Remove old authtoken options

Since we are in ocata lets remove all old parameters in api
to configure the keystone_authtoken section

Change-Id: I4950c5dba0eb257412fe2d2d39f1780b431c05d4
This commit is contained in:
Iury Gregory Melo Ferreira 2016-11-08 00:35:33 -03:00 committed by Alex Schultz
parent 1a22c9e3ed
commit 641be0c1e0
6 changed files with 126 additions and 191 deletions

View File

@ -63,28 +63,6 @@
# in the zaqar config. # in the zaqar config.
# Defaults to false. # Defaults to false.
# #
# = DEPRECATED PARAMETERS
#
# [*identity_uri*]
# (Optional) DEPRECATED. Use zaqar::keystone::authtoken::auth_url instead.
# Defaults to undef
#
# [*auth_uri*]
# (Optional) DEPRECATED. Use zaqar::keystone::authtoken::auth_uri instead.
# Defaults to undef
#
# [*admin_user*]
# (Optional) DEPRECATED. Use zaqar::keystone::authtoken::username instead.
# Defaults to undef
#
# [*admin_tenant_name*]
# (Optional) DEPRECATED. Use zaqar::keystone::authtoken::project_name instead.
# Defaults to undef
#
# [*admin_password*]
# (Optional) DEPRECATED. Use zaqar::keystone::authtoken::password instead.
# Defaults to undef
#
class zaqar( class zaqar(
$auth_strategy = 'keystone', $auth_strategy = 'keystone',
$admin_mode = $::os_service_default, $admin_mode = $::os_service_default,
@ -98,39 +76,12 @@ class zaqar(
$package_name = $::zaqar::params::package_name, $package_name = $::zaqar::params::package_name,
$package_ensure = 'present', $package_ensure = 'present',
$purge_config = false, $purge_config = false,
# Deprecated
$identity_uri = undef,
$auth_uri = undef,
$admin_user = undef,
$admin_password = undef,
$admin_tenant_name = undef,
) inherits zaqar::params { ) inherits zaqar::params {
resources { 'zaqar_config': resources { 'zaqar_config':
purge => $purge_config, purge => $purge_config,
} }
if $identity_uri {
warning('zaqar::identity_uri is deprecated, use zaqar::keystone::authtoken::auth_url instead')
}
if $auth_uri {
warning('zaqar::auth_uri is deprecated, use zaqar::keystone::authtoken::auth_uri instead')
}
if $admin_user {
warning('zaqar::admin_user is deprecated, use zaqar::keystone::authtoken::username instead')
}
if $admin_password {
warning('zaqar::admin_password is deprecated, use zaqar::keystone::authtoken::password instead')
}
if $admin_tenant_name {
warning('zaqar::admin_tenant_name is deprecated, use zaqar::keystone::authtoken::project_name instead')
}
if $auth_strategy == 'keystone' { if $auth_strategy == 'keystone' {
include ::zaqar::keystone::authtoken include ::zaqar::keystone::authtoken
} }

