Support service tokens

Implement support for service_tokens. For that we convert
role_name to be a list along with renaming corresponding variable.

Additionally service_type is defined now for keystone_authtoken which
enables to validate tokens with restricted access rules

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/845690
Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/845994
Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/845894
Change-Id: I3db09c840b448c665c9f2a16c78fe0e0a38f158a

defaults/main.yml

@@ -122,7 +122,12 @@ masakari_service_adminurl: "{{ masakari_service_adminuri }}/v1/%(tenant_id)s"
 
 masakari_service_in_ldap: "{{ service_ldap_backend_enabled | default(False) }}"
 
-masakari_role_name: admin
+masakari_service_role_names:
+  - admin
+  - service
+masakari_service_token_roles:
+  - service
+masakari_service_token_roles_required: "{{ openstack_service_token_roles_required | default(True) }}"
 masakari_api_bind_address: "{{ openstack_service_bind_address | default('0.0.0.0') }}"
 masakari_api_service_port: 15868
 

tasks/main.yml

@@ -147,7 +147,7 @@
     _service_users:
       - name: "{{ masakari_service_user_name }}"
         password: "{{ masakari_service_password }}"
-        role: "{{ masakari_role_name }}"
+        role: "{{ masakari_service_role_names }}"
     _service_endpoints:
       - service: "{{ masakari_service_name }}"
         interface: "public"

templates/masakari.conf.j2

@@ -34,10 +34,14 @@ user_domain_id = {{ masakari_service_project_domain_id }}
 project_name = {{ masakari_service_project_name }}
 username = {{ masakari_service_user_name }}
 password = {{ masakari_service_password }}
+
+service_token_roles = {{ masakari_service_token_roles | join(',') }}
+service_token_roles_required = {{ masakari_service_token_roles_required | bool }}
+service_type = {{ masakari_service_type }}
+
 memcached_servers = {{ masakari_memcached_servers }}
 memcache_security_strategy = ENCRYPT
 memcache_secret_key = {{ memcached_encryption_key }}
-service_token_roles_required = True
 
 [database]
 connection = mysql+pymysql://{{ masakari_galera_user }}:{{ masakari_container_mysql_password }}@{{ masakari_galera_address }}/{{ masakari_galera_database }}?charset=utf8{% if masakari_galera_use_ssl | bool %}&ssl_verify_cert=true{% if masakari_galera_ssl_ca_cert | length > 0 %}&ssl_ca={{ masakari_galera_ssl_ca_cert }}{% endif %}{% endif +%}