Merge lp:~dmitriis/charms/trusty/contrail-configuration/trunk into lp:~sdn-charmers/charms/trusty/contrail-configuration/trunk

[Dmitrii Shcherbakov]

rbac support (rebased)

[Ante Karamatić (ivoks)]

See my comment

review: Needs Fixing

[Ante Karamatić (ivoks)]

One more comment

review: Needs Fixing

[Ante Karamatić (ivoks)]

I haven't investigated into detail, but with your patches contrail-analytics never populates 'api_server' in /etc/contrail/contrail-analytics-api.conf, which in turn means that contrail-analytics is not functional.

[Dmitrii Shcherbakov (dmitriis)]

Ante,

Not sure about api_server - no modifications for that in my MP.

https://code.launchpad.net/~dmitriis/charms/trusty/contrail-analytics/trunk/+merge/320154

Have to investigate why.

Have you tried it without my patch or just with the patch?

If not, we can try it without a patch first to figure out if I introduced a regression or not.

[Bernhard Koessler (bkoessler)]

I would recommend not using multi_tenancy anymore going forward.

aaa_mode can be set to:

no-auth—No authentication is performed and full access is granted to all.
cloud-admin—Authentication is performed and only the admin role has access.
rbac—Authentication is performed and access is granted based on role.

cloud-admin would be the same behaviour as multi-tenancy=true

[Ante Karamatić (ivoks)]

Right, but charms need to support older versions also.

[Dmitrii Shcherbakov (dmitriis)]

Just noticed a piece of dead code for an action that we wanted to implement originally - uploaded an updated branch.

[Robert Ayres (robert-ayres)]

For this to get merged, please remove all the unnecessary formatting changes.

This diff should only contain the *actual* code changes.

[Dmitrii Shcherbakov (dmitriis)]

Robert,

They were separated into two revisions intentionally and it is possible to view the individual diffs.

https://bazaar.launchpad.net/~dmitriis/charms/trusty/contrail-configuration/trunk/revision/66

https://bazaar.launchpad.net/~dmitriis/charms/trusty/contrail-configuration/trunk/revision/67

Lint checks are a normal part of the charm dev process so I think it is worthwhile that they pass:

https://docs.openstack.org/developer/charm-guide/testing.html#lint
https://jujucharms.com/docs/2.1/authors-charm-best-practice#charm-coding-guidelines

[Robert Ayres (robert-ayres)]

I appreciate the lint comment, but it would be better if changes to pass lint tests were in a separate patch.

[Robert Ayres (robert-ayres)]

To save effort, we can just look at merging r67 here.

[Robert Ayres (robert-ayres)]

review: Approve

=== modified file 'config.yaml'
--- config.yaml	2017-03-10 12:49:07 +0000
+++ config.yaml	2017-03-23 15:13:02 +0000
@@ -59,3 +59,13 @@
     type: int
     default: 1
     description: Minimum number of units required in cassandra relation
+  rbac:
+    type: boolean
+    default: true
+    description: enable/disable role-based authentication - only supported in Contrail 3.2 and newer
+  cloud-admin-role:
+    type: string
+    description: A user who is assigned the cloud_admin_role has full access to everything.
+  global-read-only-role:
+    type: string
+    description: This role allows read-only access to all Contrail resources. Must be configured in keystone.
 
=== modified file 'hooks/contrail_configuration_hooks.py'
--- hooks/contrail_configuration_hooks.py	2017-03-10 12:49:07 +0000
+++ hooks/contrail_configuration_hooks.py	2017-03-23 15:13:02 +0000
@@ -1,6 +1,5 @@
 #!/usr/bin/env python
 
-from socket import gethostbyname
 import sys
 
 from apt_pkg import version_compare
@@ -24,7 +23,6 @@
     relation_ids,
     relation_set,
     remote_unit,
-    unit_get
 )
 
 from charmhelpers.core.host import (
@@ -68,17 +66,44 @@
     write_ifmap_config,
     write_nodemgr_config,
     write_ssl_ca_certificate,
-    write_vnc_api_config
+    write_vnc_api_config,
 )
 
