--- /dev/null
+require 'puppet'
+require 'puppet/feature/aviator'
+require 'puppet/util/inifile'
+
+class Puppet::Provider::Aviator < Puppet::Provider
+
+ def session
+ @session ||= authenticate(resource[:auth], resource[:log_file])
+ end
+
+ def self.session
+ @session ||= authenticate(nil, nil)
+ end
+
+ def request(service, request, &block)
+ self.class.make_request(service, request, session_data, &block)
+ end
+
+ def self.request(service, request, &block)
+ self.make_request(service, request, session_data, &block)
+ end
+
+ # needed for tests
+ def session_data
+ @session_data
+ end
+
+ def self.session_data
+ @session_data
+ end
+
+ def session_data=(data)
+ @session_data=data
+ end
+
+ def self.session_data=(data)
+ @session_data=data
+ end
+
+ private
+
+ # Attempt to find credentials in this order:
+ # 1. username,password,tenant,host set in type parameters
+ # 2. openrc file path set in type parameters
+ # 3. service token and host set in type parameters
+ # 4. username,password,tenant,host set in environment variables
+ # 5. service token and host set in keystone.conf (backwards compatible version)
+ def authenticate(auth_params, log_file)
+ auth_params ||= {}
+ if password_credentials_set?(auth_params)
+ @session = get_authenticated_session(auth_params, log_file)
+
+ elsif openrc_set?(auth_params)
+ credentials = get_credentials_from_openrc(auth_params['openrc'])
+ @session = get_authenticated_session(credentials, log_file)
+
+ elsif service_credentials_set?(auth_params)
+ session_hash = get_unauthenticated_session(auth_params, log_file)
+ @session_data = session_hash[:data]
+ @session = session_hash[:session]
+
+ elsif env_vars_set?
+ credentials = get_credentials_from_env
+ @session = get_authenticated_session(credentials, log_file)
+
+ else # Last effort: try to get the token from keystone.conf
+ session_hash = self.class.try_auth_with_token(keystone_file, log_file)
+ @session_data = session_hash[:data]
+ @session = session_hash[:session]
+ end
+ end
+
+ def self.authenticate(auth_params, log_file)
+ auth_params = {} unless auth_params
+ if env_vars_set?
+ credentials = get_credentials_from_env
+ @session = get_authenticated_session(credentials, log_file)
+
+ else # Last effort: try to get the token from keystone.conf
+ session_hash = try_auth_with_token(keystone_file, log_file)
+ @session_data = session_hash[:data]
+ @session = session_hash[:session]
+ end
+ end
+
+
+ def self.try_auth_with_token(conf_file, log_file)
+ service_token = get_admin_token_from_keystone_file(conf_file)
+ auth_url = get_auth_url_from_keystone_file(conf_file)
+ session_hash = {}
+ if service_token
+ credentials = {
+ 'service_token' => service_token,
+ 'host_uri' => auth_url,
+ }
+ session_hash = get_unauthenticated_session(credentials, log_file)
+ else # All authentication efforts failed
+ raise(Puppet::Error, 'No credentials provided.')
+ end
+ end
+
+
+ def self.make_request(service, request, session_data, &block)
+ response = nil
+ if service && service.default_session_data
+ response = service.request(request, :endpoint_type => 'admin') do |params|
+ yield(params) if block
+ end
+ elsif session_data
+ response = service.request(request, :endpoint_type => 'admin',
+ :session_data => session_data) do |params|
+ yield(params) if block
+ end
+ else
+ raise(Puppet::Error, 'Cannot make a request with no session data.')
+ end
+ if response.body.hash['error']
+ raise(Puppet::Error, "Error making request: #{response.body.hash['error']['code']} #{response.body.hash['error']['title']}")
+ end
+ response
+ end
+
+
+ def password_credentials_set?(auth_params)
+ auth_params['username'] && auth_params['password'] && auth_params['tenant_name'] && auth_params['host_uri']
+ end
+
+
+ def openrc_set?(auth_params)
+ auth_params['openrc']
+ end
+
+
+ def service_credentials_set?(auth_params)
+ auth_params['service_token'] && auth_params['host_uri']
+ end
+
+
+ def self.env_vars_set?
+ ENV['OS_USERNAME'] && ENV['OS_PASSWORD'] && ENV['OS_TENANT_NAME'] && ENV['OS_AUTH_URL']
+ end
+
+
+ def env_vars_set?
+ self.class.env_vars_set?
