Add support for key manager options
These options are required to use share encryption. Notes: - Manila supports only BarbicanKeyManager atm so the code for this specific plugin is added - Manila does not use some of the options provided by castellan so these options are omitted - Manila requires keystoneauth options set in this section to authentication of the service user who own application credentials and get access to encryption secrets. Change-Id: Ia004ddcc8de519c4a33da4e03b88f6890be513c1 Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
This commit is contained in:
Takashi Kajinami
19
manifests/key_manager.pp
Normal file
19
manifests/key_manager.pp
Normal file
@@ -0,0 +1,19 @@
|
||||
# == Class: manila::key_manager
|
||||
#
|
||||
# Setup and configure Key Manager options
|
||||
#
|
||||
# === Parameters
|
||||
#
|
||||
# [*backend*]
|
||||
# (Optional) Specify the key manager implementation.
|
||||
# Defaults to $facts['os_service_default']
|
||||
#
|
||||
class manila::key_manager (
|
||||
$backend = $facts['os_service_default'],
|
||||
) {
|
||||
include manila::deps
|
||||
|
||||
oslo::key_manager { 'manila_config':
|
||||
backend => $backend,
|
||||
}
|
||||
}
|
||||
129
manifests/key_manager/barbican.pp
Normal file
129
manifests/key_manager/barbican.pp
Normal file
@@ -0,0 +1,129 @@
|
||||
# == Class: manila::key_manager::barbican
|
||||
#
|
||||
# Setup and configure Barbican Key Manager options
|
||||
#
|
||||
# === Parameters
|
||||
#
|
||||
# [*password*]
|
||||
# (Required) Password to create for the service user
|
||||
#
|
||||
# [*barbican_endpoint*]
|
||||
# (Optional) Use this endpoint to connect to Barbican.
|
||||
# Defaults to $facts['os_service_default']
|
||||
#
|
||||
# [*barbican_api_version*]
|
||||
# (Optional) Version of the Barbican API.
|
||||
# Defaults to $facts['os_service_default']
|
||||
#
|
||||
# [*auth_endpoint*]
|
||||
# (Optional) Use this endpoint to connect to Keystone.
|
||||
# Defaults to $facts['os_service_default']
|
||||
#
|
||||
# [*barbican_endpoint_type*]
|
||||
# (Optional) Specifies the type of endpoint.
|
||||
# Defaults to $facts['os_service_default']
|
||||
#
|
||||
# [*barbican_region_name*]
|
||||
# (Optional) Specifies the region of the chosen endpoint.
|
||||
# Defaults to $facts['os_service_default']
|
||||
#
|
||||
# [*auth_url*]
|
||||
# (Optional) The URL to use for authentication.
|
||||
# Defaults to 'http://localhost:5000'
|
||||
#
|
||||
# [*username*]
|
||||
# (Optional) The name of the service user
|
||||
# Defaults to 'manila'
|
||||
#
|
||||
# [*project_name*]
|
||||
# (Optional) Service project name
|
||||
# Defaults to 'services'
|
||||
#
|
||||
# [*user_domain_name*]
|
||||
# (Optional) Name of domain for $username
|
||||
# Defaults to 'Default'
|
||||
#
|
||||
# [*project_domain_name*]
|
||||
# (Optional) Name of domain for $project_name
|
||||
# Defaults to 'Default'
|
||||
#
|
||||
# [*system_scope*]
|
||||
# (Optional) Scope for system operations.
|
||||
# Defaults to $facts['os_service_default']
|
||||
#
|
||||
