aboutsummaryrefslogtreecommitdiff
path: root/ansible/roles/keystone/defaults
AgeCommit message (Collapse)AuthorFilesLines
2016-11-15Remove Ansible from KollaSteven Dake1-40/+0
Change-Id: I5396e4b9927d3e65b6aa4185238a43a4765a996b
2016-08-25Add full support for fernetShaun Smekel1-0/+15
This addresses the ansible aspects of fernet key bootstrapping as well as distributed key rotation. - Bootstrapping is handled in the same way as keystone bootstrap. - A new keystone-fernet and keystone-ssh container is created to allow the nodes to communicate with each other (taken from nova-ssh). - The keystone-fernet is a keystone container with crontab installed. This will handle key rotations through keystone-manage and trigger an rsync to push new tokens to other nodes. - Key rotation is setup to be balanced across the keystone nodes using a round-robbin style. This ensures that any node failures will not stop the keys from rotating. This is configured by a desired token expiration time which then determines the cron scheduling for each node as well as the number of fernet tokens in rotation. - Ability for recovered node to resync with the cluster. When a node starts it will run sanity checks to ensure that its fernet tokens are not stale. If they are it will rsync with other nodes to ensure its tokens are up to date. The Docker component is implemented in: https://review.openstack.org/#/c/349366 Change-Id: I15052c25a1d1149d364236f10ced2e2346119738 Implements: blueprint keystone-fernet-token
2016-08-02Horizon interface address and memcached overrideKen Wronkiewicz1-5/+1
Note: This should not result in any behavior changes in regular Kolla, just Kolla-Kubernetes and only when you've overridden stuff in globals.yml Allows override of interface address and memcached pools, so that Kubernetes can do the right thing. There are some significant architectural issues involved in memcached pooling in the Kolla-kubernetes world. Avoiding them right now. Current working with this Kolla-Kubernetes globals.yml file: api_interface_address: "0.0.0.0" memcached_servers: "memcached" keystone_database_address: "mariadb" keystone_admin_url: "http://keystone-admin:35357/v3" keystone_internal_url: "http://keystone-public:5000/v3" keystone_public_url: "http://keystone-public:5000/v3" Three tings to note: * In Kolla-Kubernetes, the service is not using net=host, so a 0.0.0.0 interface address is totally OK. That patch has been merged. * In Kolla-Kubernetes, the global.yml file doesn't do var substitution so you have to be explicit about the URLs, otherwise Keystone will look like it was provisioned but it won't quite be provisioned right. * In order to not duplicate tons of code, moved the keystone_admin_url / keystone_internal_url / keystone_public_url to the common defaults from the keystone defaults. Co-Authored-By: Ryan Hallisey <rhallise@redhat.com> Change-Id: I586ce1c6c3300254c4e2a398ff46645df576aeb0 Partially-implements: blueprint api-interface-bind-address-override
2016-07-14Keystones openstack_auth was undefinedPatrick Powell1-0/+2
Keystones openstack_auth is undefined for Keystones sanity check closes-bug: #1601808 Change-Id: I445482ce32b924d9220e8c351363b6793558d3b4
2016-05-13add support for non-default database_port in kolla/ansibleWaldemar Znoinski1-1/+1
This change makes each step of the kolla deployment aware of the port database was configured to listen on. It defaults mariadb_port to database_port. Change-Id: I8e85d5732015afc0a5481cb33e0b629fdfa84a1b Closes-Bug: #1576151 DocImpact
2016-03-03Fix Keystone v3 and HorizonSamYaple1-9/+3
After our switch to keystone-manage bootstrap Horizon is not happy due to v3 not being setup correctly. This patch fixes that This also includes removal of unused variables (transforms them into endpoint url variables) TrivialFix Change-Id: I1e04db8c24049f80e974c063f03068a2ab32a563
2016-03-01Remove keystone admin tokenSamYaple1-1/+4
Admin token has been deprecated upstream. It will be removed in O. We switch over to the new `keystone-manage bootstrap` method for creating the initial admin user, role, and project. Co-Authored-By: Sam Yaple <sam@yaple.net> Change-Id: I6ca90e8d4c3b71009e24b049b2efbc08c05ebfbf
2016-02-26Change kolla_internal_address variableSamYaple1-4/+4
Due to poor planning on our variable names we have a situation where we have "internal_address" which must be a VIP, but "external_address" which should be a DNS name. Now with two vips "external_vip_address" is a new variable. This corrects that issue by deprecating kolla_internal_address and replacing it with 4 nicely named variables. kolla_internal_vip_address kolla_internal_fqdn kolla_external_vip_address kolla_external_fqdn The default behaviour will remain the same, and the way the variable inheritance is setup the kolla_internal_address variable can still be set in globals.yml and propogate out to these 4 new variables like it normally would, but all reference to kolla_internal_address has been completely removed. Change-Id: I4556dcdbf4d91a8d2751981ef9c64bad44a719e5 Partially-Implements: blueprint ssl-kolla
2016-02-15Use uppercase 'S' in word "OpenStack"venkatamahesh1-1/+1
Change-Id: I27ca0ea75f3d6a4371c91b3cb2c7a999ec90fbc4
2016-01-20remove option verbose define in defaults/main.ymlIce Yao1-1/+0
References: https://review.openstack.org/#/c/269042/ TrivialFix Change-Id: Ief08781342a06f956fc4cf00ba4383759da8c897
2015-12-15Move the admin account creation to register.ymlJeffrey Zhang1-0/+1
Create the admin project, user, role and keystone service info by using ansible task rather than shell script Closes-Bug: #1526251 Change-Id: Ieee215b9de1618b3d31f3d1a766a9d0ebafdee4d
2015-12-02Sanity check for keystoneMichal Jastrzebski1-0/+2
This runs first sanity check for keystone. After keystone is deployed it checks tenants.list() Change-Id: Ie919ffe6124eb70428309404a434d9b0eb0b9f70 Partially-Implements: blueprint sanity-check-container
2015-08-08Remove Ansible abstraction for KeystoneSam Yaple1-14/+3
Change-Id: I0daf8b78f39b919d2b88336322203f1d643fc54b Partial-Bug: #1482214 Partially-Implements: blueprint remove-abstraction-ansible
2015-08-01Removes unneeded variablesSam Yaple1-3/+0
These variables are defined in the defaults.yml file Change-Id: I45de4fbd41c50e2a8fe3233cdffc467c9a594aa5 Closes-Bug: #1480498
2015-07-31Add missing slash if docker registry is specifiedVladislav Belogrudov1-1/+1
If user specifies registry a full image name is constructed by concatenation of the registry, namespace and image. Currently concatenation does not include '/' if registry is non-empty but it should. If registry is empty '/' is not required. This fix covers both use cases with help of Ansible filter. Change-Id: I0588dd0da55d777e6caa7eb47d51b2435d38d5e0 Closes-Bug: #1479013
2015-06-30Add initial config function and keystone supportSam Yaple1-0/+42
Add set_configs function that implements the flow from the proposed ansible-multi spec. Move start.sh to config-internal.sh to preserve existing behaviour. config-externall.sh copies the appropriate configs in from the bind'd location and sets permissions and ownership appropriately. Partially Implements: blueprint ansible-multi Change-Id: I53fca0660451087f273fefc3c63e0d8cf1a2c096
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 23:20:55 +0000