Merge lp:~dmitriis/charms/trusty/contrail-configuration/trunk into lp:~sdn-charmers/charms/trusty/contrail-configuration/trunk

[Dmitrii Shcherbakov]

rbac support (rebased)

[Ante Karamatić (ivoks)]

See my comment

review: Needs Fixing

[Ante Karamatić (ivoks)]

One more comment

review: Needs Fixing

[Ante Karamatić (ivoks)]

I haven't investigated into detail, but with your patches contrail-analytics never populates 'api_server' in /etc/contrail/contrail-analytics-api.conf, which in turn means that contrail-analytics is not functional.

[lp:~dmitriis/charms/trusty/contrail-configuration/trunk]

67. By Dmitrii Shcherbakov on 2017-03-23

enable rbac configuration support

- add an action to create roles which may then be configured for use by
contrail rbac mechanism
- render the required config file with the additional data provided via
config.yaml
- set relation data for use by other contrail charms

Unmerged revisions

=== modified file 'config.yaml'
--- config.yaml	2017-03-10 12:49:07 +0000
+++ config.yaml	2017-03-19 16:48:41 +0000
@@ -59,3 +59,13 @@
     type: int
     default: 1
     description: Minimum number of units required in cassandra relation
+  rbac:
+    type: boolean
+    default: true
+    description: enable/disable role-based authentication - only supported in Contrail 3.2 and newer
+  cloud-admin-role:
+    type: string
+    description: A user who is assigned the cloud_admin_role has full access to everything.
+  global-read-only-role:
+    type: string
+    description: This role allows read-only access to all Contrail resources. Must be configured in keystone.

=== modified file 'hooks/contrail_configuration_hooks.py'
--- hooks/contrail_configuration_hooks.py	2017-03-10 12:49:07 +0000
+++ hooks/contrail_configuration_hooks.py	2017-03-19 16:48:41 +0000
@@ -1,6 +1,5 @@
 #!/usr/bin/env python
 
-from socket import gethostbyname
 import sys
 
 from apt_pkg import version_compare
@@ -24,7 +23,6 @@
     relation_ids,
     relation_set,
     remote_unit,
-    unit_get
 )
 
 from charmhelpers.core.host import (
@@ -68,17 +66,45 @@
     write_ifmap_config,
     write_nodemgr_config,
     write_ssl_ca_certificate,
-    write_vnc_api_config
+    write_vnc_api_config,
+    write_admin_oscreds_config,
 )
 
-PACKAGES = [ "ifmap-server", "contrail-config", "contrail-config-openstack",
-             "neutron-common", "contrail-utils", "contrail-nodemgr" ]
-
-PACKAGES_BARBICAN = [ "python-barbicanclient" ]
+PACKAGES = ["ifmap-server", "contrail-config", "contrail-config-openstack",
+            "neutron-common", "contrail-utils", "contrail-nodemgr"]
+
+PACKAGES_BARBICAN = ["python-barbicanclient"]
+
+CONFIG_ROLES = ['cloud-admin-role', 'global-read-only-role']
 
 hooks = Hooks()
 config = config()
 
+
+def get_rbac_roles():
+    rid = relation_ids("identity-admin")[0]
+    unit = related_units(rid)[0]
+    default_role = relation_get(attribute='service_tenant_name',
+                                rid=rid, unit=unit)
+    rbac_roles = {}
+    for r in CONFIG_ROLES:
+        val = config.get(r)
+        rbac_roles[r] = val if val else default_role
+    return rbac_roles
+
+
+def add_rbac_settings(d):
+    rbac = config.get('rbac')
+    # update the rbac settings unconditionally
+    # we do need to signal the change of relation data
+    if rbac:
+        d['rbac'] = rbac
+        d.update(get_rbac_roles())
+    else:
+        d['rbac'] = None
+        d.update({k: None for k in CONFIG_ROLES})
+
+
 def add_contrail_api():
     # check relation dependencies
     if not config_get("contrail-api-configured") \
@@ -95,14 +121,18 @@
         config["contrail-api-configured"] = True
 
