Andrew Bogott has submitted this change and it was merged. (
https://gerrit.wikimedia.org/r/345638 )
Change subject: dns-floating-ip-updater.py: Use keystone api v3
......................................................................
dns-floating-ip-updater.py: Use keystone api v3
This will allow us to use novaobserver creds rather than novaadmin.
The v2 api doesn't properly observer policy.json and rejects novaobserver
for things that should be permitted.
Bug: T158650
Change-Id: I4720394615ec233b34a5aba8edb34d5762aa915d
---
M modules/role/files/labs/dns-floating-ip-updater.py
M modules/role/manifests/labs/dns_floating_ip_updater.pp
2 files changed, 15 insertions(+), 13 deletions(-)
Approvals:
Andrew Bogott: Looks good to me, approved
jenkins-bot: Verified
diff --git a/modules/role/files/labs/dns-floating-ip-updater.py
b/modules/role/files/labs/dns-floating-ip-updater.py
old mode 100644
new mode 100755
index 799e9c8..bd77850
--- a/modules/role/files/labs/dns-floating-ip-updater.py
+++ b/modules/role/files/labs/dns-floating-ip-updater.py
@@ -4,9 +4,9 @@
import re
import yaml
-import keystoneclient.session as keystonesession
-import keystoneclient.auth.identity.v2 as keystoneauth
-import keystoneclient.client as keystoneclient
+from keystoneclient.auth.identity import generic
+from keystoneclient import session as keystone_session
+from keystoneclient.v3 import client as keystone_client
import novaclient.client as novaclient
import designateclient.v2.client as designateclient
@@ -37,25 +37,27 @@
def getKeystoneSession(config, project):
- return keystonesession.Session(auth=keystoneauth.Password(
+ auth = generic.Password(
auth_url=config['nova_api_url'],
username=config['username'],
password=config['password'],
- tenant_name=project
- ))
+ user_domain_name='Default',
+ project_domain_name='Default',
+ project_name=project)
-keystone_admin_session = getKeystoneSession(config,
config['admin_project_name'])
-keystone_client = keystoneclient.Client(
- session=keystone_admin_session,
- endpoint=config['nova_api_url']
-)
+ return keystone_session.Session(auth=auth)
+
+
+observer_session = getKeystoneSession(config, config['admin_project_name'])
+keystone_client = keystone_client.Client(
+ session=observer_session, interface='public', connect_retries=5)
keystone_sessions = {}
project_main_zone_ids = {}
public_addrs = {}
existing_As = []
# Go through every tenant
-for tenant in keystone_client.tenants.list():
+for tenant in keystone_client.projects.list():
keystone_sessions[tenant.name] = getKeystoneSession(config, tenant.name)
server_addresses = {}
diff --git a/modules/role/manifests/labs/dns_floating_ip_updater.pp
b/modules/role/manifests/labs/dns_floating_ip_updater.pp
index a592e20..397abc5 100644
--- a/modules/role/manifests/labs/dns_floating_ip_updater.pp
+++ b/modules/role/manifests/labs/dns_floating_ip_updater.pp
@@ -6,7 +6,7 @@
$config = {
'username' => 'novaadmin',
'password' =>
$keystoneconfig['ldap_user_pass'],
- 'nova_api_url' =>
"http://${nova_controller_hostname}:35357/v2.0";,
+ 'nova_api_url' =>
"http://${nova_controller_hostname}:35357/v3";,
'admin_project_name' =>
$keystoneconfig['admin_project_name'],
'floating_ip_ptr_zone' =>
$designateconfig['floating_ip_ptr_zone'],
'floating_ip_ptr_fqdn_matching_regex' =>
$designateconfig['floating_ip_ptr_fqdn_matching_regex'],
--
To view, visit https://gerrit.wikimedia.org/r/345638
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I4720394615ec233b34a5aba8edb34d5762aa915d
Gerrit-PatchSet: 5
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Andrew Bogott <[email protected]>
Gerrit-Reviewer: Andrew Bogott <[email protected]>
Gerrit-Reviewer: Giuseppe Lavagetto <[email protected]>
Gerrit-Reviewer: Volans <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