# [*region_name*]
|
||||
# (optional) Region name for connecting to keystone
|
||||
# Defaults to $facts['os_service_default']
|
||||
#
|
||||
# [*endpoint_type*]
|
||||
# (optional) The type of keystone endpoint to use when
|
||||
# looking up in the keystone catalog.
|
||||
# Defaults to $facts['os_service_default']
|
||||
#
|
||||
# [*insecure*]
|
||||
# (Optional) If true, explicitly allow TLS without checking server cert
|
||||
# against any certificate authorities. WARNING: not recommended. Use with
|
||||
# caution.
|
||||
# Defaults to $facts['os_service_default']
|
||||
#
|
||||
# [*auth_type*]
|
||||
# (Optional) Authentication type to load
|
||||
# Defaults to 'password'
|
||||
#
|
||||
# [*cafile*]
|
||||
# (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs
|
||||
# connections.
|
||||
# Defaults to $facts['os_service_default'].
|
||||
#
|
||||
class manila::key_manager::barbican (
|
||||
$password,
|
||||
$barbican_endpoint = $facts['os_service_default'],
|
||||
$barbican_api_version = $facts['os_service_default'],
|
||||
$auth_endpoint = $facts['os_service_default'],
|
||||
$barbican_endpoint_type = $facts['os_service_default'],
|
||||
$barbican_region_name = $facts['os_service_default'],
|
||||
$auth_url = 'http://localhost:5000',
|
||||
$username = 'manila',
|
||||
$project_name = 'services',
|
||||
$user_domain_name = 'Default',
|
||||
$project_domain_name = 'Default',
|
||||
$system_scope = $facts['os_service_default'],
|
||||
$region_name = $facts['os_service_default'],
|
||||
$endpoint_type = $facts['os_service_default'],
|
||||
$insecure = $facts['os_service_default'],
|
||||
$auth_type = 'password',
|
||||
$cafile = $facts['os_service_default'],
|
||||
) {
|
||||
include manila::deps
|
||||
|
||||
oslo::key_manager::barbican { 'manila_config':
|
||||
barbican_endpoint => $barbican_endpoint,
|
||||
barbican_api_version => $barbican_api_version,
|
||||
auth_endpoint => $auth_endpoint,
|
||||
barbican_endpoint_type => $barbican_endpoint_type,
|
||||
barbican_region_name => $barbican_region_name,
|
||||
}
|
||||
|
||||
if is_service_default($system_scope) {
|
||||
$project_name_real = $project_name
|
||||
$project_domain_name_real = $project_domain_name
|
||||
} else {
|
||||
$project_name_real = $facts['os_service_default']
|
||||
$project_domain_name_real = $facts['os_service_default']
|
||||
}
|
||||
|
||||
manila_config {
|
||||
'barbican/auth_url': value => $auth_url;
|
||||
'barbican/username': value => $username;
|
||||
'barbican/user_domain_name': value => $user_domain_name;
|
||||
'barbican/password': value => $password, secret => true;
|
||||
'barbican/project_name': value => $project_name_real;
|
||||
'barbican/project_domain_name': value => $project_domain_name_real;
|
||||
'barbican/system_scope': value => $system_scope;
|
||||
'barbican/region_name': value => $region_name;
|
||||
'barbican/endpoint_type': value => $endpoint_type;
|
||||
'barbican/insecure': value => $insecure;
|
||||
'barbican/auth_type': value => $auth_type;
|
||||
'barbican/cafile': value => $cafile;
