meta-stx/recipes-devtools/python/python-keystone_git.bb

   1 #
   2 ## Copyright (C) 2019 Wind River Systems, Inc.
   3 #
   4 #  Licensed under the Apache License, Version 2.0 (the "License");
   5 #  you may not use this file except in compliance with the License.
   6 #  You may obtain a copy of the License at
   7 #
   8 #      http://www.apache.org/licenses/LICENSE-2.0
   9 #
  10 #  Unless required by applicable law or agreed to in writing, software
  11 #  distributed under the License is distributed on an "AS IS" BASIS,
  12 #  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 #  See the License for the specific language governing permissions and
  14 #  limitations under the License.
  15
  16 DESCRIPTION = "Authentication service for OpenStack"
  17 HOMEPAGE = "http://www.openstack.org"
  18 SECTION = "devel/python"
  19 LICENSE = "Apache-2.0"
  20 LIC_FILES_CHKSUM = "file://LICENSE;md5=1dece7821bf3fd70fe1309eaa37d52a2"
  21
  22 SRCREV = "c78581b4608f3dc10e945d358963000f284f188a"
  23 SRCNAME = "keystone"
  24 PROTOCOL = "git"
  25 BRANCH = "stable/stein"
  26 S = "${WORKDIR}/git"
  27 PV = "15.0.0+git${SRCPV}"
  28
  29
  30 SRC_URI = " \
  31         git://opendev.org/openstack/${SRCNAME}.git;protocol=${PROTOCOL};branch=${BRANCH} \
  32         file://${PN}/keystone.conf \
  33         file://${PN}/identity.sh \
  34         file://${PN}/convert_keystone_backend.py \
  35         file://${PN}/wsgi-keystone.conf \
  36         file://${PN}/admin-openrc \
  37         file://${PN}/keystone-init.service \
  38         file://${PN}/stx-files/openstack-keystone.service \
  39         file://${PN}/stx-files/keystone-all \
  40         file://${PN}/stx-files/keystone-fernet-keys-rotate-active \
  41         file://${PN}/stx-files/public.py \
  42         file://${PN}/stx-files/password-rules.conf \
  43         "
  44
  45
  46 inherit setuptools identity hosts default_configs monitor useradd systemd
  47
  48 SERVICE_TOKEN = "password"
  49 TOKEN_FORMAT ?= "PKI"
  50
  51 USERADD_PACKAGES = "${PN}"
  52 USERADD_PARAM_${PN} = "--system -m -s /bin/false keystone"
  53
  54 LDAP_DN ?= "dc=my-domain,dc=com"
  55
  56 SERVICECREATE_PACKAGES = "${SRCNAME}-setup"
  57 KEYSTONE_HOST="${CONTROLLER_IP}"
  58
  59 # USERCREATE_PARAM and SERVICECREATE_PARAM contain the list of parameters to be
  60 # set.  If the flag for a parameter in the list is not set here, the default
  61 # value will be given to that parameter. Parameters not in the list will be set
  62 # to empty.
