Merge lp:~thedac/charm-helpers/keystoneauth1 into lp:charm-helpers

[David Ames]

Use keystoneauth1 sessions

As of Ocata clients keystoneauth1 sessions is the appropriate method
to authenticate against keystone.

This changes some of the previous methods used to interrogate
keystone including retrieving catalog entries.

This change updates the amulet utilities to use keystoneauth1.

[Billy Olsen (billy-olsen)]

Changes look fine to me. I'd be nice to have unit tests, but none exist for this module as it is.

review: Approve

[lp:~thedac/charm-helpers/keystoneauth1]

751. By David Ames on 2017-06-08

Avoid collision between project_name and tenant

=== modified file 'charmhelpers/contrib/openstack/amulet/utils.py'
--- charmhelpers/contrib/openstack/amulet/utils.py	2017-04-20 21:30:53 +0000
+++ charmhelpers/contrib/openstack/amulet/utils.py	2017-06-08 17:03:27 +0000
@@ -26,8 +26,11 @@
 import glanceclient.v1.client as glance_client
 import heatclient.v1.client as heat_client
 import keystoneclient.v2_0 as keystone_client
-from keystoneclient.auth.identity import v3 as keystone_id_v3
-from keystoneclient import session as keystone_session
+from keystoneauth1.identity import (
+    v3,
+    v2,
+)
+from keystoneauth1 import session as keystone_session
 from keystoneclient.v3 import client as keystone_client_v3
 from novaclient import exceptions
 
@@ -368,12 +371,19 @@
                                         port)
         if not api_version or api_version == 2:
             ep = base_ep + "/v2.0"
-            return keystone_client.Client(username=username, password=password,
-                                          tenant_name=project_name,
-                                          auth_url=ep)
+            auth = v2.Password(
+                username=username,
+                password=password,
+                tenant_name=project_name,
+                auth_url=ep
+            )
+
+            return keystone_client.Client(
+                session=keystone_session.Session(auth=auth)
+            )
         else:
             ep = base_ep + "/v3"
-            auth = keystone_id_v3.Password(
+            auth = v3.Password(
                 user_domain_name=user_domain_name,
                 username=username,
                 password=password,
@@ -388,30 +398,40 @@
 
     def authenticate_keystone_admin(self, keystone_sentry, user, password,
                                     tenant=None, api_version=None,
-                                    keystone_ip=None):
+                                    keystone_ip=None, user_domain_name=None,
+                                    project_domain_name=None,
+                                    project_name=None):
         """Authenticates admin user with the keystone admin endpoint."""
         self.log.debug('Authenticating keystone admin...')
         if not keystone_ip:
             keystone_ip = keystone_sentry.info['public-address']
 
-        user_domain_name = None
-        domain_name = None
-        if api_version == 3:
+        # To support backward compatibility usage of this function
+        if not project_name:
+            project_name = tenant
+        if api_version == 3 and not user_domain_name:
             user_domain_name = 'admin_domain'
-            domain_name = user_domain_name
+        if api_version == 3 and not project_domain_name:
+            project_domain_name = 'admin_domain'
+        if api_version == 3 and not project_name:
+            project_name = 'admin'
 
-        return self.authenticate_keystone(keystone_ip, user, password,
-                                          project_name=tenant,
-                                          api_version=api_version,
-                                          user_domain_name=user_domain_name,
-                                          domain_name=domain_name,
-                                          admin_port=True)
+        return self.authenticate_keystone(
+            keystone_ip, user, password,
+            api_version=api_version,
+            user_domain_name=user_domain_name,
+            project_domain_name=project_domain_name,
+            project_name=project_name,
+            admin_port=True)
 
     def authenticate_keystone_user(self, keystone, user, password, tenant):
         """Authenticates a regular user with the keystone public endpoint."""
         self.log.debug('Authenticating keystone user ({})...'.format(user))
-        ep = keystone.service_catalog.url_for(service_type='identity',
-                                              endpoint_type='publicURL')
+
+        endpoint_filter = {'service_type': 'identity',
+                           'interface': 'public',
+                           'region_name': 'RegionOne'}
+        ep = keystone.session.get_endpoint(**endpoint_filter)
         keystone_ip = urlparse.urlparse(ep).hostname
 
         return self.authenticate_keystone(keystone_ip, user, password,
@@ -420,22 +440,29 @@
     def authenticate_glance_admin(self, keystone):
         """Authenticates admin user with glance."""
         self.log.debug('Authenticating glance admin...')
-        ep = keystone.service_catalog.url_for(service_type='image',
-                                              endpoint_type='adminURL')
+        endpoint_filter = {'service_type': 'image',
+                           'interface': 'admin',
+                           'region_name': 'RegionOne'}
+        ep = keystone.session.get_endpoint(**endpoint_filter)
         return glance_client.Client(ep, token=keystone.auth_token)
 
     def authenticate_heat_admin(self, keystone):
         """Authenticates the admin user with heat."""
         self.log.debug('Authenticating heat admin...')
-        ep = keystone.service_catalog.url_for(service_type='orchestration',
-                                              endpoint_type='publicURL')
+        endpoint_filter = {'service_type': 'orchestration',
+                           'interface': 'public',
+                           'region_name': 'RegionOne'}
+        ep = keystone.session.get_endpoint(**endpoint_filter)
         return heat_client.Client(endpoint=ep, token=keystone.auth_token)
 
     def authenticate_nova_user(self, keystone, user, password, tenant):
         """Authenticates a regular user with nova-api."""
         self.log.debug('Authenticating nova user ({})...'.format(user))
-        ep = keystone.service_catalog.url_for(service_type='identity',
-                                              endpoint_type='publicURL')
+        endpoint_filter = {'service_type': 'identity',
+                           'interface': 'public',
+                           'region_name': 'RegionOne'}
+        ep = keystone.session.get_endpoint(**endpoint_filter)
+
         if novaclient.__version__[0] >= "7":
             return nova_client.Client(NOVA_CLIENT_VERSION,
                                       username=user, password=password,
@@ -448,8 +475,10 @@
     def authenticate_swift_user(self, keystone, user, password, tenant):
         """Authenticates a regular user with swift api."""
         self.log.debug('Authenticating swift user ({})...'.format(user))
-        ep = keystone.service_catalog.url_for(service_type='identity',
-                                              endpoint_type='publicURL')
+        endpoint_filter = {'service_type': 'identity',
+                           'interface': 'public',
+                           'region_name': 'RegionOne'}
+        ep = keystone.session.get_endpoint(**endpoint_filter)
         return swiftclient.Connection(authurl=ep,
                                       user=user,
                                       key=password,