Skip to content

Commit 5100d59

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #599 from jichenjc/add_application_id
Add application cred usage
2 parents b48eb69 + 55ea934 commit 5100d59

File tree

3 files changed

+50
-4
lines changed

3 files changed

+50
-4
lines changed

‎docs/configuration.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
- [Operating system image](#operating-system-image)
77
- [SSH key pair](#ssh-key-pair)
88
- [OpenStack credential](#openstack-credential)
9+
- [Generate credentials](#generate-credentials)
910
- [Availability zone](#availability-zone)
1011
- [DNS server](#dns-server)
1112
- [Optional Configuration](#optional-configuration)
@@ -61,6 +62,7 @@ spec:
6162
6263
## OpenStack credential
6364
65+
### Generate credentials
6466
The [env.rc](./env.rc) script sets the environment variables related to credentials.
6567
6668
```bash
@@ -76,6 +78,8 @@ The following variables are set.
7678
| OPENSTACK_CLOUD_PROVIDER_CONF_B64 | The content of [cloud.conf](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#cloud-conf) which is used by OpenStack cloud provider |
7779
| OPENSTACK_CLOUD_CACERT_B64 | (Optional) The content of your custom CA file which can be specified in your clouds.yaml by `ca-file` |
7880

81+
Note: Only the [external cloud provider](./external-cloud-provider.md) supports [Application Credentials](https://docs.openstack.org/keystone/latest/user/application_credentials.html).
82+
7983
## Availability zone
8084

8185
The availability zone names must be exposed as an environment variable `OPENSTACK_FAILURE_DOMAIN`.

‎templates/create_cloud_conf.sh‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,9 @@ CAPO_REGION=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_C
6969
CAPO_PROJECT_ID=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_CLOUD}.auth.project_id)
7070
CAPO_PROJECT_NAME=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_CLOUD}.auth.project_name)
7171
CAPO_DOMAIN_NAME=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_CLOUD}.auth.user_domain_name)
72+
CAPO_APPLICATION_CREDENTIAL_NAME=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_CLOUD}.auth.application_credential_name)
73+
CAPO_APPLICATION_CREDENTIAL_ID=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_CLOUD}.auth.application_credential_id)
74+
CAPO_APPLICATION_CREDENTIAL_SECRET=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_CLOUD}.auth.application_credential_secret)
7275
if [[ "$CAPO_DOMAIN_NAME" = "null" ]]; then
7376
CAPO_DOMAIN_NAME=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_CLOUD}.auth.domain_name)
7477
fi
@@ -83,10 +86,16 @@ CAPO_CLOUD_PROVIDER_CONF_TMP=$(mktemp /tmp/cloud.confXXX)
8386
cat >> ${CAPO_CLOUD_PROVIDER_CONF_TMP} << EOF
8487
[Global]
8588
auth-url=${CAPO_AUTH_URL}
86-
username="${CAPO_USERNAME}"
87-
password="${CAPO_PASSWORD}"
8889
EOF
8990

91+
if [[ "$CAPO_USERNAME" != "" && "$CAPO_USERNAME" != "null" ]]; then
92+
echo "username=\"${CAPO_USERNAME}\"" >> ${CAPO_CLOUD_PROVIDER_CONF_TMP}
93+
fi
94+
95+
if [[ "$CAPO_PASSWORD" != "" && "$CAPO_PASSWORD" != "null" ]]; then
96+
echo "password=\"${CAPO_PASSWORD}\"" >> ${CAPO_CLOUD_PROVIDER_CONF_TMP}
97+
fi
98+
9099
if [[ "$CAPO_PROJECT_ID" != "" && "$CAPO_PROJECT_ID" != "null" ]]; then
91100
echo "tenant-id=\"${CAPO_PROJECT_ID}\"" >> ${CAPO_CLOUD_PROVIDER_CONF_TMP}
92101
fi
@@ -107,4 +116,17 @@ if [[ "$CAPO_REGION" != "" && "$CAPO_REGION" != "null" ]]; then
107116
echo "region=\"${CAPO_REGION}\"" >> ${CAPO_CLOUD_PROVIDER_CONF_TMP}
108117
fi
109118

119+