|
||||
}
|
||||
}
|
||||
99
manifests/key_manager/barbican/service_user.pp
Normal file
99
manifests/key_manager/barbican/service_user.pp
Normal file
@@ -0,0 +1,99 @@
|
||||
# == Class: manila::key_manager::barbican::service_user
|
||||
#
|
||||
# Setup and configure the service token feature for Barbican Key Manager
|
||||
#
|
||||
# === Parameters
|
||||
#
|
||||
# [*password*]
|
||||
# (Required) Password to create for the service user
|
||||
#
|
||||
# [*username*]
|
||||
# (Optional) The name of the service user
|
||||
# Defaults to 'manila'
|
||||
#
|
||||
# [*auth_url*]
|
||||
# (Optional) The URL to use for authentication.
|
||||
# Defaults to 'http://localhost:5000'
|
||||
#
|
||||
# [*project_name*]
|
||||
# (Optional) Service project name
|
||||
# Defaults to 'services'
|
||||
#
|
||||
# [*user_domain_name*]
|
||||
# (Optional) Name of domain for $username
|
||||
# Defaults to 'Default'
|
||||
#
|
||||
# [*project_domain_name*]
|
||||
# (Optional) Name of domain for $project_name
|
||||
# Defaults to 'Default'
|
||||
#
|
||||
# [*system_scope*]
|
||||
# (Optional) Scope for system operations.
|
||||
# Defaults to $facts['os_service_default']
|
||||
#
|
||||
# [*insecure*]
|
||||
# (Optional) If true, explicitly allow TLS without checking server cert
|
||||
# against any certificate authorities. WARNING: not recommended. Use with
|
||||
# caution.
|
||||
# Defaults to $facts['os_service_default']
|
||||
#
|
||||
# [*auth_type*]
|
||||
# (Optional) Authentication type to load
|
||||
# Defaults to 'password'
|
||||
#
|
||||
# [*auth_version*]
|
||||
# (Optional) API version of the admin Identity API endpoint.
|
||||
# Defaults to $facts['os_service_default'].
|
||||
#
|
||||
# [*cafile*]
|
||||
# (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs
|
||||
# connections.
|
||||
# Defaults to $facts['os_service_default'].
|
||||
#
|
||||
# [*certfile*]
|
||||
# (Optional) Required if identity server requires client certificate
|
||||
# Defaults to $facts['os_service_default'].
|
||||
#
|
||||
# [*keyfile*]
|
||||
# (Optional) Required if identity server requires client certificate
|
||||
# Defaults to $facts['os_service_default'].
|
||||
#
|
||||
# [*region_name*]
|
||||
# (Optional) The region in which the identity server can be found.
|
||||
# Defaults to $facts['os_service_default'].
|
||||
#
|
||||
class manila::key_manager::barbican::service_user (
|
||||
$password,
|
||||
$username = 'manila',
|
||||
$auth_url = 'http://localhost:5000',
|
||||
$project_name = 'services',
|
||||
$user_domain_name = 'Default',
|
||||
$project_domain_name = 'Default',
|
||||
$system_scope = $facts['os_service_default'],
|
||||
$insecure = $facts['os_service_default'],
|
||||
$auth_type = 'password',
|
||||
$auth_version = $facts['os_service_default'],
|
||||
$cafile = $facts['os_service_default'],
|
||||
$certfile = $facts['os_service_default'],
|
||||
$keyfile = $facts['os_service_default'],
|
||||
$region_name = $facts['os_service_default'],
|
||||
) {
|
||||
include manila::deps
|
||||
|
||||
oslo::key_manager::barbican::service_user { 'manila_config':
|
||||
username => $username,
|
||||
password => $password,
|
||||
auth_url => $auth_url,
|
||||
project_name => $project_name,
|
||||
user_domain_name => $user_domain_name,
|
||||
project_domain_name => $project_domain_name,
|
||||
system_scope => $system_scope,
|
||||
insecure => $insecure,
|
||||
auth_type => $auth_type,
|
||||
auth_version => $auth_version,
|
||||
cafile => $cafile,
|
||||
certfile => $certfile,
|
||||
keyfile => $keyfile,
|
||||
region_name => $region_name,
|
||||
}
|
||||
}
|
||||
8
releasenotes/notes/key-manager-3261ce24c2eabbd3.yaml
Normal file
8
releasenotes/notes/key-manager-3261ce24c2eabbd3.yaml
Normal file
@@ -0,0 +1,8 @@
|
||||
---
|
||||
features:
|
||||
- |
|
||||
The following classes have been added.
|
||||
|
||||
- ``manila::key_manager``
|
||||
- ``manila::key_manager::barbican``
|
||||
- ``manila::key_manager::barbican::service_user``
|
||||
@@ -0,0 +1,82 @@
|
||||
require 'spec_helper'
|
||||
|
||||
describe 'manila::key_manager::barbican::service_user' do
|
||||
shared_examples 'manila::key_manager::barbican::service_user' do
|
||||
|
||||
let :params do
|
||||
{ :password => 'secret' }
|
||||
end
