Drop Admin API from Keystone

With the removal of Keystone V2, the admin and public APIs serve
no difference so we're better off removing those extra services.

Change-Id: I2a8743357934ace7aa2accc53b0df7b3865b866f
This commit is contained in:
Mohammed Naser 2018-07-31 15:48:33 -04:00 committed by Jesse Pretorius
parent 5bc4850987
commit 0fbba8a708
6 changed files with 45 additions and 65 deletions

View File

@ -157,7 +157,6 @@ keystone_role_name: admin
keystone_default_role_name: _member_
## Admin info
keystone_admin_port: 35357
keystone_admin_user_name: admin
keystone_admin_tenant_name: admin
keystone_admin_description: Admin Tenant
@ -182,7 +181,7 @@ keystone_service_adminuri_insecure: false
keystone_service_publicuri: "{{ keystone_service_publicuri_proto }}://{{ external_lb_vip_address }}:{{ keystone_service_port }}"
keystone_service_internaluri: "{{ keystone_service_internaluri_proto }}://{{ internal_lb_vip_address }}:{{ keystone_service_port }}"
keystone_service_adminuri: "{{ keystone_service_adminuri_proto }}://{{ internal_lb_vip_address }}:{{ keystone_admin_port }}"
keystone_service_adminuri: "{{ keystone_service_adminuri_proto }}://{{ internal_lb_vip_address }}:{{ keystone_service_port }}"
## Set this value to override the "public_endpoint" keystone.conf variable
#keystone_public_endpoint: "{{ keystone_service_publicuri }}"
@ -223,7 +222,6 @@ keystone_nginx_access_log_format_combined: '$remote_addr - $remote_user [$time_l
keystone_nginx_access_log_format_extras: '$request_time $upstream_response_time'
keystone_nginx_ports:
keystone-wsgi-public: "{{ keystone_service_port }}"
keystone-wsgi-admin: "{{ keystone_admin_port }}"
keystone_nginx_extra_conf:
- keepalive_timeout 70;
@ -237,9 +235,6 @@ keystone_uwsgi_ports:
keystone-wsgi-public:
http: 37358
socket: 35358
keystone-wsgi-admin:
http: 37359
socket: 5001
keystone_uwsgi_ini_overrides: {}
@ -503,10 +498,6 @@ keystone_services:
service_name: "keystone-wsgi-public"
init_config_overrides: "{{ keystone_uwsgi_init_overrides }}"
execstarts: "{{ keystone_uwsgi_bin }}/uwsgi --autoload --ini /etc/uwsgi/keystone-wsgi-public.ini"
keystone-wsgi-admin:
service_name: "keystone-wsgi-admin"
init_config_overrides: "{{ keystone_uwsgi_init_overrides }}"
execstarts: "{{ keystone_uwsgi_bin }}/uwsgi --autoload --ini /etc/uwsgi/keystone-wsgi-admin.ini"
## Extra HTTP headers for Keystone
# Add any additional headers here that Keystone should return.

View File

@ -33,7 +33,6 @@
delay: 10
with_items:
- "{{ keystone_service_port }}"
- "{{ keystone_admin_port }}"
register: _wait_check
until: _wait_check is success
retries: 5
@ -55,6 +54,46 @@
- "venv changed"
- "Restart uWSGI"
# NOTE(mnaser): This should be removed in the Stein cycle
- name: Stop and disable keystone-wsgi-admin
shell: |
return_code=0
if [[ "$(systemctl is-active keystone-wsgi-admin)" == "active" ]]; then
systemctl stop keystone-wsgi-admin
return_code=2
fi
if [[ "$(systemctl is-enabled keystone-wsgi-admin)" == "enabled" ]]; then
systemctl disable keystone-wsgi-admin
return_code=2
fi
exit ${return_code}
args:
executable: /bin/bash
register: _remove_admin_service
changed_when: _remove_admin_service.rc == 2
failed_when: _remove_admin_service.rc not in [0, 2]
listen: "Restart uWSGI"
# This task causes ansible-lint to give a ANSIBLE0014
# error, which does not make much sense given how the
# environment variable is used in this case.
# TODO(odyssey4me):
# Try to understand the issue ansible-lint is trying
# to highlight and address it.
tags:
- skip_ansible_lint
# NOTE(mnaser): This should be removed in the Stein cycle
- name: Clean up keystone-wsgi-admin service files
file:
path: "{{ item }}"
state: absent
with_items:
- "/etc/tmpfiles.d/openstack-keystone-wsgi-admin.conf"
- "/etc/systemd/system/keystone-wsgi-admin.service"
- "/etc/uwsgi/keystone-wsgi-admin.ini"
- "/var/www/cgi-bin/keystone/admin"
listen: "Restart uWSGI"
# Note (odyssey4me):
# The policy.json file is currently read continually by the services
# and is not only read on service start. We therefore cannot template
@ -106,7 +145,6 @@
timeout: 25
delay: 10
with_items:
- "{{ keystone_uwsgi_ports['keystone-wsgi-admin']['socket'] }}"
- "{{ keystone_uwsgi_ports['keystone-wsgi-public']['socket'] }}"
register: _wait_check
until: _wait_check is success

