Open Stack

We are amped to announce the release of:

puppet-keystone 9.0.0: Puppet module for OpenStack Keystone

This release is part of the newton release series.

For more details, please see below.

9.0.0
^^^^^

This is the first Mitaka release for puppet-keystone module.

Support for multi-domain has been added.  You can configure LDAP
identity drivers along with the sql, and have multi-domain working.


New Features
************

* Add keystone::disable_admin_token_auth class Allow to disable
  admin_token (highly recommended by Keystone team) after an initial
  bootstrap.

* Federation support for Mellon.

* Run keystone-manage bootstrap Per upstream Keystone Mitaka commit
  7b7fea7a3fe7677981fbf9bac5121bc15601163 keystone no longer creates
  the default domain during the db_sync. This feature enables by
  default the usage of keystone-manage bootstrap.

* moves all dependencies to an external class. This allows keystone
  to be installed and managed via external mechanisms like venvs or
  docker.

* Resource keystone_identity_provider for Keystone, used for
  Identity Federation. The remote-id parameter is missing from
  openstack client Kilo release on most distributions so this provider
  will work starting with Liberty.

* Add the ability to manage LDAP support packages or not. In some
  instances you may not want this module installing the LDAP support
  packages even if you are using LDAP with keystone. The default
  behavior will be no change from before.

* Add keystone domain specific configuration. Adds a provider able
  to configure multiple domains and two parameters in keystone class
  to setup a working multi-domains configuration.

* Support for multiple ldap backend. It enables users to inject
  multiple ldap backend configurations into keystone.

* Add policy driver option for Keystone. This option allows to
  configure the policy backend driver in the keystone.policy
  namespace. New parameter is policy/driver, using Keystone default
  value.

* Provides bool to determine if policy-rc.d should be managed for
  keystone eventlet service.

* The module no longer manages POSIX users/groups, file and
  directory, that are already managed by packaging.

* Support for multi-domain;

* Remove prefetch in keystone_user/keystone_user_role

* Switch to puppet-oslo resource usage (instead of manual
  configuration file editing).


Known Issues
************

* Keystone eventlet service is auto-started on debian based systems
  on package install.


Upgrade Notes
*************

* Usage of $::os_service_default function in init, db and logging
  classes. It will make sure that some Keystone parameters are using
  OpenStack default values.

* The prefetch and associated instances class function removal could
  impact users that somehow use the command *puppet resource
  keystone_user* or *puppet resource keystone_user_role* in
  production.  Those commands won't work anymore.  Directly use the
  associated *openstack* commands to get the same effect.


Deprecation Notes
*****************

* Deprecate PKI signing related parameters.

* Remove deprecated tenant LDAP parameters.

* The single wsgi script for both the keystone admin and public
  endpoints have been deprecated upstream. As such, our support of a
  single wsgi script for keystone is also deprecated.

* keystone::python class is deprecated, please use keystone::client.

* Remove unused and broken keystone::dev::install class.

* service_provider parameter is deprecated, does nothing and will be
  removed in a future release. The parameter has no effect. The
  Service provider will be found by Puppet itself. If you really need
  to override this value, please use a Puppet resource collector,
  using keystone-service resource tag.

* verbose option is now deprecated for removal, the parameter has no
  effect.


Bug Fixes
*********

* Fixes bug 1533913 so admin user role is applied in
  admin_project_domain and admin_user_domain.

* Fixes bug 1535939 so endpoint provider take the regions in
  account.

* Fixes bug 1522541 so when /root/openrc is present and has a v2
  auth_url, the Keystone_user resource will not fail to check
  credentials.

* Hash domains by name. Improving performances of providers when
  managing lot of resources in the same domain (users and projects).

* Sanitize providers for IPv6 by making sure the IP has brackets
  when needed.

* Fixes bug 1563261 so when using LDAP backend, identity_driver,
  credential_driver and assignment_driver parameters will be
  configured in the Domain section, with other LDAP parameters.

* Fixes bug 1554555 so openstack cli provider needs to pass domain
  in v3 calls

* Fixes bug 1485508 so when domain_specific_drivers_enabled=True
  keystone_user provider fails.


Other Notes
***********

* Drop all Qpid support, it was removed from Oslo in Mitaka.

* Add support for the newer admin and public wsgi scripts for
  keystone. Also added is the ability to provide a custom script for
  each of these. By default, the module will leverage scripts provided
  by the keystone package.

