Alexandros Kosiaris has submitted this change and it was merged.
Change subject: maps: Add usernames/passwords to kartotherian config
......................................................................
maps: Add usernames/passwords to kartotherian config
In order for the kartotherian service to connect to DB & cassandra
provide it with the passwords in the generated service config.
Bug: T108610
Change-Id: Ib18328e86f15ddf5505bcb0b443b02f63c5b95b8
---
M manifests/role/maps.pp
M modules/kartotherian/manifests/init.pp
M modules/kartotherian/templates/config.yaml.erb
A templates/maps/grants.cql.erb
4 files changed, 36 insertions(+), 0 deletions(-)
Approvals:
Alexandros Kosiaris: Looks good to me, approved
jenkins-bot: Verified
diff --git a/manifests/role/maps.pp b/manifests/role/maps.pp
index 06588d9..6d40844 100644
--- a/manifests/role/maps.pp
+++ b/manifests/role/maps.pp
@@ -57,6 +57,15 @@
mode => '0400',
content => template('maps/grants.sql.erb'),
}
+ # Cassandra grants
+ $cassandra_kartotherian_pass = hiera('maps::cassandra_kartotherian_pass')
+ $cassandra_tilerator_pass = hiera('maps::cassandra_tilerator_pass')
+ file { '/usr/local/bin/maps-grants.cql':
+ owner => 'root',
+ group => 'root',
+ mode => '0400',
+ content => template('maps/grants.cql.erb'),
+ }
}
class role::maps::slave {
diff --git a/modules/kartotherian/manifests/init.pp
b/modules/kartotherian/manifests/init.pp
index 826ff82..ec06b58 100644
--- a/modules/kartotherian/manifests/init.pp
+++ b/modules/kartotherian/manifests/init.pp
@@ -7,6 +7,12 @@
# classes as well as conform to a de-facto standard of having a module for
every
# service
class kartotherian() {
+
+ $cassandra_kartotherian_user = 'kartotherian'
+ $cassandra_kartotherian_pass = hiera('maps::cassandra_kartotherian_pass')
+ $pgsql_kartotherian_user = 'kartotherian'
+ $pgsql_kartotherian_pass = hiera('maps::postgresql_kartotherian_pass')
+
service::node { 'kartotherian':
port => 4000,
config => template('kartotherian/config.yaml.erb'),
diff --git a/modules/kartotherian/templates/config.yaml.erb
b/modules/kartotherian/templates/config.yaml.erb
index fb291ef..687dca2 100644
--- a/modules/kartotherian/templates/config.yaml.erb
+++ b/modules/kartotherian/templates/config.yaml.erb
@@ -1,2 +1,10 @@
# Kartotherian-specific settings
+
+variables:
+ osmdb-user: '<%= @pgsql_kartotherian_user %>'
+ osmdb-pswd: '<%= @pgsql_kartotherian_pass %>'
+
+ cassandra-user: '<%= @cassandra_kartotherian_user %>'
+ cassandra-pswd: '<%= @cassandra_kartotherian_pass %>'
+
sources: sources.prod.yaml
diff --git a/templates/maps/grants.cql.erb b/templates/maps/grants.cql.erb
new file mode 100644
index 0000000..65012b8
--- /dev/null
+++ b/templates/maps/grants.cql.erb
@@ -0,0 +1,13 @@
+# Cassandra grants for maps
+CREATE USER kartotherian WITH PASSWORD '<%= @cassadra_kartotherian_pass %>';
+CREATE USER tilerator WITH PASSWORD '<%= @cassadra_tilerator_pass %>';
+
+# First revoking all permissions to maintain consistency
+REVOKE ALL PERMISSIONS ON ALL KEYSPACES FROM kartotherian;
+REVOKE ALL PERMISSIONS ON ALL KEYSPACES FROM tilerator;
+# kartotherian read only
+GRANT SELECT ON KEYSPACE v1 to kartotherian;
+# tilerator should be able to update tiles
+GRANT SELECT ON KEYSPACE v1 to tilerator;
+GRANT MODIFY ON KEYSPACE v1 to tilerator;
+# TODO: Admin account to create indexes, alter tables?
--
To view, visit https://gerrit.wikimedia.org/r/230549
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: Ib18328e86f15ddf5505bcb0b443b02f63c5b95b8
Gerrit-PatchSet: 5
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Yurik <[email protected]>
Gerrit-Reviewer: Alexandros Kosiaris <[email protected]>
Gerrit-Reviewer: BBlack <[email protected]>
Gerrit-Reviewer: Dzahn <[email protected]>
Gerrit-Reviewer: Giuseppe Lavagetto <[email protected]>
Gerrit-Reviewer: Jcrespo <[email protected]>
Gerrit-Reviewer: MaxSem <[email protected]>
Gerrit-Reviewer: Yurik <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
