From 0befdba12408242a8b797a00896ebb2cd07f0aab Mon Sep 17 00:00:00 2001 From: Takashi Kajinami Date: Tue, 7 Apr 2020 21:46:12 +0900 Subject: [PATCH] Deprecate ceilometer::keystone::authtoken ... because ceilometer-api was deprecated in Ocata release, and now ceilometer doesn't provide api thus doesn't use authtoken middleware. Change-Id: Ib9ada5ff0e8b77a3b44728ebd7fcb9632cb3a3e1 --- examples/ceilometer_with_gnocchi.pp | 3 - examples/site.pp | 5 - manifests/keystone/authtoken.pp | 173 +++++++----------- ...e-keystone-authtoken-be535237501b3b96.yaml | 5 + .../ceilometer_keystone_authtoken_spec.rb | 141 -------------- 5 files changed, 73 insertions(+), 254 deletions(-) create mode 100644 releasenotes/notes/deprecate-keystone-authtoken-be535237501b3b96.yaml delete mode 100644 spec/classes/ceilometer_keystone_authtoken_spec.rb diff --git a/examples/ceilometer_with_gnocchi.pp b/examples/ceilometer_with_gnocchi.pp index e1c35315..abf43c56 100644 --- a/examples/ceilometer_with_gnocchi.pp +++ b/examples/ceilometer_with_gnocchi.pp @@ -14,9 +14,6 @@ class { 'ceilometer::keystone::auth': class { 'ceilometer::expirer': } class { 'ceilometer::agent::polling': } class { 'ceilometer::agent::notification': } -class { 'ceilometer::keystone::authtoken': - password => 'a_big_secret', -} class { 'ceilometer::collector': meter_dispatchers => ['gnocchi'], diff --git a/examples/site.pp b/examples/site.pp index 746e5cdd..b077f1e8 100644 --- a/examples/site.pp +++ b/examples/site.pp @@ -29,11 +29,6 @@ node default { # require => Class['mongodb'], # } - # Configure keystonemiddleware for ceilometer - class { 'ceilometer::keystone::authtoken': - password => 'tralalayouyou' - } - # Set common auth parameters used by all agents (compute/central) class { 'ceilometer::agent::auth': auth_url => 'http://localhost:5000/v3', diff --git a/manifests/keystone/authtoken.pp b/manifests/keystone/authtoken.pp index 06d46037..47f13864 100644 --- a/manifests/keystone/authtoken.pp +++ b/manifests/keystone/authtoken.pp @@ -1,73 +1,74 @@ # class: ceilometer::keystone::authtoken # +# DEPRECATED ! # Configure the keystone_authtoken section in the configuration file # # === Parameters # # [*username*] # (Optional) The name of the service user -# Defaults to 'ceilometer' +# Defaults to undef. # # [*password*] # (Optional) Password to create for the service user -# Defaults to $::os_service_default +# Defaults to undef. # # [*auth_url*] # (Optional) The URL to use for authentication. -# Defaults to 'http://127.0.0.1:5000/'. +# Defaults to undef. # # [*project_name*] # (Optional) Service project name -# Defaults to 'services' +# Defaults to undef. # # [*user_domain_name*] # (Optional) Name of domain for $username -# Defaults to 'Default' +# Defaults to undef # # [*project_domain_name*] # (Optional) Name of domain for $project_name -# Defaults to 'Default' +# Defaults to undef # # [*insecure*] # (Optional) If true, explicitly allow TLS without checking server cert # against any certificate authorities. WARNING: not recommended. Use with # caution. -# Defaults to $::os_service_default +# Defaults to undef # # [*auth_section*] # (Optional) Config Section from which to load plugin specific options -# Defaults to $::os_service_default. +# Defaults to undef. # # [*auth_type*] # (Optional) Authentication type to load -# Defaults to 'password' +# Defaults to undef # # [*www_authenticate_uri*] # (Optional) Complete public Identity API endpoint. -# Defaults to 'http://127.0.0.1:5000/'. +# Defaults to undef # # [*auth_version*] # (Optional) API version of the admin Identity API endpoint. -# Defaults to $::os_service_default. +# Defaults to undef. # # [*cache*] # (Optional) Env key for the swift cache. -# Defaults to $::os_service_default. +# Defaults to undef. # # [*cafile*] # (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs # connections. -# Defaults to $::os_service_default. +# Defaults to undef. # # [*certfile*] # (Optional) Required if identity server requires client certificate -# Defaults to $::os_service_default. +# Defaults to undef. # # [*delay_auth_decision*] # (Optional) Do not handle authorization requests within the middleware, but # delegate the authorization decision to downstream WSGI components. Boolean # value -# Defaults to $::os_service_default. +# Defaults to