View File

@ -29,166 +29,161 @@
# Defaults to $::os_service_default # Defaults to $::os_service_default
# #
# [*insecure*] # [*insecure*]
# (Optional) If true, explicitly allow TLS without checking server cert # (Optional) If true, explicitly allow TLS without checking server cert
# against any certificate authorities. WARNING: not recommended. Use with # against any certificate authorities. WARNING: not recommended. Use with
# caution. # caution.
# Defaults to $:os_service_default # Defaults to $:os_service_default
# #
# [*auth_section*] # [*auth_section*]
# (Optional) Config Section from which to load plugin specific options # (Optional) Config Section from which to load plugin specific options
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*auth_type*] # [*auth_type*]
# (Optional) Authentication type to load # (Optional) Authentication type to load
# Defaults to 'password' # Defaults to 'password'
# #
# [*auth_uri*] # [*auth_uri*]
# (Optional) Complete public Identity API endpoint. # (Optional) Complete public Identity API endpoint.
# Defaults to 'http://localhost:5000' # Defaults to 'http://localhost:5000'
# #
# [*auth_version*] # [*auth_version*]
# (Optional) API version of the admin Identity API endpoint. # (Optional) API version of the admin Identity API endpoint.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*cache*] # [*cache*]
# (Optional) Env key for the swift cache. # (Optional) Env key for the swift cache.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*cafile*] # [*cafile*]
# (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs # (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs
# connections. # connections.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*certfile*] # [*certfile*]
# (Optional) Required if identity server requires client certificate # (Optional) Required if identity server requires client certificate
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*check_revocations_for_cached*] # [*check_revocations_for_cached*]
# (Optional) If true, the revocation list will be checked for cached tokens. # (Optional) If true, the revocation list will be checked for cached tokens.
# This requires that PKI tokens are configured on the identity server. # This requires that PKI tokens are configured on the identity server.
# boolean value. # boolean value.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*delay_auth_decision*] # [*delay_auth_decision*]
# (Optional) Do not handle authorization requests within the middleware, but # (Optional) Do not handle authorization requests within the middleware, but
# delegate the authorization decision to downstream WSGI components. Boolean # delegate the authorization decision to downstream WSGI components. Boolean
# value # value
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*enforce_token_bind*] # [*enforce_token_bind*]
# (Optional) Used to control the use and type of token binding. Can be set # (Optional) Used to control the use and type of token binding. Can be set
# to: "disabled" to not check token binding. "permissive" (default) to # to: "disabled" to not check token binding. "permissive" (default) to
# validate binding information if the bind type is of a form known to the # validate binding information if the bind type is of a form known to the
# server and ignore it if not. "strict" like "permissive" but if the bind # server and ignore it if not. "strict" like "permissive" but if the bind
# type is unknown the token will be rejected. "required" any form of token # type is unknown the token will be rejected. "required" any form of token
# binding is needed to be allowed. Finally the name of a binding method that # binding is needed to be allowed. Finally the name of a binding method that
# must be present in tokens. String value. # must be present in tokens. String value.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*hash_algorithms*] # [*hash_algorithms*]
# (Optional) Hash algorithms to use for hashing PKI tokens. This may be a # (Optional) Hash algorithms to use for hashing PKI tokens. This may be a
# single algorithm or multiple. The algorithms are those supported by Python # single algorithm or multiple. The algorithms are those supported by Python
# standard hashlib.new(). The hashes will be tried in the order given, so put # standard hashlib.new(). The hashes will be tried in the order given, so put
# the preferred one first for performance. The result of the first hash will # the preferred one first for performance. The result of the first hash will
# be stored in the cache. This will typically be set to multiple values only # be stored in the cache. This will typically be set to multiple values only
# while migrating from a less secure algorithm to a more secure one. Once all # while migrating from a less secure algorithm to a more secure one. Once all
# the old tokens are expired this option should be set to a single value for # the old tokens are expired this option should be set to a single value for
# better performance. List value. # better performance. List value.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*http_connect_timeout*] # [*http_connect_timeout*]
# (Optional) Request timeout value for communicating with Identity API # (Optional) Request timeout value for communicating with Identity API
# server. # server.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*http_request_max_retries*] # [*http_request_max_retries*]
# (Optional) How many times are we trying to reconnect when communicating # (Optional) How many times are we trying to reconnect when communicating
# with Identity API Server. Integer value # with Identity API Server. Integer value
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*include_service_catalog*] # [*include_service_catalog*]
# (Optional) Indicate whether to set the X-Service-Catalog header. If False, # (Optional) Indicate whether to set the X-Service-Catalog header. If False,
# middleware will not ask for service catalog on token validation and will # middleware will not ask for service catalog on token validation and will
# not # not set the X-Service-Catalog header. Boolean value.
# set the X-Service-Catalog header. Boolean value. # Defaults to $::os_service_default.
# Defaults to $::os_service_default.
# #
# [*keyfile*] # [*keyfile*]
# (Optional) Required if identity server requires client certificate # (Optional) Required if identity server requires client certificate
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*memcache_pool_conn_get_timeout*] # [*memcache_pool_conn_get_timeout*]
