Skip to content

Commit abdd981

Browse files
cardoecardoe
authored
Merge pull request #1235 from rackerlabs/openstack-service-users
feat(openstack): share service acct credentials via ESO
2 parents 86a8a7d + ad14140 commit abdd981

23 files changed

+5190
-39
lines changed

‎components/cinder/configmap-cinder-bin.yaml‎

Lines changed: 883 additions & 0 deletions
Large diffs are not rendered by default.

‎components/cinder/kustomization.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,7 @@ resources:
66
- cinder-mariadb-db.yaml
77
- cinder-rabbitmq-queue.yaml
88
- cinder-volume-netapp.yaml
9+
# less than ideal addition but necessary so that we can have the cinder.conf.d loading
10+
# working due to the way the chart hardcodes the config-file parameter which then
11+
# takes precedence over the directory
12+
- configmap-cinder-bin.yaml

‎components/cinder/values.yaml‎

Lines changed: 94 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -62,16 +62,94 @@ pod:
6262
volumeMounts:
6363
- mountPath: /var/lib/cinder
6464
name: var-lib-cinder
65-
- mountPath: /etc/cinder/cinder.conf.d/netapp_nvme.conf
66-
subPath: netapp_nvme.conf
67-
name: volume-backend
65+
- name: cinder-etc-snippets
66+
mountPath: /etc/cinder/cinder.conf.d/
6867
readOnly: true
6968
volumes:
7069
- name: var-lib-cinder
7170
emptyDir: {}
72-
- name: volume-backend
73-
secret:
74-
secretName: cinder-netapp-config
71+
- name: cinder-etc-snippets
72+
projected:
73+
sources:
74+
- secret:
75+
name: cinder-ks-etc
76+
- secret:
77+
name: volume-backend
78+
items:
79+
- key: netapp_nvme.conf
80+
path: netapp_nvme.conf
81+
cinder_volume_usage_audit:
82+
cinder_volume_usage_audit:
83+
volumeMounts:
84+
- name: cinder-etc-snippets
85+
mountPath: /etc/cinder/cinder.conf.d/
86+
readOnly: true
87+
volumes:
88+
- name: cinder-etc-snippets
89+
projected:
90+
sources:
91+
- secret:
92+
name: cinder-ks-etc
93+
cinder_db_sync:
94+
cinder_db_sync:
95+
volumeMounts:
96+
- name: cinder-etc-snippets
97+
mountPath: /etc/cinder/cinder.conf.d/
98+
readOnly: true
99+
volumes:
100+
- name: cinder-etc-snippets
101+
projected:
102+
sources:
103+
- secret:
104+
name: cinder-ks-etc
105+
cinder_backup:
106+
cinder_backup:
107+
volumeMounts:
108+
- name: cinder-etc-snippets
109+
mountPath: /etc/cinder/cinder.conf.d/
110+
readOnly: true
111+
volumes:
112+
- name: cinder-etc-snippets
113+
projected:
114+
sources:
115+
- secret:
116+
name: cinder-ks-etc
117+
cinder_scheduler:
118+
cinder_scheduler:
119+
volumeMounts:
120+
- name: cinder-etc-snippets
121+
mountPath: /etc/cinder/cinder.conf.d/
122+
readOnly: true
123+
volumes:
124+
- name: cinder-etc-snippets
125+
projected:
126+
sources:
127+
- secret:
128+
name: cinder-ks-etc
129+
cinder_db_purge:
130+
cinder_db_purge:
131+
volumeMounts:
132+
- name: cinder-etc-snippets
133+
mountPath: /etc/cinder/cinder.conf.d/
134+
readOnly: true
135+
volumes:
136+
- name: cinder-etc-snippets
137+
projected:
138+
sources:
139+
- secret:
140+
name: cinder-ks-etc
141+
cinder_api:
142+
cinder_api:
143+
volumeMounts:
144+
- name: cinder-etc-snippets
145+
mountPath: /etc/cinder/cinder.conf.d/
146+
readOnly: true
147+
volumes:
148+
- name: cinder-etc-snippets
149+
projected:
150+
sources:
151+
- secret:
152+
name: cinder-ks-etc
75153
lifecycle:
76154
disruption_budget:
77155
deployments:
@@ -126,7 +204,6 @@ dependencies:
126204
- cinder-ks-endpoints
127205

