Merge lp:~gandelman-a/charms/precise/keystone/db_recreate_services into lp:~charmers/charms/precise/keystone/trunk

[Adam Gandelman]

[lp:~gandelman-a/charms/precise/keystone/db_recreate_services]

36. By Adam Gandelman on 2012-09-20

hooks/utils.py: Avoid another duplicate role assignment in create_role().

Do not add role directly through API in create_role(). Use grant_role()
utility function instead, which checks for duplicate assignments.

[Clint Byrum (clint-fewbar)]

Adam, this is brilliant. Keep up the good work!

review: Approve

=== modified file 'hooks/keystone-hooks'
--- hooks/keystone-hooks	2012-08-08 23:17:52 +0000
+++ hooks/keystone-hooks	2012-09-20 18:19:18 +0000
@@ -101,18 +101,26 @@
     time.sleep(5)
     ensure_initial_admin(config)
 
+    # If the backend database has been switched to something new and there
+    # are existing identity-service relations,, service entries need to be
+    # recreated in the new database.  Re-executing identity-service-changed
+    # will do this.
+    for id in relation_ids(relation_name='identity-service'):
+        for unit in relation_list(relation_id=id):
+            juju_log("Re-exec'ing identity-service-changed for: %s - %s" %
+                     (id, unit))
+            identity_changed(relation_id=id, remote_unit=unit)
+
 def identity_joined():
     """ Do nothing until we get information about requested service """
     pass
 
-def identity_changed():
-    """ A service has advertised its API endpoints, create an entry in the 
-        service catalog. """
-    # TODO(adm_g): Need to add this type of logic back
-    #relation_data = relation_get(options)
-    #if len(relation_data) != len(options):
-    #    juju_log("Missing relation data.  Peer not ready, exit 0")
-    #    exit(0)
+def identity_changed(relation_id=None, remote_unit=None):
+    """ A service has advertised its API endpoints, create an entry in the
+        service catalog.
+        Optionally allow this hook to be re-fired for an existing
+        relation+unit, for context see see db_changed().
+    """
     def ensure_valid_service(service):
         if service not in valid_services.keys():
             juju_log("WARN: Invalid service requested: '%s'" % service)
@@ -128,7 +136,8 @@
                                  admin_url=admin_url,
                                  internal_url=internal_url)
 
-    settings = relation_get_dict()
+    settings = relation_get_dict(relation_id=relation_id,
+                                 remote_unit=remote_unit)
 
     # the minimum settings needed per endpoint
     single = set(['service', 'region', 'public_url', 'admin_url',
@@ -136,14 +145,9 @@
     if single.issubset(settings):
         # other end of relation advertised only one endpoint
 
-        # TODO(adam_g): Remove this hack once the features described
-        # at https://lists.ubuntu.com/archives/juju/2012-March/001342.html
-        # land.  In the meantime, allow remote units to pass service=None
-        # and treat it as a noop, so that service can do the reconfiguration
-        # it needs for keystone strategy without the need to register any
-        # services/endpoints in the catalog.  This is now required for backend
-        # nova components that dont expose endpoints (compute, specifically)
         if 'None' in [v for k,v in settings.iteritems()]:
+            # Some backend services advertise no endpoint but require a
+            # hook execution to update auth strategy.
             return
 
         ensure_valid_service(settings['service'])

=== modified file 'hooks/utils.py'
--- hooks/utils.py	2012-08-10 01:15:28 +0000
+++ hooks/utils.py	2012-09-20 18:19:18 +0000
@@ -93,6 +93,17 @@
     config["hostname"] = execute("unit-get private-address")[0].strip()
     return config
 
+def relation_ids(relation_name=None):
+    j = execute('relation-ids --format=json %s' % relation_name)[0]
+    return json.loads(j)
+
+def relation_list(relation_id=None):
+    cmd = 'relation-list --format=json'
+    if relation_id:
+        cmd += ' -r %s' % relation_id
+    j = execute(cmd)[0]
+    return json.loads(j)
+
 def relation_set(relation_data):
     """ calls relation-set for all key=values in dict """
     for k in relation_data:
@@ -114,9 +125,17 @@
            results[r] = result
     return results
 
-def relation_get_dict():
+def relation_get_dict(relation_id=None, remote_unit=None):
     """Obtain all relation data as dict by way of JSON"""
-    j = execute('relation-get --format=json', die=True)[0]
+    cmd = 'relation-get --format=json'
+    if relation_id:
+        cmd += ' -r %s' % relation_id
+    if remote_unit:
+        remote_unit_orig = os.getenv('JUJU_REMOTE_UNIT', None)
+        os.environ['JUJU_REMOTE_UNIT'] = remote_unit
+    j = execute(cmd, die=True)[0]
+    if remote_unit and remote_unit_orig:
+        os.environ['JUJU_REMOTE_UNIT'] = remote_unit_orig
     d = json.loads(j)
     settings = {}
     # convert unicode to strings
@@ -327,10 +346,7 @@
         error_out("Could not resolve [user_id, role_id, tenant_id]" %
                    [user_id, role_id, tenant_id])
 
-    manager.api.roles.add_user_role(user=user_id,
-                                    role=role_id,
-                                    tenant=tenant_id)
-    juju_log("Granted role '%s' to '%s'" % (name, user))
+    grant_role(user, name, tenant)
 
 def grant_role(user, role, tenant):
     """grant user+tenant a specific role"""

=== modified file 'revision'
--- revision	2012-09-17 18:25:43 +0000
+++ revision	2012-09-20 18:19:18 +0000
@@ -1,1 +1,1 @@
-142
+145