x
/
novajoin
Code Issues Proposed changes
Nova metadata dynamic vendordata server for enrolling IPA instances
24 Commits 1 Branch 26 Tags 1.9 MiB
Python 98.8%
Shell 1.1%
Go to file
Rob Crittenden 1c51140028 Initial commit of REST/notification services 
This is based heavily on the WSGI code in cinder.

There are two services: a REST service and a notification
listener.

Currently both log only to stdout.

The configuration file join.conf controls the REST service.

nova configuration should look like this (assuming the REST
service is running on the nova compute host).

vendordata_providers = StaticJSON, DynamicJSON
vendordata_dynamic_targets = 'join@http://127.0.0.1:9999/v1/'
vendordata_driver = nova.api.metadata.vendordata_http.HTTPFileVendorData
vendordata_dynamic_connect_timeout = 5
vendordata_dynamic_read_timeout = 30
vendordata_jsonfile_path = /etc/nova/cloud-config.json

For the notification service like this:

notification_driver = messaging
notification_topic = notifications
notify_on_state_change = vm_state

Authentication is disabled in api-paste.ini for now.
 		2016-07-05 19:53:11 +00:00
files Initial commit of REST/notification services 2016-07-05 19:53:11 +00:00
novajoin Initial commit of REST/notification services 2016-07-05 19:53:11 +00:00
scripts Initial commit of REST/notification services 2016-07-05 19:53:11 +00:00
.gitignore Add basic .gitignore 2016-02-26 20:05:07 +00:00
LICENSE Initial commit 2016-02-26 19:47:47 +00:00
MANIFEST.in Remove hooks-specific implementation 2016-07-05 17:53:10 +00:00
Makefile Initial commit 2016-02-26 19:47:47 +00:00
README.md Initial commit of REST/notification services 2016-07-05 19:53:11 +00:00
setup.py Execute IPA permissions installer automatically 2016-02-26 19:51:56 +00:00

README.md

==== WARNING ====

These instructions are incomplete and DO NOT WORK

novajoin Package

This Python package provides a vendordata plugin for the OpenStack nova metadata service to manage host instantiation in an IPA server.

It consists of two services:

- REST service
- notification listener

The REST service will respond to dynamic requests from the nova metadata server. This is used to add hosts into IPA.

The notification listener will handle instance delete requests and remove the appropriate host from IPA.

Build

In this directory, run:

python setup.py build

Installation

In this directory, run:

python setup.py install

Configuration

Run novajoin-install to install and configure the plugin on a pre-installed nova server.

Pre-requisites

You will need the IPA admin password, or an account that can add privileges, permissions, roles and can retrieve keytabs.

You will need to provide Openstack credentails in the environment so that the glance metadata upload can occur.

This will:

  • copy the cloud-init and enrollment script to /etc/nova
  • obtain a keytab to be used to authenticate against IPA when doing host management
  • call out to a script to create the requisite permissions and role in IPA
  • add the IPA metadata to the glance metadata service

The nova compute service will need to be manually restarted.

The installer takes the following options:

--hostname: use this value as the FQDN of the server. --user: user that the nova service runs as. This is needed to set filesystem permissions --principal: the user used to configure IPA integration: create permissions, get the keytab, etc. Default is the IPA admin account. --password: the password for the principal. If this is not set the the password is obtained interactively --password-file: the file containing the password for the principal.

Metadata REST Service Configuration

The REST service is configured in /etc/nova/ipaclient.conf in the DEFAULT section. It provides the following options:

url: The JSON RPC URL to an IPA server, e.g. https://ipa.host.domain/ipa/json keytab: The Kerberos keytab containing the credentails for the user nova will use to manage hosts. The default is /etc/krb5.keytab. service_name: The service name of the JSON RPC handler. This is normally HTTP@ domain: If dhcp_domain is not set in nova.conf then this value is used as the default domain for IPA hosts. connect_retries: The number of times to attempt to contact the IPA server before failing. project_subdomain: Use the project the instance is created in as the subddomain for the fully-qualified domain name. For example if the project is admin and the domain is example.com and the instance name is test the FQDN will be test.admin.example.com normalize_project: A project name can contain values not allowed as a DNS label. This will convert invalid values to a dash (-) dropping leading and trailing dashes. inject_files: Files to inject into the VM.

Origin

This builds on the work of Rich Megginson and Nathan Kinder. Rich did the initial implementation visible at https://github.com/richm/rdo-vm-factory/blob/master/rdo-ipa-nova

Copyright and License

Copyright 2016 Red Hat, Inc.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.