+ end
+
+
+ def get_credentials_from_openrc(file)
+ creds = {}
+ begin
+ File.open(file).readlines.delete_if{|l| l=~ /^#/}.each do |line|
+ key, value = line.split('=')
+ key = key.split(' ').last
+ value = value.chomp.gsub(/'/, '')
+ creds[key] = value
+ end
+ return creds
+ rescue Exception => error
+ return {}
+ end
+ end
+
+
+ def self.get_credentials_from_env
+ ENV.to_hash.dup.delete_if { |key, _| ! (key =~ /^OS/) } # Ruby 1.8.7
+ end
+
+ def get_credentials_from_env
+ self.class.get_credentials_from_env
+ end
+
+
+ def self.keystone_file
+ keystone_file = Puppet::Util::IniConfig::File.new
+ keystone_file.read('/etc/keystone/keystone.conf')
+ keystone_file
+ end
+
+ def keystone_file
+ return @keystone_file if @keystone_file
+ @keystone_file = Puppet::Util::IniConfig::File.new
+ @keystone_file.read('/etc/keystone/keystone.conf')
+ @keystone_file
+ end
+
+
+ def self.get_admin_token_from_keystone_file(conf_file)
+ if conf_file and conf_file['DEFAULT'] and conf_file['DEFAULT']['admin_token']
+ return "#{conf_file['DEFAULT']['admin_token'].strip}"
+ else
+ return nil
+ end
+ end
+
+ def get_admin_token_from_keystone_file
+ conf_file = keystone_file
+ self.class.get_admin_token_from_keystone_file(conf_file)
+ end
+
+
+ def self.get_auth_url_from_keystone_file(conf_file)
+ if conf_file
+ if conf_file['DEFAULT']
+ if conf_file['DEFAULT']['admin_endpoint']
+ auth_url = conf_file['DEFAULT']['admin_endpoint'].strip
+ return versioned_endpoint(auth_url)
+ end
+
+ if conf_file['DEFAULT']['admin_port']
+ admin_port = conf_file['DEFAULT']['admin_port'].strip
+ else
+ admin_port = '35357'
+ end
+
+ if conf_file['DEFAULT']['admin_bind_host']
+ host = conf_file['DEFAULT']['admin_bind_host'].strip
+ if host == "0.0.0.0"
+ host = "127.0.0.1"
+ end
+ else
+ host = "127.0.0.1"
+ end
+ end
+
+ if conf_file['ssl'] && conf_file['ssl']['enable'] && conf_file['ssl']['enable'].strip.downcase == 'true'
+ protocol = 'https'
+ else
+ protocol = 'http'
+ end
+ end
+
+ "#{protocol}://#{host}:#{admin_port}/v2.0/"
+ end
+
+ def get_auth_url_from_keystone_file
+ self.class.get_auth_url_from_keystone_file(keystone_file)
+ end
+
+
+ def self.make_configuration(credentials)
+ host_uri = versioned_endpoint(credentials['host_uri'] || credentials['OS_AUTH_URL'], credentials['api_version'])
+ {
+ :provider => 'openstack',
+ :auth_service => {
+ :name => 'identity',
+ :host_uri => host_uri,
+ :request => 'create_token',
+ :validator => 'list_tenants',
+ },
+ :auth_credentials => {
+ :username => credentials['username'] || credentials['OS_USERNAME'],
+ :password => credentials['password'] || credentials['OS_PASSWORD'],
+ :tenant_name => credentials['tenant_name'] || credentials['OS_TENANT_NAME']
+ }
+ }
+ end
+
+
+ def self.get_authenticated_session(credentials, log_file)
+ configuration = make_configuration(credentials)
+ session = ::Aviator::Session.new(:config => configuration, :log_file => log_file)
+ session.authenticate
+ session
+ end
+
+ def get_authenticated_session(credentials, log_file)
+ self.class.get_authenticated_session(credentials, log_file)
+ end
+
+
+ def self.get_unauthenticated_session(credentials, log_file)
+ configuration = {
+ :provider => 'openstack',
+ }
+ session_data = {
+ :base_url => credentials['host_uri'],
+ :service_token => credentials['service_token']
+ }
+ session = ::Aviator::Session.new(:config => configuration, :log_file => log_file)
+ { :session => session, :data => session_data }
+ end
+
+ def get_unauthenticated_session(credentials, log_file)
+ self.class.get_unauthenticated_session(credentials, log_file)
+ end
+
+
+ def self.versioned_endpoint(endpoint, version = 'v2.0')
+ version = 'v2.0' if version.nil?
+ if endpoint =~ /\/#{version}\/?$/ || endpoint =~ /\/v2.0\/?$/ || endpoint =~ /\/v3\/?$/
+ endpoint
+ else
+ "#{endpoint.chomp('/')}/#{version}"
+ end
+ end
+end
projects / dsa-puppet.git / blobdiff