From a15ccc9327ac8a95a668b32750ecf444fcc65a9a Mon Sep 17 00:00:00 2001
From: Jesse Pretorius <jesse.pretorius@rackspace.co.uk>
Date: Tue, 7 Jul 2015 21:01:20 +0000
Subject: [PATCH] Enable all services to use Keystone 'insecurely'

This patch introduces an insecure flag for the Keystone internal
 and admin endpoints:

* keystone_service_adminuri_insecure
* keystone_service_internaluri_insecure

Both values default to false. If you have setup SSL endpoints
for Keystone using an untrusted certificate then you should
set the appropriate flag to true in your user_variables.

This patch is used to enable testing and development with
Keystone SSL endpoints without having to make use of SSL
certificates signed by a trusted, public CA.

The patch introduces a new optional argument (insecure) to the
keystone, glance and neutron Ansible libraries. This is a
boolean value which, when true, enables these libraries to
access Keystone endpoints 'insecurely'. When these libraries
are used in plays, the appropriate value is set automatically
as per the above conditions.

Implements: blueprint keystone-federation
Change-Id: Ia07e7e201f901042dd06a86efe5c6f6725e9ce13
---
 tasks/swift_service_setup.yml  | 7 +++++++
 templates/proxy-server.conf.j2 | 1 +
 2 files changed, 8 insertions(+)

diff --git a/tasks/swift_service_setup.yml b/tasks/swift_service_setup.yml
index 08ef02ce..a90fed52 100644
--- a/tasks/swift_service_setup.yml
+++ b/tasks/swift_service_setup.yml
@@ -22,6 +22,7 @@
     service_name: "{{ swift_service_name }}"
     service_type: "{{ swift_service_type }}"
     description: "{{ swift_service_description }}"
+    insecure: "{{ keystone_service_adminuri_insecure }}"
   register: add_service
   until: add_service|success
   retries: 5
@@ -40,6 +41,7 @@
     user_name: "{{ swift_service_user_name }}"
     tenant_name: "{{ swift_service_project_name }}"
     password: "{{ swift_service_password }}"
+    insecure: "{{ keystone_service_adminuri_insecure }}"
   register: add_service
   until: add_service|success
   retries: 5
@@ -58,6 +60,7 @@
     user_name: "{{ swift_service_user_name }}"
     tenant_name: "{{ swift_service_project_name }}"
     role_name: "{{ swift_service_role_name }}"
+    insecure: "{{ keystone_service_adminuri_insecure }}"
   register: add_service
   until: add_service|success
   retries: 5
@@ -73,6 +76,7 @@
     token: "{{ keystone_auth_admin_token }}"
     endpoint: "{{ keystone_service_adminurl }}"
     role_name: "{{ swift_operator_role }}"
+    insecure: "{{ keystone_service_adminuri_insecure }}"
   register: add_service
   until: add_service|success
   retries: 5
@@ -90,6 +94,7 @@
     user_name: "{{ swift_dispersion_user }}"
     tenant_name: "{{ swift_service_project_name }}"
     password: "{{ swift_dispersion_password }}"
+    insecure: "{{ keystone_service_adminuri_insecure }}"
   register: add_service
   until: add_service|success
   retries: 5
@@ -107,6 +112,7 @@
     user_name: "{{ swift_dispersion_user }}"
     tenant_name: "{{ swift_service_project_name }}"
     role_name: "{{ swift_operator_role }}"
+    insecure: "{{ keystone_service_adminuri_insecure }}"
   register: add_service
   until: add_service|success
   retries: 5
@@ -128,6 +134,7 @@
     publicurl: "{{ swift_service_publicurl }}"
     adminurl: "{{ swift_service_internalurl }}"
     internalurl: "{{ swift_service_adminurl }}"
+    insecure: "{{ keystone_service_adminuri_insecure }}"
   register: add_service
   until: add_service|success
   retries: 5
diff --git a/templates/proxy-server.conf.j2 b/templates/proxy-server.conf.j2
index af34dc3f..96071602 100644
--- a/templates/proxy-server.conf.j2
+++ b/templates/proxy-server.conf.j2
@@ -46,6 +46,7 @@ user_test_tester3 = testing3
 {% elif swift_authtoken_active %}
 [filter:authtoken]
 paste.filter_factory = keystonemiddleware.auth_token:filter_factory
+insecure = {{ keystone_service_internaluri_insecure | bool }}
 auth_plugin = {{ swift_keystone_auth_plugin }}
 auth_url = {{ keystone_service_adminuri }}
 auth_uri = {{ keystone_service_internaluri }}