         # inform relations
-        settings = { "private-address": control_network_ip(),
-                     "port": api_port(),
-                     "vip": config.get("vip") }
+        settings = {"private-address": control_network_ip(),
+                    "port": api_port(),
+                    "vip": config.get("vip")}
+
+        add_rbac_settings(settings)
+
         for rid in relation_ids("contrail-api"):
             relation_set(relation_id=rid, relation_settings=settings)
 
         configure_floating_ip_pools()
 
+
 def add_metadata():
     # check relation dependencies
     if is_leader() \
@@ -112,6 +142,7 @@
         provision_metadata()
         leader_set({"metadata-provisioned": True})
 
+
 @hooks.hook("amqp-relation-changed")
 def amqp_changed():
     if not relation_get("password"):
@@ -122,6 +153,7 @@
     add_contrail_api()
     add_metadata()
 
+
 @hooks.hook("amqp-relation-departed")
 @hooks.hook("amqp-relation-broken")
 def amqp_departed():
@@ -131,10 +163,13 @@
         config["amqp-ready"] = False
     amqp_relation()
 
-@restart_on_change({"/etc/contrail/contrail-api.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"]})
+
+@restart_on_change(
+    {
+        "/etc/contrail/contrail-api.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"]})
 def amqp_relation():
     write_contrail_api_config()
     write_contrail_svc_monitor_config()
@@ -142,10 +177,12 @@
     if version_compare(CONTRAIL_VERSION, "3.0") >= 0:
         write_contrail_schema_config()
 
+
 @hooks.hook("amqp-relation-joined")
 def amqp_joined():
     relation_set(username="contrail", vhost="contrail")
 
+
 @hooks.hook("cassandra-relation-changed")
 def cassandra_changed():
     # 'port' is used in legacy precise charm
@@ -156,13 +193,15 @@
         units = len(cassandra_units())
         required = config["cassandra-units"]
         if units < required:
-            log("{} cassandra unit(s) ready, require {} more".format(units, required - units))
+            log("{} cassandra unit(s) ready, require {} more".format(
+                units, required - units))
             return
     config["cassandra-ready"] = True
     cassandra_relation()
     add_contrail_api()
     add_metadata()
 
+
 @hooks.hook("cassandra-relation-departed")
 @hooks.hook("cassandra-relation-broken")
 def cassandra_departed():
@@ -172,12 +211,15 @@
         config["cassandra-ready"] = False
     cassandra_relation()
 
-@restart_on_change({"/etc/contrail/contrail-api.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-discovery.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"],
-                    "/etc/contrail/discovery.conf": ["supervisor-config"]})
+
+@restart_on_change(
+    {
+        "/etc/contrail/contrail-api.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-discovery.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"],
+        "/etc/contrail/discovery.conf": ["supervisor-config"]})
 def cassandra_relation():
     write_contrail_api_config()
     write_contrail_schema_config()
@@ -185,6 +227,7 @@
     write_contrail_svc_monitor_config()
     write_device_manager_config()
 
+
 @hooks.hook("config-changed")
 def config_changed():
     write_config()
@@ -197,8 +240,14 @@
 
     ip = control_network_ip()
     vip = config.get("vip")
-    settings = { "private-address": ip,
-                 "vip": vip }
+    settings = {"private-address": ip,
+                "vip": vip}
+
+    # a role fetched from keystone is used as a fallback
+    # hence we have to check if this relation is established
+    if config_get("identity-admin-ready"):
+        add_rbac_settings(settings)
+
     for rid in relation_ids("contrail-api"):
         relation_set(relation_id=rid, relation_settings=settings)
     for rid in relation_ids("contrail-discovery"):
@@ -217,12 +266,14 @@
     for rid in relation_ids("http-services"):
         relation_set(relation_id=rid, services=services)
 