|
||||
|
||||
context 'with default parameters' do
|
||||
it {
|
||||
is_expected.to contain_oslo__key_manager__barbican__service_user('manila_config').with(
|
||||
:username => 'manila',
|
||||
:password => 'secret',
|
||||
:auth_url => 'http://localhost:5000',
|
||||
:project_name => 'services',
|
||||
:user_domain_name => 'Default',
|
||||
:project_domain_name => 'Default',
|
||||
:system_scope => '<SERVICE DEFAULT>',
|
||||
:insecure => '<SERVICE DEFAULT>',
|
||||
:auth_type => 'password',
|
||||
:auth_version => '<SERVICE DEFAULT>',
|
||||
:cafile => '<SERVICE DEFAULT>',
|
||||
:certfile => '<SERVICE DEFAULT>',
|
||||
:keyfile => '<SERVICE DEFAULT>',
|
||||
:region_name => '<SERVICE DEFAULT>',
|
||||
)
|
||||
}
|
||||
end
|
||||
|
||||
context 'with specified parameters' do
|
||||
before :each do
|
||||
params.merge!({
|
||||
:username => 'alt_manila',
|
||||
:auth_url => 'http://127.0.0.1:5000',
|
||||
:project_name => 'alt_services',
|
||||
:user_domain_name => 'Domain1',
|
||||
:project_domain_name => 'Domain2',
|
||||
:system_scope => 'all',
|
||||
:insecure => false,
|
||||
:auth_type => 'v3password',
|
||||
:auth_version => 'v3',
|
||||
:cafile => '/opt/stack/data/cafile.pem',
|
||||
:certfile => 'certfile.crt',
|
||||
:keyfile => 'keyfile',
|
||||
:region_name => 'regionOne',
|
||||
})
|
||||
end
|
||||
|
||||
it {
|
||||
is_expected.to contain_oslo__key_manager__barbican__service_user('manila_config').with(
|
||||
:username => 'alt_manila',
|
||||
:password => 'secret',
|
||||
:auth_url => 'http://127.0.0.1:5000',
|
||||
:project_name => 'alt_services',
|
||||
:user_domain_name => 'Domain1',
|
||||
:project_domain_name => 'Domain2',
|
||||
:system_scope => 'all',
|
||||
:insecure => false,
|
||||
:auth_type => 'v3password',
|
||||
:auth_version => 'v3',
|
||||
:cafile => '/opt/stack/data/cafile.pem',
|
||||
:certfile => 'certfile.crt',
|
||||
:keyfile => 'keyfile',
|
||||
:region_name => 'regionOne',
|
||||
)
|
||||
}
|
||||
end
|
||||
end
|
||||
|
||||
on_supported_os({
|
||||
:supported_os => OSDefaults.get_supported_os
|
||||
}).each do |os,facts|
|
||||
context "on #{os}" do
|
||||
let (:facts) do
|
||||
facts.merge(OSDefaults.get_facts())
|
||||
end
|
||||
|
||||
it_behaves_like 'manila::key_manager::barbican::service_user'
|
||||
end
|
||||
end
|
||||
end
|
||||
106
spec/classes/manila_key_manager_barbican_spec.rb
Normal file
106
spec/classes/manila_key_manager_barbican_spec.rb
Normal file
@@ -0,0 +1,106 @@
|
||||
require 'spec_helper'
|
||||
|
||||
describe 'manila::key_manager::barbican' do
|
||||
shared_examples 'manila::key_manager::barbican' do
|
||||
context 'with default parameters' do
|
||||
let :params do
|
||||
{ :password => 'manilapassword' }
|
||||
end
|
||||
|
||||
it {
|
||||
is_expected.to contain_oslo__key_manager__barbican('manila_config').with(
|
||||
:barbican_endpoint => '<SERVICE DEFAULT>',
|
||||
:barbican_api_version => '<SERVICE DEFAULT>',
|
||||
:auth_endpoint => '<SERVICE DEFAULT>',
|
||||
:barbican_endpoint_type => '<SERVICE DEFAULT>',
|
||||
:barbican_region_name => '<SERVICE DEFAULT>',
|
||||
)
|
||||
|
||||
is_expected.to contain_manila_config('barbican/username').with_value('manila')
|
||||
is_expected.to contain_manila_config('barbican/password').with_value('manilapassword').with_secret(true)
|
||||
is_expected.to contain_manila_config('barbican/auth_url').with_value('http://localhost:5000')
|
||||
is_expected.to contain_manila_config('barbican/project_name').with_value('services')
|
||||
is_expected.to contain_manila_config('barbican/user_domain_name').with_value('Default')
|
||||
is_expected.to contain_manila_config('barbican/project_domain_name').with_value('Default')
|
||||
is_expected.to contain_manila_config('barbican/system_scope').with_value('<SERVICE DEFAULT>')
|
||||
is_expected.to contain_manila_config('barbican/region_name').with_value('<SERVICE DEFAULT>')
|
||||
is_expected.to contain_manila_config('barbican/endpoint_type').with_value('<SERVICE DEFAULT>')
|
||||
is_expected.to contain_manila_config('barbican/insecure').with_value('<SERVICE DEFAULT>')
|
||||
is_expected.to contain_manila_config('barbican/auth_type').with_value('password')
|
||||
is_expected.to contain_manila_config('barbican/cafile').with_value('<SERVICE DEFAULT>')