  63
  64 USERCREATE_PARAM_${SRCNAME}-setup = "name pass tenant role email"
  65 python () {
  66     flags = {'name':'${ADMIN_USER}',\
  67              'pass':'${ADMIN_PASSWORD}',\
  68              'tenant':'${ADMIN_TENANT}',\
  69              'role':'${ADMIN_ROLE}',\
  70              'email':'${ADMIN_USER_EMAIL}',\
  71             }
  72     d.setVarFlags("USERCREATE_PARAM_%s-setup" % d.getVar('SRCNAME',True), flags)
  73 }
  74
  75 SERVICECREATE_PARAM_${SRCNAME}-setup = "name type description region publicurl adminurl internalurl"
  76 python () {
  77     flags = {'type':'identity',\
  78              'description':'OpenStack Identity',\
  79              'publicurl':"'http://${KEYSTONE_HOST}:8081/keystone/main/v2.0'",\
  80              'adminurl':"'http://${KEYSTONE_HOST}:8081/keystone/admin/v2.0'",\
  81              'internalurl':"'http://${KEYSTONE_HOST}:8081/keystone/main/v2.0'"}
  82     d.setVarFlags("SERVICECREATE_PARAM_%s-setup" % d.getVar('SRCNAME',True), flags)
  83 }
  84
  85 do_install_append() {
  86
  87     KEYSTONE_CONF_DIR=${D}${sysconfdir}/keystone
  88     KEYSTONE_DATA_DIR=${D}${localstatedir}/lib/keystone
  89     KEYSTONE_PACKAGE_DIR=${D}${PYTHON_SITEPACKAGES_DIR}/keystone
  90     APACHE_CONF_DIR=${D}${sysconfdir}/apache2/conf.d/
  91
  92
  93     # Create directories
  94     install -m 755 -d ${KEYSTONE_CONF_DIR}
  95     install -m 755 -d ${KEYSTONE_DATA_DIR}
  96     install -m 755 -d ${APACHE_CONF_DIR}
  97     install -d ${D}${localstatedir}/log/${SRCNAME}
  98
  99     # Setup the systemd service file
 100     install -d ${D}${systemd_system_unitdir}/
 101     install -m 644 ${WORKDIR}/${PN}/keystone-init.service ${D}${systemd_system_unitdir}/keystone-init.service
 102
 103     mv  ${D}/${datadir}/etc/keystone/sso_callback_template.html ${KEYSTONE_CONF_DIR}/
 104     rm -rf ${D}/${datadir}
 105
 106     # Setup the admin-openrc file
 107     KS_OPENRC_FILE=${KEYSTONE_CONF_DIR}/admin-openrc
 108     install -m 600 ${WORKDIR}/${PN}/admin-openrc ${KS_OPENRC_FILE}
 109     sed -e "s:%CONTROLLER_IP%:${CONTROLLER_IP}:g" -i ${KS_OPENRC_FILE}
 110     sed -e "s:%ADMIN_USER%:${ADMIN_USER}:g" -i ${KS_OPENRC_FILE}
 111     sed -e "s:%ADMIN_PASSWORD%:${ADMIN_PASSWORD}:g" -i ${KS_OPENRC_FILE}
 112
 113     # Install various configuration files. We have to select suitable
 114     # permissions as packages such as Apache require read access.
 115     #
 116     # Apache needs to read the keystone.conf
 117     install -m 644 ${WORKDIR}/${PN}/keystone.conf ${KEYSTONE_CONF_DIR}/
 118     # Apache needs to read the wsgi-keystone.conf
 119     install -m 644 ${WORKDIR}/${PN}/wsgi-keystone.conf ${APACHE_CONF_DIR}/keystone.conf
 120     install -m 600 ${S}${sysconfdir}/logging.conf.sample  ${KEYSTONE_CONF_DIR}/logging.conf
 121
 122     # Copy examples from upstream
 123     cp -r ${S}/examples ${KEYSTONE_PACKAGE_DIR}
 124
 125     # Edit the configuration to allow it to work out of the box
 126     KEYSTONE_CONF_FILE=${KEYSTONE_CONF_DIR}/keystone.conf
 127     sed "/# admin_endpoint = .*/a \
 128         public_endpoint = http://%CONTROLLER_IP%:5000/ " \
 129         -i ${KEYSTONE_CONF_FILE}
 130
 131     sed "/# admin_endpoint = .*/a \
 132         admin_endpoint = http://%CONTROLLER_IP%:35357/ " \
 133         -i ${KEYSTONE_CONF_FILE}
 134