128206
manifests:
129-
secret_keystone: true
130207
job_backup_storage_init: false
131208
job_bootstrap: false
132209
job_clean: false
@@ -141,6 +218,16 @@ manifests:
141218
secret_registry: false
142219
service_ingress_api: false
143220
deployment_backup: false
221+
# We set the `secret_keystone` and `secret_ks_etc` to false in order to disable
222+
# Kubernetes section generation in OpenStack Helm, because we want those
223+
# to be generated indirectly via ESO as configured in keystoneServiceUsers.enabled
224+
# that is later consumed via components/openstack helm chart
225+
secret_keystone: false
226+
secret_ks_etc: false
227+
# less than ideal but currently necessary due to the way the chart
228+
# hardcodes the config-file flag which then causes oslo.config to prefer
229+
# that data over the directory which we want to override
230+
configmap_bin: false
144231

145232
annotations:
146233
# we need to modify the annotations on OpenStack Helm

‎components/glance/values.yaml‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,31 @@ dependencies:
6565
- glance-ks-endpoints
6666

6767
pod:
68+
mounts:
69+
glance_db_sync:
70+
glance_db_sync:
71+
volumeMounts:
72+
- name: glance-etc-snippets
73+
mountPath: /etc/glance/glance.conf.d/
74+
readOnly: true
75+
volumes:
76+
- name: glance-etc-snippets
77+
projected:
78+
sources:
79+
- secret:
80+
name: glance-ks-etc
81+
glance_api:
82+
glance_api:
83+
volumeMounts:
84+
- name: glance-etc-snippets
85+
mountPath: /etc/glance/glance.conf.d/
86+
readOnly: true
87+
volumes:
88+
- name: glance-etc-snippets
89+
projected:
90+
sources:
91+
- secret:
92+
name: glance-ks-etc
6893
lifecycle:
6994
disruption_budget:
7095
api:
@@ -109,8 +134,13 @@ manifests:
109134
job_image_repo_sync: false
110135
pod_rally_test: false
111136
secret_db: false
112-
secret_keystone: true
113137
service_ingress_api: false
138+
# We set the `secret_keystone` and `secret_ks_etc` to false in order to disable
139+
# Kubernetes section generation in OpenStack Helm, because we want those
140+
# to be generated indirectly via ESO as configured in keystoneServiceUsers.enabled
141+
# that is later consumed via components/openstack helm chart
142+
secret_keystone: false
143+
secret_ks_etc: false
114144

115145
annotations:
116146
# we need to modify the annotations on OpenStack Helm

‎components/ironic/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,12 @@ manifests:
192192
secret_rabbitmq: false
193193
secret_registry: false
194194
service_ingress_api: false
195+
# We set the `secret_keystone` and `secret_ks_etc` to false in order to disable
196+
# Kubernetes section generation in OpenStack Helm, because we want those
197+
# to be generated indirectly via ESO as configured in keystoneServiceUsers.enabled
198+
# that is later consumed via components/openstack helm chart
199+
secret_keystone: false
200+
secret_ks_etc: false
195201

196202
pod:
197203
mounts:

‎components/keystone/values.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -304,11 +304,16 @@ manifests:
304304
job_rabbit_init: false
305305
pod_rally_test: false
306306
secret_db: false
307-
secret_keystone: true
308307
service_ingress_api: false
309308
# these next two we create ourselves to avoid helm hooks issues
310309
secret_credential_keys: false
311310
secret_fernet_keys: false
311+
# We set the `secret_keystone` and `secret_ks_etc` to false in order to disable
312+
# Kubernetes section generation in OpenStack Helm, because we want those
313+
# to be generated indirectly via ESO as configured in keystoneServiceUsers.enabled
314+
# that is later consumed via components/openstack helm chart
315+
secret_keystone: false
316+
secret_ks_etc: false
312317

313318
annotations:
314319
# we need to modify the annotations on OpenStack Helm

0 commit comments

Comments
 (0)