View File

@ -146,15 +146,10 @@
- name: Create WSGI symlinks
file:
src: "{{ item.src }}"
dest: "/var/www/cgi-bin/keystone/{{ item.dest }}"
src: "{{ keystone_bin }}/keystone-wsgi-public"
dest: "/var/www/cgi-bin/keystone/main"
state: link
force: yes
with_items:
- src: "{{ keystone_bin }}/keystone-wsgi-admin"
dest: admin
- src: "{{ keystone_bin }}/keystone-wsgi-public"
dest: main
notify:
- Manage LB
- Restart web server

View File

@ -13,14 +13,11 @@
# See the License for the specific language governing permissions and
# limitations under the License.
- name: Wait for services to be up
- name: Wait for service to be up
uri:
url: "{{ item }}"
url: "http://{{ ansible_host }}:{{ keystone_uwsgi_ports['keystone-wsgi-public']['http'] }}"
method: "HEAD"
status_code: 300
with_items:
- "http://{{ ansible_host }}:{{ keystone_uwsgi_ports['keystone-wsgi-admin']['http'] }}"
- "http://{{ ansible_host }}:{{ keystone_uwsgi_ports['keystone-wsgi-public']['http'] }}"
register: _wait_check
until: _wait_check is success
retries: 12

View File

@ -69,44 +69,4 @@ Listen {{ keystone_service_port }}
</VirtualHost>
Listen {{ keystone_admin_port }}
<VirtualHost *:{{ keystone_admin_port }}>
<IfVersion >= 2.4>
ErrorLogFormat "%{cu}t %M"
</IfVersion>
LogLevel {{ keystone_apache_log_level }}
# NOTE(Cloudnull): Log files can changed to use "mod_journal" when Apache 2.5 is released
ErrorLog {{ keystone_apache_default_log_folder }}/keystone-apache-error.log
CustomLog {{ keystone_apache_default_log_folder }}/ssl_access.log {{ keystone_apache_custom_log_format }}
Options +FollowSymLinks
{% if keystone_ssl | bool and keystone_service_adminuri_proto == "https" -%}
SSLEngine on
SSLCertificateFile {{ keystone_ssl_cert }}
SSLCertificateKeyFile {{ keystone_ssl_key }}
{% if keystone_user_ssl_ca_cert is defined -%}
SSLCACertificateFile {{ keystone_ssl_ca_cert }}
{% endif -%}
SSLCompression Off
SSLProtocol {{ keystone_ssl_protocol }}
SSLHonorCipherOrder On
SSLCipherSuite {{ keystone_ssl_cipher_suite }}
SSLOptions +StdEnvVars +ExportCertData
{% endif %}
<Directory /var/www/cgi-bin/keystone>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>
ProxyPass / uwsgi://127.0.0.1:{{ keystone_uwsgi_ports['keystone-wsgi-admin']["socket"] }}/
</VirtualHost>
ProxyPass /identity uwsgi://127.0.0.1:{{ keystone_uwsgi_ports['keystone-wsgi-public']['socket'] }}/
ProxyPass /identity_admin uwsgi://127.0.0.1:{{ keystone_uwsgi_ports['keystone-wsgi-admin']['socket'] }}/

View File

@ -139,7 +139,6 @@ idp_contact_type = {{ keystone_idp.contact_type }}
[eventlet_server]
admin_bind_host = {{ keystone_bind_address }}
admin_port = {{ keystone_admin_port }}
public_port = {{ keystone_service_port }}
[credential]