Add initcontainer to keystone

- migrate database
- bootstrap keystone

Change-Id: I5f8bb4d23076f8c9faf064a70abbb92ddd14bc1f

devstack/lib/keystone

@@ -30,12 +30,6 @@ function init_keystone {
 		# (Re)create keystone database
 		recreate_database keystone
 	fi
-
-	# DB sync
-	time_start "dbsync"
-	sudo docker run -v /etc/keystone:/etc/keystone vexxhost/keystone:latest keystone-manage --config-file $KEYSTONE_CONF db_sync
-	time_stop "dbsync"
-
 }
 export -f init_keystone
 
@@ -81,24 +75,7 @@ function start_keystone {
 export -f start_keystone
 
 # bootstrap_keystone() - Initialize user, role and project
-# This function uses the following GLOBAL variables:
-# - ``KEYSTONE_BIN_DIR``
-# - ``ADMIN_PASSWORD``
-# - ``IDENTITY_API_VERSION``
-# - ``KEYSTONE_AUTH_URI``
-# - ``REGION_NAME``
-# - ``KEYSTONE_SERVICE_PROTOCOL``
-# - ``KEYSTONE_SERVICE_HOST``
-# - ``KEYSTONE_SERVICE_PORT``
 function bootstrap_keystone {
-	kubectl exec deploy/keystone -- keystone-manage bootstrap \
+	echo noop
-		--bootstrap-username admin \
-		--bootstrap-password "$ADMIN_PASSWORD" \
-		--bootstrap-project-name admin \
-		--bootstrap-role-name admin \
-		--bootstrap-service-name keystone \
-		--bootstrap-region-id "$REGION_NAME" \
-		--bootstrap-admin-url "$KEYSTONE_AUTH_URI" \
-		--bootstrap-public-url "$KEYSTONE_SERVICE_URI"
 }
 export -f bootstrap_keystone

openstack_operator/keystone.py

@@ -18,6 +18,7 @@ This module maintains the operator for Keystone which does everything from
 deployment to taking care of rotating fernet & credentials keys."""
 
 import base64
+import os
 import kopf
 
 from cryptography import fernet
@@ -95,6 +96,18 @@ def create_or_resume(name, spec, **_):
     """
     env = utils.get_uwsgi_env()
     config_hash = utils.generate_hash(spec)
+    conn = utils.get_openstack_connection()
+    auth_url = conn.config.auth["auth_url"]
+    password = os.getenv("OS_PASSWORD")
+    project_name = conn.config.auth["project_name"]
+    region_name = conn.config.get_region_name()
+    username = conn.config.auth["username"]
+    utils.create_or_update('keystone/secret-init.yml.j2',
+                           auth_url=auth_url,
+                           password=password,
+                           project_name=project_name,
+                           region_name=region_name,
+                           username=username)
     utils.create_or_update('keystone/deployment.yml.j2',
                            name=name, spec=spec,
                            env=env, config_hash=config_hash)

openstack_operator/templates/keystone/deployment.yml.j2

@@ -22,6 +22,11 @@ metadata:
     {{ labels("keystone", name) | indent(4) }}
 spec:
   replicas: 3
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
   selector:
     matchLabels:
       {{ labels("keystone", name) | indent(6) }}
@@ -32,6 +37,64 @@ spec:
       annotations:
         checksum/config: "{{ config_hash }}"
     spec:
+      initContainers:
+      - name: db-sync
+        image: vexxhost/keystone:latest
+        imagePullPolicy: Always
+        command:
+        - keystone-manage
+        - db_sync
+        volumeMounts:
+        - mountPath: /etc/keystone
+          name: config
+      - name: bootstrap
+        image: vexxhost/keystone:latest
+        imagePullPolicy: Always
+        env:
+        - name: OS_BOOTSTRAP_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: keystone-init
+        - name: OS_BOOTSTRAP_REGION_ID
+          valueFrom:
+            secretKeyRef:
+              key: region_name
+              name: keystone-init
+        - name: OS_BOOTSTRAP_ADMIN_URL
+          valueFrom:
+            secretKeyRef:
+              key: auth_url
+              name: keystone-init
+        - name: OS_BOOTSTRAP_PUBLIC_URL
+          valueFrom:
+            secretKeyRef:
+              key: auth_url
+              name: keystone-init
+        - name: OS_BOOTSTRAP_USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: keystone-init
+        - name: OS_BOOTSTRAP_PROJECT_NAME
+          valueFrom:
+            secretKeyRef:
+              key: project_name
+              name: keystone-init
+        - name: OS_BOOTSTRAP_SERVICE_NAME
+          value: keystone
+        - name: OS_BOOTSTRAP_INTERNAL_URL
+          value: http://keystone.openstack
+        command:
+        - keystone-manage
+        - bootstrap
+        volumeMounts:
+        - mountPath: /etc/keystone
+          name: config
+        - name: fernet-keys
+          mountPath: /etc/keystone/fernet-keys
+        - name: credential-keys
+          mountPath: /etc/keystone/credential-keys
       containers:
       - name: keystone
         image: vexxhost/keystone:latest

openstack_operator/templates/keystone/secret-init.yml.j2

@@ -0,0 +1,26 @@
+---
+# Copyright 2020 VEXXHOST, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: keystone-init
+  namespace: openstack
+stringData:
+  auth_url: {{ auth_url }}
+  project_name: {{ project_name }}
+  region_name: {{ region_name }}
+  password: {{ password }}
+  username: {{ username }}