-PACKAGES = [ "ifmap-server", "contrail-config", "contrail-config-openstack",
-             "neutron-common", "contrail-utils", "contrail-nodemgr" ]
-
-PACKAGES_BARBICAN = [ "python-barbicanclient" ]
+PACKAGES = ["ifmap-server", "contrail-config", "contrail-config-openstack",
+            "neutron-common", "contrail-utils", "contrail-nodemgr"]
+
+PACKAGES_BARBICAN = ["python-barbicanclient"]
+
+CONFIG_ROLES = ['cloud-admin-role', 'global-read-only-role']
 
 hooks = Hooks()
 config = config()
 
+
+def get_rbac_roles():
+    rid = relation_ids("identity-admin")[0]
+    unit = related_units(rid)[0]
+    default_role = relation_get(attribute='service_tenant_name',
+                                rid=rid, unit=unit)
+    rbac_roles = {}
+    for r in CONFIG_ROLES:
+        val = config.get(r)
+        rbac_roles[r] = val if val else default_role
+    return rbac_roles
+
+
+def add_rbac_settings(d):
+    rbac = config.get('rbac')
+    # update the rbac settings unconditionally
+    # we do need to signal the change of relation data
+    if rbac:
+        d['rbac'] = rbac
+        d.update(get_rbac_roles())
+    else:
+        d['rbac'] = None
+        d.update({k: None for k in CONFIG_ROLES})
+
+
 def add_contrail_api():
     # check relation dependencies
     if not config_get("contrail-api-configured") \
@@ -95,14 +120,18 @@
         config["contrail-api-configured"] = True
 
         # inform relations
-        settings = { "private-address": control_network_ip(),
-                     "port": api_port(),
-                     "vip": config.get("vip") }
+        settings = {"private-address": control_network_ip(),
+                    "port": api_port(),
+                    "vip": config.get("vip")}
+
+        add_rbac_settings(settings)
+
         for rid in relation_ids("contrail-api"):
             relation_set(relation_id=rid, relation_settings=settings)
 
         configure_floating_ip_pools()
 
+
 def add_metadata():
     # check relation dependencies
     if is_leader() \
@@ -112,6 +141,7 @@
         provision_metadata()
         leader_set({"metadata-provisioned": True})
 
+
 @hooks.hook("amqp-relation-changed")
 def amqp_changed():
     if not relation_get("password"):
@@ -122,6 +152,7 @@
     add_contrail_api()
     add_metadata()
 
+
 @hooks.hook("amqp-relation-departed")
 @hooks.hook("amqp-relation-broken")
 def amqp_departed():
@@ -131,10 +162,13 @@
         config["amqp-ready"] = False
     amqp_relation()
 
-@restart_on_change({"/etc/contrail/contrail-api.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"]})
+
+@restart_on_change(
+    {
+        "/etc/contrail/contrail-api.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"]})
 def amqp_relation():
     write_contrail_api_config()
     write_contrail_svc_monitor_config()
@@ -142,10 +176,12 @@
     if version_compare(CONTRAIL_VERSION, "3.0") >= 0:
         write_contrail_schema_config()
 
+
 @hooks.hook("amqp-relation-joined")
 def amqp_joined():
     relation_set(username="contrail", vhost="contrail")
 
+
 @hooks.hook("cassandra-relation-changed")
 def cassandra_changed():
     # 'port' is used in legacy precise charm
@@ -156,13 +192,15 @@
         units = len(cassandra_units())
         required = config["cassandra-units"]
         if units < required:
-            log("{} cassandra unit(s) ready, require {} more".format(units, required - units))
+            log("{} cassandra unit(s) ready, require {} more".format(
+                units, required - units))
             return
     config["cassandra-ready"] = True
     cassandra_relation()
     add_contrail_api()
     add_metadata()
 
+
 @hooks.hook("cassandra-relation-departed")
 @hooks.hook("cassandra-relation-broken")
 def cassandra_departed():
@@ -172,12 +210,15 @@
         config["cassandra-ready"] = False
     cassandra_relation()
 
