{"id":20111211,"url":"https://github.com/openstack/puppet-keystone","last_synced_at":"2025-12-17T23:08:54.752Z","repository":{"id":7855955,"uuid":"9228010","full_name":"openstack/puppet-keystone","owner":"openstack","description":"OpenStack Keystone Puppet Module. Mirror of code maintained at opendev.org.","archived":false,"fork":false,"pushed_at":"2025-03-31T14:11:30.000Z","size":3385,"stargazers_count":69,"open_issues_count":0,"forks_count":105,"subscribers_count":16,"default_branch":"master","last_synced_at":"2025-04-01T07:21:13.694Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://opendev.org/openstack/puppet-keystone","language":"Ruby","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/openstack.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.rst","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2013-04-04T21:04:13.000Z","updated_at":"2025-03-31T14:11:35.000Z","dependencies_parsed_at":"2023-11-08T04:14:49.663Z","dependency_job_id":"df3598a3-288b-46c7-bd72-16fd71647ed3","html_url":"https://github.com/openstack/puppet-keystone","commit_stats":null,"previous_names":[],"tags_count":141,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fpuppet-keystone","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fpuppet-keystone/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fpuppet-keystone/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fpuppet-keystone/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/openstack","download_url":"https://codeload.github.com/openstack/puppet-keystone/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247294538,"owners_count":20915340,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-13T18:14:54.156Z","updated_at":"2025-12-17T23:08:49.717Z","avatar_url":"https://github.com/openstack.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"Team and repository tags\n========================\n\n[![Team and repository tags](https://governance.openstack.org/tc/badges/puppet-keystone.svg)](https://governance.openstack.org/tc/reference/tags/index.html)\n\n\u003c!-- Change things from this point on --\u003e\n\nkeystone\n========\n\n#### Table of Contents\n\n1. [Overview - What is the keystone module?](#overview)\n2. [Module Description - What does the module do?](#module-description)\n3. [Setup - The basics of getting started with keystone](#setup)\n4. [Implementation - An under-the-hood peek at what the module is doing](#implementation)\n5. [Limitations - OS compatibility, etc.](#limitations)\n6. [Development - Guide for contributing to the module](#development)\n7. [Contributors - Those with commits](#contributors)\n8. [Release Notes - Release notes for the project](#release-notes)\n9. [Repository - The project source code repository](#repository)\n\nOverview\n--------\n\nThe keystone module is a part of [OpenStack](https://opendev.org/openstack), an effort by the OpenStack infrastructure team to provide continuous integration testing and code review for OpenStack and OpenStack community projects as part of the core software.  The module itself is used to flexibly configure and manage the identity service for OpenStack.\n\nModule Description\n------------------\n\nThe keystone module is a thorough attempt to make Puppet capable of managing the entirety of keystone.  This includes manifests to provision region specific endpoint and database connections.  Types are shipped as part of the keystone module to assist in manipulation of configuration files.\n\nThis module is tested in combination with other modules needed to build and leverage an entire OpenStack software stack.\n\nSetup\n-----\n\n**What the keystone module affects**\n\n* [Keystone](https://docs.openstack.org/keystone/latest/), the identity service for OpenStack.\n\n### Installing keystone\n\n    puppet module install openstack/keystone\n\n### Beginning with keystone\n\nTo utilize the keystone module's functionality you will need to declare multiple resources. This is not an exhaustive list of all the components needed, we recommend you consult and understand the [core openstack](http://docs.openstack.org) documentation.