From f728ca5707b8d4e200877ac55de15198edb7142c Mon Sep 17 00:00:00 2001 From: Dmitriy Rabotyagov Date: Wed, 15 Jun 2022 19:11:22 +0200 Subject: [PATCH] Support service tokens Implement support for service_tokens. For that we convert role_name to be a list along with renaming corresponding variable. Additionally service_type is defined now for keystone_authtoken which enables to validate tokens with restricted access rules Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/845690 Change-Id: Ie5ebb4d68ed06cff26462dc55092fda8a9ad2f44 --- defaults/main.yml | 7 ++++++- tasks/main.yml | 2 +- templates/manila.conf.j2 | 4 ++++ 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 2d02117..56d9d84 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -133,7 +133,12 @@ manila_service_project_domain_id: default manila_service_user_domain_id: default manila_service_user_name: manila manila_service_project_name: service -manila_service_role_name: admin +manila_service_role_names: + - admin + - service +manila_service_token_roles: + - service +manila_service_token_roles_required: "{{ openstack_service_token_roles_required | default(True) }}" manila_service_region: "{{ service_region | default('RegionOne') }}" manila_service_description: "Openstack Shared File Systems" manila_service_port: 8786 diff --git a/tasks/main.yml b/tasks/main.yml index 5eeac41..0b35295 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -181,7 +181,7 @@ _service_users: - name: "{{ manila_service_user_name }}" password: "{{ manila_service_password }}" - role: "{{ manila_service_role_name }}" + role: "{{ manila_service_role_names }}" _service_catalog: - name: "{{ manila_service_name }}" type: "{{ manila_service_type }}" diff --git a/templates/manila.conf.j2 b/templates/manila.conf.j2 index d75140f..f3ccd8c 100644 --- a/templates/manila.conf.j2 +++ b/templates/manila.conf.j2 @@ -80,6 +80,10 @@ username = {{ manila_service_user_name }} password = {{ manila_service_password }} region_name = {{ keystone_service_region }} +service_token_roles_required = {{ manila_service_token_roles_required | bool }} +service_token_roles = {{ manila_service_token_roles | join(',') }} +service_type = {{ manila_service_v2_type }} + memcached_servers = {{ manila_memcached_servers }} token_cache_time = 300