-@restart_on_change({"/etc/contrail/contrail-api.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-discovery.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"],
-                    "/etc/contrail/discovery.conf": ["supervisor-config"]})
+
+@restart_on_change(
+    {
+        "/etc/contrail/contrail-api.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-discovery.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"],
+        "/etc/contrail/discovery.conf": ["supervisor-config"]})
 def cassandra_relation():
     write_contrail_api_config()
     write_contrail_schema_config()
@@ -185,6 +226,7 @@
     write_contrail_svc_monitor_config()
     write_device_manager_config()
 
+
 @hooks.hook("config-changed")
 def config_changed():
     write_config()
@@ -197,8 +239,14 @@
 
     ip = control_network_ip()
     vip = config.get("vip")
-    settings = { "private-address": ip,
-                 "vip": vip }
+    settings = {"private-address": ip,
+                "vip": vip}
+
+    # a role fetched from keystone is used as a fallback
+    # hence we have to check if this relation is established
+    if config_get("identity-admin-ready"):
+        add_rbac_settings(settings)
+
     for rid in relation_ids("contrail-api"):
         relation_set(relation_id=rid, relation_settings=settings)
     for rid in relation_ids("contrail-discovery"):
@@ -217,12 +265,14 @@
     for rid in relation_ids("http-services"):
         relation_set(relation_id=rid, services=services)
 
+
 def config_get(key):
     try:
         return config[key]
     except KeyError:
         return None
 
+
 def configure_control_network():
     # unprovision/provision configuration on 3.0.2.0+
     if version_compare(CONTRAIL_VERSION, "3.0.2.0-34") >= 0:
@@ -230,6 +280,7 @@
             unprovision_configuration()
             provision_configuration()
 
+
 def configure_floating_ip_pools():
     if is_leader():
         floating_pools = config.get("floating-ip-pools")
@@ -237,16 +288,19 @@
         if floating_pools != previous_floating_pools:
             # create/destroy pools, activate/deactivate projects
             # according to new value
-            pools = { (pool["project"],
-                       pool["network"],
-                       pool["pool-name"]): set(pool["target-projects"])
-                      for pool in yaml.safe_load(floating_pools) } \
-                    if floating_pools else {}
+            pools = {(pool["project"],
+                      pool["network"],
+                      pool["pool-name"]): set(pool["target-projects"])
+                     for pool in yaml.safe_load(floating_pools)} \
+                if floating_pools else {}
             previous_pools = {}
             if previous_floating_pools:
                 for pool in yaml.safe_load(previous_floating_pools):
                     projects = pool["target-projects"]
-                    name = (pool["project"], pool["network"], pool["pool-name"])
+                    name = (
+                        pool["project"],
+                        pool["network"],
+                        pool["pool-name"])
                     if name in pools:
                         previous_pools[name] = set(projects)
                     else:
@@ -255,10 +309,12 @@
                 if name not in previous_pools:
                     floating_ip_pool_create(name, projects)
                 else:
-                    floating_ip_pool_update(name, projects, previous_pools[name])
+                    floating_ip_pool_update(
+                        name, projects, previous_pools[name])
 
             leader_set({"floating-ip-pools": floating_pools})
 
+
 def configure_ssl():
     cert = config.get("ssl-ca")
     if cert:
@@ -268,6 +324,7 @@
         if remove_ssl_ca_certificate():
             service_restart("supervisor-config")
 
+
 @hooks.hook("contrail-analytics-api-relation-changed")
 def contrail_analytics_api_changed():
     if not relation_get("port"):
@@ -275,27 +332,33 @@
         return
     contrail_analytics_api_relation()
 
+
 @hooks.hook("contrail-analytics-api-relation-departed")
 @hooks.hook("contrail-analytics-api-relation-broken")
-@restart_on_change({"/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"]})
+@restart_on_change(
+    {"/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"]})
 def contrail_analytics_api_relation():
     write_contrail_svc_monitor_config()
 
