Authdriver #236

samvarankashyap · 2017-05-15T13:41:59Z

Summary:

Designed according to PR #76 discussion
Updated schema v4
Updated playbooks

example topology :

---
    topology_name: "ex_os_server"
    resource_groups:
      - 
        resource_group_name: "testgroup1"
        res_group_type: "openstack"
        res_defs:
          - 
            res_name: "sktestinstance"
            flavor: "m1.small"
            res_type: "os_server"
            image: "rhel-6.5_jeos"
            count: 3
            keypair: "ci-factory"
            networks:
              - "atomic-e2e-jenkins-test"
              - "atomic-e2e-jenkins-test2"
            fip_pool: "10.8.172.0/22"
        credentials:
          name: "atomic_jenkins"
          profile: "default"  # optional if not mentioned it defaults to default
          auth_type: "file" # optional defaults to "file" no other implementations yet
    resource_group_vars:
      - 
        resource_group_name : "testgroup1"
        test_var1: "test_var1 msg is grp1 hello "
        test_var2: "test_var2 msg is grp1 hello "
        test_var3: "test_var3 msg is grp1 hello "

cli usage:

linchpin rise --creds /path/to/creds

or

export LP_CREDS='/path/to/creds'
linchpin rise

Issue fixes:

fixes #76

Note:
** should be merged after #218 **
** Needs Rebase **
** Needs testing (for gcloud) **

herlo · 2017-05-22T18:52:41Z

linchpin/__init__.py

@@ -60,12 +60,15 @@ def get_command(self, ctx, name):
 @click.option('-w', '--workspace', type=click.Path(), envvar='WORKSPACE',
        help='Use the specified workspace if the familiar Jenkins $WORKSPACE environment variable '
        'is not set')
+@click.option('-c', '--creds', type=click.Path(), envvar='LP_CREDS',


the -c option is already used for config. Just use --creds-path option here.

herlo · 2017-05-22T18:58:28Z

linchpin/__init__.py

 @click.option('-v', '--verbose', is_flag=True, default=False,
        help='Enable verbose output')
 @click.option('--version', is_flag=True,
        help='Prints the version and exits')
 @pass_context
-def runcli(ctx, config, workspace, verbose, version):
+def runcli(ctx, config, workspace, creds, verbose, version):


When adding new args, please add them at the end as a keyword argument. This is especially important for api functionality. In this case, it's unlikely to be a kwarg, but creds_path should be at the end.

herlo · 2017-05-22T19:29:05Z

linchpin/linchpin.conf

@@ -36,6 +36,7 @@ schemas_folder = schemas

 resources_folder = resources
 inventories_folder = inventories
+credentials_folder = credentials


Is this necessary? I don't see where it's currently used.

…ll string Current built in default jinja filter helps the user to omit/provide default to keys in the ansible module. However , it doesnt provide a way for user to conditionally provide a default value to ie., based on the value provided by the output of previous filter . In order to facilitate the same provide_default filter is being written.

auth_driver module fetches and parses file returns to credentials in auth_var variable making creds accessible inside ansible playbooks.

…it as evar to run_cli

samvarankashyap · 2017-05-22T20:10:05Z

PR is broken after rebase, will be fixing it soon .

samvarankashyap · 2017-05-22T20:56:14Z

linchpin up on openstack

$ linchpin --creds-path ./credentials/ up openstack
target: openstack, action: up
PLAY [schema check and Pre Provisioning Activities on topology_file] ***********
...
TASK [inventory_gen : Updating inventory_file with the absolute path] **********
ok: [localhost]

TASK [inventory_gen : Generate Generic Inventory] ******************************
ok: [localhost]

PLAY RECAP *********************************************************************
localhost                  : ok=33   changed=3    unreachable=0    failed=0

linchpin destroy on openstack

$ linchpin --creds-path ./credentials/ destroy openstack
target: openstack, action: destroy


PLAY [schema check and Pre Provisioning Activities on topology_file] ***********

TASK [common : use linchpin_config if provided] ********************************
skipping: [localhost]
...
...
PLAY RECAP *********************************************************************
localhost                  : ok=27   changed=2    unreachable=0    failed=0

herlo · 2017-05-22T21:18:35Z

linchpin/api/__init__.py

@@ -188,6 +188,8 @@ def run_playbook(self, pinfile, targets='all', playbook='up'):
        if self.ctx.cfgs.get('ansible'):
            ansible_console = ast.literal_eval(self.ctx.cfgs['ansible'].get('console', 'False'))

+        self.ctx.evars['creds_path'] = self.ctx.creds_path


Use self.set_evar here. Failed CI due to the value not being there. set_evar makes sure to create the structure for you if it isn't there.

herlo · 2017-05-22T21:40:42Z

linchpin/api/__init__.py

@@ -188,7 +188,7 @@ def run_playbook(self, pinfile, targets='all', playbook='up'):
        if self.ctx.cfgs.get('ansible'):
            ansible_console = ast.literal_eval(self.ctx.cfgs['ansible'].get('console', 'False'))

-        self.ctx.evars['creds_path'] = self.ctx.creds_path
+        self.set_evar('creds_path', self.ctx.creds_path)


This does not help. self.ctx.creds_path is being set into the same place. Why is this necessary?

