master only support newton

JIRA: COMPASS-513

Remove other roles and ppa, master only support newton.

Change-Id: I47ddb16baa25902c3e05cc7f9d0d6430f5dc7e00
Signed-off-by: liyuenan <liyuenan@huawei.com>

4 files changed, 198 insertions, 53 deletions

diff --git a/deploy/adapters/ansible/roles/keystone/tasks/keystone_config.yml b/deploy/adapters/ansible/roles/keystone/tasks/keystone_config.yml
index e7e9297e..ea211470 100644
--- a/deploy/adapters/ansible/roles/keystone/tasks/keystone_config.yml
+++ b/deploy/adapters/ansible/roles/keystone/tasks/keystone_config.yml
@@ -7,55 +7,90 @@
 # http://www.apache.org/licenses/LICENSE-2.0
 ##############################################################################
 ---
+- include_vars: "{{ ansible_os_family }}.yml"
+
 - name: keystone-manage db-sync
-  #keystone_manage: action=dbsync
   shell: su -s /bin/sh -c 'keystone-manage db_sync' keystone
 
+- name: Check if fernet keys already exist
+  stat:
+    path: "/etc/keystone/fernet-keys/0"
+  register: fernet_keys_0
+
+- name: Create fernet keys for Keystone
+  command:
+    keystone-manage fernet_setup
+      --keystone-user keystone
+      --keystone-group keystone
+  when: not fernet_keys_0.stat.exists
+  notify:
+    - restart keystone services
+
+- name: Rotate fernet keys for Keystone
+  command:
+    keystone-manage fernet_rotate
+      --keystone-user keystone
+      --keystone-group keystone
+  when: fernet_keys_0.stat.exists
+  notify:
+    - restart keystone services
+
+- name: Distribute the fernet key repository
+  shell: rsync -e 'ssh -o StrictHostKeyChecking=no' \
+               -avz \
+               --delete \
+               /etc/keystone/fernet-keys \
+               root@{{ hostvars[ item ].ansible_eth0.ipv4.address }}:/etc/keystone/
+  with_items: groups['controller'][1:]
+  notify:
+    - restart keystone services
+
+- name: Check if credential keys already exist
+  stat:
+    path: "/etc/keystone/credential-keys/0"
+  register: credential_keys_0
+
+- name: Create credential keys for Keystone
+  command:
+    keystone-manage credential_setup
+      --keystone-user keystone
+      --keystone-group keystone
+  when: not credential_keys_0.stat.exists
+  notify:
+    - restart keystone services
+
+- name: Rotate credential keys for Keystone
+  command:
+    keystone-manage credential_rotate
+      --keystone-user keystone
+      --keystone-group keystone
+  when: credential_keys_0.stat.exists
+  notify:
+    - restart keystone services
+
+- name: Distribute the credential key repository
+  shell: rsync -e 'ssh -o StrictHostKeyChecking=no' \
+               -avz \
+               --delete \
+               /etc/keystone/credential-keys \
+               root@{{ hostvars[ item ].ansible_eth0.ipv4.address }}:/etc/keystone/
+  with_items: groups['controller'][1:]
+  notify:
+    - restart keystone services
+
+- name: Bootstrap the Identity service
+  shell:
+    keystone-manage bootstrap \
+      --bootstrap-password {{ ADMIN_PASS }} \
+      --bootstrap-admin-url http://{{ internal_ip }}:35357/v3/ \
+      --bootstrap-internal-url http://{{ internal_ip }}:35357/v3/ \
+      --bootstrap-public-url http://{{ internal_ip }}:5000/v3/
+      --bootstrap-region-id RegionOne \
+  notify:
+    - restart keystone services
+
+- meta: flush_handlers
+
 - name: wait for keystone ready
-  wait_for: port=35357 delay=3 timeout=10 host={{ internal_ip }}
-
-- name: cron job to purge expired tokens hourly
-  cron:
-    name: 'purge expired tokens'
-    special_time: hourly
-    job: '/usr/bin/keystone-manage token_flush > /var/log/keystone/keystone-tokenflush.log 2>&1'
-
-- name: add tenants
-  keystone_user:
-    token: "{{ ADMIN_TOKEN }}"
-    endpoint: "http://{{ internal_ip }}:35357/v2.0"
-    tenant: "{{ item.tenant }}"
-    tenant_description: "{{ item.tenant_description }}"
-  with_items: "{{ os_users }}"
-
-- name: add users
-  keystone_user:
-    token: "{{ ADMIN_TOKEN }}"
-    endpoint: "http://{{ internal_ip }}:35357/v2.0"
-    user: "{{ item.user }}"
-    tenant: "{{ item.tenant }}"
-    password: "{{ item.password }}"
-    email: "{{ item.email }}"
-  with_items: "{{ os_users }}"
-
-- name: grant roles
-  keystone_user:
-    token: "{{ ADMIN_TOKEN }}"
-    endpoint: "http://{{ internal_ip }}:35357/v2.0"
-    user: "{{ item.user }}"
-    role: "{{ item.role }}"
-    tenant: "{{ item.tenant }}"
