Skip to content

Commit f52de0b

Browse files
hjensashjensas
committed
Refactor auth config to eliminate duplication
Move auth_url into auth_config template definitions and consolidate auth config across templates. Changes: - Add auth_url to auth_config template in common/ironic.conf, inspector, and neutron-agent configs - Remove duplicate auth_url lines across all templates - Add [ironic] section to common config for API client authentication - Remove duplicate auth sections from ironicapi/01-api.conf - Update ironicapi test to check ironic.conf for auth configuration Assisted-By: Claude Code/claude-4.5-sonnet Signed-off-by: Harald Jensås <hjensas@redhat.com>
1 parent c583d43 commit f52de0b

File tree

5 files changed

+13
-74
lines changed

5 files changed

+13
-74
lines changed

‎templates/common/config/ironic.conf‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{{- define "auth_config" -}}
2+
auth_url={{ .KeystoneInternalURL }}
23
{{ if .UseApplicationCredentials -}}
34
auth_type=v3applicationcredential
45
application_credential_id = {{ .ACID }}
@@ -62,42 +63,41 @@ deploy_logs_local_path=/var/lib/ironic/ramdisk-logs
6263
[service_catalog]
6364
auth_type=none
6465
endpoint_override={{ .IronicPublicURL }}
66+
67+
[ironic]
68+
auth_type=none
69+
endpoint_override={{ .IronicPublicURL }}
6570
{{else}}
6671
[keystone_authtoken]
67-
auth_url={{ .KeystoneInternalURL }}
6872
www_authenticate_uri={{ .KeystonePublicURL }}
69-
{{ template "auth_config" . }}
7073
# This is part of hardening related to CVE-2023-2088
7174
# https://docs.openstack.org/nova/latest/configuration/config.html#keystone_authtoken.service_token_roles_required
7275
# when enabled the service token user must have the service role to be considered valid.
7376
service_token_roles_required = true
77+
{{ template "auth_config" . }}
7478

7579
[service_catalog]
76-
auth_url={{ .KeystoneInternalURL }}
7780
{{ template "auth_config" . }}
7881

7982
[cinder]
80-
auth_url={{ .KeystoneInternalURL }}
8183
{{ template "auth_config" . }}
8284

8385
[glance]
84-
auth_url={{ .KeystoneInternalURL }}
8586
{{ template "auth_config" . }}
8687

8788
[neutron]
88-
auth_url={{ .KeystoneInternalURL }}
8989
{{ template "auth_config" . }}
9090

9191
[nova]
92-
auth_url={{ .KeystoneInternalURL }}
9392
{{ template "auth_config" . }}
9493

9594
[swift]
96-
auth_url={{ .KeystoneInternalURL }}
9795
{{ template "auth_config" . }}
9896

9997
[inspector]
100-
auth_url={{ .KeystoneInternalURL }}
98+
{{ template "auth_config" . }}
99+
100+
[ironic]
101101
{{ template "auth_config" . }}
102102

103103
[oslo_policy]

‎templates/ironicapi/config/01-api.conf‎

Lines changed: 0 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,3 @@
1-
{{- define "auth_config" -}}
2-
{{ if .UseApplicationCredentials -}}
3-
auth_type=v3applicationcredential
4-
application_credential_id = {{ .ACID }}
5-
application_credential_secret = {{ .ACSecret }}
6-
{{- else -}}
7-
auth_type=password
8-
username={{ .ServiceUser }}
9-
password = {{ .ServicePassword }}
10-
user_domain_name=Default
11-
project_name=service
12-
project_domain_name=Default
13-
{{- end }}
14-
{{ if (index . "Region") -}}
15-
region_name={{ .Region }}
16-
{{ end -}}
17-
{{- end -}}
18-
191
[DEFAULT]
202
# API-specific configuration overrides
213

@@ -27,44 +9,6 @@ max_age=3600
279
allow_methods=GET,POST,PUT,DELETE,OPTIONS,PATCH
2810
allow_headers=Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token
2911

