Puppet Class: cinder::keystone::authtoken

Defined in:
manifests/keystone/authtoken.pp

Overview

class: cinder::keystone::authtoken

Configure the keystone_authtoken section in the configuration file

Parameters

username

(Optional) The name of the service user Defaults to ‘cinder’

password

(Optional) Password to create for the service user Defaults to $::os_service_default

auth_url

(Optional) The URL to use for authentication. Defaults to ‘localhost:35357’.

project_name

(Optional) Service project name Defaults to ‘services’

user_domain_name

(Optional) Name of domain for $username Defaults to $::os_service_default

project_domain_name

(Optional) Name of domain for $project_name Defaults to $::os_service_default

insecure

(Optional) If true, explicitly allow TLS without checking server cert against any certificate authorities. WARNING: not recommended. Use with caution. Defaults to $:os_service_default

auth_section

(Optional) Config Section from which to load plugin specific options Defaults to $::os_service_default.

auth_type

(Optional) Authentication type to load Defaults to ‘password’

auth_uri

(Optional) Complete public Identity API endpoint. Defaults to ‘localhost:5000’.

auth_version

(Optional) API version of the admin Identity API endpoint. Defaults to $::os_service_default.

cache

(Optional) Env key for the swift cache. Defaults to $::os_service_default.

cafile

(Optional) A PEM encoded Certificate Authority to use when verifying HTTPs connections. Defaults to $::os_service_default.

certfile

(Optional) Required if identity server requires client certificate Defaults to $::os_service_default.

check_revocations_for_cached

(Optional) If true, the revocation list will be checked for cached tokens. This requires that PKI tokens are configured on the identity server. boolean value. Defaults to $::os_service_default.

delay_auth_decision

(Optional) Do not handle authorization requests within the middleware, but delegate the authorization decision to downstream WSGI components. Boolean value Defaults to $::os_service_default.

enforce_token_bind

(Optional) Used to control the use and type of token binding. Can be set to: “disabled” to not check token binding. “permissive” (default) to validate binding information if the bind type is of a form known to the server and ignore it if not. “strict” like “permissive” but if the bind type is unknown the token will be rejected. “required” any form of token binding is needed to be allowed. Finally the name of a binding method that must be present in tokens. String value. Defaults to $::os_service_default.

hash_algorithms

(Optional) Hash algorithms to use for hashing PKI tokens. This may be a single algorithm or multiple. The algorithms are those supported by Python standard hashlib.new(). The hashes will be tried in the order given, so put the preferred one first for performance. The result of the first hash will be stored in the cache. This will typically be set to multiple values only while migrating from a less secure algorithm to a more secure one. Once all the old tokens are expired this option should be set to a single value for better performance. List value. Defaults to $::os_service_default.

http_connect_timeout

(Optional) Request timeout value for communicating with Identity API server. Defaults to $::os_service_default.

http_request_max_retries

(Optional) How many times are we trying to reconnect when communicating with Identity API Server. Integer value Defaults to $::os_service_default.

include_service_catalog

(Optional) Indicate whether to set the X-Service-Catalog header. If False, middleware will not ask for service catalog on token validation and will not set the X-Service-Catalog header. Boolean value. Defaults to $::os_service_default.

keyfile

(Optional) Required if identity server requires client certificate Defaults to $::os_service_default.

memcache_pool_conn_get_timeout

(Optional) Number of seconds that an operation will wait to get a memcached client connection from the pool. Integer value Defaults to $::os_service_default.

memcache_pool_dead_retry

(Optional) Number of seconds memcached server is considered dead before it is tried again. Integer value Defaults to $::os_service_default.

memcache_pool_maxsize

(Optional) Maximum total number of open connections to every memcached server. Integer value Defaults to $::os_service_default.

memcache_pool_socket_timeout

(Optional) Number of seconds a connection to memcached is held unused in the pool before it is closed. Integer value Defaults to $::os_service_default.

memcache_pool_unused_timeout

(Optional) Number of seconds a connection to memcached is held unused in the pool before it is closed. Integer value Defaults to $::os_service_default.