+
 def config_get(key):
     try:
         return config[key]
     except KeyError:
         return None
 
+
 def configure_control_network():
     # unprovision/provision configuration on 3.0.2.0+
     if version_compare(CONTRAIL_VERSION, "3.0.2.0-34") >= 0:
@@ -230,6 +281,7 @@
             unprovision_configuration()
             provision_configuration()
 
+
 def configure_floating_ip_pools():
     if is_leader():
         floating_pools = config.get("floating-ip-pools")
@@ -237,16 +289,19 @@
         if floating_pools != previous_floating_pools:
             # create/destroy pools, activate/deactivate projects
             # according to new value
-            pools = { (pool["project"],
-                       pool["network"],
-                       pool["pool-name"]): set(pool["target-projects"])
-                      for pool in yaml.safe_load(floating_pools) } \
-                    if floating_pools else {}
+            pools = {(pool["project"],
+                      pool["network"],
+                      pool["pool-name"]): set(pool["target-projects"])
+                     for pool in yaml.safe_load(floating_pools)} \
+                if floating_pools else {}
             previous_pools = {}
             if previous_floating_pools:
                 for pool in yaml.safe_load(previous_floating_pools):
                     projects = pool["target-projects"]
-                    name = (pool["project"], pool["network"], pool["pool-name"])
+                    name = (
+                        pool["project"],
+                        pool["network"],
+                        pool["pool-name"])
                     if name in pools:
                         previous_pools[name] = set(projects)
                     else:
@@ -255,10 +310,12 @@
                 if name not in previous_pools:
                     floating_ip_pool_create(name, projects)
                 else:
-                    floating_ip_pool_update(name, projects, previous_pools[name])
+                    floating_ip_pool_update(
+                        name, projects, previous_pools[name])
 
             leader_set({"floating-ip-pools": floating_pools})
 
+
 def configure_ssl():
     cert = config.get("ssl-ca")
     if cert:
@@ -268,6 +325,7 @@
         if remove_ssl_ca_certificate():
             service_restart("supervisor-config")
 
+
 @hooks.hook("contrail-analytics-api-relation-changed")
 def contrail_analytics_api_changed():
     if not relation_get("port"):
@@ -275,27 +333,33 @@
         return
     contrail_analytics_api_relation()
 
+
 @hooks.hook("contrail-analytics-api-relation-departed")
 @hooks.hook("contrail-analytics-api-relation-broken")
-@restart_on_change({"/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"]})
+@restart_on_change(
+    {"/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"]})
 def contrail_analytics_api_relation():
     write_contrail_svc_monitor_config()
 
+
 @hooks.hook("contrail-api-relation-joined")
 def contrail_api_joined():
     if config_get("contrail-api-configured"):
-        settings = { "private-address": control_network_ip(),
-                     "port": api_port(),
-                     "vip": config.get("vip") }
+        settings = {"private-address": control_network_ip(),
+                    "port": api_port(),
+                    "vip": config.get("vip")}
+        add_rbac_settings(settings)
         relation_set(relation_settings=settings)
 
+
 @hooks.hook("contrail-discovery-relation-joined")
 def contrail_discovery_joined():
-    settings = { "private-address": control_network_ip(), 
-                 "port": discovery_port(),
-                 "vip": config.get("vip") }
+    settings = {"private-address": control_network_ip(),
+                "port": discovery_port(),
+                "vip": config.get("vip")}
     relation_set(relation_settings=settings)
 
+
 @hooks.hook("contrail-ifmap-relation-joined")
 def contrail_ifmap_joined():
     if is_leader():
@@ -303,12 +367,12 @@
         creds = json.loads(creds) if creds else {}
 