\n\n**Define a keystone node**\n\n```puppet\nclass { 'keystone::db':\n  database_connection =\u003e 'mysql://keystone_admin:super_secret_db_password@openstack-controller.example.com/keystone',\n}\n\nclass { 'keystone':\n  catalog_driver =\u003e 'sql',\n}\n\nclass { 'keystone::bootstrap':\n  password     =\u003e 'super_secret',\n  public_url   =\u003e 'http://10.16.0.101:5000',\n  admin_url    =\u003e 'http://10.16.1.101:5000',\n  internal_url =\u003e 'http://10.16.2.101:5000',\n  region       =\u003e 'example-1',\n}\n```\n\n**Leveraging the Native Types**\n\nKeystone ships with a collection of native types that can be used to interact with the data stored in keystone.  The following, related to user management could live throughout your Puppet code base.  They even support puppet's ability to introspect the current environment much the same as `puppet resource user`, `puppet resource keystone_tenant` will print out all the currently stored tenants and their parameters.\n\n```puppet\nkeystone_tenant { 'openstack':\n  ensure  =\u003e present,\n  enabled =\u003e true,\n}\nkeystone_user { 'openstack':\n  ensure  =\u003e present,\n  enabled =\u003e true,\n}\nkeystone_role { 'admin':\n  ensure =\u003e present,\n}\nkeystone_user_role { 'admin@openstack':\n  roles =\u003e ['admin', 'superawesomedude'],\n  ensure =\u003e present\n}\n```\n\nThese two will seldom be used outside openstack related classes, like nova or cinder.  These are modified examples from Class['nova::keystone::auth'].\n\n```puppet\n# Setup the nova keystone service\nkeystone_service { 'nova':\n  ensure      =\u003e present,\n  type        =\u003e 'compute',\n  description =\u003e 'OpenStack Compute Service',\n}\n\n```\n\nServices can also be written with the type as a suffix:\n\n```puppet\nkeystone_service { 'nova::type':\n  ensure      =\u003e present,\n  description =\u003e 'OpenStack Compute Service',\n}\n\n\n# Setup nova keystone endpoint\nkeystone_endpoint { 'example-1-west/nova':\n   ensure       =\u003e present,\n   type         =\u003e 'compute',\n   public_url   =\u003e \"http://127.0.0.1:8774/v2/%(tenant_id)s\",\n   admin_url    =\u003e \"http://127.0.0.1:8774/v2/%(tenant_id)s\",\n   internal_url =\u003e \"http://127.0.0.1:8774/v2/%(tenant_id)s\",\n}\n```\n\nEndpoints can also be written with the type as a suffix:\n\n```puppet\nkeystone_endpoint { 'example-1-west/nova::compute':\n   ensure       =\u003e present,\n   public_url   =\u003e \"http://127.0.0.1:8774/v2/%(tenant_id)s\",\n   admin_url    =\u003e \"http://127.0.0.1:8774/v2/%(tenant_id)s\",\n   internal_url =\u003e \"http://127.0.0.1:8774/v2/%(tenant_id)s\",\n}\n```\n\nDefining an endpoint without the type is supported in Liberty release\nfor backward compatibility, but will be dropped in Mitaka, as this can\nlead to corruption of the endpoint database if omitted.  See [this\nbug](https://bugs.launchpad.net/puppet-keystone/+bug/1506996)\n\n**Setting up a database for keystone**\n\nA keystone database can be configured separately from the keystone services.\n\nIf one needs to actually install a fresh database they have the choice of mysql or postgres.  Use the mysql::server or postgreql::server classes to do this setup, and then the Class['keystone::db::mysql'] or Class['keystone::db::postgresql'] for adding the databases and users that will be needed by keystone.\n\n* For mysql\n\n```puppet\nclass { 'mysql::server': }\n\nclass { 'keystone::db::mysql':\n  password      =\u003e 'super_secret_db_password',\n  allowed_hosts =\u003e '%',\n}\n```\n\n* For postgresql\n\n```puppet\nclass { 'postgresql::server': }\n\nclass { 'keystone::db::postgresql': password =\u003e 'super_secret_db_password', }\n```\n\n**About Keystone V3 syntax in keystone_user/keystone_tenant/keystone_user_role**\n\nA complete description of the syntax available for those resources are\nin `examples/user_project_user_role_composite_namevar.pp`\n\n**About Keystone V3 and default domain**\n\n***For users***\n\nWith Keystone V3, domains made their appearance.  For backward\ncompatibility a default domain is defined in the `keystone.conf` file.\nAll the V2 resources are then assigned to this default domain.  The\ndefault domain id is by default `default` associated with the name\n`Default`.