openstack
/
puppet-nova
Code Issues Proposed changes

Add nova::compute::libvirt::secret_ceph resource 

This adds the nova::compute::libvirt::secret_ceph
resource definition that can be used to define
libvirt secrets of ceph type.

Before this patch one could only handle one libvirt
secret by configuring the parameters in the
nova::compute::rbd class and with this one can
configure multiple.

This adds a new manage_libvirt_secret parameter
defaulting to true in the nova::compute::rbd class
so that one can disable the creation of the libvirt
secret from that class.

Change-Id: Ief031f5dd4b0648d5629789cb7d6d2f6f946fbf8
This commit is contained in:
Tobias Urdin 2024-04-19 10:03:05 +02:00
parent ddde8befa8
commit a7498d6dbc
6 changed files with 225 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

85
manifests/compute/libvirt/secret_ceph.pp Normal file
View File

@ -0,0 +1,85 @@
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
# == Define: nova::compute::libvirt::secret_ceph
#
# Configure a libvirt secret with ceph type.
#
# === Parameters
#
# [*uuid*]
# (Required) The UUID of the libvirt secret.
#
# [*value*]
# (Required) The value to store in the secret.
#
# [*secret_name*]
# (Optional) The name of the libvirt secret.
# Defaults to $name
#
# [*secret_path*]
# (Optional) Directory to store files related to secrets.
# Defaults to /etc/nova
#
define nova::compute::libvirt::secret_ceph(
String $uuid,
String $value,
String[1] $secret_name = $name,
Stdlib::Absolutepath $secret_path = '/etc/nova',
) {
$xml_file = "${secret_path}/libvirt-secret-${uuid}.xml"
file { $xml_file:
ensure => 'present',
owner => 'root',
group => 'root',
mode => '0600',
content => epp('nova/libvirt-secret-ceph.xml.epp', {
'secret_name' => $secret_name,
'uuid' => $uuid,
}),
require => Anchor['nova::config::begin'],
}
$secret_file = "${secret_path}/libvirt-secret-${uuid}.secret"
file { $secret_file:
ensure => 'present',
owner => 'root',
group => 'root',
mode => '0600',
content => $value,
show_diff => false,
require => Anchor['nova::config::begin'],
}
exec { "get-or-set virsh secret ${uuid}":
command => [
'/usr/bin/virsh', 'secret-define', '--file', $xml_file,
],
unless => "/usr/bin/virsh secret-list | grep -i ${uuid}",
require => File[$xml_file],
}
Service<| tag == 'libvirt-service' |> -> Exec["get-or-set virsh secret ${uuid}"]
exec { "set-secret-value virsh secret ${uuid}":
command => [
'/usr/bin/virsh', 'secret-set-value', '--secret', $uuid,
'--file', $secret_file,
],
unless => "/usr/bin/virsh secret-get-value ${uuid} | grep -f ${secret_file}",
logoutput => false,
require => [
File[$secret_file],
Exec["get-or-set virsh secret ${uuid}"],
],
}
}

60
manifests/compute/rbd.pp
View File

@ -84,6 +84,10 @@
# only in Ubuntu/Debian.
# Defaults to 'present'
#
# [*manage_libvirt_secret*]
# (optional) Manage the libvirt secret
# Defaults to true
#
class nova::compute::rbd (
$libvirt_rbd_user,
$libvirt_rbd_secret_uuid = false,
@ -98,6 +102,7 @@ class nova::compute::rbd (
Boolean $manage_ceph_client = true,
$ceph_client_ensure = 'present',
$package_ensure = 'present',
Boolean $manage_libvirt_secret = true,
) {
include nova::deps
@ -128,33 +133,38 @@ class nova::compute::rbd (
'libvirt/rbd_secret_uuid': value => $libvirt_rbd_secret_uuid;
}
file { '/etc/nova/secret.xml':
content => template('nova/secret.xml-compute.erb'),
require => Anchor['nova::config::begin'],
}
if $manage_libvirt_secret {
file { '/etc/nova/secret.xml':
content => epp('nova/libvirt-secret-ceph.xml.epp', {
'secret_name' => "${rbd_keyring} secret",
'uuid' => $libvirt_rbd_secret_uuid,
}),
require => Anchor['nova::config::begin'],
}
#Variable name shrunk in favor of removing
#the more than 140 chars puppet-lint warning.
#variable used in the get-or-set virsh secret
#resource.
$cm = '/usr/bin/virsh secret-define --file /etc/nova/secret.xml | /usr/bin/awk \'{print $2}\' | sed \'/^$/d\' > /etc/nova/virsh.secret'
exec { 'get-or-set virsh secret':
command => $cm,
unless => "/usr/bin/virsh secret-list | grep -i ${libvirt_rbd_secret_uuid}",
require => File['/etc/nova/secret.xml'],
}
Service<| tag == 'libvirt-service' |> -> Exec['get-or-set virsh secret']
#Variable name shrunk in favor of removing
#the more than 140 chars puppet-lint warning.
#variable used in the get-or-set virsh secret
#resource.
$cm = '/usr/bin/virsh secret-define --file /etc/nova/secret.xml | /usr/bin/awk \'{print $2}\' | sed \'/^$/d\' > /etc/nova/virsh.secret'
exec { 'get-or-set virsh secret':
command => $cm,
unless => "/usr/bin/virsh secret-list | grep -i ${libvirt_rbd_secret_uuid}",
require => File['/etc/nova/secret.xml'],
}
Service<| tag == 'libvirt-service' |> -> Exec['get-or-set virsh secret']
if $libvirt_rbd_secret_key {
$libvirt_key = $libvirt_rbd_secret_key
} else {
$libvirt_key = "$(ceph auth get-key ${rbd_keyring})"
}
exec { 'set-secret-value virsh':
command => "/usr/bin/virsh secret-set-value --secret ${libvirt_rbd_secret_uuid} --base64 ${libvirt_key}",
unless => "/usr/bin/virsh secret-get-value ${libvirt_rbd_secret_uuid} | grep ${libvirt_key}",
logoutput => false,
require => Exec['get-or-set virsh secret'],
if $libvirt_rbd_secret_key {
$libvirt_key = $libvirt_rbd_secret_key
} else {
$libvirt_key = "$(ceph auth get-key ${rbd_keyring})"
}
exec { 'set-secret-value virsh':
command => "/usr/bin/virsh secret-set-value --secret ${libvirt_rbd_secret_uuid} --base64 ${libvirt_key}",
unless => "/usr/bin/virsh secret-get-value ${libvirt_rbd_secret_uuid} | grep ${libvirt_key}",
logoutput => false,
require => Exec['get-or-set virsh secret'],
}
}
} else {
nova_config {