 135     sed -e "s:%SERVICE_TOKEN%:${SERVICE_TOKEN}:g" -i ${KEYSTONE_CONF_FILE}
 136     sed -e "s:%DB_USER%:${DB_USER}:g" -i ${KEYSTONE_CONF_FILE}
 137     sed -e "s:%DB_PASSWORD%:${DB_PASSWORD}:g" -i ${KEYSTONE_CONF_FILE}
 138     sed -e "s:%CONTROLLER_IP%:${CONTROLLER_IP}:g" -i ${KEYSTONE_CONF_FILE}
 139     sed -e "s:%CONTROLLER_IP%:${CONTROLLER_IP}:g" -i ${KEYSTONE_CONF_FILE}
 140     sed -e "s:%TOKEN_FORMAT%:${TOKEN_FORMAT}:g" -i ${KEYSTONE_CONF_FILE}
 141
 142     install -d ${KEYSTONE_PACKAGE_DIR}/tests/tmp
 143     if [ -e "${KEYSTONE_PACKAGE_DIR}/tests/test_overrides.conf" ];then
 144         sed -e "s:%KEYSTONE_PACKAGE_DIR%:${PYTHON_SITEPACKAGES_DIR}/keystone:g" \
 145             -i ${KEYSTONE_PACKAGE_DIR}/tests/test_overrides.conf
 146     fi
 147
 148     if ${@bb.utils.contains('DISTRO_FEATURES', 'OpenLDAP', 'true', 'false', d)};
 149     then
 150         sed -i -e '/^\[identity\]/a \
 151 driver = keystone.identity.backends.hybrid_identity.Identity \
 152 \
 153 [assignment]\
 154 driver = keystone.assignment.backends.hybrid_assignment.Assignment\
 155 ' ${D}${sysconfdir}/keystone/keystone.conf
 156
 157         sed -i -e '/^\[ldap\]/a \
 158 url = ldap://localhost \
 159 user = cn=Manager,${LDAP_DN} \
 160 password = secret \
 161 suffix = ${LDAP_DN} \
 162 use_dumb_member = True \
 163 \
 164 user_tree_dn = ou=Users,${LDAP_DN} \
 165 user_attribute_ignore = enabled,email,tenants,default_project_id \
 166 user_id_attribute = uid \
 167 user_name_attribute = uid \
 168 user_mail_attribute = email \
 169 user_pass_attribute = keystonePassword \
 170 \
 171 tenant_tree_dn = ou=Groups,${LDAP_DN} \
 172 tenant_desc_attribute = description \
 173 tenant_domain_id_attribute = businessCategory \
 174 tenant_attribute_ignore = enabled \
 175 tenant_objectclass = groupOfNames \
 176 tenant_id_attribute = cn \
 177 tenant_member_attribute = member \
 178 tenant_name_attribute = ou \
 179 \
 180 role_attribute_ignore = enabled \
 181 role_objectclass = groupOfNames \
 182 role_member_attribute = member \
 183 role_id_attribute = cn \
 184 role_name_attribute = ou \
 185 role_tree_dn = ou=Roles,${LDAP_DN} \
 186 ' ${KEYSTONE_CONF_FILE}
 187
 188         install -m 0755 ${WORKDIR}/${PN}/convert_keystone_backend.py \
 189             ${D}${sysconfdir}/keystone/convert_keystone_backend.py
 190     fi
 191
 192
 193     install -m 755 ${WORKDIR}/${PN}/stx-files/keystone-fernet-keys-rotate-active ${D}/${bindir}/keystone-fernet-keys-rotate-active
 194     install -m 440 ${WORKDIR}/${PN}/stx-files/password-rules.conf ${KEYSTONE_CONF_DIR}/password-rules.conf
 195     install -m 755 ${WORKDIR}/${PN}/stx-files/public.py ${KEYSTONE_DATA_DIR}/public.py
 196     install -m 644 ${WORKDIR}/${PN}/stx-files/openstack-keystone.service ${D}${systemd_system_unitdir}/openstack-keystone.service
 197     install -m 755 ${WORKDIR}/${PN}/stx-files/keystone-all ${D}${bindir}/keystone-all
 198
 199 }
 200
 201 # By default tokens are expired after 1 day so by default we can set
 202 # this token flush cronjob to run every 2 days
 203 KEYSTONE_TOKEN_FLUSH_TIME ??= "0 0 */2 * *"
 204
 205 pkg_postinst_${SRCNAME}-cronjobs () {
 206     if [ -z "$D" ]; then
 207         # By default keystone expired tokens are not automatic removed out of the
 208         # database.  So we create a cronjob for cleaning these expired tokens.