         # prune credentials because we can't remove them directly lp #1469731
-        creds = { rid: { unit: units[unit]
-                         for unit, units in
-                         ((unit, creds[rid]) for unit in related_units(rid))
-                         if unit in units }
-                  for rid in relation_ids("contrail-ifmap")
-                  if rid in creds }
+        creds = {rid: {unit: units[unit]
+                       for unit, units in
+                       ((unit, creds[rid]) for unit in related_units(rid))
+                       if unit in units}
+                 for rid in relation_ids("contrail-ifmap")
+                 if rid in creds}
 
         rid = relation_id()
         if rid not in creds:
@@ -318,12 +382,13 @@
         if unit in cs:
             return
         # generate new credentials for unit
-        cs[unit] = { "username": unit, "password": pwgen(32) }
+        cs[unit] = {"username": unit, "password": pwgen(32)}
         leader_set({"ifmap-creds": json.dumps(creds)})
         write_ifmap_config()
         service_restart("supervisor-config")
         relation_set(creds=json.dumps(cs))
 
+
 def floating_ip_pool_create(name, projects):
     # create pool
     fq_network = "default-domain:" + ":".join(name[:2])
@@ -335,6 +400,7 @@
         fq_project = "default-domain:" + project
         contrail_floating_ip_use(fq_project, fq_pool_name)
 
+
 def floating_ip_pool_delete(name, projects):
     # deactivate pool for projects
     fq_pool_name = "default-domain:" + ":".join(name)
@@ -346,6 +412,7 @@
     fq_network = "default-domain:" + ":".join(name[:2])
     contrail_floating_ip_delete(fq_network, name[2])
 
+
 def floating_ip_pool_update(name, projects, previous_projects):
     fq_pool_name = "default-domain:" + ":".join(name)
 
@@ -359,24 +426,39 @@
         fq_project = "default-domain:" + project
         contrail_floating_ip_use(fq_project, fq_pool_name)
 
+
 def http_services():
     name = local_unit().replace("/", "-")
     addr = control_network_ip()
-    return [ { "service_name": "contrail-api",
-               "service_host": "0.0.0.0",
-               "service_port": 8082,
-               "service_options": [ "mode http", "balance leastconn", "option httpchk GET /Snh_SandeshUVECacheReq?x=NodeStatus HTTP/1.0" ],
-               "servers": [ [ name, addr, api_port(), "check port 8084" ] ] },
-             { "service_name": "contrail-discovery",
-               "service_host": "0.0.0.0",
-               "service_port": 5998,
-               "service_options": [ "mode http", "balance leastconn", "option httpchk GET /services HTTP/1.0" ],
-               "servers": [ [ name, addr, discovery_port(), "check" ] ] } ]
+    return [{"service_name": "contrail-api",
+             "service_host": "0.0.0.0",
+             "service_port": 8082,
+             "service_options": ["mode http",
+                                 "balance leastconn",
+                                 "option httpchk GET "
+                                 "/Snh_SandeshUVECacheReq?x=NodeStatus "
+                                 "HTTP/1.0"],
+             "servers": [[name,
+                          addr,
+                          api_port(),
+                          "check port 8084"]]},
+            {"service_name": "contrail-discovery",
+             "service_host": "0.0.0.0",
+             "service_port": 5998,
+             "service_options": ["mode http",
+                                 "balance leastconn",
+                                 "option httpchk GET /services HTTP/1.0"],
+             "servers": [[name,
+                          addr,
+                          discovery_port(),
+                          "check"]]}]
+
 
 @hooks.hook("http-services-relation-joined")
 def http_services_joined():
     relation_set(services=yaml.dump(http_services()))
 
+
 @hooks.hook("identity-admin-relation-changed")
 def identity_admin_changed():
     if not relation_get("service_hostname"):
@@ -387,6 +469,7 @@
     add_contrail_api()
     add_metadata()
 
+
 @hooks.hook("identity-admin-relation-departed")
 @hooks.hook("identity-admin-relation-broken")
 def identity_admin_departed():
@@ -396,19 +479,24 @@
         config["identity-admin-ready"] = False
     identity_admin_relation()
 
