blob: ac3ff8fe381ef24a4000351e29e3700cfd7faca0 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
##############################################################################
# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
#
# All rights reserved. This program and the accompanying materials
# are made available under the terms of the Apache License, Version 2.0
# which accompanies this distribution, and is available at
# http://www.apache.org/licenses/LICENSE-2.0
##############################################################################
---
- include_vars: "{{ ansible_os_family }}.yml"
- name: keystone-manage db-sync
shell: su -s /bin/sh -c 'keystone-manage db_sync' keystone
- name: Check if fernet keys already exist
stat:
path: "/etc/keystone/fernet-keys/0"
register: fernet_keys_0
- name: Create fernet keys for Keystone
command:
keystone-manage fernet_setup
--keystone-user keystone
--keystone-group keystone
when: not fernet_keys_0.stat.exists
notify:
- restart keystone services
- name: Rotate fernet keys for Keystone
command:
keystone-manage fernet_rotate
--keystone-user keystone
--keystone-group keystone
when: fernet_keys_0.stat.exists
notify:
- restart keystone services
- name: Distribute the fernet key repository
shell: |
rsync -e 'ssh -o StrictHostKeyChecking=no' \
-avz \
--delete \
/etc/keystone/fernet-keys \
root@{{ hostvars[ item ].ansible_eth0.ipv4.address }}:/etc/keystone/
with_items: "{{ groups['controller'][1:] }}"
notify:
- restart keystone services
- name: Check if credential keys already exist
stat:
path: "/etc/keystone/credential-keys/0"
register: credential_keys_0
- name: Create credential keys for Keystone
command:
keystone-manage credential_setup
--keystone-user keystone
--keystone-group keystone
when: not credential_keys_0.stat.exists
notify:
- restart keystone services
- name: Rotate credential keys for Keystone
command:
keystone-manage credential_rotate
--keystone-user keystone
--keystone-group keystone
when: credential_keys_0.stat.exists
notify:
- restart keystone services
- name: Distribute the credential key repository
shell: |
rsync -e 'ssh -o StrictHostKeyChecking=no' \
-avz \
--delete \
/etc/keystone/credential-keys \
root@{{ hostvars[ item ].ansible_eth0.ipv4.address }}:/etc/keystone/
with_items: "{{ groups['controller'][1:] }}"
notify:
- restart keystone services
- name: Bootstrap the Identity service
shell:
keystone-manage bootstrap \
--bootstrap-password {{ ADMIN_PASS }} \
--bootstrap-admin-url http://{{ internal_ip }}:35357/v3/ \
--bootstrap-internal-url http://{{ internal_ip }}:35357/v3/ \
--bootstrap-public-url http://{{ internal_ip }}:5000/v3/
--bootstrap-region-id RegionOne \
notify:
- restart keystone services
- meta: flush_handlers
- name: wait for keystone ready
wait_for: port=35357 delay=15 timeout=60 host={{ internal_ip }}
|