Changes in puppet-keystone 8.0.0b1..9.0.0
-----------------------------------------

c9d6777 Cleanup README
0cab2c7 Change wiki to docs
b9412d9 Prepare 9.0.0 release
255725d Revert "Deprecate use_syslog"
a1a3205 Add oslo::db to dependency chain
b057920 Add oslo::cache to dependency chain
9aab781 reno: show mitaka release notes
eb12a28 Deprecate use_syslog
0dc65b8 Use ensure_packages instead of package
092d303 Adapt keystone tests for a new concat version
e812075 Update keystone wsgi scripts
617fa98 Deprecate PKI signing related parameter
8b7b81b Add other-requirements.txt for bindep
e5824b0 Adding a purge_config option for keystone_config
6f9d029 Fixed require statements for puppet 4
dbde71b Deprecate verbose option in logging
8832518 Add unit test for keystone::config
cb1ed62 stop managing eventlet service on RedHat
be3cae0 Add some kombu options
13c27ec Fix markdown format typo
15890b4 Add support for db_max_retries param
f8ea995 Test multiple operating systems for keystone::db::postgresql
1bb09e8 metadata.json: fix oslo module name
a90175e Prevent keystone eventlet from starting
a5dbb53 Deprecate service_provider
ff3c84d Add Unit Tests for keystone_config type
fef6467 Add missing bit to the user prefetch removal.
46ced68 Totally drop Qpid support
64100bb Remove user/role prefetch to support multi-domain.
030820a Set oslo options in keystone module through puppet-oslo
96ba3fa Make the SSL apache module happens at correct time
055aab7 Add release note for https://review.openstack.org/298672
37b684d Gemfile: rely on puppet-openstack_spec_helper for dependencies
8594336 domain backend drivers set in domain config
04d4969 Ensure endpoints created before admin_token_auth
170c85d Fix for pki_setup
90b2be3 Release 8.0.0
c11b324 Add the ability to control LDAP package mgmt
ec8e045 Ensure keystone service is created before openrc
abca05e Release notes for Keystone external deps
71c6bac Remove matcher definition.
a5da52e Keystone hooks support
fd328e0 CHANGELOG: update for 8.0.0
515c3a4 Prepare release notes for Mitaka 8.0.0
3640727 Missing dependency for domain config.
66d83a4 admin role: make sure openrc is created after
cd4f7d8 Fix issue with fernet_setup exec
6fbae75 Improve keystone::wsgi spec for testing headers parameter
b8ae179 Make apache::vhost::headers configuration possible

Diffstat (except docs and test files)
-------------------------------------

CHANGELOG.md                                       |  11 +
Gemfile                                            |  24 +-
README.md                                          |  15 +-
examples/apache_dropin.pp                          |   1 -
examples/apache_with_paths.pp                      |   1 -
examples/k2k_sp_shib.pp                            |   1 -
examples/ldap_backend.pp                           |   1 -
examples/v3_basic.pp                               |   1 -
examples/v3_domain_configuration.pp                |   1 -
lib/puppet/provider/keystone.rb                    |  24 +-
lib/puppet/provider/keystone_domain/openstack.rb   |   2 +-
lib/puppet/provider/keystone_endpoint/openstack.rb |   2 +-
.../keystone_identity_provider/openstack.rb        |   2 +-
lib/puppet/provider/keystone_role/openstack.rb     |   2 +-
lib/puppet/provider/keystone_service/openstack.rb  |   2 +-
lib/puppet/provider/keystone_tenant/openstack.rb   |   2 +-
lib/puppet/provider/keystone_user/openstack.rb     |  59 +--
.../provider/keystone_user_role/openstack.rb       | 108 +---
lib/puppet/type/keystone_domain.rb                 |   2 +-
lib/puppet/type/keystone_endpoint.rb               |   2 +-
lib/puppet/type/keystone_identity_provider.rb      |   2 +-
lib/puppet/type/keystone_role.rb                   |   2 +-
lib/puppet/type/keystone_service.rb                |   2 +-
lib/puppet/type/keystone_tenant.rb                 |   2 +-
lib/puppet/type/keystone_user.rb                   |   2 +-
lib/puppet/type/keystone_user_role.rb              |   2 +-
manifests/client.pp                                |   2 +
manifests/config.pp                                |   2 +
manifests/cron/token_flush.pp                      |   2 +
manifests/db.pp                                    |  55 +-
manifests/db/mysql.pp                              |   6 +-
manifests/db/postgresql.pp                         |   7 +-
manifests/db/sync.pp                               |  15 +-
manifests/deps.pp                                  |  82 +++
manifests/disable_admin_token_auth.pp              |   3 +
manifests/endpoint.pp                              |   3 +
manifests/federation/identity_provider.pp          |  26 +-
manifests/federation/mellon.pp                     |  10 +-
manifests/federation/shibboleth.pp                 |   1 +
manifests/init.pp                                  | 587 ++++++++++++---------
manifests/ldap.pp                                  |  21 +-
manifests/ldap_backend.pp                          |  37 +-
manifests/logging.pp                               |  79 +--
manifests/params.pp                                |  23 +-
manifests/policy.pp                                |   4 +-
manifests/resource/authtoken.pp                    |   2 +
manifests/resource/service_identity.pp             |   3 +
manifests/roles/admin.pp                           |   5 +
manifests/service.pp                               |  17 +-
manifests/wsgi/apache.pp                           | 168 +++---
metadata.json                                      |   5 +-
other-requirements.txt                             |   0
.../deprecate_pki_signing-ae35fe25182735ab.yaml    |   3 +
.../notes/deprecated_ldap-02957eb56827ead5.yaml    |   3 +
.../disable_admin_token_auth-b82d0aca80d1f091.yaml |   6 +
releasenotes/notes/drop_qpid-50eb89c1bec84504.yaml |   3 +
.../federation_with_mellon-2f8229c1464b2e0e.yaml   |   3 +
releasenotes/notes/fix_admin-fee6e76089c07a42.yaml |   5 +
.../fix_endpoint_region-0fa0d89061ebaf12.yaml      |   5 +
.../notes/fix_openrc_v2-64049769daf57b65.yaml      |   6 +
.../notes/hash_domains-d6a867466bcf324b.yaml       |   4 +
.../notes/ipv6_provider-796b60badd356e59.yaml      |   3 +
.../keystone-wsgi-scripts-0d772d1f9f2d6c57.yaml    |  11 +
.../notes/keystone_bootstrap-4bf00198001d3350.yaml |   6 +
.../keystone_hooks_support-2c9e8b09bdbd1b5b.yaml   |   5 +
...eystone_identity_provider-9b6f6b3ad70c60f3.yaml |   6 +
.../keystone_python_depr-80fa804d9cd242c5.yaml     |   3 +
.../ldap_backend_domain-37839afb8b1d26e4.yaml      |   6 +
.../manage_ldap_packages-3b739e338f3e59c2.yaml     |   7 +
releasenotes/notes/mitaka-dece9d43a565e6cb.yaml    |   3 +
...ulti_domain_configuration-32dc8cbef450f1d6.yaml |   5 +
.../notes/multi_ldap-975858a46dd622a6.yaml         |   5 +
.../notes/os_service_default-9caeeb340d4bb303.yaml |   5 +
.../notes/policy_driver-c991dd693d2336fc.yaml      |   6 +
...cy_rc_d_keystone_eventlet-2dc65eb3d27f8969.yaml |   7 +
.../remove_unused_class-0615d6744896ad97.yaml      |   3 +
...vice_provider_deprecation-50421064c823f3ee.yaml |   6 +
.../stop_posix_and_files-930ee921d0ebead2.yaml     |   4 +
.../support_multi_domain-bd04f18aa7913eaa.yaml     |  21 +
.../notes/switch_to_oslo-b7caf6d5906e29dc.yaml     |   4 +
releasenotes/notes/use-reno-1caaec4ba5aa4285.yaml  |   2 -
.../verbose-deprecation-38d9b7667fcf381d.yaml      |   4 +
releasenotes/source/conf.py                        |   4 +-
releasenotes/source/index.rst                      |  19 +-
releasenotes/source/mitaka.rst                     |   6 +
spec/acceptance/default_domain_spec.rb             |  20 +-
spec/classes/keystone_client_spec.rb               |   4 +
spec/classes/keystone_config_spec.rb               |  48 ++
spec/classes/keystone_db_postgresql_spec.rb        |  48 +-
spec/classes/keystone_db_spec.rb                   |  11 +-
spec/classes/keystone_db_sync_spec.rb              |  12 +-
spec/classes/keystone_deps_spec.rb                 |  17 +
spec/classes/keystone_ldap_spec.rb                 |   8 +
spec/classes/keystone_logging_spec.rb              |   8 +-
spec/classes/keystone_policy_spec.rb               |   1 +
spec/classes/keystone_service_spec.rb              |   4 +
spec/classes/keystone_spec.rb                      | 143 ++---
spec/classes/keystone_wsgi_apache_spec.rb          | 106 ++--
spec/defines/keystone_ldap_backend_spec.rb         |   2 +-
spec/spec_helper.rb                                |   2 +
spec/spec_helper_acceptance.rb                     |   2 -
.../matchers/have_array_of_instances_hash.rb       |  17 -
spec/support/matchers/include_regexp.rb            |  20 -
spec/unit/provider/keystone_user/openstack_spec.rb |  88 +--
.../provider/keystone_user_role/openstack_spec.rb  |  36 --
spec/unit/type/keystone_config_spec.rb             |  45 ++
107 files changed, 1312 insertions(+), 962 deletions(-)


Requirements updates
--------------------

diff --git a/other-requirements.txt b/other-requirements.txt
new file mode 100644
index 0000000..e69de29