-@restart_on_change({"/etc/contrail/contrail-api.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"]})
+
+@restart_on_change(
+    {
+        "/etc/contrail/contrail-api.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"]})
 def identity_admin_relation():
     write_contrail_api_config()
     write_contrail_schema_config()
     write_contrail_svc_monitor_config()
     write_device_manager_config()
     write_vnc_api_config()
+    write_admin_oscreds_config()
     if version_compare(CONTRAIL_VERSION, "3.0.2.0-34") >= 0:
         write_barbican_auth_config()
 
+
 @hooks.hook("identity-service-relation-joined")
 def identity_service_joined():
     vip = config.get("vip")
@@ -419,6 +507,7 @@
                  internal_url=url,
                  admin_url=url)
 
+
 @hooks.hook()
 def install():
     configure_installation_source(config["openstack-origin"])
@@ -437,8 +526,10 @@
     write_nodemgr_config()
     service_restart("contrail-config-nodemgr")
 
+
 @hooks.hook("leader-settings-changed")
-@restart_on_change({"/etc/ifmap-server/basicauthusers.properties": ["supervisor-config"]})
+@restart_on_change(
+    {"/etc/ifmap-server/basicauthusers.properties": ["supervisor-config"]})
 def leader_changed():
     write_ifmap_config()
     creds = leader_get("ifmap-creds")
@@ -448,12 +539,14 @@
         if rid in creds:
             relation_set(relation_id=rid, creds=json.dumps(creds[rid]))
 
+
 def main():
     try:
         hooks.execute(sys.argv)
     except UnregisteredHookError as e:
         log("Unknown hook {} - skipping.".format(e))
 
+
 @hooks.hook("neutron-metadata-relation-changed")
 def neutron_metadata_changed():
     if not relation_get("shared-secret"):
@@ -462,6 +555,7 @@
     config["neutron-metadata-ready"] = True
     add_metadata()
 
+
 @hooks.hook("neutron-metadata-relation-departed")
 @hooks.hook("neutron-metadata-relation-broken")
 def neutron_metadata_departed():
@@ -469,6 +563,7 @@
         remove_metadata()
         config["neutron-metadata-ready"] = False
 
+
 def remove_contrail_api():
     if config_get("contrail-api-configured"):
         # unprovision configuration on 3.0.2.0+
@@ -476,6 +571,7 @@
             unprovision_configuration()
         config["contrail-api-configured"] = False
 
+
 def remove_metadata():
     if is_leader() and leader_get("metadata-provisioned"):
         # impossible to know if current hook is firing because
@@ -484,6 +580,7 @@
             unprovision_metadata()
         leader_set({"metadata-provisioned": ""})
 
+
 @hooks.hook("upgrade-charm")
 def upgrade_charm():
     write_ifmap_config()
@@ -494,14 +591,19 @@
     write_device_manager_config()
     write_vnc_api_config()
     write_nodemgr_config()
+    write_admin_oscreds_config()
     service_restart("supervisor-config")
 
-@restart_on_change({"/etc/contrail/contrail-api.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-config-nodemgr.conf": ["supervisor-config"]})
+
+@restart_on_change(
+    {
+        "/etc/contrail/contrail-api.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-config-nodemgr.conf": ["supervisor-config"]})
 def write_config():
     write_contrail_api_config()
     write_nodemgr_config()
 
+
 @hooks.hook("zookeeper-relation-changed")
 def zookeeper_changed():
     if not relation_get("port"):
@@ -512,6 +614,7 @@
     add_contrail_api()
     add_metadata()
 
+
 @hooks.hook("zookeeper-relation-departed")
 @hooks.hook("zookeeper-relation-broken")
 def zookeeper_departed():
@@ -521,12 +624,15 @@
         config["zookeeper-ready"] = False
     zookeeper_relation()
 
