docker/services/keystone.yaml

   1 heat_template_version: pike
   2
   3 description: >
   4   OpenStack containerized Keystone service
   5
   6 parameters:
   7   DockerKeystoneImage:
   8     description: image
   9     type: string
  10   DockerKeystoneConfigImage:
  11     description: The container image to use for the keystone config_volume
  12     type: string
  13   EndpointMap:
  14     default: {}
  15     description: Mapping of service endpoint -> protocol. Typically set
  16                  via parameter_defaults in the resource registry.
  17     type: json
  18   ServiceData:
  19     default: {}
  20     description: Dictionary packing service data
  21     type: json
  22   ServiceNetMap:
  23     default: {}
  24     description: Mapping of service_name -> network name. Typically set
  25                  via parameter_defaults in the resource registry.  This
  26                  mapping overrides those in ServiceNetMapDefaults.
  27     type: json
  28   DefaultPasswords:
  29     default: {}
  30     type: json
  31   RoleName:
  32     default: ''
  33     description: Role name on which the service is applied
  34     type: string
  35   RoleParameters:
  36     default: {}
  37     description: Parameters specific to the role
  38     type: json
  39   AdminPassword:
  40     description: The password for the keystone admin account, used for monitoring, querying neutron etc.
  41     type: string
  42     hidden: true
  43   KeystoneTokenProvider:
  44     description: The keystone token format
  45     type: string
  46     default: 'fernet'
  47     constraints:
  48       - allowed_values: ['uuid', 'fernet']
  49   EnableInternalTLS:
  50     type: boolean
  51     default: false
  52
  53 resources:
  54
  55   ContainersCommon:
  56     type: ./containers-common.yaml
  57
  58   MySQLClient:
  59     type: ../../puppet/services/database/mysql-client.yaml
  60
  61   KeystoneBase:
  62     type: ../../puppet/services/keystone.yaml
  63     properties:
  64       EndpointMap: {get_param: EndpointMap}
  65       ServiceData: {get_param: ServiceData}
  66       ServiceNetMap: {get_param: ServiceNetMap}
  67       DefaultPasswords: {get_param: DefaultPasswords}
  68       RoleName: {get_param: RoleName}
  69       RoleParameters: {get_param: RoleParameters}
  70
  71 conditions:
  72
  73   internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]}
  74
  75 outputs:
  76   role_data:
  77     description: Role data for the Keystone API role.
  78     value:
  79       service_name: {get_attr: [KeystoneBase, role_data, service_name]}
  80       config_settings:
  81         map_merge:
  82           - get_attr: [KeystoneBase, role_data, config_settings]
  83           - apache::default_vhost: false
  84       logging_source: {get_attr: [KeystoneBase, role_data, logging_source]}
  85       logging_groups: {get_attr: [KeystoneBase, role_data, logging_groups]}
  86       step_config: &step_config
  87         list_join:
  88           - "\n"
  89           - - "['Keystone_user', 'Keystone_endpoint', 'Keystone_domain', 'Keystone_tenant', 'Keystone_user_role', 'Keystone_role', 'Keystone_service'].each |String $val| { noop_resource($val) }"
  90             - {get_attr: [KeystoneBase, role_data, step_config]}
  91             - {get_attr: [MySQLClient, role_data, step_config]}
  92       service_config_settings: {get_attr: [KeystoneBase, role_data, service_config_settings]}
  93       # BEGIN DOCKER SETTINGS
  94       puppet_config:
  95         config_volume: keystone
  96         puppet_tags: keystone_config
  97         step_config: *step_config
  98         config_image: &keystone_config_image {get_param: DockerKeystoneConfigImage}
  99       kolla_config:
 100         /var/lib/kolla/config_files/keystone.json:
 101           command: /usr/sbin/httpd -DFOREGROUND
 102           config_files:
 103             - source: "/var/lib/kolla/config_files/src/*"
 104               dest: "/"
 105               merge: true
 106               preserve_properties: true
 107         /var/lib/kolla/config_files/keystone_cron.json:
 108           # FIXME(dprince): this is unused ATM because Kolla hardcodes the
 109           # args for the keystone container to -DFOREGROUND
 110           command: /usr/sbin/crond -n
 111           config_files:
 112             - source: "/var/lib/kolla/config_files/src/*"
 113               dest: "/"
 114               merge: true
 115               preserve_properties: true
 116           permissions:
 117             - path: /var/log/keystone
 118               owner: keystone:keystone
 119               recurse: true
 120       docker_config:
 121         # Kolla_bootstrap/db sync runs before permissions set by kolla_config
 122         step_2:
