From 60f023e20c7e1f98d1f71fb04e829a3ff0477f65 Mon Sep 17 00:00:00 2001 From: Andy Ning Date: Mon, 4 Nov 2019 20:20:28 -0500 Subject: [PATCH 1/1] update Barbican admin secret's user/project IDs during bootstrap In a DC system when subcloud is managed, keystone user/project IDs are synced with Central Cloud, including admin user and project. But the admin's secrets in Barbian still use the original user/project IDs, causing docker registry access failure when platform-integ-apps is reapplied. This updated keystone admin user/project IDs to be the same as Central Cloud right after keystone is bootstrapped during subcloud deployment. This way any referece to admin user/project IDs after bootstrap will be using the IDs same as Central Cloud, including the ones in Barbican. This will solve the problem of registry access failure issue. Closes-Bug: 1851247 Signed-off-by: Andy Ning --- manifests/init.pp | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/manifests/init.pp b/manifests/init.pp index 7bb0094..421259c 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -791,6 +791,8 @@ class keystone( $rabbit_port = $::os_service_default, $rabbit_userid = $::os_service_default, $rabbit_virtual_host = $::os_service_default, + $dc_admin_user_id = undef, + $dc_admin_project_id = undef, ) inherits keystone::params { include ::keystone::deps @@ -1311,6 +1313,22 @@ running as a standalone service, or httpd for being run by a httpd server") subscribe => Anchor['keystone::dbsync::end'], tag => 'keystone-exec', } + + if $dc_admin_user_id and $dc_admin_project_id { + exec { 'update keystone admin assignment actor_id': + command => "sudo -u postgres psql -d keystone -c \"update public.assignment set actor_id='$dc_admin_user_id' from public.local_user where public.assignment.actor_id=public.local_user.user_id and public.local_user.name='admin'\"", + require => Exec['keystone-manage bootstrap'], + } + -> exec { 'update keystone admin assignment target_id': + command => "sudo -u postgres psql -d keystone -c \"update public.assignment set target_id='$dc_admin_project_id' from public.project where public.assignment.target_id=public.project.id and public.project.name='admin'\"", + } + -> exec { 'update keystone admin user id': + command => "sudo -u postgres psql -d keystone -c \"update public.user set id='$dc_admin_user_id' from public.local_user where public.user.id=public.local_user.user_id and public.local_user.name='admin'\"", + } + -> exec { 'update keystone admin project id': + command => "sudo -u postgres psql -d keystone -c \"update public.project set id='$dc_admin_project_id' where name='admin'\"", + } + } } # WRS: Now that the keystone service has started, -- 1.8.3.1