth json_body ec2_extension_v3 s3_extension service_v3 - -[app:public_version_service] -use = egg:keystone#public_version_service - -[app:admin_version_service] -use = egg:keystone#admin_version_service - -[pipeline:public_version_api] -pipeline = cors sizelimit url_normalize public_version_service - -[pipeline:admin_version_api] -pipeline = cors sizelimit url_normalize admin_version_service - -[composite:main] -use = egg:Paste#urlmap -/v2.0 = public_api -/v3 = api_v3 -/ = public_version_api - -[composite:admin] -use = egg:Paste#urlmap -/v2.0 = admin_api -/v3 = api_v3 -/ = admin_version_api diff --git a/ansible/roles/keystone/templates/keystone-ssh.json.j2 b/ansible/roles/keystone/templates/keystone-ssh.json.j2 deleted file mode 100644 index c13e0eda6..000000000 --- a/ansible/roles/keystone/templates/keystone-ssh.json.j2 +++ /dev/null @@ -1,17 +0,0 @@ -{ - "command": "/usr/sbin/sshd -D", - "config_files": [ - { - "source": "{{ container_config_directory }}/sshd_config", - "dest": "/etc/ssh/sshd_config", - "owner": "root", - "perm": "0644" - }, - { - "source": "{{ container_config_directory }}/id_rsa.pub", - "dest": "/var/lib/keystone/.ssh/authorized_keys", - "owner": "keystone", - "perm": "0600" - } - ] -} diff --git a/ansible/roles/keystone/templates/keystone.conf.j2 b/ansible/roles/keystone/templates/keystone.conf.j2 deleted file mode 100644 index ff33a241f..000000000 --- a/ansible/roles/keystone/templates/keystone.conf.j2 +++ /dev/null @@ -1,52 +0,0 @@ -[DEFAULT] -debug = {{ keystone_logging_debug }} -{% if enable_cadf_notifications | bool %} -notification_format = cadf -transport_url = rabbit://{% for host in groups['rabbitmq'] %}{{ rabbitmq_user }}:{{ rabbitmq_password }}@{% if orchestration_engine == 'KUBERNETES' %}rabbitmq{% else %}{{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}{% endif %}:{{ rabbitmq_port }}{% if not loop.last %},{% endif %}{% endfor %} -{% endif %} - -# NOTE(elemoine) log_dir alone does not work for Keystone -log_file = /var/log/kolla/keystone/keystone.log - -secure_proxy_ssl_header = HTTP_X_FORWARDED_PROTO - -[database] -connection = mysql+pymysql://{{ keystone_database_user }}:{{ keystone_database_password }}@{{ keystone_database_address }}/{{ keystone_database_name }} -max_retries = -1 - -{% if keystone_domain_cfg.stat.exists %} -[identity] -domain_specific_drivers_enabled = true -domain_config_dir = /etc/keystone/domains -{% endif %} - -[token] -{% if keystone_token_provider == 'uuid' %} -provider = uuid -{% elif keystone_token_provider == 'fernet' %} -provider = {{ keystone_token_provider }} -expiration = {{ fernet_token_expiry }} - -[fernet_tokens] -max_active_keys = {{ (groups['keystone'] | length) + 1 }} -{% endif %} - -[cache] -backend = oslo_cache.memcache_pool -enabled = True - -{# For Kolla-Ansible, generate the memcache servers based on the list of -memcached servers in the inventory and memcached_servers should be un-set. -For Kolla-Kubernetes, it is necessary to define the memcached_servers -variable in globals.yml to set it to the Kubernetes service for memcached. #} - -{% if orchestration_engine == 'KUBERNETES' %} -memcache_servers = {{ memcached_servers }} -{% else %} -memcache_servers = {% for host in groups['memcached'] %}{{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %} -{%- endif %} - -{% if enable_cadf_notifications | bool %} -[oslo_messaging_notifications] -driver = messagingv2 -{% endif %} diff --git a/ansible/roles/keystone/templates/keystone.json.j2 b/ansible/roles/keystone/templates/keystone.json.j2 deleted file mode 100644 index 3cd792111..000000000 --- a/ansible/roles/keystone/templates/keystone.json.j2 +++ /dev/null @@ -1,49 +0,0 @@ -{% set keystone_cmd = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set