-  with_items: "{{ os_users }}"
-
-- name: add endpoints
-  keystone_service:
-    token: "{{ ADMIN_TOKEN }}"
-    endpoint: "http://{{ internal_ip }}:35357/v2.0"
-    name: "{{ item.name }}"
-    type: "{{ item.type }}"
-    region: "{{ item.region}}"
-    description: "{{ item.description }}"
-    publicurl: "{{ item.publicurl }}"
-    internalurl: "{{ item.internalurl }}"
-    adminurl: "{{ item.adminurl }}"
-  with_items: "{{ os_services }}"
+  wait_for: port=35357 delay=15 timeout=60 host={{ internal_ip }}
+
diff --git a/deploy/adapters/ansible/roles/keystone/tasks/keystone_create.yml b/deploy/adapters/ansible/roles/keystone/tasks/keystone_create.yml
new file mode 100644
index 00000000..53077776
--- /dev/null
+++ b/deploy/adapters/ansible/roles/keystone/tasks/keystone_create.yml
@@ -0,0 +1,93 @@
+##############################################################################
+# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
+#
+# All rights reserved. This program and the accompanying materials
+# are made available under the terms of the Apache License, Version 2.0
+# which accompanies this distribution, and is available at
+# http://www.apache.org/licenses/LICENSE-2.0
+##############################################################################
+---
+- name: set keystone endpoint
+  shell:
+    . /opt/admin-openrc.sh;
+    openstack endpoint set \
+         --interface public \
+         --url {{ item.publicurl }} \
+         $(openstack endpoint list | grep keystone | grep public | awk '{print $2}');
+    openstack endpoint set \
+         --interface internal \
+         --url {{ item.internalurl }} \
+         $(openstack endpoint list | grep keystone | grep internal | awk '{print $2}');
+    openstack endpoint set \
+         --interface admin \
+         --url {{ item.adminurl }} \
+         $(openstack endpoint list | grep keystone | grep admin | awk '{print $2}');
+  with_items: "{{ os_services[0:1] }}"
+
+- name: add service
+  shell:
+    . /opt/admin-openrc.sh;
+    openstack service create \
+        --name "{{ item.name }}"
+        --description "{{ item.description }}" \
+        {{ item.type }}
+  with_items: "{{ os_services[1:] }}"
+
+- name: add project
+  shell:
+    . /opt/admin-openrc.sh;
+    openstack project create --description "Service Project" service;
+    openstack project create --domain default --description "Demo Project" demo;
+
+- name: set admin user
+  shell:
+    . /opt/admin-openrc.sh;
+    openstack user set \
+        --email "{{ item.email }}" \
+        --project "{{ item.tenant }}" \
+        --description "{{ item.tenant_description }}" \
+        --password "{{ item.password }}" \
+        {{ item.user }}
+  with_items: "{{ os_users }}"
+  when: item["user"] == "admin"
+
+- name: add user
+  shell:
+    . /opt/admin-openrc.sh;
+    openstack user create \
+        --email "{{ item.email }}" \
+        --project "{{ item.tenant }}" \
+        --description "{{ item.tenant_description }}" \
+        --password "{{ item.password }}" \
+        {{ item.user }}
+  with_items: "{{ os_users[1:] }}"
+
+- name: add roles
+  shell:
+    . /opt/admin-openrc.sh;
+    openstack role create {{ item.role }}
+  with_items: "{{ os_users }}"
+  when: item["user"] == "demo"
+
+- name: grant roles
+  shell:
+    . /opt/admin-openrc.sh;
+    openstack role add \
+        --project "{{ item.tenant }}" \
+        --user "{{ item.user }}" \
+        {{ item.role }}
+  with_items: "{{ os_users }}"
+
+- name: add endpoints
+  shell:
+    . /opt/admin-openrc.sh;
+    openstack endpoint create \
+        --region {{ item.region }} \
+        {{ item.name }} public {{ item.publicurl }};
+    openstack endpoint create \
+        --region {{ item.region }} \
+        {{ item.name }} internal {{ item.internalurl }};
+    openstack endpoint create \
+        --region {{ item.region }} \
+        {{ item.name }} admin {{ item.adminurl }};
+  with_items: "{{ os_services[1:] }}"
diff --git a/deploy/adapters/ansible/roles/keystone/tasks/keystone_install.yml b/deploy/adapters/ansible/roles/keystone/tasks/keystone_install.yml
index ea6926f4..757349c5 100644
--- a/deploy/adapters/ansible/roles/keystone/tasks/keystone_install.yml
+++ b/deploy/adapters/ansible/roles/keystone/tasks/keystone_install.yml
@@ -26,6 +26,16 @@
     state=absent
   when: ansible_os_family == "Debian"
 