30-
[oslo_middleware]
31-
enable_proxy_headers_parsing=true
32-
33-
{{if .Standalone}}
34-
[ironic]
35-
auth_type=none
36-
{{else}}
3712
[ironic]
38-
auth_url={{ .KeystoneInternalURL }}
39-
{{ template "auth_config" . }}
4013
max_retries=6
4114
retry_interval=10
42-
43-
[keystone_authtoken]
44-
auth_url={{ .KeystoneInternalURL }}
45-
www_authenticate_uri={{ .KeystonePublicURL }}
46-
{{ template "auth_config" . }}
47-
48-
[service_catalog]
49-
auth_url={{ .KeystoneInternalURL }}
50-
{{ template "auth_config" . }}
51-
52-
[glance]
53-
auth_url={{ .KeystoneInternalURL }}
54-
{{ template "auth_config" . }}
55-
56-
[neutron]
57-
auth_url={{ .KeystoneInternalURL }}
58-
{{ template "auth_config" . }}
59-
60-
[nova]
61-
auth_url={{ .KeystoneInternalURL }}
62-
{{ template "auth_config" . }}
63-
{{end}}
64-
65-
{{ if (index . "QuorumQueues") }}
66-
[oslo_messaging_rabbit]
67-
rabbit_quorum_queue=true
68-
rabbit_transient_quorum_queue=true
69-
amqp_durable_queues=true
70-
{{ end }}

‎templates/ironicinspector/config/01-inspector.conf‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{{- define "auth_config" -}}
2+
auth_url={{ .KeystoneInternalURL }}
23
{{ if .UseApplicationCredentials -}}
34
auth_type=v3applicationcredential
45
application_credential_id = {{ .ACID }}
@@ -43,22 +44,18 @@ auth_type=none
4344
endpoint_override={{ .IronicInternalURL }}
4445
{{else}}
4546
[ironic]
46-
auth_url={{ .KeystoneInternalURL }}
47-
{{ template "auth_config" . }}
4847
max_retries=6
4948
retry_interval=10
49+
{{ template "auth_config" . }}
5050

5151
[keystone_authtoken]
52-
auth_url={{ .KeystoneInternalURL }}
5352
www_authenticate_uri={{ .KeystonePublicURL }}
5453
{{ template "auth_config" . }}
5554

5655
[service_catalog]
57-
auth_url={{ .KeystoneInternalURL }}
5856
{{ template "auth_config" . }}
5957

6058
[swift]
61-
auth_url={{ .KeystoneInternalURL }}
6259
{{ template "auth_config" . }}
6360

6461
[oslo_policy]

‎templates/ironicneutronagent/config/01-ironic_neutron_agent.conf‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{{- define "auth_config" -}}
2+
auth_url={{ .KeystoneInternalURL }}
23
{{ if .UseApplicationCredentials -}}
34
auth_type=v3applicationcredential
45
application_credential_id = {{ .ACID }}
@@ -22,15 +23,12 @@ transport_url = {{ .TransportURL }}
2223

2324
[keystone_authtoken]
2425
www_authenticate_uri={{ .KeystonePublicURL }}
25-
auth_url={{ .KeystoneInternalURL }}
2626
{{ template "auth_config" . }}
2727

2828
[service_catalog]
29-
auth_url={{ .KeystoneInternalURL }}
3029
{{ template "auth_config" . }}
3130

3231
[ironic]
33-
auth_url={{ .KeystoneInternalURL }}
3432
{{ template "auth_config" . }}
3533

3634
[agent]

‎test/functional/ironicapi_controller_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -770,7 +770,7 @@ var _ = Describe("IronicAPI controller", func() {
770770
cfgSecret := th.GetSecret(configSecretName)
771771
g.Expect(cfgSecret).NotTo(BeNil())
772772

773-
conf := string(cfgSecret.Data["01-api.conf"])
773+
conf := string(cfgSecret.Data["ironic.conf"])
774774

775775
// AC auth is configured
776776
g.Expect(conf).To(ContainSubstring("auth_type=v3applicationcredential"))

0 commit comments

Comments
 (0)