+
 @hooks.hook("contrail-api-relation-joined")
 def contrail_api_joined():
     if config_get("contrail-api-configured"):
-        settings = { "private-address": control_network_ip(),
-                     "port": api_port(),
-                     "vip": config.get("vip") }
+        settings = {"private-address": control_network_ip(),
+                    "port": api_port(),
+                    "vip": config.get("vip")}
+        add_rbac_settings(settings)
         relation_set(relation_settings=settings)
 
+
 @hooks.hook("contrail-discovery-relation-joined")
 def contrail_discovery_joined():
-    settings = { "private-address": control_network_ip(), 
-                 "port": discovery_port(),
-                 "vip": config.get("vip") }
+    settings = {"private-address": control_network_ip(),
+                "port": discovery_port(),
+                "vip": config.get("vip")}
     relation_set(relation_settings=settings)
 
+
 @hooks.hook("contrail-ifmap-relation-joined")
 def contrail_ifmap_joined():
     if is_leader():
@@ -303,12 +366,12 @@
         creds = json.loads(creds) if creds else {}
 
         # prune credentials because we can't remove them directly lp #1469731
-        creds = { rid: { unit: units[unit]
-                         for unit, units in
-                         ((unit, creds[rid]) for unit in related_units(rid))
-                         if unit in units }
-                  for rid in relation_ids("contrail-ifmap")
-                  if rid in creds }
+        creds = {rid: {unit: units[unit]
+                       for unit, units in
+                       ((unit, creds[rid]) for unit in related_units(rid))
+                       if unit in units}
+                 for rid in relation_ids("contrail-ifmap")
+                 if rid in creds}
 
         rid = relation_id()
         if rid not in creds:
@@ -318,12 +381,13 @@
         if unit in cs:
             return
         # generate new credentials for unit
-        cs[unit] = { "username": unit, "password": pwgen(32) }
+        cs[unit] = {"username": unit, "password": pwgen(32)}
         leader_set({"ifmap-creds": json.dumps(creds)})
         write_ifmap_config()
         service_restart("supervisor-config")
         relation_set(creds=json.dumps(cs))
 
+
 def floating_ip_pool_create(name, projects):
     # create pool
     fq_network = "default-domain:" + ":".join(name[:2])
@@ -335,6 +399,7 @@
         fq_project = "default-domain:" + project
         contrail_floating_ip_use(fq_project, fq_pool_name)
 
+
 def floating_ip_pool_delete(name, projects):
     # deactivate pool for projects
     fq_pool_name = "default-domain:" + ":".join(name)
@@ -346,6 +411,7 @@
     fq_network = "default-domain:" + ":".join(name[:2])
     contrail_floating_ip_delete(fq_network, name[2])
 
+
 def floating_ip_pool_update(name, projects, previous_projects):
     fq_pool_name = "default-domain:" + ":".join(name)
 
@@ -359,24 +425,39 @@
         fq_project = "default-domain:" + project
         contrail_floating_ip_use(fq_project, fq_pool_name)
 
+
 def http_services():
     name = local_unit().replace("/", "-")
     addr = control_network_ip()
-    return [ { "service_name": "contrail-api",
-               "service_host": "0.0.0.0",
-               "service_port": 8082,
-               "service_options": [ "mode http", "balance leastconn", "option httpchk GET /Snh_SandeshUVECacheReq?x=NodeStatus HTTP/1.0" ],
-               "servers": [ [ name, addr, api_port(), "check port 8084" ] ] },
-             { "service_name": "contrail-discovery",
-               "service_host": "0.0.0.0",
-               "service_port": 5998,
-               "service_options": [ "mode http", "balance leastconn", "option httpchk GET /services HTTP/1.0" ],
-               "servers": [ [ name, addr, discovery_port(), "check" ] ] } ]
+    return [{"service_name": "contrail-api",
+             "service_host": "0.0.0.0",
+             "service_port": 8082,
+             "service_options": ["mode http",
+                                 "balance leastconn",
+                                 "option httpchk GET "
+                                 "/Snh_SandeshUVECacheReq?x=NodeStatus "
+                                 "HTTP/1.0"],
+             "servers": [[name,
+                          addr,
+                          api_port(),
+                          "check port 8084"]]},
+            {"service_name": "contrail-discovery",
+             "service_host": "0.0.0.0",
+             "service_port": 5998,
+             "service_options": ["mode http",
+                                 "balance leastconn",
+                                 "option httpchk GET /services HTTP/1.0"],
+             "servers": [[name,
+                          addr,
+                          discovery_port(),
+                          "check"]]}]
+
 