# (Optional) Number of seconds that an operation will wait to get a memcached # (Optional) Number of seconds that an operation will wait to get a memcached
# client connection from the pool. Integer value # client connection from the pool. Integer value
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*memcache_pool_dead_retry*] # [*memcache_pool_dead_retry*]
# (Optional) Number of seconds memcached server is considered dead before it # (Optional) Number of seconds memcached server is considered dead before it
# is tried again. Integer value # is tried again. Integer value
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*memcache_pool_maxsize*] # [*memcache_pool_maxsize*]
# (Optional) Maximum total number of open connections to every memcached # (Optional) Maximum total number of open connections to every memcached
# server. Integer value # server. Integer value
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*memcache_pool_socket_timeout*] # [*memcache_pool_socket_timeout*]
# (Optional) Number of seconds a connection to memcached is held unused in # (Optional) Number of seconds a connection to memcached is held unused in
# the # the pool before it is closed. Integer value
# pool before it is closed. Integer value # Defaults to $::os_service_default.
# Defaults to $::os_service_default.
# #
# [*memcache_pool_unused_timeout*] # [*memcache_pool_unused_timeout*]
# (Optional) Number of seconds a connection to memcached is held unused in # (Optional) Number of seconds a connection to memcached is held unused in
# the # the pool before it is closed. Integer value
# pool before it is closed. Integer value # Defaults to $::os_service_default.
# Defaults to $::os_service_default.
# #
# [*memcache_secret_key*] # [*memcache_secret_key*]
# (Optional, mandatory if memcache_security_strategy is defined) This string # (Optional, mandatory if memcache_security_strategy is defined) This string
# is used for key derivation. # is used for key derivation.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*memcache_security_strategy*] # [*memcache_security_strategy*]
# (Optional) If defined, indicate whether token data should be authenticated # (Optional) If defined, indicate whether token data should be authenticated
# or # or authenticated and encrypted. If MAC, token data is authenticated (with
# authenticated and encrypted. If MAC, token data is authenticated (with # HMAC) in the cache. If ENCRYPT, token data is encrypted and authenticated in the
# HMAC) # cache. If the value is not one of these options or empty, auth_token will
# in the cache. If ENCRYPT, token data is encrypted and authenticated in the # raise an exception on initialization.
# cache. If the value is not one of these options or empty, auth_token will # Defaults to $::os_service_default.
# raise an exception on initialization.
# Defaults to $::os_service_default.
# #
# [*memcache_use_advanced_pool*] # [*memcache_use_advanced_pool*]
# (Optional) Use the advanced (eventlet safe) memcached client pool. The # (Optional) Use the advanced (eventlet safe) memcached client pool. The
# advanced pool will only work under python 2.x Boolean value # advanced pool will only work under python 2.x Boolean value
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*memcached_servers*] # [*memcached_servers*]
# (Optional) Optionally specify a list of memcached server(s) to use for # (Optional) Optionally specify a list of memcached server(s) to use for
# caching. If left undefined, tokens will instead be cached in-process. # caching. If left undefined, tokens will instead be cached in-process.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*region_name*] # [*region_name*]
# (Optional) The region in which the identity server can be found. # (Optional) The region in which the identity server can be found.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*revocation_cache_time*] # [*revocation_cache_time*]
# (Optional) Determines the frequency at which the list of revoked tokens is # (Optional) Determines the frequency at which the list of revoked tokens is
# retrieved from the Identity service (in seconds). A high number of # retrieved from the Identity service (in seconds). A high number of
# revocation events combined with a low cache duration may significantly # revocation events combined with a low cache duration may significantly
# reduce performance. Only valid for PKI tokens. Integer value # reduce performance. Only valid for PKI tokens. Integer value
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*signing_dir*] # [*signing_dir*]
# (Optional) Directory used to cache files related to PKI tokens. # (Optional) Directory used to cache files related to PKI tokens.
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
# [*token_cache_time*] # [*token_cache_time*]
# (Optional) In order to prevent excessive effort spent validating tokens, # (Optional) In order to prevent excessive effort spent validating tokens,
# the middleware caches previously-seen tokens for a configurable duration # the middleware caches previously-seen tokens for a configurable duration
# (in seconds). Set to -1 to disable caching completely. Integer value # (in seconds). Set to -1 to disable caching completely. Integer value
# Defaults to $::os_service_default. # Defaults to $::os_service_default.
# #
class zaqar::keystone::authtoken( class zaqar::keystone::authtoken(
$username = 'zaqar', $username = 'zaqar',
@ -228,22 +223,16 @@ class zaqar::keystone::authtoken(
$token_cache_time = $::os_service_default, $token_cache_time = $::os_service_default,
) { ) {
if is_service_default($password) and ! $::zaqar::admin_password { if is_service_default($password) {
fail('Please set password for Zaqar service user') fail('Please set password for Zaqar service user')
} }
$username_real = pick($::zaqar::admin_user, $username)
$password_real = pick($::zaqar::admin_password, $password)
$project_name_real = pick($::zaqar::admin_tenant_name, $project_name)
$auth_url_real = pick($::zaqar::identity_uri, $auth_url)
$auth_uri_real = pick($::zaqar::auth_uri, $auth_uri)
keystone::resource::authtoken { 'zaqar_config': keystone::resource::authtoken { 'zaqar_config':
username => $username_real, username => $username,
password => $password_real, password => $password,
project_name => $project_name_real, project_name => $project_name,
auth_url => $auth_url_real, auth_url => $auth_url,
auth_uri => $auth_uri_real, auth_uri => $auth_uri,
auth_version => $auth_version, auth_version => $auth_version,
auth_type => $auth_type, auth_type => $auth_type,
auth_section => $auth_section, auth_section => $auth_section,