|
||||
}
|
||||
end
|
||||
|
||||
context 'with specified parameters' do
|
||||
let :params do
|
||||
{
|
||||
:barbican_endpoint => 'http://localhost:9311/',
|
||||
:barbican_api_version => 'v1',
|
||||
:auth_endpoint => 'http://localhost:5000',
|
||||
:barbican_endpoint_type => 'public',
|
||||
:barbican_region_name => 'regionOne',
|
||||
:auth_url => 'http://127.0.0.1:5000',
|
||||
:username => 'alt_manila',
|
||||
:password => 'manilapassword',
|
||||
:project_name => 'alt_services',
|
||||
:user_domain_name => 'UserDomain',
|
||||
:project_domain_name => 'ProjectDomain',
|
||||
:region_name => 'regionOne',
|
||||
:endpoint_type => 'publicURL',
|
||||
:insecure => false,
|
||||
:auth_type => 'v3password',
|
||||
:cafile => 'cafile',
|
||||
}
|
||||
end
|
||||
|
||||
it {
|
||||
is_expected.to contain_oslo__key_manager__barbican('manila_config').with(
|
||||
:barbican_endpoint => 'http://localhost:9311/',
|
||||
:barbican_api_version => 'v1',
|
||||
:auth_endpoint => 'http://localhost:5000',
|
||||
:barbican_endpoint_type => 'public',
|
||||
:barbican_region_name => 'regionOne',
|
||||
)
|
||||
|
||||
is_expected.to contain_manila_config('barbican/username').with_value('alt_manila')
|
||||
is_expected.to contain_manila_config('barbican/password').with_value('manilapassword').with_secret(true)
|
||||
is_expected.to contain_manila_config('barbican/auth_url').with_value('http://127.0.0.1:5000')
|
||||
is_expected.to contain_manila_config('barbican/project_name').with_value('alt_services')
|
||||
is_expected.to contain_manila_config('barbican/user_domain_name').with_value('UserDomain')
|
||||
is_expected.to contain_manila_config('barbican/project_domain_name').with_value('ProjectDomain')
|
||||
is_expected.to contain_manila_config('barbican/system_scope').with_value('<SERVICE DEFAULT>')
|
||||
is_expected.to contain_manila_config('barbican/region_name').with_value('regionOne')
|
||||
is_expected.to contain_manila_config('barbican/endpoint_type').with_value('publicURL')
|
||||
is_expected.to contain_manila_config('barbican/insecure').with_value(false)
|
||||
is_expected.to contain_manila_config('barbican/auth_type').with_value('v3password')
|
||||
is_expected.to contain_manila_config('barbican/cafile').with_value('cafile')
|
||||
}
|
||||
end
|
||||
|
||||
context 'when system_scope is set' do
|
||||
let :params do
|
||||
{
|
||||
:password => 'manilapassword',
|
||||
:system_scope => 'all'
|
||||
}
|
||||
end
|
||||
it 'configures system-scoped credential' do
|
||||
is_expected.to contain_manila_config('barbican/project_domain_name').with_value('<SERVICE DEFAULT>')
|
||||
is_expected.to contain_manila_config('barbican/project_name').with_value('<SERVICE DEFAULT>')
|
||||
is_expected.to contain_manila_config('barbican/system_scope').with_value('all')
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
on_supported_os({
|
||||
:supported_os => OSDefaults.get_supported_os
|
||||
}).each do |os,facts|
|
||||
context "on #{os}" do
|
||||
let (:facts) do
|
||||
facts.merge(OSDefaults.get_facts())
|
||||
end
|
||||
|
||||
it_behaves_like 'manila::key_manager::barbican'
|
||||
end
|
||||
end
|
||||
end
|
||||
39
spec/classes/manila_key_manager_spec.rb
Normal file
39
spec/classes/manila_key_manager_spec.rb
Normal file
@@ -0,0 +1,39 @@
|
||||
require 'spec_helper'
|
||||
|
||||
describe 'manila::key_manager' do
|
||||
shared_examples 'manila::key_manager' do
|
||||
context 'with default parameters' do
|
||||
it {
|
||||
is_expected.to contain_oslo__key_manager('manila_config').with(
|
||||
:backend => '<SERVICE DEFAULT>'
|
||||
)
|
||||
}
|
||||
end
|
||||
|
||||
context 'with specified parameters' do
|
||||
let :params do
|
||||
{
|
||||
:backend => 'barbican'
|
||||
}
|
||||
end
|
||||
|
||||
it {
|
||||
is_expected.to contain_oslo__key_manager('manila_config').with(
|
||||
:backend => 'barbican'
|
||||
)
|
||||
}
|
||||
end
|
||||
end
|
||||
|
||||
on_supported_os({
|
||||
:supported_os => OSDefaults.get_supported_os
|
||||
}).each do |os,facts|
|
||||
context "on #{os}" do
|
||||
let (:facts) do
|
||||
facts.merge(OSDefaults.get_facts())
|
||||
end
|
||||
|
||||
it_behaves_like 'manila::key_manager'
|
||||
end
|
||||
end
|
||||
end
|
||||
Reference in New Issue
Block a user