Merge lp:~gandelman-a/charms/precise/openstack-dashboard/request_role into lp:~charmers/charms/precise/openstack-dashboard/trunk

[Adam Gandelman]

The Keystone charm allows remote services to request roles to be created via the identity-service relation. This change adds a new config parameter that ends up in local_settings.py as OPENSTACK_KEYSTONE_DEFAULT_ROLE and is passed along to keystone for creation. This is role is required to exist for some operations in Keystone to function and avoids errors like those described in bug #1064433.

This depends on the following merge for role creation to actually happen on the Keystone side:

https://code.launchpad.net/~gandelman-a/charms/precise/keystone/grizzly/+merge/142429

=== modified file 'config.yaml'
--- config.yaml	2012-10-12 17:30:30 +0000
+++ config.yaml	2013-01-12 00:39:28 +0000
@@ -20,3 +20,9 @@
         description: |
             Directory where application will be accessible, relative to
             http://$hostname/.
+   default-role:
+        default: "Member"
+        type: string
+        description: |
+            Default role for Horizon operations that will be created in
+            Keystone upon introduction of an identity-service relation.
 
=== modified file 'hooks/horizon-relations'
--- hooks/horizon-relations	2012-11-20 12:52:41 +0000
+++ hooks/horizon-relations	2013-01-12 00:39:28 +0000
@@ -35,8 +35,12 @@
   # service=None lets keystone know we don't need anything entered
   # into the service catalog.  we only really care about getting the
   # private-address from the relation
-  relation-set service="None" region="None" public_url="None" \
-               admin_url="None" internal_url="None"
+  local relid="$1"
+  local rarg=""
+  [[ -n "$relid" ]] && rarg="-r $relid"
+  relation-set $rarg service="None" region="None" public_url="None" \
+               admin_url="None" internal_url="None" \
+               requested_roles="$(config-get default-role)"
 }
 
 function keystone_changed {
@@ -68,6 +72,15 @@
     >/etc/apache2/conf.d/openstack-dashboard.conf
   set_or_update LOGIN_URL "$web_root/auth/login"
   set_or_update LOGIN_REDIRECT_URL "$web_root"
+
+  # Set default role and trigger a identity-service relation event to
+  # ensure role is created in keystone.
+  set_or_update OPENSTACK_KEYSTONE_DEFAULT_ROLE "$(config-get default-role)"
+  local relids="$(relation-ids identity-service)"
+  for relid in $relids ; do
+    keystone_joined "$relid"
+  done
+
   service apache2 reload
 
 }
 
=== modified file 'revision'
--- revision	2013-01-11 18:30:45 +0000
+++ revision	2013-01-12 00:39:28 +0000
@@ -1,1 +1,1 @@
-20
+22