View File

@ -0,0 +1,7 @@
---
other:
- removed deprecated zaqar::admin_user
- removed deprecated zaqar::admin_password
- removed deprecated zaqar::admin_tenant_name
- removed deprecated zaqar::identity_uri
- removed deprecated zaqar::auth_uri

View File

@ -1,10 +1,13 @@
require 'spec_helper' require 'spec_helper'
describe 'zaqar' do describe 'zaqar' do
shared_examples 'zaqar' do shared_examples 'zaqar' do
let :pre_condition do
"class { '::zaqar::keystone::authtoken':
password =>'password',
}"
end
let :req_params do let :req_params do
{ {}
:admin_password => 'foo',
}
end end
describe 'with only required params' do describe 'with only required params' do
@ -34,27 +37,6 @@ describe 'zaqar' do
end end
describe 'with deprecated parameters set' do
let :params do
req_params.delete(:admin_password)
req_params.merge!({
'identity_uri' => 'https://localhost:35357/deprecated',
'auth_uri' => 'https://localhost:5000/deprecated',
'admin_user' => 'dummy',
'admin_password' => 'mypassword',
'admin_tenant_name' => 'mytenant',
})
end
it 'configures authtoken section' do
is_expected.to contain_zaqar_config('keystone_authtoken/auth_url').with(:value => 'https://localhost:35357/deprecated')
is_expected.to contain_zaqar_config('keystone_authtoken/auth_uri').with(:value => 'https://localhost:5000/deprecated')
is_expected.to contain_zaqar_config('keystone_authtoken/username').with(:value => 'dummy')
is_expected.to contain_zaqar_config('keystone_authtoken/password').with(:value => 'mypassword')
is_expected.to contain_zaqar_config('keystone_authtoken/project_name').with(:value => 'mytenant')
end
end
describe 'with custom values' do describe 'with custom values' do
let :params do let :params do
req_params.merge!({ req_params.merge!({

View File

@ -4,7 +4,10 @@ describe 'zaqar::server' do
shared_examples_for 'zaqar::server' do shared_examples_for 'zaqar::server' do
describe 'with a zaqar server enabled' do describe 'with a zaqar server enabled' do
let :pre_condition do let :pre_condition do
"class {'::zaqar': admin_password => 'foo'}" "class { '::zaqar::keystone::authtoken':
password =>'foo',
}
class {'::zaqar': }"
end end
it { is_expected.to contain_service(platform_params[:zaqar_service_name]).with( it { is_expected.to contain_service(platform_params[:zaqar_service_name]).with(

View File

@ -5,7 +5,10 @@ describe 'zaqar::server_instance' do
let(:title) { '1' } let(:title) { '1' }
let :pre_condition do let :pre_condition do
"class { 'zaqar': admin_password => 'foo' }" "class { '::zaqar::keystone::authtoken':
password =>'foo',
}
class {'::zaqar': }"
end end
let :params do let :params do