The auth_var is now used across all the playbooks to refer the aws_access_id and aws_secret_key

…ssible to unset a var in ansible

samvarankashyap · 2017-05-23T15:06:10Z

linchpin up aws # with env vars

linchpin up aws
target: aws, action: up


PLAY [schema check and Pre Provisioning Activities on topology_file] ***********

TASK [common : use linchpin_config if provided] ********************************
skipping: [localhost]
...
TASK [inventory_gen : Generate Generic Inventory] ******************************
changed: [localhost]

PLAY RECAP *********************************************************************
localhost                  : ok=33   changed=3    unreachable=0    failed=0

linchpin destroy aws

$ linchpin destroy aws
target: aws, action: destroy


PLAY [schema check and Pre Provisioning Activities on topology_file] ***********

TASK [common : use linchpin_config if provided] ********************************
skipping: [localhost]

TASK [common : set lp_path] ****************************************************
skipping: [localhost]
...
TASK [inventory_gen : Generate Generic Inventory] ******************************
skipping: [localhost]
PLAY RECAP *********************************************************************
localhost                  : ok=28   changed=2    unreachable=0    failed=0

samvarankashyap · 2017-05-23T15:18:28Z

linchpin up aws # with --creds-path

$ linchpin --creds-path ../workspace/creds/ up aws
target: aws, action: up
PLAY [schema check and Pre Provisioning Activities on topology_file] ***********
TASK [common : use linchpin_config if provided] ********************************
skipping: [localhost]
...
TASK [inventory_gen : Generate Generic Inventory] ******************************
changed: [localhost]

PLAY RECAP *********************************************************************
localhost                  : ok=33   changed=4    unreachable=0    failed=0

linchpin destroy # with --creds-path

$ linchpin --creds-path ../workspace/creds/ destroy aws
target: aws, action: destroy


PLAY [schema check and Pre Provisioning Activities on topology_file] ***********

TASK [common : use linchpin_config if provided] ********************************
skipping: [localhost]
...
...
TASK [inventory_gen : Generate Generic Inventory] ******************************
skipping: [localhost]

PLAY RECAP *********************************************************************
localhost                  : ok=28   changed=3    unreachable=0    failed=0

…attribute

samvarankashyap · 2017-05-23T15:42:10Z

linchpin up gcloud # with creds-path

$ linchpin --creds-path /home/srallaba/workspace/creds/ up gcloud
target: gcloud, action: up
PLAY [schema check and Pre Provisioning Activities on topology_file] ***********
TASK [common : use linchpin_config if provided] ********************************
skipping: [localhost]
...
...

TASK [inventory_gen : Generate Generic Inventory] ******************************
changed: [localhost]
PLAY RECAP *********************************************************************
localhost                  : ok=32   changed=4    unreachable=0    failed=0

linchpin destroy gcloud # with creds-path

linchpin --creds-path /home/srallaba/workspace/creds/ destroy gcloud
target: gcloud, action: destroy
PLAY [schema check and Pre Provisioning Activities on topology_file] ***********
TASK [common : use linchpin_config if provided] ********************************
skipping: [localhost]
...
...
TASK [inventory_gen : Generate Generic Inventory] ******************************
skipping: [localhost]

PLAY RECAP *********************************************************************
localhost                  : ok=26   changed=2    unreachable=0    failed=0

samvarankashyap · 2017-05-23T15:44:18Z

Note: All the above tests are performed on schema_v4 topologies. As credentials attribute is introduced in schema_v4 only .
example workspace for testing including the topologies can be found in following link.
linchtest

herlo · 2017-05-23T16:42:46Z

What is the likelihood of removing schema_v3 with this update? Probably shouldn't be maintaining two schemas as that's not a viable option.

samvarankashyap · 2017-05-23T16:52:47Z

@herlo I also feel we should be using schema_v4 only for auth_driver because it makes no sense in supporting both the schemas from 1.0 release. However , the only consequence is to update all the examples and documentation for openstack , gcloud and aws topologies.

herlo · 2017-05-23T18:06:41Z

@samvarankashyap since we agree on this point, please create an issue to remove schema_v3 as part of a 1.1.0 release moving forward.

herlo

LGTM

samvarankashyap · 2017-05-23T18:19:08Z

@herlo: ref #243

samvarankashyap added development enhancement testing labels May 15, 2017

samvarankashyap added this to the v1.0.0 milestone May 15, 2017

samvarankashyap self-assigned this May 15, 2017

samvarankashyap requested a review from herlo May 15, 2017 13:42

samvarankashyap force-pushed the authdriver_v2 branch from 0d659ec to 9f0e26c Compare May 15, 2017 13:44

herlo suggested changes May 22, 2017

View reviewed changes

samvarankashyap added 8 commits May 22, 2017 15:44

added auth_driver module to fetch credentials from specified locations

c3f6f4e

auth_driver module fetches and parses file returns to credentials in auth_var variable making creds accessible inside ansible playbooks.

