aboutsummaryrefslogtreecommitdiff
path: root/ansible/roles/keystone/templates
AgeCommit message (Collapse)AuthorFilesLines
2016-11-15Remove Ansible from KollaSteven Dake13-313/+0
Change-Id: I5396e4b9927d3e65b6aa4185238a43a4765a996b
2016-11-11Use uuid as keystone default token providerJeffrey Zhang1-1/+3
Keystone uses fernet as default provider in its code now. This patch adds provider=token in keystone.conf file explicitly. TrivialFix Change-Id: Id7142ff4f00ee99579ad420573eafefea0f4dcb7
2016-11-05Merge "Make number of keystone processes configurable"Jenkins1-2/+2
2016-10-14Fix keystone upgrade permission issueJeffrey Zhang1-0/+10
Change-Id: I211d9f2dbdd9647ec99e8b43be6332c8ad64114e Partial-Bug: #1631503
2016-10-12Fix keystone fernet file exchange via sshChristian Berendt9-23/+23
* install openssh client in keystone-fernet container * install rsync in keystone-ssh container * fix syntax issue in ssh configuration * copy ssh configuration into keystone-fernet container * copy id_rsa.pub into keystone-ssh container * copy id_rsa into keystone-fernet container * use full path to ssh binary in used scripts * add missing newlines at EOF * when using type source set /var/lib/keystone as home directory for the user keystone Co-Authored-By: Jeffrey Zhang <jeffrey.zhang@99cloud.net> Change-Id: Id6b41030056a69f6516a054beb2fc0e08226e876 Closes-bug: #1623013
2016-10-10Make number of keystone processes configurableChristian Berendt1-2/+2
TrivialFix Change-Id: I2f0945c444016227a09486d62cec53db51ac1ec9
2016-10-01Add CADF event configurations in Keystone when enabledNarasimha SV1-2/+2
By default CADF events added even if they are disbaled in all.yml. Boolean check is missing is added so that CADF configurations will be added only if it is enabled. Change-Id: I757ae176228cc4e74d06ce85b27200bdcdd5dd5c Closes-Bug: #1607904
2016-09-26Use keystone-paste.ini template for keystoneChristian Berendt2-0/+89
The use of the admin_token_auth middleware presents a security risk and was removed from [pipeline:api_v3], [pipeline:admin_api], and [pipeline:public_api]. Change-Id: I3a3ca2e74c0ae341105d3481f97956c6da473046 Closes-bug: #1587747
2016-09-20Merge "fix horizon fernet container"Jenkins1-1/+7
2016-09-19Fix Keystone CADF notificationsKevin Fox1-1/+1
* use template for transport_url that is working for kolla-kubernetes * use transport_url parameter in DEFAULT section Co-authored-by: Christian Berendt <berendt@betacloud-solutions.de> Change-Id: I800b5bc4c178b5df4f208ee50944e2806fd6a7c1 Closes-bug: #1625352
2016-09-20fix horizon fernet containerJeffrey Zhang1-1/+7
keystone-fernet container need keystone.conf file TrivialFix Change-Id: If4a75a4d9e88350963c31190bc09cee4862aa34d
2016-09-16Enable CADF events in Keystone and introduce enable_cadf_notificationsChristian Berendt1-0/+9
Change-Id: I0a40867ae65011fbfd53308b9d7f42d10435f5fa Closes-bug: #1607905
2016-09-01Merge "Correct permissions to /etc/keystone/domains"Jenkins1-1/+1
2016-08-25Add full support for fernetShaun Smekel10-0/+100
This addresses the ansible aspects of fernet key bootstrapping as well as distributed key rotation. - Bootstrapping is handled in the same way as keystone bootstrap. - A new keystone-fernet and keystone-ssh container is created to allow the nodes to communicate with each other (taken from nova-ssh). - The keystone-fernet is a keystone container with crontab installed. This will handle key rotations through keystone-manage and trigger an rsync to push new tokens to other nodes. - Key rotation is setup to be balanced across the keystone nodes using a round-robbin style. This ensures that any node failures will not stop the keys from rotating. This is configured by a desired token expiration time which then determines the cron scheduling for each node as well as the number of fernet tokens in rotation. - Ability for recovered node to resync with the cluster. When a node starts it will run sanity checks to ensure that its fernet tokens are not stale. If they are it will rsync with other nodes to ensure its tokens are up to date. The Docker component is implemented in: https://review.openstack.org/#/c/349366 Change-Id: I15052c25a1d1149d364236f10ced2e2346119738 Implements: blueprint keystone-fernet-token