if [[ "$CAPO_APPLICATION_CREDENTIAL_NAME" != "" && "$CAPO_APPLICATION_CREDENTIAL_NAME" != "null" ]]; then
120+
echo "application-credential-name=\"${CAPO_APPLICATION_CREDENTIAL_NAME}\"" >> ${CAPO_CLOUD_PROVIDER_CONF_TMP}
121+
fi
122+
123+
if [[ "$CAPO_APPLICATION_CREDENTIAL_ID" != "" && "$CAPO_APPLICATION_CREDENTIAL_ID" != "null" ]]; then
124+
echo "application-credential-id=\"${CAPO_APPLICATION_CREDENTIAL_ID}\"" >> ${CAPO_CLOUD_PROVIDER_CONF_TMP}
125+
fi
126+
127+
if [[ "$CAPO_APPLICATION_CREDENTIAL_SECRET" != "" && "$CAPO_APPLICATION_CREDENTIAL_SECRET" != "null" ]]; then
128+
echo "application-credential-secret=\"${CAPO_APPLICATION_CREDENTIAL_SECRET}\"" >> ${CAPO_CLOUD_PROVIDER_CONF_TMP}
129+
fi
130+
131+
110132
cat ${CAPO_CLOUD_PROVIDER_CONF_TMP}

‎templates/env.rc‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,9 @@ CAPO_REGION=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_C
6969
CAPO_PROJECT_ID=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_CLOUD}.auth.project_id)
7070
CAPO_PROJECT_NAME=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_CLOUD}.auth.project_name)
7171
CAPO_DOMAIN_NAME=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_CLOUD}.auth.user_domain_name)
72+
CAPO_APPLICATION_CREDENTIAL_NAME=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_CLOUD}.auth.application_credential_name)
73+
CAPO_APPLICATION_CREDENTIAL_ID=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_CLOUD}.auth.application_credential_id)
74+
CAPO_APPLICATION_CREDENTIAL_SECRET=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_CLOUD}.auth.application_credential_secret)
7275
if [[ "$CAPO_DOMAIN_NAME" = "null" ]]; then
7376
CAPO_DOMAIN_NAME=$(echo "$CAPO_OPENSTACK_CLOUD_YAML_CONTENT" | yq r - clouds.${CAPO_CLOUD}.auth.domain_name)
7477
fi
@@ -90,10 +93,16 @@ CAPO_CLOUD_PROVIDER_CONF_TMP=$(mktemp /tmp/cloud.confXXX)
9093
cat >> ${CAPO_CLOUD_PROVIDER_CONF_TMP} << EOF
9194
[Global]
9295
auth-url=${CAPO_AUTH_URL}
93-
username="${CAPO_USERNAME}"
94-
password="${CAPO_PASSWORD}"
9596
EOF
9697

98+
if [[ "$CAPO_USERNAME" != "" && "$CAPO_USERNAME" != "null" ]]; then
99+
echo "username=\"${CAPO_USERNAME}\"" >> ${CAPO_CLOUD_PROVIDER_CONF_TMP}
100+
fi
101+
102+
if [[ "$CAPO_PASSWORD" != "" && "$CAPO_PASSWORD" != "null" ]]; then
103+
echo "password=\"${CAPO_PASSWORD}\"" >> ${CAPO_CLOUD_PROVIDER_CONF_TMP}
104+
fi
105+
97106
if [[ "$CAPO_PROJECT_ID" != "" && "$CAPO_PROJECT_ID" != "null" ]]; then
98107
echo "tenant-id=\"${CAPO_PROJECT_ID}\"" >> ${CAPO_CLOUD_PROVIDER_CONF_TMP}
99108
fi
@@ -113,6 +122,17 @@ fi
113122
if [[ "$CAPO_REGION" != "" && "$CAPO_REGION" != "null" ]]; then
114123
echo "region=\"${CAPO_REGION}\"" >> ${CAPO_CLOUD_PROVIDER_CONF_TMP}
115124
fi
125+
if [[ "$CAPO_APPLICATION_CREDENTIAL_NAME" != "" && "$CAPO_APPLICATION_CREDENTIAL_NAME" != "null" ]]; then
126+
echo "application-credential-name=\"${CAPO_APPLICATION_CREDENTIAL_NAME}\"" >> ${CAPO_CLOUD_PROVIDER_CONF_TMP}
127+
fi
128+
129+
if [[ "$CAPO_APPLICATION_CREDENTIAL_ID" != "" && "$CAPO_APPLICATION_CREDENTIAL_ID" != "null" ]]; then
130+
echo "application-credential-id=\"${CAPO_APPLICATION_CREDENTIAL_ID}\"" >> ${CAPO_CLOUD_PROVIDER_CONF_TMP}
131+
fi
132+
133+
if [[ "$CAPO_APPLICATION_CREDENTIAL_SECRET" != "" && "$CAPO_APPLICATION_CREDENTIAL_SECRET" != "null" ]]; then
134+
echo "application-credential-secret=\"${CAPO_APPLICATION_CREDENTIAL_SECRET}\"" >> ${CAPO_CLOUD_PROVIDER_CONF_TMP}
135+
fi
116136
export OPENSTACK_CLOUD_PROVIDER_CONF_B64="$(cat ${CAPO_CLOUD_PROVIDER_CONF_TMP} | base64 --wrap=0)"
117137

118138
# Build OPENSTACK_CLOUD_CACERT_B64

0 commit comments

Comments
 (0)