Merge lp:~james-page/charms/precise/keystone/fix-requested-roles into lp:~charmers/charms/precise/keystone/trunk

[James Page]

Fixup requested_roles handling so that remote services not registering
endpoints can also request that new roles be created.

This fixes a problem in openstack deployments where swift is not being
used - the openstack-dashboard requests 'Member' but it was not actually
being created.

[James Page (james-page)]

Note that the grant_role is automatically called by created role when the service username and tenant are passed.

[Adam Gandelman (gandelman-a)]

LGTM, thanks.

review: Approve

=== modified file 'hooks/keystone_hooks.py'
--- hooks/keystone_hooks.py	2013-08-13 12:55:50 +0000
+++ hooks/keystone_hooks.py	2013-09-03 12:03:41 +0000
@@ -201,6 +201,15 @@
     pass
 
 
+def get_requested_roles(settings):
+    ''' Retrieve any valid requested_roles from dict settings '''
+    if ('requested_roles' in settings and
+        settings['requested_roles'] not in ['None', None]):
+        return settings['requested_roles'].split(',')
+    else:
+        return []
+
+
 def identity_changed(relation_id=None, remote_unit=None):
     """ A service has advertised its API endpoints, create an entry in the
         service catalog.
@@ -242,18 +251,24 @@
                 relation_data['ca_cert'] = b64encode(ca_bundle)
             if relation_id:
                 relation_data['rid'] = relation_id
+            # Allow the remote service to request creation of any additional
+            # roles. Currently used by Horizon
+            for role in get_requested_roles(settings):
+                utils.juju_log('INFO',
+                               "Creating requested role: %s" % role)
+                create_role(role)
             utils.relation_set(**relation_data)
             return
-
-        ensure_valid_service(settings['service'])
-
-        add_endpoint(region=settings['region'], service=settings['service'],
-                     publicurl=settings['public_url'],
-                     adminurl=settings['admin_url'],
-                     internalurl=settings['internal_url'])
-        service_username = settings['service']
-        https_cn = urlparse.urlparse(settings['internal_url'])
-        https_cn = https_cn.hostname
+        else:
+            ensure_valid_service(settings['service'])
+            add_endpoint(region=settings['region'],
+                         service=settings['service'],
+                         publicurl=settings['public_url'],
+                         adminurl=settings['admin_url'],
+                         internalurl=settings['internal_url'])
+            service_username = settings['service']
+            https_cn = urlparse.urlparse(settings['internal_url'])
+            https_cn = https_cn.hostname
     else:
         # assemble multiple endpoints from relation data. service name
         # should be prepended to setting name, ie:
@@ -314,13 +329,11 @@
 
     # Allow the remote service to request creation of any additional roles.
     # Currently used by Swift and Ceilometer.
-    if 'requested_roles' in settings and settings['requested_roles'] != 'None':
-        roles = settings['requested_roles'].split(',')
+    for role in get_requested_roles(settings):
         utils.juju_log('INFO',
-                       "Creating requested roles: %s" % roles)
-        for role in roles:
-            create_role(role, service_username, config['service-tenant'])
-            grant_role(service_username, role, config['service-tenant'])
+                       "Creating requested role: %s" % role)
+        create_role(role, service_username,
+                    config['service-tenant'])
 
     # As of https://review.openstack.org/#change,4675, all nodes hosting
     # an endpoint(s) needs a service username and password assigned to