2016-08-11Keystone interface address and memcached overrideKen Wronkiewicz2-2/+12
Note: This should not result in any behavior changes in regular Kolla, just Kolla-Kubernetes and only when you've overridden stuff in globals.yml Allows override of interface address and memcached pools, so that Kubernetes can do the right thing. There are some significant architectural issues involved in memcached pooling in the Kolla-kubernetes world. Avoiding them right now. Current working Kolla-Kubernetes globals.yml file, assuming that your memcached servers are available under the DNS alias "memcached": api_interface_address: "0.0.0.0" memcached_servers: "memcached" keystone_database_address: "mariadb" keystone_admin_url: "{{ admin_protocol }}://keystone-admin:{{ keystone_admin_port }}/v3" keystone_internal_url: "{{ internal_protocol }}://keystone-public:{{ keystone_public_port }}/v3" keystone_public_url: "{{ public_protocol }}://keystone-public:{{ keystone_public_port }}/v3" Co-authored-by: Ryan Hallisey <rhallise@redhat.com> Change-Id: I5126f81da7b4d48001b87f73d58bbbfad658209c Partially-implements: blueprint api-interface-bind-address-override
2016-08-03Correct permissions to /etc/keystone/domainsMathias Ewald1-1/+1
Set permission for /etc/keystone/domains/ directory to 0700 instead of 0600 which is required for Keystone to be able to list directory contents. Change-Id: I7536cc3f0bcbc8aea298ad76713e45cbb93a4b27 Closes-Bug: #1609319
2016-07-19Configurable policy.json for keystoneNenad Radojevic1-0/+7
Copy custom policy.json into keystone container Change-Id: I58787c3dd7adbeff47d0898c23db95f5919510d3 Closes-Bug: #1604431
2016-07-14Support Keystone Domain specific filesDave Walker (Daviey)2-0/+13
Currently, it is not possible to make use of Keystone Domain specific settings. Such as different domains using different LDAP servers or SQL. To enable for example domain ACME - domain settings would be put into: {{ node_custom_config }}keystone/domains/keystone.ACME.conf Change-Id: I23620978c618dd4a3598d7cb74c3e9cf8c2394ac Closes-Bug: #1599868 Signed-off-by: Dave Walker (Daviey) <email@daviey.com>
2016-04-11Set db connection retry to infinityRyan Hallisey1-1/+1
Make sure that all the sevices will attempt to connect to the database an infinite about of times. If the database ever disappears for some reason we want the services to try and reconnect more than just 10 times. Closes-bug: #1505636 Change-Id: I77abbf72ce5bfd68faa451bb9a72bd2544963f4b
2016-03-28Change keystone log dirCarlos Cesario1-5/+5
Proposed patch to change keystone and heka log dir from /var/log/kolla/apache2/ to /var/log/kolla/keystone/ Closes-Bug: #1560620 Change-Id: I70c65ceba5a301cc56880313ca86f01bd35676cb
2016-03-19Add memcached_servers to keystone_auth sectionSamYaple1-0/+6
The in-process cache for keystone tokens has been deprecated due to "incosistent results and high memory usage" with the expectation we switch to memcached_servers if we want to stay performant. Add memcache_servers [cache] section to the appropriate servers as the [DEFAULT]\memcache_servers options was deprecated. TrivialFix Related-Id: Ied2b88c8cefe5655a88d0c2f334de04e588fa75a Change-Id: Ic971bdddc0be3338b15924f7cc0f97d4a3ad2440
2016-03-03Add TLS protection on external API endpointsDave McCowan1-0/+2
TLS can be used to encrypt and authenticate the connection with OpenStack endpoints. This patch provides the necessary parameters and changes the resulting service configurations to enable TLS for the Kolla deployed OpenStack cloud. The new input parameters are: kolla_enable_tls_external: "yes" or "no" (default is "no") kolla_external_fqdn_cert: "/etc/kolla/certificates/haproxy.pem" kolla_external_fqdn_cacert: "/etc/kolla/certificates/haproxy-ca.crt" Implements: blueprint kolla-ssl Change-Id: I48ef8a781c3035d58817f9bf6f36d59a488bab41
2016-03-01Remove keystone admin tokenSamYaple1-2/+0
