This PS udpates the keystone endpoint definition to point to the
correct host for the admin endpoint when looked up using endpoint
functions from helm-toolkit.
Change-Id: Ic6b82a002cca92e37d21f594bad5f00758f1ea7a
Signed-off-by: Pete Birley <pete@port.direct>
This PS updates the logging config to pass null as a string though to
the rendering engine, which is required to avoid things like `<no value>`
when base64 encoding output.
Change-Id: I04d6afbc693ec1adf560c7be15704c8b7434c08f
Signed-off-by: Pete Birley <pete@port.direct>
This PS moves the keystone chart to be linine with other OSH
components and drives all config via the charts values.yaml
Change-Id: I14ee6ede0a87619ecbb2c56d0edf82ffbc5606be
Signed-off-by: Pete Birley <pete@port.direct>
This PS updates the keystoen chart to stop running the keystone api
as the root user.
Change-Id: If3042210f761476846da02fc8e648c700267a591
Signed-off-by: Pete Birley <pete@port.direct>
This PS disables the v2 keystone API, and finishes the migration to
full v3 support.
Change-Id: I3021ebe0bee668db9f28e7fb18e2d4b26172f209
Signed-off-by: Pete Birley <pete@port.direct>
This PS moves to use port 80 by default for the keystone
asdmin endpoint, and adjusts paths accordingly.
Change-Id: Iccae704dadc17eba269e857301654782f64763c9
Signed-off-by: Pete Birley <pete@port.direct>
As reported in OSSN-0083[0], "get_identity_providers" is invalid
and should be singular "get_identity_provider". The former rule
is ignored, this change to make the rule singular fixes this
issue.
[0] https://wiki.openstack.org/wiki/OSSN/OSSN-0083
Change-Id: I479bcda89b0be0056717864e79269b8d071d98ec
This PS removes the double logging of openstack components that
were caused by outputting to both stdout and stderr.
Change-Id: I6e0ae5861bbf5b8d736ae08251aa865e1c4ce0d8
Signed-off-by: Pete Birley <pete@port.direct>
This PS updates keystone, and the keystone endpoints sections to use
the same layout for port declarations as other charts.
Change-Id: I7dddabee6c74bf023da4b1cdf722a409e7475f8f
Signed-off-by: Pete Birley <pete@port.direct>
This patch sets the notifier driver to messagingv2 so all
messages sent to RabbitMQ using the 2.0 format.
For info:
Auth notificaitons are supressed by default, to enable it
uncomment the following parameter:
conf:
DEFAULT:
notification_opt_out: ""
Change-Id: I652fc34a229612dcb8b96c8722b8c6ac1c8aba3e
Signed-off-by: Ruslan Khanbikov <rk760n@att.com>
Keystone token expiration, rotation frequency and active keys
values should follow the formula:
max_active_keys = (token_expiration / rotation_frequency) + 2
max_active_keys by default is 3
token expiration set to 43200 (12h)
rotation frequency set to 12 hours
Change-Id: Ia04daec9b2905ef2d3f2d4fbb43557dda220dc70
Signed-off-by: Ruslan Khanbikov <rk760n@att.com>
This introduces a mechanism for generating the logging.conf
file for the openstack services via the values. This allows us to
define loggers, handlers, and formatters for the services and the
modules they're composed of.
This also allows us to take advantage of the oslo fluent handler
and formatter. The fluent handler and formatter give us the
following benefits: sending logs directly to fluentd instead of
routed to stdout/stderr and then through fluentbit to fluentd,
project specific tags on the logged events (enables us to define
more robust filters in fluentd for aggregation if required),
full traceback support, and additional metadata (modules that
created logged event, etc)
Depends-On: https://review.openstack.org/577796
Change-Id: I63340ce6b03191d93a74d9ac6947f0b49b8a1a39
This PS adds support for TLS on over-ridden fqdn's for public
endpoints for core OpenStack Services. Currently this implementation
is limited, in that it does not provide support for dynamicly loading
CAs into the containers, or specifying them manually via configuration.
As a result only well known or CA's added manually to containers will
be recognised.