\n\nWhat it means is that this user:\n\n```puppet\nkeystone_user { 'my_non_full_qualified_user':\n  ensure =\u003e present\n}\n```\n\nwill be assigned to the `Default` domain.\n\nThe same is true for `keystone_tenant` and `keystone_user_role`:\n\n```puppet\nkeystone_tenant { 'project_one':\n  ensure =\u003e present\n}\n\nkeystone_user_role { 'user_one@project_one':\n  ensure =\u003e present,\n  roles  =\u003e ['admin']\n}\n```\n\nwill be assigned to the `Default` domain.\n\nNow, you can change the default domain if you want.  But then the\npuppet resource you defined will *have* to be fully qualified.\n\nSo, for instance, if you change the default domain to be\n`my_new_default`, then you'll have to do:\n\n```puppet\nkeystone_user { 'full_qualified_user::my_new_default':\n  ensure =\u003e present\n}\nkeystone_tenant { 'project_one::my_new_default':\n  ensure =\u003e present\n}\n\nkeystone_user_role { 'user_one::my_new_default@project_one::my_new_default':\n  ensure =\u003e present,\n  roles  =\u003e ['admin']\n}\n```\n\nas the module will *always* assign a resource without domain to\nthe `Default` domain.\n\nA deprecation warning will be visible in the log when you have\nchanged the default domain id and used an non fully qualified name for\nyour resource.\n\nIn Mitaka, a deprecation warning will be displayed any time\nyou use a non fully qualified resource.\n\nAfter Mitaka all the resources will have to be fully qualified.\n\n***For developers***\n\nOther modules can try to find user/tenant resources using Puppet's\nindirection.  The rule for the name of the resources are:\n\n 1. fully qualified if domain is not 'Default';\n 2. short form if domain is 'Default'\n\nThis is for backward compatibility.\n\nNote that, as stated above, the 'Default' domain is hardcoded.  It is\nnot related to the real default domain which can be set to something\nelse.  But then again, you will have to set the fully qualified name.\n\nYou can check `spec/acceptance/default_domain_spec.rb` to see an\nexample of the behavior described here.\n\nImplementation\n--------------\n\n### keystone\n\nkeystone is a combination of Puppet manifest and ruby code to delivery configuration and extra functionality through types and providers.\n\n### Types\n\n#### keystone_config\n\nThe `keystone_config` provider is a children of the ini_setting provider. It allows one to write an entry in the `/etc/keystone/keystone.conf` file.\n\n```puppet\nkeystone_config { 'token/expiration' :\n  value =\u003e 3600,\n}\n```\n\nThis will write `expiration=3600` in the `[token]` section.\n\n##### name\n\nSection/setting name to manage from `keystone.conf`\n\n##### value\n\nThe value of the setting to be defined.\n\n##### secret\n\nWhether to hide the value from Puppet logs. Defaults to `false`.\n\n##### ensure_absent_val\n\nIf value is equal to ensure_absent_val then the resource will behave as if `ensure =\u003e absent` was specified. Defaults to `\u003cSERVICE DEFAULT\u003e`\n\nLimitations\n------------\n\n* All the keystone types use the CLI tools and so need to be run on the keystone node.\n\n### Upgrade warning\n\n* If you've setup OpenStack using previous versions of this module you need to be aware that it used UUID as the default for the token_format parameter but now defaults to PKI.  If you're using this module to manage a Grizzly OpenStack deployment that was set up using a development release of the modules or are attempting an upgrade from Folsom then you'll need to make sure you set the token_format to UUID at classification time.\n\nDevelopment\n-----------\n\nDeveloper documentation for the entire puppet-openstack project.\n\n* https://docs.openstack.org/puppet-openstack-guide/latest/\n\nContributors\n------------\n\n* https://github.com/openstack/puppet-keystone/graphs/contributors\n\nRelease Notes\n-------------\n\n* https://docs.openstack.org/releasenotes/puppet-keystone\n\nRepository\n----------\n\n* https://opendev.org/openstack/puppet-keystone\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenstack%2Fpuppet-keystone","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fopenstack%2Fpuppet-keystone","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenstack%2Fpuppet-keystone/lists"}