memcache_secret_key

(Optional, mandatory if memcache_security_strategy is defined) This string is used for key derivation. Defaults to $::os_service_default.

memcache_security_strategy

(Optional) If defined, indicate whether token data should be authenticated or authenticated and encrypted. If MAC, token data is authenticated (with HMAC) in the cache. If ENCRYPT, token data is encrypted and authenticated in the cache. If the value is not one of these options or empty, auth_token will raise an exception on initialization. Defaults to $::os_service_default.

memcache_use_advanced_pool

(Optional) Use the advanced (eventlet safe) memcached client pool. The advanced pool will only work under python 2.x Boolean value Defaults to $::os_service_default.

memcached_servers

(Optional) Optionally specify a list of memcached server(s) to use for caching. If left undefined, tokens will instead be cached in-process. Defaults to $::os_service_default.

region_name

(Optional) The region in which the identity server can be found. Defaults to $::os_service_default.

revocation_cache_time

(Optional) Determines the frequency at which the list of revoked tokens is retrieved from the Identity service (in seconds). A high number of revocation events combined with a low cache duration may significantly reduce performance. Only valid for PKI tokens. Integer value Defaults to $::os_service_default.

signing_dir

(Optional) Directory used to cache files related to PKI tokens. Defaults to $::os_service_default.

token_cache_time

(Optional) In order to prevent excessive effort spent validating tokens, the middleware caches previously-seen tokens for a configurable duration (in seconds). Set to -1 to disable caching completely. Integer value Defaults to $::os_service_default.

Parameters:

  • username (Any) (defaults to: 'cinder')
  • password (Any) (defaults to: $::os_service_default)
  • auth_url (Any) (defaults to: 'http://localhost:35357')
  • project_name (Any) (defaults to: 'services')
  • user_domain_name (Any) (defaults to: $::os_service_default)
  • project_domain_name (Any) (defaults to: $::os_service_default)
  • insecure (Any) (defaults to: $::os_service_default)
  • auth_section (Any) (defaults to: $::os_service_default)
  • auth_type (Any) (defaults to: 'password')
  • auth_uri (Any) (defaults to: 'http://localhost:5000')
  • auth_version (Any) (defaults to: $::os_service_default)
  • cache (Any) (defaults to: $::os_service_default)
  • cafile (Any) (defaults to: $::os_service_default)
  • certfile (Any) (defaults to: $::os_service_default)
  • check_revocations_for_cached (Any) (defaults to: $::os_service_default)
  • delay_auth_decision (Any) (defaults to: $::os_service_default)
  • enforce_token_bind (Any) (defaults to: $::os_service_default)
  • hash_algorithms (Any) (defaults to: $::os_service_default)
  • http_connect_timeout (Any) (defaults to: $::os_service_default)
  • http_request_max_retries (Any) (defaults to: $::os_service_default)
  • include_service_catalog (Any) (defaults to: $::os_service_default)
  • keyfile (Any) (defaults to: $::os_service_default)
  • memcache_pool_conn_get_timeout (Any) (defaults to: $::os_service_default)
  • memcache_pool_dead_retry (Any) (defaults to: $::os_service_default)
  • memcache_pool_maxsize (Any) (defaults to: $::os_service_default)
  • memcache_pool_socket_timeout (Any) (defaults to: $::os_service_default)
  • memcache_pool_unused_timeout (Any) (defaults to: $::os_service_default)
  • memcache_secret_key (Any) (defaults to: $::os_service_default)
  • memcache_security_strategy (Any) (defaults to: $::os_service_default)
  • memcache_use_advanced_pool (Any) (defaults to: $::os_service_default)
  • memcached_servers (Any) (defaults to: $::os_service_default)
  • region_name (Any) (defaults to: $::os_service_default)
  • revocation_cache_time (Any) (defaults to: $::os_service_default)
  • signing_dir (Any) (defaults to: $::os_service_default)
  • token_cache_time (Any) (defaults to: $::os_service_default) 