 123           keystone_init_log:
 124             image: &keystone_image {get_param: DockerKeystoneImage}
 125             user: root
 126             command: ['/bin/bash', '-c', 'chown -R keystone:keystone /var/log/keystone']
 127             volumes:
 128               - /var/log/containers/keystone:/var/log/keystone
 129               - /var/log/containers/httpd/keystone:/var/log/httpd
 130         step_3:
 131           keystone_db_sync:
 132             image: *keystone_image
 133             net: host
 134             user: root
 135             privileged: false
 136             detach: false
 137             volumes: &keystone_volumes
 138               list_concat:
 139                 - {get_attr: [ContainersCommon, volumes]}
 140                 -
 141                   - /var/lib/kolla/config_files/keystone.json:/var/lib/kolla/config_files/config.json:ro
 142                   - /var/lib/config-data/puppet-generated/keystone/:/var/lib/kolla/config_files/src:ro
 143                   - /var/log/containers/keystone:/var/log/keystone
 144                   - /var/log/containers/httpd/keystone:/var/log/httpd
 145                   -
 146                     if:
 147                       - internal_tls_enabled
 148                       - /etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro
 149                       - ''
 150                   -
 151                     if:
 152                       - internal_tls_enabled
 153                       - /etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro
 154                       - ''
 155             environment:
 156               - KOLLA_BOOTSTRAP=True
 157               - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
 158             command: ['/usr/bin/bootstrap_host_exec', 'keystone', '/usr/local/bin/kolla_start']
 159           keystone:
 160             start_order: 2
 161             image: *keystone_image
 162             net: host
 163             privileged: false
 164             restart: always
 165             volumes: *keystone_volumes
 166             environment:
 167               - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
 168           keystone_bootstrap:
 169             start_order: 3
 170             action: exec
 171             user: root
 172             command:
 173               [ 'keystone', '/usr/bin/bootstrap_host_exec', 'keystone' ,'keystone-manage', 'bootstrap', '--bootstrap-password', {get_param: AdminPassword} ]
 174           keystone_cron:
 175             start_order: 4
 176             image: *keystone_image
 177             user: root
 178             net: host
 179             privileged: false
 180             restart: always
 181             command: ['/bin/bash', '-c', '/usr/local/bin/kolla_set_configs && /usr/sbin/crond -n']
 182             healthcheck:
 183               test: /bin/true
 184             volumes:
 185               list_concat:
 186                 - {get_attr: [ContainersCommon, volumes]}
 187                 -
 188                   - /var/lib/kolla/config_files/keystone_cron.json:/var/lib/kolla/config_files/config.json:ro
 189                   - /var/lib/config-data/puppet-generated/keystone/:/var/lib/kolla/config_files/src:ro
 190                   - /var/log/containers/keystone:/var/log/keystone
 191                   - /var/log/containers/httpd/keystone:/var/log/httpd
 192             environment:
 193               - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
 194       docker_puppet_tasks:
 195         # Keystone endpoint creation occurs only on single node
 196         step_3:
 197           config_volume: 'keystone_init_tasks'
 198           puppet_tags: 'keystone_config,keystone_domain_config,keystone_endpoint,keystone_identity_provider,keystone_paste_ini,keystone_role,keystone_service,keystone_tenant,keystone_user,keystone_user_role,keystone_domain'
 199           step_config: 'include ::tripleo::profile::base::keystone'
 200           config_image: *keystone_config_image
 201       host_prep_tasks:
 202         - name: create persistent logs directory
 203           file:
 204             path: "{{ item }}"
 205             state: directory
 206           with_items:
 207             - /var/log/containers/keystone
 208             - /var/log/containers/httpd/keystone
 209       upgrade_tasks:
 210         - name: Stop and disable keystone service (running under httpd)
 211           tags: step2
 212           service: name=httpd state=stopped enabled=no
 213         - name: remove old keystone cron jobs
 214           tags: step2
 215           file:
 216             path: /var/spool/cron/keystone
 217             state: absent
 218       metadata_settings:
 219         get_attr: [KeystoneBase, role_data, metadata_settings]