X-Git-Url: https://gerrit.opnfv.org/gerrit/gitweb?a=blobdiff_plain;f=puppet%2Fservices%2Fkeystone.yaml;h=e48d70374dd8501c2d8eab736739fce23c03ec60;hb=22ba81cf9dd8b2690c3e8c0eee5a70dcb37e10c4;hp=7c200a5bed01ffee8385d888ca14b0f259303c5d;hpb=da3b0cb68f5652789e67a82052f5396f4df3531c;p=apex-tripleo-heat-templates.git

diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml
index 7c200a5b..e48d7037 100644
--- a/puppet/services/keystone.yaml
+++ b/puppet/services/keystone.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2016-04-08
+heat_template_version: 2016-10-14
 
 description: >
   OpenStack Keystone service configured with Puppet
@@ -32,6 +32,12 @@ parameters:
     type: string
     default: 'regionOne'
     description: Keystone region for endpoint
+  KeystoneTokenProvider:
+    description: The keystone token format
+    type: string
+    default: 'uuid'
+    constraints:
+      - allowed_values: ['uuid', 'fernet']
   ServiceNetMap:
     default: {}
     description: Mapping of service_name -> network name. Typically set
@@ -83,9 +89,9 @@ parameters:
   KeystoneWorkers:
     type: string
     description: Set the number of workers for keystone::wsgi::apache
-    default: '"%{::os_workers}"'
+    default: '%{::os_workers}'
   MonitoringSubscriptionKeystone:
-    default: 'overcloud-kestone'
+    default: 'overcloud-keystone'
     type: string
   KeystoneCredential0:
     type: string
@@ -93,11 +99,20 @@ parameters:
   KeystoneCredential1:
     type: string
     description: The second Keystone credential key. Must be a valid key.
+  KeystoneFernetKey0:
+    type: string
+    description: The first Keystone fernet key. Must be a valid key.
+  KeystoneFernetKey1:
+    type: string
+    description: The second Keystone fernet key. Must be a valid key.
   KeystoneLoggingSource:
     type: json
     default:
       tag: openstack.keystone
       path: /var/log/keystone/keystone.log
+  EnableInternalTLS:
+    type: boolean
+    default: false
 
 resources:
 
@@ -107,6 +122,10 @@ resources:
       ServiceNetMap: {get_param: ServiceNetMap}
       DefaultPasswords: {get_param: DefaultPasswords}
       EndpointMap: {get_param: EndpointMap}
+      EnableInternalTLS: {get_param: EnableInternalTLS}
+
+conditions:
+  keystone_fernet_tokens: {equals: [{get_param: KeystoneTokenProvider}, "fernet"]}
 
 outputs:
   role_data:
@@ -130,9 +149,12 @@ outputs:
                   - {get_param: [EndpointMap, MysqlInternal, host]}
                   - '/keystone'
             keystone::admin_token: {get_param: AdminToken}
+            keystone::admin_password: {get_param: AdminPassword}
             keystone::roles::admin::password: {get_param: AdminPassword}
             keystone_ssl_certificate: {get_param: KeystoneSSLCertificate}
             keystone_ssl_certificate_key: {get_param: KeystoneSSLCertificateKey}
+            keystone::token_provider: {get_param: KeystoneTokenProvider}
+            keystone::enable_fernet_setup: {if: [keystone_fernet_tokens, true, false]}
             keystone::enable_proxy_headers_parsing: true
             keystone::enable_credential_setup: true
             keystone::credential_keys:
@@ -140,6 +162,11 @@ outputs:
                 content: {get_param: KeystoneCredential0}
               '/etc/keystone/credential-keys/1':
                 content: {get_param: KeystoneCredential1}
+            keystone::fernet_keys:
+              '/etc/keystone/fernet-keys/0':
+                content: {get_param: KeystoneFernetKey0}
+              '/etc/keystone/fernet-keys/1':
+                content: {get_param: KeystoneFernetKey1}
             keystone::debug: {get_param: Debug}
             keystone::rabbit_userid: {get_param: RabbitUserName}
             keystone::rabbit_password: {get_param: RabbitPassword}
@@ -163,17 +190,18 @@ outputs:
               ec2/driver:
                 value: 'keystone.contrib.ec2.backends.sql.Ec2'
             keystone::service_name: 'httpd'
-            keystone::wsgi::apache::ssl: false
+            keystone::enable_ssl: {get_param: EnableInternalTLS}
+            keystone::wsgi::apache::ssl: {get_param: EnableInternalTLS}
             keystone::wsgi::apache::servername:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  "%{hiera('fqdn_$NETWORK')}"
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}
             keystone::wsgi::apache::servername_admin:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  "%{hiera('fqdn_$NETWORK')}"
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}
             keystone::wsgi::apache::workers: {get_param: KeystoneWorkers}
@@ -188,15 +216,25 @@ outputs:
                   - 13000
                   - 35357
                   - 13357
+            keystone::admin_bind_host:
+              str_replace:
+                template:
+                  "%{hiera('fqdn_$NETWORK')}"
+                params:
+                  $NETWORK: {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}
+            keystone::public_bind_host:
+              str_replace:
+                template:
+                  "%{hiera('fqdn_$NETWORK')}"
+                params:
+                  $NETWORK: {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}
             # NOTE: bind IP is found in Heat replacing the network name with the
             # local node IP for the given network; replacement examples
             # (eg. for internal_api):
             # internal_api -> IP
             # internal_api_uri -> [IP]
             # internal_api_subnet - > IP/CIDR
-            # NOTE: this applies to all 4 bind IP settings below...
-            keystone::admin_bind_host: {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}
-            keystone::public_bind_host: {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}
+            # NOTE: this applies to all 2 bind IP settings below...
             keystone::wsgi::apache::bind_host: {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}
             keystone::wsgi::apache::admin_bind_host: {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}
       step_config: |
@@ -210,3 +248,14 @@ outputs:
           keystone::db::mysql::allowed_hosts:
             - '%'
             - "%{hiera('mysql_bind_host')}"
+      # Ansible tasks to handle upgrade
+      upgrade_tasks:
+        - name: Stop keystone service (running under httpd)
+          tags: step2
+          service: name=httpd state=stopped
+        - name: Sync keystone DB
+          tags: step5
+          command: keystone-manage db_sync
+        - name: Start keystone service (running under httpd)
+          tags: step6
+          service: name=httpd state=started