193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
 
# File 'manifests/keystone/authtoken.pp', line 193

class cinder::keystone::authtoken(
  $username                       = 'cinder',
  $password                       = $::os_service_default,
  $auth_url                       = 'http://localhost:35357',
  $project_name                   = 'services',
  $user_domain_name               = $::os_service_default,
  $project_domain_name            = $::os_service_default,
  $insecure                       = $::os_service_default,
  $auth_section                   = $::os_service_default,
  $auth_type                      = 'password',
  $auth_uri                       = 'http://localhost:5000',
  $auth_version                   = $::os_service_default,
  $cache                          = $::os_service_default,
  $cafile                         = $::os_service_default,
  $certfile                       = $::os_service_default,
  $check_revocations_for_cached   = $::os_service_default,
  $delay_auth_decision            = $::os_service_default,
  $enforce_token_bind             = $::os_service_default,
  $hash_algorithms                = $::os_service_default,
  $http_connect_timeout           = $::os_service_default,
  $http_request_max_retries       = $::os_service_default,
  $include_service_catalog        = $::os_service_default,
  $keyfile                        = $::os_service_default,
  $memcache_pool_conn_get_timeout = $::os_service_default,
  $memcache_pool_dead_retry       = $::os_service_default,
  $memcache_pool_maxsize          = $::os_service_default,
  $memcache_pool_socket_timeout   = $::os_service_default,
  $memcache_pool_unused_timeout   = $::os_service_default,
  $memcache_secret_key            = $::os_service_default,
  $memcache_security_strategy     = $::os_service_default,
  $memcache_use_advanced_pool     = $::os_service_default,
  $memcached_servers              = $::os_service_default,
  $region_name                    = $::os_service_default,
  $revocation_cache_time          = $::os_service_default,
  $signing_dir                    = $::os_service_default,
  $token_cache_time               = $::os_service_default,
) {

  include ::cinder::deps

  if is_service_default($password) and ! $::cinder::api::keystone_password {
    fail('Please set password for cinder service user')
  }

  $username_real = pick($::cinder::api::keystone_user,$username)
  $password_real = pick($::cinder::api::keystone_password,$password)
  $project_name_real = pick($::cinder::api::keystone_tenant,$project_name)
  $auth_uri_real = pick($::cinder::api::auth_uri,$auth_uri)
  $auth_url_real = pick($::cinder::api::identity_uri,$auth_url)
  $memcached_servers_real = pick($::cinder::api::memcached_servers,$memcached_servers)

  keystone::resource::authtoken { 'cinder_config':
    username                       => $username_real,
    password                       => $password_real,
    project_name                   => $project_name_real,
    auth_url                       => $auth_url_real,
    auth_uri                       => $auth_uri_real,
    auth_version                   => $auth_version,
    auth_type                      => $auth_type,
    auth_section                   => $auth_section,
    user_domain_name               => $user_domain_name,
    project_domain_name            => $project_domain_name,
    insecure                       => $insecure,
    cache                          => $cache,
    cafile                         => $cafile,
    certfile                       => $certfile,
    check_revocations_for_cached   => $check_revocations_for_cached,
    delay_auth_decision            => $delay_auth_decision,
    enforce_token_bind             => $enforce_token_bind,
    hash_algorithms                => $hash_algorithms,
    http_connect_timeout           => $http_connect_timeout,
    http_request_max_retries       => $http_request_max_retries,
    include_service_catalog        => $include_service_catalog,
    keyfile                        => $keyfile,
    memcache_pool_conn_get_timeout => $memcache_pool_conn_get_timeout,
    memcache_pool_dead_retry       => $memcache_pool_dead_retry,
    memcache_pool_maxsize          => $memcache_pool_maxsize,
    memcache_pool_socket_timeout   => $memcache_pool_socket_timeout,
    memcache_secret_key            => $memcache_secret_key,
    memcache_security_strategy     => $memcache_security_strategy,
    memcache_use_advanced_pool     => $memcache_use_advanced_pool,
    memcache_pool_unused_timeout   => $memcache_pool_unused_timeout,
    memcached_servers              => $memcached_servers_real,
    region_name                    => $region_name,
    revocation_cache_time          => $revocation_cache_time,
    signing_dir                    => $signing_dir,
    token_cache_time               => $token_cache_time,
  }
}