Change-Id: I8f1b699af29cbed2d83ad91bb6840dccce8c5146
Depends-On: I535f38a8d92c01280d79926a1f0acd06984aabbf
Signed-off-by: Tin Lam <tin@irrational.io>
Signed-off-by: Pete Birley <pete@port.direct>
As of Rocky, keystone creates a default "member" role upon bootstrap.
This change modifies any references to the manually created
"_member_" role to "member". In a future change, the manualy creation
of this role in keystone can be removed since it will no longer be
needed.
Change-Id: I65c63695976f38da21dc6dd8f40ad70e23da6f48
This PS adds dep checking for the rabbitmq management jobs.
Change-Id: Ibdaa1a9d6db0eb8fae83ba6390d629af7ee63571
Signed-off-by: Pete Birley <pete@port.direct>
This PS adds the local registry image managment to OSH from OSH-Infra.
With this the delta between helm-toolkits in the Repo's is removed,
allowing the toolkit from OSH-Infra to be used and the one from OSH
to be depreciated.
Change-Id: If5e218cf7df17261fe5ef249d281f9d9637e2f6a
Co-Authored-By: Pete Birley <pete@port.direct>
Move to v0.3.1 of kubernetes-entrypoint which has 2
breaking changes to pod dependencies, and also adds support for
depending on jobs via labels.
Change-Id: I49d2cea11fbe5c5919ae22a020b877ebbb285992
This PS adds vhost management to rabbitmq jobs. It also prevents
sensitive information being displayed in the management job, and
removes the 'administrator' tag from service users.
Change-Id: Id337f763c5e4776bce7269676a8a2dc54dc2e5f8
This patch set provides PATCH capability for ldap-backed domain config,
and prevents silent failure if the configuration contains erroneous
setting. This also moves from loading .conf files into DB directly,
and uses the API endpoints.
Change-Id: I17a19046fa96e0f3e8fb029c156ba79c924a0097
Signed-off-by: Tin Lam <tin@irrational.io>
This PS allows arbitary hostnames to be used for public endpoints,
provided the resolve externally to the ingress controllers.
Change-Id: I44411687f756968d00178d487af66c2393e6bde0
This patch set performs non-critical polish fix to [0].
[0] https://review.openstack.org/#/c/552171/
Change-Id: I5bbb64d5af65782665fd659886e55e25bac61452
Signed-off-by: Tin Lam <tin@irrational.io>
This version is already being used by some charts, so this brings the
rest of the charts in line and allows them to use a new feature,
pod dependencies, that this version provides.
Change-Id: Ie8289eb09b31cd8f98c2c5b4dd5bbe469078e6d8
This patch set adds TLS support for keystone LDAP.
External-tracking: OSH#555
Change-Id: Ice32a31a712b8534a5d1a8f90a8a203710bdb9a9
Signed-off-by: Tin Lam <tin@irrational.io>
This PS moves static dependencies under a 'static' key to allow
expansion to cover dynamic dependencies.
Change-Id: I38990b93aa79fa1f70af6f2c78e5e5c61c63f32c
This PS moves the default image in OSH for most services to use LOCI
and also provides a Kolla gate for newton openstack.
Change-Id: Ice6cb9f89bc3ce6e8280e580d215aedda9e71904
This PS removes the user managemnt from the rally driven helm tests
which allows LDAP and other read only sources being used to validate
service functionality, in addition to reducing false -ve results in
the Zuul gates.
Change-Id: I1cc0e99bf74d578648b3cd40eaf60c1804044d88
This PS moves all credentials for OpenStack services from 'user' to
the service name. This allows a single yaml snippet to articulate
the credentials for a deployment.
Change-Id: Ic720109f2ba854561b23767cb480bcae91f74b6b
This PS updates the image used in the ingress controller and
adds UDP/TCP proxying. In addition the chart has been given
a spring clean to better match other OSH charts.
Change-Id: Ib892b82c4657c42e7531a2ce81746398e7bd4df5
This PS allows the ingress rules to be dynamicly driven from the
values.yaml, permitting the ingress cotnroller to ba changed and
custom rules to be applied: eg whitelisting of clients.
Change-Id: Ica6b4692ff9b6b77d1efe6bae212a1227e56ca66
This PS makes the service-specific images for Keystone have
explicit names, allowing simple over-riding of images for an
entire site.
Change-Id: I0b50d07fc0c2e00ab7803dd4c986c8a26e25ea49
