Merge "Enable internal TLS for Barbican API"

[apex-tripleo-heat-templates.git] / puppet / services / keystone.yaml

diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml
index d1765fc..d819e04 100644 (file)
--- a/puppet/services/keystone.yaml
+++ b/puppet/services/keystone.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2016-04-08
+heat_template_version: 2016-10-14
 
 description: >
   OpenStack Keystone service configured with Puppet
@@ -32,6 +32,12 @@ parameters:
     type: string
     default: 'regionOne'
     description: Keystone region for endpoint
+  KeystoneTokenProvider:
+    description: The keystone token format
+    type: string
+    default: 'uuid'
+    constraints:
+      - allowed_values: ['uuid', 'fernet']
   ServiceNetMap:
     default: {}
     description: Mapping of service_name -> network name. Typically set
@@ -85,7 +91,7 @@ parameters:
     description: Set the number of workers for keystone::wsgi::apache
     default: '"%{::os_workers}"'
   MonitoringSubscriptionKeystone:
-    default: 'overcloud-kestone'
+    default: 'overcloud-keystone'
     type: string
   KeystoneCredential0:
     type: string
@@ -112,6 +118,9 @@ resources:
       EndpointMap: {get_param: EndpointMap}
       EnableInternalTLS: {get_param: EnableInternalTLS}
 
+conditions:
+  keystone_fernet_tokens: {equals: [{get_param: KeystoneTokenProvider}, "fernet"]}
+
 outputs:
   role_data:
     description: Role data for the Keystone role.
@@ -134,9 +143,12 @@ outputs:
                   - {get_param: [EndpointMap, MysqlInternal, host]}
                   - '/keystone'
             keystone::admin_token: {get_param: AdminToken}
+            keystone::admin_password: {get_param: AdminPassword}
             keystone::roles::admin::password: {get_param: AdminPassword}
             keystone_ssl_certificate: {get_param: KeystoneSSLCertificate}
             keystone_ssl_certificate_key: {get_param: KeystoneSSLCertificateKey}
+            keystone::token_provider: {get_param: KeystoneTokenProvider}
+            keystone::enable_fernet_setup: {if: [keystone_fernet_tokens, true, false]}
             keystone::enable_proxy_headers_parsing: true
             keystone::enable_credential_setup: true
             keystone::credential_keys: