controller: basic barbican controller setup

Creates databases and openstack endpoints.

Signed-off-by: Stefan Kober <stefan.kober@cyberus-technology.de>
On-behalf-of: SAP stefan.kober@sap.com

Author: hertrste

modules/controller/keystone.nix

@@ -40,6 +40,12 @@ let
     catalog.RegionOne.placement.internalURL = http://controller:8778
     catalog.RegionOne.placement.name = Placement Service
 
+    # barbican
+    catalog.RegionOne.key-manager.publicURL = http://controller:9311
+    catalog.RegionOne.key-manager.adminURL = http://controller:9311
+    catalog.RegionOne.key-manager.internalURL = http://controller:9311
+    catalog.RegionOne.key-manager.name = Barbican Service
+
     catalog.RegionOne.volumev3.publicURL = http://controller:8776/v3
     catalog.RegionOne.volumev3.adminURL = http://controller:8776/v3
     catalog.RegionOne.volumev3.internalURL = http://controller:8776/v3

modules/controller/openstack-controller.nix

@@ -6,6 +6,7 @@
   placement,
   horizon,
   cinder,
+  barbican,
 }:
 {
   config,
@@ -34,6 +35,7 @@ in
     (import ./neutron.nix { inherit neutron; })
     (import ./horizon.nix { inherit horizon; })
     (import ./cinder.nix { inherit cinder; }) # only cinder management component
+    (import ./barbican.nix { inherit barbican; }) # only cinder management component
   ];
 
   config = {
@@ -68,6 +70,12 @@ in
           mysql -N -e "GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'localhost' IDENTIFIED BY 'cinder';"
           mysql -N -e "GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'%' IDENTIFIED BY 'cinder';"
 
+          # barbican
+          mysql -N -e "drop database barbican;" || true
+          mysql -N -e "create database barbican;" || true
+          mysql -N -e "GRANT ALL PRIVILEGES ON barbican.* TO 'barbican'@'localhost' IDENTIFIED BY 'barbican';"
+          mysql -N -e "GRANT ALL PRIVILEGES ON barbican.* TO 'barbican'@'%' IDENTIFIED BY 'barbican';"
+
           # Placement
           mysql -N -e "drop database placement;" || true
           mysql -N -e "create database placement;" || true
@@ -154,6 +162,30 @@ in
       };
     };
 
+    systemd.services.barbican = {
+      description = "OpenStack barbican setup";
+      after = [ "keystone-all.service" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = adminEnv;
+      path = [
+        pkgs.openstackclient
+        barbican
+      ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = "barbican";
+        Group = "barbican";
+        ExecStart = pkgs.writeShellScript "barbican.sh" ''
+          set -euxo pipefail
+          openstack user create --domain default --password barbican barbican
+          openstack role add --project service --user barbican admin
+          openstack role add --user barbican --user-domain default --system all reader
+          barbican-manage --config-file ${config.barbican.config} db upgrade
+          barbican-manage --config-file ${config.barbican.config} db sync_secret_stores
+        '';
+      };
+    };
+
     systemd.services.cinder = {
       description = "OpenStack Cinder setup";
       after = [ "keystone-all.service" ];

modules/default.nix

@@ -8,6 +8,7 @@
       glance
       horizon
       cinder
+      barbican
       ;
     placement = openstackPkgs.openstack-placement;
   };