Set virsh secret with an init step when using Ceph

Run virsh secret-define and secret-set-value in an init step
instead of relying on the puppet-nova exec.

Co-Authored-By: Jiri Stransky <jistr@redhat.com>
Change-Id: Ic950e290af1c66d34b40791defbdf4f8afaa11da
Closes-Bug: #1709583

3 files changed, 62 insertions, 4 deletions

diff --git a/docker/services/nova-libvirt.yaml b/docker/services/nova-libvirt.yaml
index 2f3851a5..916b057e 100644
--- a/docker/services/nova-libvirt.yaml
+++ b/docker/services/nova-libvirt.yaml
@@ -56,7 +56,21 @@ parameters:
     description: Port that dockerized nova migration target sshd service
                  binds to.
     type: number
-
+  NovaEnableRbdBackend:
+    default: false
+    description: Whether to enable or not the Rbd backend for Nova
+    type: boolean
+  CinderEnableRbdBackend:
+    default: false
+    description: Whether to enable or not the Rbd backend for Cinder
+    type: boolean
+  CephClientKey:
+    description: The Ceph client key. Can be created with ceph-authtool --gen-print-key. Currently only used for external Ceph deployments to create the openstack user keyring.
+    type: string
+    hidden: true
+  CephClusterFSID:
+    type: string
+    description: The Ceph cluster FSID. Must be a UUID.
 
 conditions:
 
@@ -69,6 +83,15 @@ conditions:
       - {get_param: UseTLSTransportForLiveMigration}
       - true
 
+  need_libvirt_secret:
+    or:
+    - equals:
+      - {get_param: NovaEnableRbdBackend}
+      - true
+    - equals:
+      - {get_param: CinderEnableRbdBackend}
+      - true
+
 resources:
 
   ContainersCommon:
@@ -102,7 +125,7 @@ outputs:
             - {get_attr: [MySQLClient, role_data, step_config]}
       puppet_config:
         config_volume: nova_libvirt
-        puppet_tags: libvirtd_config,nova_config,file,exec
+        puppet_tags: libvirtd_config,nova_config,file
         step_config: *step_config
         config_image: {get_param: DockerNovaLibvirtConfigImage}
       kolla_config:
@@ -145,21 +168,46 @@ outputs:
                   - /run:/run
                   - /sys/fs/cgroup:/sys/fs/cgroup
                   - /var/lib/nova:/var/lib/nova
-                  - /etc/libvirt/secrets:/etc/libvirt/secrets
+                  - /etc/libvirt:/etc/libvirt
                   # Needed to use host's virtlogd
                   - /var/run/libvirt:/var/run/libvirt
                   - /var/lib/libvirt:/var/lib/libvirt
-                  - /etc/libvirt/qemu:/etc/libvirt/qemu
                   - /var/log/libvirt/qemu:/var/log/libvirt/qemu:ro
                   - /var/log/containers/nova:/var/log/nova
             environment:
               - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
+        step_4:
+          if:
+            - need_libvirt_secret
+            - nova_libvirt_init_secret:
+                detach: false
+                image: {get_param: DockerNovaLibvirtImage}
+                privileged: false
+                user: root
+                volumes:
+                  list_concat:
+                    - {get_attr: [ContainersCommon, volumes]}
+                    -
+                      - /var/lib/config-data/puppet-generated/nova_libvirt/etc/nova:/etc/nova:ro
+                      - /etc/libvirt:/etc/libvirt
+                      - /var/run/libvirt:/var/run/libvirt
+                      - /var/lib/libvirt:/var/lib/libvirt
+                command:
+                  - /bin/bash
+                  - -c
+                  - str_replace:
+                      template: /usr/bin/virsh secret-define --file /etc/nova/secret.xml && /usr/bin/virsh secret-set-value --secret 'SECRET_UUID' --base64 'SECRET_KEY'
+                      params:
+                        SECRET_UUID: {get_param: CephClusterFSID}
+                        SECRET_KEY: {get_param: CephClientKey}
+            - {}
       host_prep_tasks:
         - name: create libvirt persistent data directories
           file:
             path: "{{ item }}"
             state: directory
           with_items:
+            - /etc/libvirt
             - /etc/libvirt/secrets
             - /etc/libvirt/qemu
             - /var/lib/libvirt
diff --git a/puppet/services/nova-compute.yaml b/puppet/services/nova-compute.yaml
index 6e1f3f56..36866a3a 100644
--- a/puppet/services/nova-compute.yaml
+++ b/puppet/services/nova-compute.yaml
@@ -170,6 +170,11 @@ outputs:
             tripleo::profile::base::nova::migration::client::ssh_port: {get_param: MigrationSshPort}
             nova::compute::rbd::libvirt_images_rbd_pool: {get_param: NovaRbdPoolName}
             nova::compute::rbd::libvirt_rbd_user: {get_param: CephClientUserName}
+            nova::compute::rbd::rbd_keyring:
+              list_join:
+              - '.'
+              - - 'client'
+                - {get_param: CephClientUserName}
             tripleo::profile::base::nova::compute::cinder_nfs_backend: {get_param: CinderEnableNfsBackend}
             rbd_persistent_storage: {get_param: CinderEnableRbdBackend}
             nova::compute::rbd::libvirt_rbd_secret_key: {get_param: CephClientKey}
diff --git a/puppet/services/nova-libvirt.yaml b/puppet/services/nova-libvirt.yaml
index e2ae7260..04936c33 100644
--- a/puppet/services/nova-libvirt.yaml
+++ b/puppet/services/nova-libvirt.yaml
@@ -139,6 +139,11 @@ outputs:
           # we manage migration in nova common puppet profile
             nova::compute::libvirt::migration_support: false
             nova::compute::rbd::libvirt_rbd_user: {get_param: CephClientUserName}
+            nova::compute::rbd::rbd_keyring:
+              list_join:
+              - '.'
+              - - 'client'
+                - {get_param: CephClientUserName}
             nova::compute::rbd::libvirt_rbd_secret_key: {get_param: CephClientKey}
             nova::compute::rbd::libvirt_rbd_secret_uuid: {get_param: CephClusterFSID}
             tripleo::profile::base::nova::migration::client::libvirt_enabled: true