8
releasenotes/notes/libvirt-secret-ceph-b4b11706463f13c6.yaml Normal file
View File

@ -0,0 +1,8 @@
---
features:
- |
Added new ``nova::compute::libvirt::secret_ceph`` resource definition that
can be used to create a libvirt secret of type ceph.
- |
Added new ``manage_libvirt_secret`` parameter defaulting to true in the
``nova::compute::rbd`` class.

91
spec/defines/nova_compute_libvirt_secret_ceph_spec.rb Normal file
View File

@ -0,0 +1,91 @@
require 'spec_helper'
describe 'nova::compute::libvirt::secret_ceph' do
shared_examples 'nova::compute::libvirt::secret_ceph' do
describe 'with required parameters' do
let :pre_condition do
"include nova"
end
let :params do
{
:uuid => '4f515eff-47e4-425c-b24d-9c6adc56401c',
:value => 'AQBHCbtT6APDHhAA5W00cBchwkQjh3dkKsyPjw==',
:secret_name => 'client.openstack',
:secret_path => '/tmp',
}
end
let :title do
'random'
end
it { is_expected.to contain_file('/tmp/libvirt-secret-4f515eff-47e4-425c-b24d-9c6adc56401c.xml').with(
:ensure => 'present',
:owner => 'root',
:group => 'root',
:mode => '0600',
:require => 'Anchor[nova::config::begin]',
)}
it {
verify_contents(catalogue, '/tmp/libvirt-secret-4f515eff-47e4-425c-b24d-9c6adc56401c.xml', [
"<secret ephemeral=\'no\' private=\'no\'>",
" <usage type=\'ceph\'>",
" <name>client.openstack</name>",
" </usage>",
" <uuid>4f515eff-47e4-425c-b24d-9c6adc56401c</uuid>",
"</secret>"
])
}
it { is_expected.to contain_file('/tmp/libvirt-secret-4f515eff-47e4-425c-b24d-9c6adc56401c.secret').with(
:ensure => 'present',
:owner => 'root',
:group => 'root',
:mode => '0600',
:show_diff => false,
:require => 'Anchor[nova::config::begin]',
)}
it {
verify_contents(catalogue, '/tmp/libvirt-secret-4f515eff-47e4-425c-b24d-9c6adc56401c.secret', [
"AQBHCbtT6APDHhAA5W00cBchwkQjh3dkKsyPjw==",
])
}
it { is_expected.to contain_exec('get-or-set virsh secret 4f515eff-47e4-425c-b24d-9c6adc56401c').with(
:command => [
'/usr/bin/virsh', 'secret-define', '--file', '/tmp/libvirt-secret-4f515eff-47e4-425c-b24d-9c6adc56401c.xml',
],
:unless => "/usr/bin/virsh secret-list | grep -i 4f515eff-47e4-425c-b24d-9c6adc56401c",
:require => 'File[/tmp/libvirt-secret-4f515eff-47e4-425c-b24d-9c6adc56401c.xml]',
)}
it { is_expected.to contain_exec('set-secret-value virsh secret 4f515eff-47e4-425c-b24d-9c6adc56401c').with(
:command => [
'/usr/bin/virsh', 'secret-set-value', '--secret', '4f515eff-47e4-425c-b24d-9c6adc56401c',
'--file', '/tmp/libvirt-secret-4f515eff-47e4-425c-b24d-9c6adc56401c.secret',
],
:unless => "/usr/bin/virsh secret-get-value 4f515eff-47e4-425c-b24d-9c6adc56401c | grep -f /tmp/libvirt-secret-4f515eff-47e4-425c-b24d-9c6adc56401c.secret",
:logoutput => false,
:require => [
'File[/tmp/libvirt-secret-4f515eff-47e4-425c-b24d-9c6adc56401c.secret]',
'Exec[get-or-set virsh secret 4f515eff-47e4-425c-b24d-9c6adc56401c]',
],
)}
end
end
on_supported_os({
:supported_os => OSDefaults.get_supported_os
}).each do |os,facts|
context "on #{os}" do
let (:facts) do
facts.merge!(OSDefaults.get_facts())
end
it_behaves_like 'nova::compute::libvirt::secret_ceph'
end
end
end

6
templates/libvirt-secret-ceph.xml.epp Normal file
View File

@ -0,0 +1,6 @@
<secret ephemeral='no' private='no'>
<usage type='ceph'>
<name><%= $secret_name -%></name>
</usage>
<uuid><%= $uuid -%></uuid>
</secret>

6
templates/secret.xml-compute.erb
View File

@ -1,6 +0,0 @@
<secret ephemeral='no' private='no'>
<usage type='ceph'>
<name><%= @rbd_keyring %> secret</name>
</usage>
<uuid><%= @libvirt_rbd_secret_uuid %></uuid>
</secret>