-@restart_on_change({"/etc/contrail/contrail-api.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-discovery.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"],
-                    "/etc/contrail/discovery.conf": ["supervisor-config"]})
+
+@restart_on_change(
+    {
+        "/etc/contrail/contrail-api.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-discovery.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"],
+        "/etc/contrail/discovery.conf": ["supervisor-config"]})
 def zookeeper_relation():
     write_contrail_api_config()
     write_contrail_schema_config()
@@ -534,5 +640,6 @@
     write_contrail_svc_monitor_config()
     write_device_manager_config()
 
+
 if __name__ == "__main__":
     main()

=== modified file 'hooks/contrail_configuration_utils.py'
--- hooks/contrail_configuration_utils.py	2017-03-10 12:49:07 +0000
+++ hooks/contrail_configuration_utils.py	2017-03-19 16:48:41 +0000
@@ -40,6 +40,7 @@
 
 apt_pkg.init()
 
+
 def dpkg_version(pkg):
     try:
         return check_output(["dpkg-query", "-f", "${Version}\\n", "-W", pkg]).rstrip()
@@ -155,10 +156,16 @@
 
 def contrail_ctx():
     addr = control_network_ip()
+    rbac = config.get("rbac")
+    cloud_admin_role = config.get("cloud-admin-role")
+    global_read_only_role = config.get("global-read-only-role")
     return { "api_port": api_port(),
              "ifmap_server": addr,
              "disc_server": addr,
-             "disc_port": discovery_port() }
+             "disc_port": discovery_port(),
+             "rbac": rbac,
+             "cloud_admin_role": cloud_admin_role,
+             "global_read_only_role": global_read_only_role }
 
 def contrail_floating_ip_create(network, name):
     user, password, tenant = [ (relation_get("service_username", unit, rid),
@@ -344,7 +351,9 @@
                "admin_user": relation_get("service_username", unit, rid),
                "admin_password": relation_get("service_password", unit, rid),
                "admin_tenant_name": relation_get("service_tenant_name", unit, rid),
-               "auth_region": relation_get("service_region", unit, rid) }
+               "auth_region": relation_get("service_region", unit, rid),
+               "service_protocol": relation_get("service_protocol", unit, rid),
+               "api_version": relation_get("api_version", unit, rid)}
              for rid in relation_ids("identity-admin")
              for unit, hostname in
              ((unit, relation_get("service_hostname", unit, rid)) for unit in related_units(rid))
@@ -555,6 +564,11 @@
     ctx.update(identity_admin_ctx())
     render("vnc_api_lib.ini", "/etc/contrail/vnc_api_lib.ini", ctx)
 
+def write_admin_oscreds_config():
+    ctx = {}
+    ctx.update(identity_admin_ctx())
+    render("admin-oscreds-v2.yaml", '/root/admin-oscreds-v2.yaml', ctx)
+
 def zookeeper_ctx():
     return { "zk_servers": [ (host if host \
                                else gethostbyname(relation_get("private-address", unit, rid)))

=== added symlink 'hooks/identity-credentials-relation-changed'
=== target is u'contrail_configuration_hooks.py'
=== added symlink 'hooks/identity-credentials-relation-joined'
=== target is u'contrail_configuration_hooks.py'
=== modified file 'templates/contrail-api.conf'
--- templates/contrail-api.conf	2017-01-31 12:51:09 +0000
+++ templates/contrail-api.conf	2017-03-19 16:48:41 +0000
@@ -10,7 +10,16 @@
 ifmap_password = api-server
 cassandra_server_list = {{ cassandra_servers|join(" ") }}
 auth = keystone
-multi_tenancy = True
+
+{% if rbac -%}
+aaa_mode = rbac
+{% else -%}
+multi_tenancy = true
+{% endif -%}
+
+cloud_admin_role = {{ cloud_admin_role }}
+global_read_only_role = {{ global_read_only_role }}
+
 disc_server_ip = {{ disc_server }}
 disc_server_port = {{ disc_port }}
 zk_server_ip = {{ zk_servers|join(",") }}