keystone_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{ - "command": "/usr/sbin/{{ keystone_cmd }}", - "config_files": [ - { - "source": "{{ container_config_directory }}/keystone.conf", - "dest": "/etc/keystone/keystone.conf", - "owner": "keystone", - "perm": "0600" - }, - { - "source": "{{ container_config_directory }}/keystone-paste.ini", - "dest": "/etc/keystone/keystone-paste.ini", - "owner": "keystone", - "perm": "0600" - }, - { - "source": "{{ container_config_directory }}/domains", - "dest": "/etc/keystone/domains", - "owner": "keystone", - "perm": "0700", - "optional": true - }, - { - "source": "{{ container_config_directory }}/policy.json", - "dest": "/etc/keystone/policy.json", - "owner": "keystone", - "perm": "0600", - "optional": true - }, - { - "source": "{{ container_config_directory }}/wsgi-keystone.conf", - "dest": "/etc/{{ keystone_dir }}/wsgi-keystone.conf", - "owner": "keystone", - "perm": "0644" - } - ], - "permissions": [ - { - "path": "/var/log/kolla", - "owner": "keystone:kolla" - }, - { - "path": "/var/log/kolla/keystone/keystone.log", - "owner": "keystone:keystone" - } - ] -} diff --git a/ansible/roles/keystone/templates/ssh_config.j2 b/ansible/roles/keystone/templates/ssh_config.j2 deleted file mode 100644 index 4a177f655..000000000 --- a/ansible/roles/keystone/templates/ssh_config.j2 +++ /dev/null @@ -1,4 +0,0 @@ -Host * - StrictHostKeyChecking no - UserKnownHostsFile /dev/null - Port {{ keystone_ssh_port }} diff --git a/ansible/roles/keystone/templates/sshd_config.j2 b/ansible/roles/keystone/templates/sshd_config.j2 deleted file mode 100644 index 8b66f42c7..000000000 --- a/ansible/roles/keystone/templates/sshd_config.j2 +++ /dev/null @@ -1,5 +0,0 @@ -Port {{ keystone_ssh_port }} -ListenAddress {{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }} - -SyslogFacility AUTHPRIV -UsePAM yes diff --git a/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 b/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 deleted file mode 100644 index a3f98173a..000000000 --- a/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 +++ /dev/null @@ -1,32 +0,0 @@ -{% set keystone_log_dir = '/var/log/kolla/keystone' %} -{% set python_path = '/usr/lib/python2.7/site-packages' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/lib/python2.7/site-packages' %} -Listen {{ api_interface_address }}:{{ keystone_public_port }} -Listen {{ api_interface_address }}:{{ keystone_admin_port }} - -<VirtualHost *:{{ keystone_public_port }}> - WSGIDaemonProcess keystone-public processes={{ openstack_service_workers }} threads=1 user=keystone group=keystone display-name=%{GROUP} python-path={{ python_path }} - WSGIProcessGroup keystone-public - WSGIScriptAlias / /var/www/cgi-bin/keystone/main - WSGIApplicationGroup %{GLOBAL} - WSGIPassAuthorization On - <IfVersion >= 2.4> - ErrorLogFormat "%{cu}t %M" - </IfVersion> - ErrorLog "{{ keystone_log_dir }}/keystone-apache-public-error.log" - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ keystone_log_dir }}/keystone-apache-public-access.log" logformat -</VirtualHost> - -<VirtualHost *:{{ keystone_admin_port }}> - WSGIDaemonProcess keystone-admin processes={{ openstack_service_workers }} threads=1 user=keystone group=keystone display-name=%{GROUP} python-path={{ python_path }} - WSGIProcessGroup keystone-admin - WSGIScriptAlias / /var/www/cgi-bin/keystone/admin - WSGIApplicationGroup %{GLOBAL} - WSGIPassAuthorization On - <IfVersion >= 2.4> - ErrorLogFormat "%{cu}t %M" - </IfVersion> - ErrorLog "{{ keystone_log_dir }}/keystone-apache-admin-error.log" - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ keystone_log_dir }}/keystone-apache-admin-access.log" logformat -</VirtualHost> |