updated schema v3 and schema_v4 to incorporate auth_driver functionality

594627c

Added credentials folder to linchpin conf and templates

a9341ad

updated openstack playbooks to incorporate auth_driver functionality

442e9e7

updated aws playbooks to incorporate auth_driver functionality

2ffac00

updated gcloud playbooks to incorporate auth_driver functionality

84c41ec

Updated linchpin cli , and api to fetch the creds_path variable pass …

b5e1291

…it as evar to run_cli

samvarankashyap force-pushed the authdriver_v2 branch from 9f0e26c to b5e1291 Compare May 22, 2017 19:49

samvarankashyap force-pushed the authdriver_v2 branch from 6e72cad to 9679c50 Compare May 22, 2017 20:38

herlo reviewed May 22, 2017

View reviewed changes

samvarankashyap force-pushed the authdriver_v2 branch from d62a6f4 to afa01b3 Compare May 22, 2017 21:52

samvarankashyap added 5 commits May 22, 2017 17:58

Renamed the parameter --creds to --creds-path

11af8b4

bugfix: Make provide default return the fetched items

df29db9

Updated schema for aws resource group type

48d165d

Updated Authdriver references inside aws role

810f991

The auth_var is now used across all the playbooks to refer the aws_access_id and aws_secret_key

Updated setting for creds_path evar param using set_evar

80655fb

samvarankashyap force-pushed the authdriver_v2 branch from afa01b3 to 80655fb Compare May 22, 2017 21:58

Added multiple tasks to handle auth_var when not given, as its not po…

2d7176d

…ssible to unset a var in ansible

samvarankashyap force-pushed the authdriver_v2 branch from 97e9309 to e9cffcf Compare May 22, 2017 23:02

Added creds_path to linchpin api context and defaulted it to None

ee7fd2f

samvarankashyap force-pushed the authdriver_v2 branch from 4867d2f to ee7fd2f Compare May 22, 2017 23:18

bugfix: Updated gcloud schema , added name, auth_type to credentials …

0fd98c7

…attribute

herlo approved these changes May 23, 2017

View reviewed changes

samvarankashyap mentioned this pull request May 23, 2017

Drop support for schema_v3 #243

Closed

samvarankashyap merged commit bc145e7 into CentOS-PaaS-SIG:develop May 23, 2017

samvarankashyap mentioned this pull request May 23, 2017

Need a way to retrieve the path to credential store #229

Closed

adl-bot mentioned this pull request Aug 30, 2018

Add debug mode #650

Merged

adl-bot mentioned this pull request Sep 25, 2019

Update beaker setup dependencies with linchpin #1346

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Authdriver #236

Authdriver #236

samvarankashyap commented May 15, 2017 •

edited

Loading

herlo May 22, 2017

herlo May 22, 2017

herlo May 22, 2017

samvarankashyap commented May 22, 2017

samvarankashyap commented May 22, 2017

herlo May 22, 2017 •

edited

Loading

herlo May 22, 2017

samvarankashyap commented May 23, 2017

samvarankashyap commented May 23, 2017 •

edited

Loading

samvarankashyap commented May 23, 2017

samvarankashyap commented May 23, 2017

herlo commented May 23, 2017

samvarankashyap commented May 23, 2017 •

edited

Loading

herlo commented May 23, 2017

herlo left a comment

samvarankashyap commented May 23, 2017

Authdriver #236

Authdriver #236

Conversation

samvarankashyap commented May 15, 2017 • edited Loading

Summary:

example topology :

cli usage:

Issue fixes:

herlo May 22, 2017

Choose a reason for hiding this comment

herlo May 22, 2017

Choose a reason for hiding this comment

herlo May 22, 2017

Choose a reason for hiding this comment

samvarankashyap commented May 22, 2017

samvarankashyap commented May 22, 2017

herlo May 22, 2017 • edited Loading

Choose a reason for hiding this comment

herlo May 22, 2017

Choose a reason for hiding this comment

samvarankashyap commented May 23, 2017

samvarankashyap commented May 23, 2017 • edited Loading

samvarankashyap commented May 23, 2017

samvarankashyap commented May 23, 2017

herlo commented May 23, 2017

samvarankashyap commented May 23, 2017 • edited Loading

herlo commented May 23, 2017

herlo left a comment

Choose a reason for hiding this comment

samvarankashyap commented May 23, 2017

samvarankashyap commented May 15, 2017 •

edited

Loading

herlo May 22, 2017 •

edited

Loading

samvarankashyap commented May 23, 2017 •

edited

Loading

samvarankashyap commented May 23, 2017 •

edited

Loading