+- name: disable boot auto start
+  file:
+    path={{ item }}
+    state=absent
+  with_items:
+    - /etc/init.d/keystone
+    - /etc/init/keystone.conf
+    - /lib/systemd/system/keystone.service
+  when: ansible_os_family == "Debian"
+
 - name: generate keystone service list
   lineinfile: dest=/opt/service create=yes line='{{ item }}'
   with_items: services | union(services_noarch)
@@ -56,7 +66,7 @@
 - name: update apache2 configs
   template:
     src: wsgi-keystone.conf.j2
-    dest: '{{ apache_config_dir }}/sites-available/wsgi-keystone.conf'
+    dest: '{{ apache_config_dir }}/sites-available/keystone.conf'
   when: ansible_os_family == 'Debian'
   notify:
     - restart keystone services
@@ -64,15 +74,15 @@
 - name: update apache2 configs
   template:
     src: wsgi-keystone.conf.j2
-    dest: '{{ apache_config_dir }}/wsgi-keystone.conf'
+    dest: '{{ apache_config_dir }}/keystone.conf'
   when: ansible_os_family == 'RedHat'
   notify:
     - restart keystone services
 
 - name: enable keystone server
   file:
-    src: "{{ apache_config_dir }}/sites-available/wsgi-keystone.conf"
-    dest: "{{ apache_config_dir }}/sites-enabled/wsgi-keystone.conf"
+    src: "{{ apache_config_dir }}/sites-available/keystone.conf"
+    dest: "{{ apache_config_dir }}/sites-enabled/keystone.conf"
     state: "link"
   when: ansible_os_family == 'Debian'
   notify:
@@ -82,7 +92,7 @@
   template: src={{ item }} dest=/opt/{{ item }}
   with_items:
     - admin-openrc.sh
+    - admin-openrc-v2.sh
     - demo-openrc.sh
-    - admin-openrc-v3.sh
 
 - meta: flush_handlers
diff --git a/deploy/adapters/ansible/roles/keystone/tasks/main.yml b/deploy/adapters/ansible/roles/keystone/tasks/main.yml
index 21939fa7..ad619d40 100644
--- a/deploy/adapters/ansible/roles/keystone/tasks/main.yml
+++ b/deploy/adapters/ansible/roles/keystone/tasks/main.yml
@@ -20,4 +20,11 @@
     - keystone_config
     - keystone
 
+- include: keystone_create.yml
+  when: inventory_hostname == groups['controller'][0]
+  tags:
+    - config
+    - keystone_create
+    - keystone
+
 - meta: flush_handlers