 @hooks.hook("http-services-relation-joined")
 def http_services_joined():
     relation_set(services=yaml.dump(http_services()))
 
+
 @hooks.hook("identity-admin-relation-changed")
 def identity_admin_changed():
     if not relation_get("service_hostname"):
@@ -387,6 +468,7 @@
     add_contrail_api()
     add_metadata()
 
+
 @hooks.hook("identity-admin-relation-departed")
 @hooks.hook("identity-admin-relation-broken")
 def identity_admin_departed():
@@ -396,10 +478,13 @@
         config["identity-admin-ready"] = False
     identity_admin_relation()
 
-@restart_on_change({"/etc/contrail/contrail-api.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"]})
+
+@restart_on_change(
+    {
+        "/etc/contrail/contrail-api.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"]})
 def identity_admin_relation():
     write_contrail_api_config()
     write_contrail_schema_config()
@@ -409,6 +494,7 @@
     if version_compare(CONTRAIL_VERSION, "3.0.2.0-34") >= 0:
         write_barbican_auth_config()
 
+
 @hooks.hook("identity-service-relation-joined")
 def identity_service_joined():
     vip = config.get("vip")
@@ -419,6 +505,7 @@
                  internal_url=url,
                  admin_url=url)
 
+
 @hooks.hook()
 def install():
     configure_installation_source(config["openstack-origin"])
@@ -437,8 +524,10 @@
     write_nodemgr_config()
     service_restart("contrail-config-nodemgr")
 
+
 @hooks.hook("leader-settings-changed")
-@restart_on_change({"/etc/ifmap-server/basicauthusers.properties": ["supervisor-config"]})
+@restart_on_change(
+    {"/etc/ifmap-server/basicauthusers.properties": ["supervisor-config"]})
 def leader_changed():
     write_ifmap_config()
     creds = leader_get("ifmap-creds")
@@ -448,12 +537,14 @@
         if rid in creds:
             relation_set(relation_id=rid, creds=json.dumps(creds[rid]))
 
+
 def main():
     try:
         hooks.execute(sys.argv)
     except UnregisteredHookError as e:
         log("Unknown hook {} - skipping.".format(e))
 
+
 @hooks.hook("neutron-metadata-relation-changed")
 def neutron_metadata_changed():
     if not relation_get("shared-secret"):
@@ -462,6 +553,7 @@
     config["neutron-metadata-ready"] = True
     add_metadata()
 
+
 @hooks.hook("neutron-metadata-relation-departed")
 @hooks.hook("neutron-metadata-relation-broken")
 def neutron_metadata_departed():
@@ -469,6 +561,7 @@
         remove_metadata()
         config["neutron-metadata-ready"] = False
 
+
 def remove_contrail_api():
     if config_get("contrail-api-configured"):
         # unprovision configuration on 3.0.2.0+
@@ -476,6 +569,7 @@
             unprovision_configuration()
         config["contrail-api-configured"] = False
 
+
 def remove_metadata():
     if is_leader() and leader_get("metadata-provisioned"):
         # impossible to know if current hook is firing because
@@ -484,6 +578,7 @@
             unprovision_metadata()
         leader_set({"metadata-provisioned": ""})
 
+
 @hooks.hook("upgrade-charm")
 def upgrade_charm():
     write_ifmap_config()
@@ -496,12 +591,16 @@
     write_nodemgr_config()
     service_restart("supervisor-config")
 
-@restart_on_change({"/etc/contrail/contrail-api.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-config-nodemgr.conf": ["supervisor-config"]})
+
+@restart_on_change(
+    {
+        "/etc/contrail/contrail-api.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-config-nodemgr.conf": ["supervisor-config"]})
 def write_config():
     write_contrail_api_config()
     write_nodemgr_config()
 