 209         echo "${KEYSTONE_TOKEN_FLUSH_TIME} root /usr/bin/keystone-manage token_flush" >> /etc/crontab
 210     fi
 211 }
 212
 213 pkg_postinst_${SRCNAME} () {
 214     # openstak-keystone will be run in httpd/apache2 instead of standalone
 215     ln -sf ${systemd_system_unitdir}/apache2.service $D${sysconfdir}/systemd/system/openstack-keystone.service
 216 }
 217
 218 PACKAGES += " ${SRCNAME}-tests ${SRCNAME} ${SRCNAME}-setup ${SRCNAME}-cronjobs"
 219
 220 SYSTEMD_PACKAGES += "${SRCNAME}-setup"
 221 SYSTEMD_SERVICE_${SRCNAME}-setup = "keystone-init.service"
 222 SYSTEMD_SERVICE_${SRCNAME} = "openstack-keystone.service"
 223
 224 SYSTEMD_AUTO_ENABLE_${SRCNAME}-setup = "disable"
 225 SYSTEMD_AUTO_ENABLE_${SRCNAME} = "disable"
 226
 227 FILES_${SRCNAME}-setup = " \
 228     ${systemd_system_unitdir}/keystone-init.service \
 229     "
 230
 231 ALLOW_EMPTY_${SRCNAME}-cronjobs = "1"
 232
 233 FILES_${PN} = "${libdir}/* \
 234     "
 235
 236 FILES_${SRCNAME}-tests = "${sysconfdir}/${SRCNAME}/run_tests.sh"
 237
 238 FILES_${SRCNAME} = "${bindir}/* \
 239     ${sysconfdir}/${SRCNAME}/* \
 240     ${localstatedir}/* \
 241     ${datadir}/openstack-dashboard/openstack_dashboard/api/keystone-httpd.py \
 242     ${sysconfdir}/apache2/conf.d/keystone.conf \
 243     ${systemd_system_unitdir}/openstack-keystone.service \
 244     "
 245
 246 DEPENDS += " \
 247         python-pip \
 248         python-pbr-native \
 249         "
 250
 251 # Satisfy setup.py 'setup_requires'
 252 DEPENDS += " \
 253         python-pbr-native \
 254         "
 255
 256 RDEPENDS_${PN} += " \
 257         python-babel \
 258         python-pbr \
 259         python-webob \
 260         python-pastedeploy \
 261         python-paste \
 262         python-routes \
 263         python-cryptography \
 264         python-six \
 265         python-sqlalchemy \
 266         python-sqlalchemy-migrate \
 267         python-stevedore \
 268         python-passlib \
 269         python-keystoneclient \
 270         python-keystonemiddleware \
 271         python-bcrypt \
 272         python-scrypt \
 273         python-oslo.cache \
 274         python-oslo.concurrency \
 275         python-oslo.config \
 276         python-oslo.context \
 277         python-oslo.messaging \
 278         python-oslo.db \
 279         python-oslo.i18n \
 280         python-oslo.log \
 281         python-oslo.middleware \
 282         python-oslo.policy \
 283         python-oslo.serialization \
 284         python-oslo.utils \
 285         python-oauthlib \
 286         python-pysaml2 \
 287         python-dogpile.cache \
 288         python-jsonschema \
 289         python-pycadf \
 290         python-msgpack \
 291         python-osprofiler \
 292         python-flask \
 293         python-flask-restful \
 294         python-pytz \
 295         "
 296
 297 RDEPENDS_${SRCNAME}-tests += " bash"
 298
 299 PACKAGECONFIG ?= "${@bb.utils.contains('DISTRO_FEATURES', 'OpenLDAP', 'OpenLDAP', '', d)}"
 300 PACKAGECONFIG[OpenLDAP] = ",,,python-ldap python-keystone-hybrid-backend"
 301
 302 # TODO:
 303 #    if DISTRO_FEATURE contains "tempest" then add *-tests to the main RDEPENDS
 304
 305 RDEPENDS_${SRCNAME} = " \
 306     ${PN} \
 307     postgresql \
 308     postgresql-client \
 309     python-psycopg2 \
 310     apache2 \
 311     "
 312
 313 RDEPENDS_${SRCNAME}-setup = "postgresql sudo ${SRCNAME}"
 314 RDEPENDS_${SRCNAME}-cronjobs = "cronie ${SRCNAME}"
 315
 316 MONITOR_SERVICE_PACKAGES = "${SRCNAME}"
 317 MONITOR_SERVICE_${SRCNAME} = "keystone"