Admin token has been deprecated upstream. It will be removed in O. We switch over to the new `keystone-manage bootstrap` method for creating the initial admin user, role, and project. Co-Authored-By: Sam Yaple <sam@yaple.net> Change-Id: I6ca90e8d4c3b71009e24b049b2efbc08c05ebfbf
2016-02-24Use passed client IP address in various audit logsDave McCowan1-2/+2
HAProxy: change to use option forwardfor to pass origin IP address to backend via X-Forwarded-For header Keystone: Apache does the audit logs for keystone. Change the LogFormat to display the passed address instead of the connection address which is that of the load balancer. Nova, Cinder, Glance: these services can make use of the address passed in X-Forwarded-For. With this setting the API logs for these services include the client IP address. Change-Id: Ia861ecc11a7c7d463d0366586926d1a842853f69 Closes-Bug: #1548935
2016-02-19Make Heka collect Keystone logsÉric Lemoine2-6/+9
Partially implements: blueprint heka Change-Id: I940143876981a04464af67aff65c09a06926701d
2016-01-18remove option verbose from config filesAllen Gao1-1/+0
Option "verbose" from group "DEFAULT" is deprecated for removal. Its value may be silently ignored in the future. If this option is not set explicitly, there is no such warning. Furthermore, the default value of verbose is true, so there is no need to set this value in config files. TrivialFix Change-Id: I3ec2a8900c984a64bc0645672ef89a63975f7f4e
2015-12-22Convert to pymysqlSamYaple1-1/+1
Closes-Bug: #1528432 Change-Id: I6e56f283521b29678964cb655ac3cff2d13b8246
2015-11-27Source installation in virtualenvMichal Rostecki1-2/+3
Use virtualenv for installation of OpenStack projects and dependencies to avoid conflicts with Python libraries installed by non-OpenStack binary packages. Change-Id: I21ecd673b2e93335b1d3dd4e279e940c9d694c3c Implements: blueprint virtualenv
2015-11-17Fixed log error messages from keystone to syslog.akwasniewska1-0/+2
Rsyslog adapted to filter keystone error log messages. Related bug: 1516462 Change-Id: I4d8d4280dc8fef870d56d8466ed466241ee18e64
2015-10-06Bring Kolla inline with FHSSam Yaple1-2/+2
This brings Kolla images inline with FHS and should make finding locations of things more consistent and reliable with the linux world at large. Change-Id: Iece5b4da4bace0fb8b1f41a65ab2c852ec73e6f8 Closes-Bug: #1485742
2015-09-24Keystone logging to rsyslogMichal Jastrzebski1-4/+4
Configure keystone to use rsyslog container as logging mechanism Change-Id: Id77574fe841e9c2a9d870b712ffd0c26b5463ded Implements: bp logging-container
2015-09-18Replace config-external with a JSON file for Keystonerthallisey1-0/+19
Change-Id: I4c403edb7cd16f587f30a313c1943f070512eda3 Partially-Implements: blueprint replace-config-external
2015-08-23Fix keystone for UbuntuSam Yaple1-4/+5
Due to the differences between Ubuntu and Centos around Apache2 I have had to copy both start.sh and config-external.sh to be unique files for Ubuntu so as not to affect Centos either. This can be removed when we change the way config-external works. Change-Id: I14dc11e7bb6284b897259a53acc914ae8f254d3c Partially-Implements: blueprint install-from-ubuntu
2015-07-08Fix permissions on log directory for keystoneSam Yaple1-4/+4
Additionally fixed bootstrap issue caused by an ansible bug in some versions of the docker module. Closes-Bug: #1472270 Change-Id: Ia5a370db5ab7690854afcd63492ba7dbbea29835
2015-07-03Updated keystone for wsgi in config-externalSam Yaple2-5/+28
This will switch config-external to using wsgi vs evenlet for keystone. Partially Implements: blueprint ansible-service Change-Id: I85a88c813ed36d827916796199dad735b2d44b40
2015-06-30Add initial config function and keystone supportSam Yaple1-0/+13
Add set_configs function that implements the flow from the proposed ansible-multi spec. Move start.sh to config-internal.sh to preserve existing behaviour. config-externall.sh copies the appropriate configs in from the bind'd location and sets permissions and ownership appropriately. Partially Implements: blueprint ansible-multi Change-Id: I53fca0660451087f273fefc3c63e0d8cf1a2c096
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-07 15:17:42 +0000