+
 @hooks.hook("zookeeper-relation-changed")
 def zookeeper_changed():
     if not relation_get("port"):
@@ -512,6 +611,7 @@
     add_contrail_api()
     add_metadata()
 
+
 @hooks.hook("zookeeper-relation-departed")
 @hooks.hook("zookeeper-relation-broken")
 def zookeeper_departed():
@@ -521,12 +621,15 @@
         config["zookeeper-ready"] = False
     zookeeper_relation()
 
-@restart_on_change({"/etc/contrail/contrail-api.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-discovery.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
-                    "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"],
-                    "/etc/contrail/discovery.conf": ["supervisor-config"]})
+
+@restart_on_change(
+    {
+        "/etc/contrail/contrail-api.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-device-manager.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-discovery.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-schema.conf": ["supervisor-config"],
+        "/etc/contrail/contrail-svc-monitor.conf": ["supervisor-config"],
+        "/etc/contrail/discovery.conf": ["supervisor-config"]})
 def zookeeper_relation():
     write_contrail_api_config()
     write_contrail_schema_config()
@@ -534,5 +637,6 @@
     write_contrail_svc_monitor_config()
     write_device_manager_config()
 
+
 if __name__ == "__main__":
     main()
 
=== modified file 'hooks/contrail_configuration_utils.py'
--- hooks/contrail_configuration_utils.py	2017-03-10 12:49:07 +0000
+++ hooks/contrail_configuration_utils.py	2017-03-23 15:13:02 +0000
@@ -40,6 +40,7 @@
 
 apt_pkg.init()
 
+
 def dpkg_version(pkg):
     try:
         return check_output(["dpkg-query", "-f", "${Version}\\n", "-W", pkg]).rstrip()
@@ -155,10 +156,16 @@
 
 def contrail_ctx():
     addr = control_network_ip()
+    rbac = config.get("rbac")
+    cloud_admin_role = config.get("cloud-admin-role")
+    global_read_only_role = config.get("global-read-only-role")
     return { "api_port": api_port(),
              "ifmap_server": addr,
              "disc_server": addr,
-             "disc_port": discovery_port() }
+             "disc_port": discovery_port(),
+             "rbac": rbac,
+             "cloud_admin_role": cloud_admin_role,
+             "global_read_only_role": global_read_only_role }
 
 def contrail_floating_ip_create(network, name):
     user, password, tenant = [ (relation_get("service_username", unit, rid),
@@ -344,7 +351,9 @@
                "admin_user": relation_get("service_username", unit, rid),
                "admin_password": relation_get("service_password", unit, rid),
                "admin_tenant_name": relation_get("service_tenant_name", unit, rid),
-               "auth_region": relation_get("service_region", unit, rid) }
+               "auth_region": relation_get("service_region", unit, rid),
+               "service_protocol": relation_get("service_protocol", unit, rid),
+               "api_version": relation_get("api_version", unit, rid)}
              for rid in relation_ids("identity-admin")
              for unit, hostname in
              ((unit, relation_get("service_hostname", unit, rid)) for unit in related_units(rid))
 
=== added symlink 'hooks/identity-credentials-relation-changed'
=== target is u'contrail_configuration_hooks.py'
=== added symlink 'hooks/identity-credentials-relation-joined'
=== target is u'contrail_configuration_hooks.py'
=== modified file 'templates/contrail-api.conf'
--- templates/contrail-api.conf	2017-01-31 12:51:09 +0000
+++ templates/contrail-api.conf	2017-03-23 15:13:02 +0000
@@ -10,7 +10,16 @@
 ifmap_password = api-server
 cassandra_server_list = {{ cassandra_servers|join(" ") }}
 auth = keystone
-multi_tenancy = True
+
+{% if rbac -%}
+aaa_mode = rbac
+{% else -%}
+multi_tenancy = true
+{% endif -%}
+
+cloud_admin_role = {{ cloud_admin_role }}
+global_read_only_role = {{ global_read_only_role }}
+
 disc_server_ip = {{ disc_server }}
 disc_server_port = {{ disc_port }}
 zk_server_ip = {{ zk_servers|join(",") }}