undef. # # [*enforce_token_bind*] # (Optional) Used to control the use and type of token binding. Can be set @@ -77,57 +78,57 @@ # type is unknown the token will be rejected. "required" any form of token # binding is needed to be allowed. Finally the name of a binding method that # must be present in tokens. String value. -# Defaults to $::os_service_default. +# Defaults to undef. # # [*http_connect_timeout*] # (Optional) Request timeout value for communicating with Identity API # server. -# Defaults to $::os_service_default. +# Defaults to undef. # # [*http_request_max_retries*] # (Optional) How many times are we trying to reconnect when communicating # with Identity API Server. Integer value -# Defaults to $::os_service_default. +# Defaults to undef. # # [*include_service_catalog*] # (Optional) Indicate whether to set the X-Service-Catalog header. If False, # middleware will not ask for service catalog on token validation and will # not set the X-Service-Catalog header. Boolean value. -# Defaults to $::os_service_default. +# Defaults to undef. # # [*keyfile*] # (Optional) Required if identity server requires client certificate -# Defaults to $::os_service_default. +# Defaults to undef. # # [*memcache_pool_conn_get_timeout*] # (Optional) Number of seconds that an operation will wait to get a memcached # client connection from the pool. Integer value -# Defaults to $::os_service_default. +# Defaults to undef. # # [*memcache_pool_dead_retry*] # (Optional) Number of seconds memcached server is considered dead before it # is tried again. Integer value -# Defaults to $::os_service_default. +# Defaults to undef. # # [*memcache_pool_maxsize*] # (Optional) Maximum total number of open connections to every memcached # server. Integer value -# Defaults to $::os_service_default. +# Defaults to undef. # # [*memcache_pool_socket_timeout*] # (Optional) Number of seconds a connection to memcached is held unused in # the pool before it is closed. Integer value -# Defaults to $::os_service_default. +# Defaults to undef. # # [*memcache_pool_unused_timeout*] # (Optional) Number of seconds a connection to memcached is held unused in # the pool before it is closed. Integer value -# Defaults to $::os_service_default. +# Defaults to undef. # # [*memcache_secret_key*] # (Optional, mandatory if memcache_security_strategy is defined) This string # is used for key derivation. -# Defaults to $::os_service_default. +# Defaults to undef. # # [*memcache_security_strategy*] # (Optional) If defined, indicate whether token data should be authenticated @@ -135,113 +136,75 @@ # HMAC) in the cache. If ENCRYPT, token data is encrypted and authenticated in the # cache. If the value is not one of these options or empty, auth_token will # raise an exception on initialization. -# Defaults to $::os_service_default. +# Defaults to undef. # # [*memcache_use_advanced_pool*] # (Optional) Use the advanced (eventlet safe) memcached client pool. The # advanced pool will only work under python 2.x Boolean value -# Defaults to $::os_service_default. +# Defaults to undef. # # [*memcached_servers*] # (Optional) Optionally specify a list of memcached server(s) to use for # caching. If left undefined, tokens will instead be cached in-process. -# Defaults to $::os_service_default. +# Defaults to undef. # # [*manage_memcache_package*] # (Optional) Whether to install the python-memcache package. -# Defaults to false. +# Defaults to undef. # # [*region_name*] # (Optional) The region in which the identity server can be found. -# Defaults to $::os_service_default. +# Defaults to undef. # # [*token_cache_time*] # (Optional) In order to prevent excessive effort spent validating tokens, # the middleware caches previously-seen tokens for a configurable duration # (in seconds). Set to -1 to disable caching completely. Integer value -# Defaults to $::os_service_default. +# Defaults to undef. # # [*service_token_roles_required*] # (optional) backwards compatibility to ensure that the service tokens are # compared against a list of possible roles for validity # true/false -# Defaults to $::os_service_default. +# Defaults to undef. # class ceilometer::keystone::authtoken( - $username = 'ceilometer', - $password = $::os_service_default, - $auth_url = 'http://127.0.0.1:5000/', - $project_name = 'services', - $user_domain_name = 'Default', - $project_domain_name = 'Default', - $insecure = $::os_service_default, - $auth_section = $::os_service_default, - $auth_type = 'password', - $www_authenticate_uri = 'http://127.0.0.1:5000/', - $auth_version = $::os_service_default, - $cache = $::os_service_default, - $cafile = $::os_service_default, - $certfile = $::os_service_default, - $delay_auth_decision = $::os_service_default, - $enforce_token_bind = $::os_service_default, - $http_connect_timeout = $::os_service_default, - $http_request_max_retries = $::os_service_default, - $include_service_catalog = $::os_service_default, - $keyfile = $::os_service_default, - $memcache_pool_conn_get_timeout = $::os_service_default, - $memcache_pool_dead_retry = $::os_service_default, - $memcache_pool_maxsize = $::os_service_default, - $memcache_pool_socket_timeout = $::os_service_default, - $memcache_pool_unused_timeout = $::os_service_default, - $memcache_secret_key = $::os_service_default, - $memcache_security_strategy = $::os_service_default, - $memcache_use_advanced_pool = $::os_service_default, - $memcached_servers = $::os_service_default, - $manage_memcache_package = false, - $region_name = $::os_service_default, - $token_cache_time = $::os_service_default, - $service_token_roles_required = $::os_service_default, + $username = undef, + $password = undef, + $auth_url = undef, + $project_name = undef, + $user_domain_name = undef, + $project_domain_name = undef, + $insecure = undef, + $auth_section = undef, + $auth_type = undef, + $www_authenticate_uri = undef, + $auth_version = undef, + $cache = undef, + $cafile = undef, + $certfile = undef, + $delay_auth_decision = undef, + $enforce_token_bind = undef, + $http_connect_timeout = undef, + $http_request_max_retries = undef, + $include_service_catalog = undef, + $keyfile = undef, + $memcache_pool_conn_get_timeout = undef, + $memcache_pool_dead_retry = undef, + $memcache_pool_maxsize = undef, + $memcache_pool_socket_timeout = undef, + $memcache_pool_unused_timeout = undef, + $memcache_secret_key = undef, + $memcache_security_strategy = undef, + $memcache_use_advanced_pool = undef, + $memcached_servers = undef, + $manage_memcache_package = undef, + $region_name = undef, + $token_cache_time = undef, + $service_token_roles_required = undef, ) { include ceilometer::deps - if is_service_default($password) { - fail('Please set password for ceilometer service user') - } - - keystone::resource::authtoken { 'ceilometer_config': - username => $username, - password => $password, - project_name => $project_name, - auth_url => $auth_url, - www_authenticate_uri => $www_authenticate_uri, - auth_version => $auth_version, - auth_type => $auth_type, - auth_section => $auth_section, - user_domain_name => $user_domain_name, - project_domain_name => $project_domain_name, - insecure => $insecure, - cache => $cache, - cafile => $cafile, - certfile => $certfile, - delay_auth_decision => $delay_auth_decision, - enforce_token_bind => $enforce_token_bind, - http_connect_timeout => $http_connect_timeout, - http_request_max_retries => $http_request_max_retries, - include_service_catalog => $include_service_catalog, - keyfile => $keyfile, - memcache_pool_conn_get_timeout => $memcache_pool_conn_get_timeout, - memcache_pool_dead_retry => $memcache_pool_dead_retry, - memcache_pool_maxsize => $memcache_pool_maxsize, - memcache_pool_socket_timeout => $memcache_pool_socket_timeout, - memcache_secret_key => $memcache_secret_key, - memcache_security_strategy => $memcache_security_strategy, - memcache_use_advanced_pool => $memcache_use_advanced_pool, - memcache_pool_unused_timeout => $memcache_pool_unused_timeout, - memcached_servers => $memcached_servers, - manage_memcache_package => $manage_memcache_package, - region_name => $region_name, - token_cache_time => $token_cache_time, - service_token_roles_required => $service_token_roles_required, - } + warning('ceilometer::keystone::authtoken is deprecated and has not effect') } diff --git a/releasenotes/notes/deprecate-keystone-authtoken-be535237501b3b96.yaml b/releasenotes/notes/deprecate-keystone-authtoken-be535237501b3b96.yaml new file mode 100644 index 00000000..1f4531d4 --- /dev/null +++ b/releasenotes/notes/deprecate-keystone-authtoken-be535237501b3b96.yaml @@ -0,0 +1,5 @@ +--- +deprecations: + - | + The ceilometer::keystone::authtoken class is now deprecated for removal + and has no effect, because ceilometer doesn't provide api anymore. diff --git a/spec/classes/ceilometer_keystone_authtoken_spec.rb b/spec/classes/ceilometer_keystone_authtoken_spec.rb deleted file mode 100644 index 7040ea99..00000000 --- a/spec/classes/ceilometer_keystone_authtoken_spec.rb +++ /dev/null @@ -1,141 +0,0 @@ -require 'spec_helper' - -describe 'ceilometer::keystone::authtoken' do - - let :params do - { :password => 'ceilometer_password', } - end - - shared_examples 'ceilometer authtoken' do - - context 'with default parameters' do - - it 'configure keystone_authtoken' do - is_expected.to contain_ceilometer_config('keystone_authtoken/username').with_value('ceilometer') - is_expected.to contain_ceilometer_config('keystone_authtoken/password').with_value('ceilometer_password') - is_expected.to contain_ceilometer_config('keystone_authtoken/auth_url').with_value('http://127.0.0.1:5000/') - is_expected.to contain_ceilometer_config('keystone_authtoken/project_name').with_value('services') - is_expected.to contain_ceilometer_config('keystone_authtoken/user_domain_name').with_value('Default') - is_expected.to contain_ceilometer_config('keystone_authtoken/project_domain_name').with_value('Default') - is_expected.to contain_ceilometer_config('keystone_authtoken/insecure').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/auth_section').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/auth_type').with_value('password') - is_expected.to contain_ceilometer_config('keystone_authtoken/www_authenticate_uri').with_value('http://127.0.0.1:5000/') - is_expected.to contain_ceilometer_config('keystone_authtoken/auth_version').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/cache').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/cafile').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/certfile').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/delay_auth_decision').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/enforce_token_bind').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/http_connect_timeout').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/http_request_max_retries').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/include_service_catalog').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/keyfile').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_pool_dead_retry').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_pool_maxsize').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_pool_socket_timeout').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_pool_unused_timeout').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_secret_key').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_security_strategy').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_use_advanced_pool').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/memcached_servers').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/region_name').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/token_cache_time').with_value('') - is_expected.to contain_ceilometer_config('keystone_authtoken/service_token_roles_required').with_value('') - end - end - - context 'when overriding parameters' do - before do - params.merge!({ - :www_authenticate_uri => 'https://10.0.0.1:9999/', - :username => 'myuser', - :password => 'mypasswd', - :auth_url => 'https://127.0.0.1:5000', - :project_name => 'service_project', - :user_domain_name => 'domainX', - :project_domain_name => 'domainX', - :insecure => false, - :auth_section => 'new_section', - :auth_type => 'password', - :auth_version => 'v3', - :cache => 'somevalue', - :cafile => '/opt/stack/data/cafile.pem', - :certfile => 'certfile.crt', - :delay_auth_decision => false, - :enforce_token_bind => 'permissive', - :http_connect_timeout => '300', - :http_request_max_retries => '3', - :include_service_catalog => true, - :keyfile => 'keyfile', - :memcache_pool_conn_get_timeout => '9', - :memcache_pool_dead_retry => '302', - :memcache_pool_maxsize => '11', - :memcache_pool_socket_timeout => '2', - :memcache_pool_unused_timeout => '61', - :memcache_secret_key => 'secret_key', - :memcache_security_strategy => 'ENCRYPT', - :memcache_use_advanced_pool => true, - :memcached_servers => ['memcached01:11211','memcached02:11211'], - :manage_memcache_package => true, - :region_name => 'region2', - :token_cache_time => '301', - :service_token_roles_required => false, - }) - end - - it 'configure keystone_authtoken' do - is_expected.to contain_ceilometer_config('keystone_authtoken/www_authenticate_uri').with_value('https://10.0.0.1:9999/') - is_expected.to contain_ceilometer_config('keystone_authtoken/username').with_value(params[:username]) - is_expected.to contain_ceilometer_config('keystone_authtoken/password').with_value(params[:password]).with_secret(true) - is_expected.to contain_ceilometer_config('keystone_authtoken/auth_url').with_value(params[:auth_url]) - is_expected.to contain_ceilometer_config('keystone_authtoken/project_name').with_value(params[:project_name]) - is_expected.to contain_ceilometer_config('keystone_authtoken/user_domain_name').with_value(params[:user_domain_name]) - is_expected.to contain_ceilometer_config('keystone_authtoken/project_domain_name').with_value(params[:project_domain_name]) - is_expected.to contain_ceilometer_config('keystone_authtoken/insecure').with_value(params[:insecure]) - is_expected.to contain_ceilometer_config('keystone_authtoken/auth_section').with_value(params[:auth_section]) - is_expected.to contain_ceilometer_config('keystone_authtoken/auth_type').with_value(params[:auth_type]) - is_expected.to contain_ceilometer_config('keystone_authtoken/auth_version').with_value(params[:auth_version]) - is_expected.to contain_ceilometer_config('keystone_authtoken/cache').with_value(params[:cache]) - is_expected.to contain_ceilometer_config('keystone_authtoken/cafile').with_value(params[:cafile]) - is_expected.to contain_ceilometer_config('keystone_authtoken/certfile').with_value(params[:certfile]) - is_expected.to contain_ceilometer_config('keystone_authtoken/delay_auth_decision').with_value(params[:delay_auth_decision]) - is_expected.to contain_ceilometer_config('keystone_authtoken/enforce_token_bind').with_value(params[:enforce_token_bind]) - is_expected.to contain_ceilometer_config('keystone_authtoken/http_connect_timeout').with_value(params[:http_connect_timeout]) - is_expected.to contain_ceilometer_config('keystone_authtoken/http_request_max_retries').with_value(params[:http_request_max_retries]) - is_expected.to contain_ceilometer_config('keystone_authtoken/include_service_catalog').with_value(params[:include_service_catalog]) - is_expected.to contain_ceilometer_config('keystone_authtoken/keyfile').with_value(params[:keyfile]) - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value(params[:memcache_pool_conn_get_timeout]) - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_pool_dead_retry').with_value(params[:memcache_pool_dead_retry]) - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_pool_maxsize').with_value(params[:memcache_pool_maxsize]) - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_pool_socket_timeout').with_value(params[:memcache_pool_socket_timeout]) - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_pool_unused_timeout').with_value(params[:memcache_pool_unused_timeout]) - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_secret_key').with_value(params[:memcache_secret_key]) - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_security_strategy').with_value(params[:memcache_security_strategy]) - is_expected.to contain_ceilometer_config('keystone_authtoken/memcache_use_advanced_pool').with_value(params[:memcache_use_advanced_pool]) - is_expected.to contain_ceilometer_config('keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211') - is_expected.to contain_ceilometer_config('keystone_authtoken/region_name').with_value(params[:region_name]) - is_expected.to contain_ceilometer_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time]) - is_expected.to contain_ceilometer_config('keystone_authtoken/service_token_roles_required').with_value(params[:service_token_roles_required]) - end - - it 'installs python memcache package' do - is_expected.to contain_package('python-memcache') - end - end - end - - on_supported_os({ - :supported_os => OSDefaults.get_supported_os - }).each do |os,facts| - context "on #{os}" do - let (:facts) do - facts.merge!(OSDefaults.get_facts()) - end - - it_behaves_like 'ceilometer authtoken' - end - end - -end