Skip to content

Commit 823389d

Browse files
jageeopenshift-cherrypick-robot
jagee
authored and
openshift-cherrypick-robot
committed
keystone ldap adoption testing
LDAP adoption testing will add a ldap domain to keystone. This ldap connection will be to the freeipa server setup for tlse environments on a multinode adoption job. Jira: https://issues.redhat.com/browse/OSPRH-6861
1 parent c2642cf commit 823389d

5 files changed

Lines changed: 172 additions & 0 deletions

File tree

‎scenarios/hci.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ undercloud:
2424
ctlplane_vip: 192.168.122.98
2525
cloud_domain: "ooo.test"
2626
tlse: true
27+
enable_keystone_ldap: true
2728
hostname_groups_map:
2829
# map ansible groups in the inventory to role hostname format for
2930
# 17.1 deployment

‎tests/roles/development_environment/defaults/main.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,14 @@
1+
# IPA-related variables
2+
ipa_hostname: "osp-free-ipa-0.ooo.test"
3+
# Short hostname for SSH to the FreeIPA server
4+
ipa_ssh_host: "{{ ipa_hostname.split('.')[0] }}"
5+
# ci-framework test-operator default is ~/.ssh/id_cifw (e.g. /home/zuul/.ssh/id_cifw in Zuul)
6+
controller_ssh_identity_file: "{{ cifmw_test_operator_controller_priv_key_file_path | default(edpm_privatekey_path) }}"
7+
# OpenShift cluster DNS forwarding for the IPA/LDAP domain (TLS-E)
8+
openshift_dns_forward_zone: "{{ ipa_hostname.split('.')[1:] | join('.') }}"
9+
openshift_dns_forward_upstream: "192.168.111.30"
10+
ipa_admin_password: "nomoresecrets"
11+
ipa_user_password: "nomoresecrets"
112
prelaunch_test_instance: true
213
prelaunch_test_instance_scripts:
314
- pre_launch.bash

‎tests/roles/development_environment/tasks/main.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -233,3 +233,52 @@
233233
cmd: |
234234
{{ shell_header }}
235235
curl {{ octavia_vip_address.stdout }}
236+
237+
- name: Add IPA domain to Keystone and create IPA users
238+
when: enable_keystone_ldap | default(false) | bool
239+
block:
240+
- name: Configure OpenShift cluster DNS forwarding for IPA domain
241+
ansible.builtin.shell: |
242+
{{ shell_header }}
243+
{{ oc_header }}
244+
oc apply -f - <<EOF
245+
apiVersion: operator.openshift.io/v1
246+
kind: DNS
247+
metadata:
248+
name: default
249+
spec:
250+
servers:
251+
- name: internal-forwarder
252+
zones:
253+
- {{ openshift_dns_forward_zone }}
254+
forwardPlugin:
255+
upstreams:
256+
- {{ openshift_dns_forward_upstream }}
257+
EOF
258+
259+
- name: SSH into IPA host and execute IPA commands
260+
ansible.builtin.shell: |
261+
{{ shell_header }}
262+
ssh -o StrictHostKeyChecking=accept-new -i {{ controller_ssh_identity_file }} root@{{ ipa_ssh_host }} "echo {{ ipa_admin_password }} | kinit admin;\
263+
ipa user-add svc-ldap --first=Openstack --last=LDAP;\
264+
echo {{ ipa_admin_password }} | ipa passwd svc-ldap;\
265+
ipa user-add ipauser1 --first=ipa1 --last=user1;\
266+
echo {{ ipa_user_password }} | ipa passwd ipauser1;\
267+
ipa user-add ipauser2 --first=ipa2 --last=user2;\
268+
echo {{ ipa_user_password }} | ipa passwd ipauser2;\
269+
ipa user-add ipauser3 --first=ipa3 --last=user3;\
270+
echo {{ ipa_user_password }} | ipa passwd ipauser3;\
271+
ipa group-add --desc=\"OpenStack Users\" grp-openstack;\
272+
ipa group-add --desc=\"OpenStack Admin Users\" grp-openstack-admin;\
273+
ipa group-add --desc=\"OpenStack Demo Users\" grp-openstack-demo;\
274+
ipa group-add-member --users=svc-ldap grp-openstack;\
275+
ipa group-add-member --users=ipauser1 grp-openstack;\
276+
ipa group-add-member --users=ipauser1 grp-openstack-admin;\
277+
ipa group-add-member --users=ipauser2 grp-openstack;\
278+
ipa group-add-member --users=ipauser2 grp-openstack-demo;\
279+
ipa group-add-member --users=ipauser3 grp-openstack;"
280+
281+
- name: Add REDHAT domain to Keystone
282+
ansible.builtin.shell: |
283+
{{ shell_header }}
284+
{{ openstack_command }} domain create --description \"Test LDAP Domain\" REDHAT

