Merge lp:~hopem/charm-helpers/pki into lp:charm-helpers

[Edward Hope-Morley]

[lp:~hopem/charm-helpers/pki]

321. By Edward Hope-Morley on 2015-02-24

synced lp:charm-helpers

[Liam Young (gnuoy)]

Approve

review: Approve

=== modified file 'charmhelpers/contrib/openstack/context.py'
--- charmhelpers/contrib/openstack/context.py	2015-02-24 11:22:24 +0000
+++ charmhelpers/contrib/openstack/context.py	2015-02-24 12:34:15 +0000
@@ -279,9 +279,25 @@
 class IdentityServiceContext(OSContextGenerator):
     interfaces = ['identity-service']
 
+    def __init__(self, service=None, service_user=None):
+        self.service = service
+        self.service_user = service_user
+
     def __call__(self):
         log('Generating template context for identity-service', level=DEBUG)
         ctxt = {}
+
+        if self.service and self.service_user:
+            # This is required for pki token signing if we don't want /tmp to
+            # be used.
+            cachedir = '/var/cache/%s' % (self.service)
+            if not os.path.isdir(cachedir):
+                log("Creating service cache dir %s" % (cachedir), level=DEBUG)
+                mkdir(path=cachedir, owner=self.service_user,
+                      group=self.service_user, perms=0o700)
+
+            ctxt['signing_dir'] = cachedir
+
         for rid in relation_ids('identity-service'):
             for unit in related_units(rid):
                 rdata = relation_get(rid=rid, unit=unit)
@@ -291,15 +307,16 @@
                 auth_host = format_ipv6_addr(auth_host) or auth_host
                 svc_protocol = rdata.get('service_protocol') or 'http'
                 auth_protocol = rdata.get('auth_protocol') or 'http'
-                ctxt = {'service_port': rdata.get('service_port'),
-                        'service_host': serv_host,
-                        'auth_host': auth_host,
-                        'auth_port': rdata.get('auth_port'),
-                        'admin_tenant_name': rdata.get('service_tenant'),
-                        'admin_user': rdata.get('service_username'),
-                        'admin_password': rdata.get('service_password'),
-                        'service_protocol': svc_protocol,
-                        'auth_protocol': auth_protocol}
+                ctxt.update({'service_port': rdata.get('service_port'),
+                             'service_host': serv_host,
+                             'auth_host': auth_host,
+                             'auth_port': rdata.get('auth_port'),
+                             'admin_tenant_name': rdata.get('service_tenant'),
+                             'admin_user': rdata.get('service_username'),
+                             'admin_password': rdata.get('service_password'),
+                             'service_protocol': svc_protocol,
+                             'auth_protocol': auth_protocol})
+
                 if context_complete(ctxt):
                     # NOTE(jamespage) this is required for >= icehouse
                     # so a missing value just indicates keystone needs

=== modified file 'tests/contrib/openstack/test_os_contexts.py'
--- tests/contrib/openstack/test_os_contexts.py	2015-02-24 11:22:24 +0000
+++ tests/contrib/openstack/test_os_contexts.py	2015-02-24 12:34:15 +0000
@@ -631,6 +631,30 @@
         }
         self.assertEquals(result, expected)
 
+    def test_identity_service_context_with_cache(self):
+        '''Test shared-db context with signing cache info'''
+        relation = FakeRelation(relation_data=IDENTITY_SERVICE_RELATION_UNSET)
+        self.relation_get.side_effect = relation.get
+        svc = 'cinder'
+        identity_service = context.IdentityServiceContext(service=svc,
+                                                          service_user=svc)
+        result = identity_service()
+        expected = {
+            'admin_password': 'foo',
+            'admin_tenant_name': 'admin',
+            'admin_tenant_id': None,
+            'admin_user': 'adam',
+            'auth_host': 'keystone-host.local',
+            'auth_port': '35357',
+            'auth_protocol': 'http',
+            'service_host': 'keystonehost.local',
+            'service_port': '5000',
+            'service_protocol': 'http',
+            'signing_dir': '/var/cache/cinder',
+        }
+        self.assertTrue(self.mkdir.called)
+        self.assertEquals(result, expected)
+
     def test_identity_service_context_with_data_http(self):
         '''Test shared-db context with all required data'''
         relation = FakeRelation(relation_data=IDENTITY_SERVICE_RELATION_HTTP)