From 5ae3fab74381403cc76525ba3ff63a60836c17c1 Mon Sep 17 00:00:00 2001
From: Alan Bishop <abishop@redhat.com>
Date: Fri, 28 Jul 2017 10:30:27 -0400
Subject: Fix legacy nova/cinder encryption key manager configuration

Recent changes in Nova [0] and Cinder [1] result in Barbican being selected
as the default encryption key manager, even when TripleO is not deploying
Barbican.

This change ensures the legacy key manager is enabled when no key manager
(such as Barbican) has been specified. This restores the previous behavior,
where the legacy key manager was enabled by default.

[0] https://review.openstack.org/484501
[1] https://review.openstack.org/485322

Closes-Bug: #1706389
Change-Id: Idc92f7a77cde757538eaac51c4ad8dc397f9c3d3
---
 manifests/profile/base/cinder/api.pp   | 11 ++++++++++-
 manifests/profile/base/nova/compute.pp | 11 ++++++++++-
 2 files changed, 20 insertions(+), 2 deletions(-)

(limited to 'manifests')

diff --git a/manifests/profile/base/cinder/api.pp b/manifests/profile/base/cinder/api.pp
index 54880ad..892e4ed 100644
--- a/manifests/profile/base/cinder/api.pp
+++ b/manifests/profile/base/cinder/api.pp
@@ -43,6 +43,12 @@
 #   (Optional) Whether TLS in the internal network is enabled or not.
 #   Defaults to hiera('enable_internal_tls', false)
 #
+# [*keymgr_api_class*]
+#   (Optional) The encryption key manager API class. The default value
+#   ensures Cinder's legacy key manager is enabled when no hiera value is
+#   specified.
+#   Defaults to hiera('cinder::api::keymgr_api_class', 'cinder.keymgr.conf_key_mgr.ConfKeyManager')
+#
 # [*step*]
 #   (Optional) The current step in deployment. See tripleo-heat-templates
 #   for more details.
@@ -53,6 +59,7 @@ class tripleo::profile::base::cinder::api (
   $certificates_specs            = hiera('apache_certificates_specs', {}),
   $cinder_api_network            = hiera('cinder_api_network', undef),
   $enable_internal_tls           = hiera('enable_internal_tls', false),
+  $keymgr_api_class              = hiera('cinder::api::keymgr_api_class', 'cinder.keymgr.conf_key_mgr.ConfKeyManager'),
   $step                          = Integer(hiera('step')),
 ) {
   if $::hostname == downcase($bootstrap_node) {
@@ -75,7 +82,9 @@ class tripleo::profile::base::cinder::api (
   }
 
   if $step >= 4 or ($step >= 3 and $sync_db) {
-    include ::cinder::api
+    class { '::cinder::api':
+      keymgr_api_class => $keymgr_api_class,
+    }
     include ::apache::mod::ssl
     class { '::cinder::wsgi::apache':
       ssl_cert => $tls_certfile,
diff --git a/manifests/profile/base/nova/compute.pp b/manifests/profile/base/nova/compute.pp
index 3eae880..a9a1f94 100644
--- a/manifests/profile/base/nova/compute.pp
+++ b/manifests/profile/base/nova/compute.pp
@@ -27,9 +27,16 @@
 #   (Optional) Whether or not Cinder is backed by NFS.
 #   Defaults to hiera('cinder_enable_nfs_backend', false)
 #
+# [*keymgr_api_class*]
+#   (Optional) The encryption key manager API class. The default value
+#   ensures Nova's legacy key manager is enabled when no hiera value is
+#   specified.
+#   Defaults to hiera('nova::compute::keymgr_api_class', 'nova.keymgr.conf_key_mgr.ConfKeyManager')
+#
 class tripleo::profile::base::nova::compute (
   $step               = Integer(hiera('step')),
   $cinder_nfs_backend = hiera('cinder_enable_nfs_backend', false),
+  $keymgr_api_class   = hiera('nova::compute::keymgr_api_class', 'nova.keymgr.conf_key_mgr.ConfKeyManager'),
 ) {
 
   if $step >= 4 {
@@ -37,7 +44,9 @@ class tripleo::profile::base::nova::compute (
     include ::tripleo::profile::base::nova
 
     # deploy basic bits for nova-compute
-    include ::nova::compute
+    class { '::nova::compute':
+      keymgr_api_class => $keymgr_api_class,
+    }
     # If Service['nova-conductor'] is in catalog, make sure we start it
     # before nova-compute.
     Service<| title == 'nova-conductor' |> -> Service['nova-compute']
-- 
cgit 1.2.3-korg