‎tests/roles/keystone_adoption/defaults/main.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,3 +70,54 @@ keystone_patch_federation: |
7070
secret: osp-secret
7171
7272
keystone_retry_delay: 30
73+
74+
keystone_patch_ldap: |
75+
spec:
76+
keystone:
77+
enabled: true
78+
apiOverride:
79+
route: {}
80+
template:
81+
customServiceConfig: |
82+
[token]
83+
expiration = 360000
84+
[identity]
85+
domain_specific_drivers_enabled = true
86+
extraMounts:
87+
- name: v1
88+
region: r1
89+
extraVol:
90+
- propagation:
91+
- Keystone
92+
extraVolType: Conf
93+
volumes:
94+
- name: keystone-domains
95+
secret:
96+
secretName: keystone-domains
97+
mounts:
98+
- name: keystone-domains
99+
mountPath: "/etc/keystone/domains"
100+
readOnly: true
101+
override:
102+
service:
103+
internal:
104+
metadata:
105+
annotations:
106+
metallb.universe.tf/address-pool: internalapi
107+
metallb.universe.tf/allow-shared-ip: internalapi
108+
{% if ipv6_enabled | default(false) -%}
109+
metallb.universe.tf/loadBalancerIPs: {{ internalapi_prefix_ipv6 | default('2620:cf:cf:bbbb') }}::50
110+
{%- else -%}
111+
metallb.universe.tf/loadBalancerIPs: {{ internalapi_prefix | default('172.17.0') }}.80
112+
{%- endif %}
113+
114+
spec:
115+
type: LoadBalancer
116+
databaseInstance: openstack
117+
secret: osp-secret
118+
119+
# IPA-related variables
120+
ipa_hostname: "osp-free-ipa-0.ooo.test"
121+
ipa_ssh_host: "{{ ipa_hostname.split('.')[0] }}"
122+
ipa_admin_password: "nomoresecrets"
123+
ipa_user_password: "nomoresecrets"

‎tests/roles/keystone_adoption/tasks/main.yaml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,52 @@
1616
type: Opaque
1717
EOF
1818
19+
- name: Set IPA BaseDN var
20+
ansible.builtin.set_fact:
21+
ipa_basedn: "dc={{ ipa_hostname.split('.')[1:] | join(',dc=') }}"
22+
when: enable_keystone_ldap | default(false) | bool
23+
24+
- name: Create Keystone domain config secret for LDAP
25+
ansible.builtin.shell: |
26+
{{ shell_header }}
27+
{{ oc_header }}
28+
cat <<EOF | oc apply -n openstack -f -
29+
apiVersion: v1
30+
kind: Secret
31+
metadata:
32+
name: keystone-domains
33+
type: Opaque
34+
stringData:
35+
keystone.{{ ipa_domain | default('REDHAT') }}.conf: |
36+
[identity]
37+
driver = ldap
38+
[ldap]
39+
url = ldaps://osp-free-ipa-0.ooo.test
40+
user = uid=svc-ldap,cn=users,cn=accounts,{{ ipa_basedn }}
41+
password = {{ ipa_admin_password | default('nomoresecrets') }}
42+
suffix = {{ ipa_basedn }}
43+
user_tree_dn = cn=users,cn=accounts,{{ ipa_basedn }}
44+
user_objectclass = person
45+
user_id_attribute = uid
46+
user_name_attribute = uid
47+
user_mail_attribute = mail
48+
group_tree_dn = cn=groups,cn=accounts,{{ ipa_basedn }}
49+
group_objectclass = groupOfNames
50+
group_id_attribute = cn
51+
group_name_attribute = cn
52+
group_member_attribute = member
53+
group_desc_attribute = description
54+
EOF
55+
when: enable_keystone_ldap | default(false) | bool
56+
1957
- name: deploy podified Keystone
2058
ansible.builtin.shell: |
2159
{{ shell_header }}
2260
{{ oc_header }}
2361
if {{ enable_federation | default(false) | lower }} == true; then
2462
oc patch openstackcontrolplane openstack --type=merge --patch '{{ keystone_patch_federation }}'
63+
elif {{ enable_keystone_ldap | default(false) | lower }}; then
64+
oc patch openstackcontrolplane openstack --type=merge --patch '{{ keystone_patch_ldap }}'
2565
else
2666
oc patch openstackcontrolplane openstack --type=merge --patch '{{ keystone_patch }}'
2767
fi
@@ -183,3 +223,23 @@
183223
${BASH_ALIASES[openstack]} credential show {{ before_adoption_credential.stdout }} -f value -c blob
184224
register: after_adoption_credential
185225
failed_when: after_adoption_credential.stdout != 'test'
226+
227+
- name: get ldap user token
228+
ansible.builtin.shell: |
229+
{{ shell_header }}
230+
{{ oc_header }}
231+
232+
alias openstack="oc exec -t openstackclient -- openstack"
233+
234+
auth_url=$(${BASH_ALIASES[openstack]} endpoint list --service keystone --interface public -f value -c URL)
235+
236+
alias openstack="oc exec -t openstackclient -- env -u OS_CLOUD - OS_AUTH_URL=${auth_url} OS_USERNAME=ipauser1 OS_PASSWORD={{ ipa_user_password }} OS_PROJECT_DOMAIN_NAME=REDHAT OS_USER_DOMAIN_NAME=REDHAT openstack"
237+
238+
${BASH_ALIASES[openstack]} token issue -f json
239+
register: keystone_ldap_responding_result
240+
when: enable_keystone_ldap | default(false) | bool
241+
242+
- name: Print ldap user token
243+
ansible.builtin.debug:
244+
var: keystone_ldap_responding_result
245+
when: enable_keystone_ldap | default(false) | bool

0 commit comments

Comments
 (0)