Merge ~cjwatson/launchpad-mojo-specs:custom-secgroups-ps5 into launchpad-mojo-specs:master

[Colin Watson]

custom-secgroups: Handle keystone v3 and refactor get_instance_secgroups

Imported from https://code.launchpad.net/~sajoupa/canonical-mojo-specs/custom-secgroups-ps5-readable/+merge/403810 and https://code.launchpad.net/~alejdg/canonical-mojo-specs/custom-secgroups/+merge/404351, but I arranged to have a single script rather than separate ps45/ps5 copies of it.

[Cristian Gonzalez (cristiangsp)]

Looks good!

review: Approve

diff --git a/utils/custom-secgroups.py b/utils/custom-secgroups.py
index a838e60..69bc134 100755
--- a/utils/custom-secgroups.py
+++ b/utils/custom-secgroups.py
@@ -178,37 +178,70 @@ def add_rule(neutron, secgroup, rule):
         body={"security_group_rule": neutron_rule})
 
 
-def get_nova_client():
-    from novaclient import client as novaclient
+_openstack_session = None
+
+
+def get_os_session():
+    from keystoneauth1 import loading, session
+
+    global _openstack_session
+    if _openstack_session is not None:
+        return _openstack_session
 
     if "OS_PROJECT_NAME" in os.environ:
         project_name = os.environ["OS_PROJECT_NAME"]
     else:
         project_name = os.environ["OS_TENANT_NAME"]
-    auth = {
-        "username": os.environ["OS_USERNAME"],
-        "api_key": os.environ["OS_PASSWORD"],
-        "auth_url": os.environ["OS_AUTH_URL"],
-        "project_id": project_name,
-        "region_name": os.environ["OS_REGION_NAME"],
-        }
+    loader = loading.get_plugin_loader('password')
+    auth = loader.load_from_options(
+        username=os.environ["OS_USERNAME"],
+        password=os.environ["OS_PASSWORD"],
+        auth_url=os.environ["OS_AUTH_URL"],
+        project_name=project_name,
+        project_domain_name=os.environ["OS_PROJECT_DOMAIN_NAME"],
+        user_domain_name=os.environ["OS_USER_DOMAIN_NAME"],
+        )
+    _openstack_session = session.Session(auth=auth)
+    return _openstack_session
+
+
+def get_nova_client():
+    from novaclient import client as novaclient
+
+    if os.environ.get("OS_IDENTITY_API_VERSION") == "3":
+        auth = {"session": get_os_session()}
+    else:
+        if "OS_PROJECT_NAME" in os.environ:
+            project_name = os.environ["OS_PROJECT_NAME"]
+        else:
+            project_name = os.environ["OS_TENANT_NAME"]
+        auth = {
+            "username": os.environ["OS_USERNAME"],
+            "api_key": os.environ["OS_PASSWORD"],
+            "auth_url": os.environ["OS_AUTH_URL"],
+            "project_id": project_name,
+            "region_name": os.environ["OS_REGION_NAME"],
+            }
     return novaclient.Client("2", **auth)
 
 
 def get_neutron_client():
     from neutronclient.v2_0 import client as neutronclient
 
-    if "OS_PROJECT_NAME" in os.environ:
-        project_name = os.environ["OS_PROJECT_NAME"]
+    if os.environ.get("OS_IDENTITY_API_VERSION") == "3":
+        auth = {"session": get_os_session()}
     else:
-        project_name = os.environ["OS_TENANT_NAME"]
-    auth = {
-        "username": os.environ["OS_USERNAME"],
-        "password": os.environ["OS_PASSWORD"],
-        "auth_url": os.environ["OS_AUTH_URL"],
-        "tenant_name": project_name,
-        "region_name": os.environ["OS_REGION_NAME"],
-        }
+        if "OS_PROJECT_NAME" in os.environ:
+            project_name = os.environ["OS_PROJECT_NAME"]
+        else:
+            project_name = os.environ["OS_TENANT_NAME"]
+        auth = {
+            "username": os.environ["OS_USERNAME"],
+            "password": os.environ["OS_PASSWORD"],
+            "auth_url": os.environ["OS_AUTH_URL"],
+            "tenant_name": project_name,
+            "region_name": os.environ["OS_REGION_NAME"],
+            }
     return neutronclient.Client(**auth)
 
 
@@ -433,6 +466,23 @@ def get_config(args):
     return config
 
 
+def get_instance_secgroups(config, juju_status):
+    """For each machine, list its needed secgroups. """
+    instance_secgroups = collections.defaultdict(set)
+    for app in juju_status['applications']:
+        properties = config['applications'].get(app)
+        if properties is not None:
+            if properties.get("type", "neutron") != "neutron":
+                continue
+            for _, machine in find_machines_for_service(juju_status, app):
+                instance_secgroups[machine["instance-id"]].update(
+                    properties["rules"])
+        for _, machine in find_machines_for_service(juju_status, app):
+            instance_secgroups[machine["instance-id"]].update(
+                config["all-units"])
+    return instance_secgroups
+
+
 def main():
     parser = argparse.ArgumentParser(
         description="Manage custom security groups on a Juju model.")
@@ -466,16 +516,7 @@ def main():
 
     if any(properties.get("type", "neutron") == "neutron"
            for properties in config["applications"].values()):
-        instance_secgroups = collections.defaultdict(set)
-        for service, properties in config["applications"].items():
-            if properties.get("type", "neutron") == "neutron":
-                for _, machine in find_machines_for_service(
-                        juju_status, service):
-                    instance_secgroups[machine["instance-id"]].update(
-                        properties["rules"])
-                    instance_secgroups[machine["instance-id"]].update(
-                        config["all-units"])
-
+        instance_secgroups = get_instance_secgroups(config, juju_status)
         configure_secgroup_rules(args, config["rules"])
         configure_instance_secgroups(args, instance_secgroups)