Add DefaultPasswords to composable services

[apex-tripleo-heat-templates.git] / puppet / services / keystone.yaml

diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml
index 1654f0e..0a5193d 100644 (file)
--- a/puppet/services/keystone.yaml
+++ b/puppet/services/keystone.yaml
@@ -4,24 +4,11 @@ description: >
   OpenStack Keystone service configured with Puppet
 
 parameters:
-  KeystoneCACertificate:
-    default: ''
-    description: Keystone self-signed certificate authority certificate.
-    type: string
   KeystoneEnableDBPurge:
     default: true
     description: |
         Whether to create cron job for purging soft deleted rows in Keystone database.
     type: boolean
-  KeystoneSigningCertificate:
-    default: ''
-    description: Keystone certificate for verifying token validity.
-    type: string
-  KeystoneSigningKey:
-    default: ''
-    description: Keystone key for signing tokens.
-    type: string
-    hidden: true
   KeystoneSSLCertificate:
     default: ''
     description: Keystone certificate for verifying token validity.
@@ -45,18 +32,20 @@ parameters:
     type: string
     default: 'regionOne'
     description: Keystone region for endpoint
-  KeystoneWorkers:
-    default: 0
-    description: Number of workers for Keystone service.
-    type: number
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.  This
+                 mapping overrides those in ServiceNetMapDefaults.
+    type: json
+  DefaultPasswords:
+    default: {}
+    type: json
   EndpointMap:
     default: {}
     description: Mapping of service endpoint -> protocol. Typically set
                  via parameter_defaults in the resource registry.
     type: json
-  MysqlVirtualIPUri:
-    type: string
-    default: ''
   Debug:
     type: string
     default: ''
@@ -91,28 +80,30 @@ parameters:
     default: 5672
     description: Set rabbit subscriber port, change this if using SSL
     type: number
-
+  KeystoneWorkers:
+    type: string
+    description: Set the number of workers for keystone::wsgi::apache
+    default: '"%{::processorcount}"'
 outputs:
   role_data:
     description: Role data for the Keystone role.
     value:
+      service_name: keystone
       config_settings:
-        keystone_dsn: &keystone_dsn
+        keystone::database_connection:
           list_join:
             - ''
-            - - 'mysql+pymysql://keystone:'
+            - - {get_param: [EndpointMap, MysqlInternal, protocol]}
+              - '://keystone:'
               - {get_param: AdminToken}
               - '@'
-              - {get_param: MysqlVirtualIPUri}
+              - {get_param: [EndpointMap, MysqlInternal, host]}
               - '/keystone'
-        keystone::database_connection: *keystone_dsn
         keystone::admin_token: {get_param: AdminToken}
         keystone::roles::admin::password: {get_param: AdminPassword}
-        keystone_ca_certificate: {get_param: KeystoneCACertificate}
-        keystone_signing_key: {get_param: KeystoneSigningKey}
-        keystone_signing_certificate: {get_param: KeystoneSigningCertificate}
         keystone_ssl_certificate: {get_param: KeystoneSSLCertificate}
         keystone_ssl_certificate_key: {get_param: KeystoneSSLCertificateKey}
+        keystone::enable_proxy_headers_parsing: true
         keystone::debug: {get_param: Debug}
         keystone::db::mysql::password: {get_param: AdminToken}
         keystone::rabbit_userid: {get_param: RabbitUserName}
@@ -127,9 +118,36 @@ outputs:
         keystone::endpoint::internal_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
         keystone::endpoint::admin_url: {get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix]}
         keystone::endpoint::region: {get_param: KeystoneRegion}
-        keystone::admin_workers: {get_param: KeystoneWorkers}
-        keystone::public_workers: {get_param: KeystoneWorkers}
         keystone_enable_db_purge: {get_param: KeystoneEnableDBPurge}
         keystone::public_endpoint: {get_param: [EndpointMap, KeystonePublic, uri_no_suffix]}
+        keystone::db::mysql::user: keystone
+        keystone::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
+        keystone::db::mysql::dbname: keystone
+        keystone::db::mysql::allowed_hosts:
+          - '%'
+          - "%{hiera('mysql_bind_host')}"
+        keystone::rabbit_heartbeat_timeout_threshold: 60
+        keystone::cron::token_flush::maxdelay: 3600
+        keystone::roles::admin::service_tenant: 'service'
+        keystone::roles::admin::admin_tenant: 'admin'
+        keystone::cron::token_flush::destination: '/dev/null'
+        keystone::config::keystone_config:
+          ec2/driver:
+            value: 'keystone.contrib.ec2.backends.sql.Ec2'
+        keystone::service_name: 'httpd'
+        keystone::wsgi::apache::ssl: false
+
+        keystone::wsgi::apache::workers: {get_param: KeystoneWorkers}
+        # override via extraconfig:
+        keystone::wsgi::apache::threads: 1
+        keystone::db::database_db_max_retries: -1
+        keystone::db::database_max_retries: -1
+        tripleo.keystone.firewall_rules:
+          '111 keystone':
+            dport:
+              - 5000
+              - 13000
+              - 35357
+              - 13357
       step_config: |
         include ::tripleo::profile::base::keystone