File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/states/__pycache__/keystone.cpython-310.pyc
o
�N�gk � @ s� d Z dd� Zdadad!dd�Z d"d d
�Zd!d d �Z d#d
d�Zd!dd�Z d#dd�Z d!dd�Z
d!dd�Z d!dd�Z d$dd�Z
d!dd �Z d%d d �Zd&d d �ZdS )'a�
Management of Keystone users
============================
:depends: - keystoneclient Python module
:configuration: See :py:mod:`salt.modules.keystone` for setup instructions.
.. code-block:: yaml
Keystone tenants:
keystone.tenant_present:
- names:
- admin
- demo
- service
Keystone roles:
keystone.role_present:
- names:
- admin
- Member
admin:
keystone.user_present:
- password: R00T_4CC3SS
- email: admin@domain.com
- roles:
admin: # tenants
- admin # roles
service:
- admin
- Member
- require:
- keystone: Keystone tenants
- keystone: Keystone roles
nova:
keystone.user_present:
- password: '$up3rn0v4'
- email: nova@domain.com
- tenant: service
- roles:
service:
- admin
- require:
- keystone: Keystone tenants
- keystone: Keystone roles
demo:
keystone.user_present:
- password: 'd3m0n$trati0n'
- email: demo@domain.com
- tenant: demo
- roles:
demo:
- Member
- require:
- keystone: Keystone tenants
- keystone: Keystone roles
nova service:
keystone.service_present:
- name: nova
- service_type: compute
- description: OpenStack Compute Service
c C s dt v rdS dS )z9
Only load if the keystone module is in __salt__
z
keystone.authZkeystone)Fz#keystone module could not be loaded)�__salt__� r r �H/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/keystone.py� __virtual__F s r � � tenant_idNc K sN z t td dd| i|���d��dkrdadaW dS W dS ty& Y dS w )ze
Sets global variables _OS_IDENTITY_API_VERSION and _TENANT_ID
depending on API version.
zkeystone.api_version�profile�v� Z
project_idNr )�floatr �strip�
_TENANT_ID�_OS_IDENTITY_API_VERSION�KeyError)r �connection_argsr r r � _api_versionS s"
����
� �r Tc K s | i dd| � d�d�}
t d9d|i| �� |r|s|}|durCtd d9||d�| ��} d | v r<d
|
d < d |� d
�|
d< |
S | | d } nd} td d9| |d�| ��}
d |
v�r6d
}d
}d
}d
}|
| �dd�|krjd}|
| �dd�|krvd}|r�t|
| vs�|
| �td�| kr�d}|du r�td d9| ||d�| ��s�d}t�d�r�|s�|s�|s�|r�d|
d < d| � d�|
d< |du r�d|
d d< |du r�d|
d d< |du r�d|� d �|
d d < |du r�d|
d d < |
S d| � d �|
d< |�r
td d9| ||d!�| �� d| � d"�|
d< d#|
d d< |�r+td d9| ||d$�| �� d| � d"�|
d< d%|� �|
d d< |�rMtd d9| ||d&�| �� d| � d"�|
d< d'|� d �|
d d < |�rktd( d9| ||d�| �� d| � d"�|
d< d#|
d d < |�r4|D ]�}t| ||d)�fi | ��}td* d9i |��}|| D ]N}||v�r�t�d��r�d|
d < d+�| �|
d< |
S t| |||d,�fi | ��}td- d9i |��}d.|
d v �r�|
d d. �|� �q�|g|
d d.< �q�tt |�t || � �}|D ]I}t�d��rd|
d < d+�| �|
d< |
S t| |||d,�fi | ��}td/ d9i |��}d.|
d v �r)|
d d. �|� �q�|g|
d d.< �q�qp|
S t�d��rPd|
d < d0| � d1�|
d< d2|
d d3< |
S td4 d9| ||| ||d5�| �� |�r|D ]}|| D ]}td- d9| |||d,�| �� �qk�qed6| � d7�|
d< d8|
d d3< |
S ):a�
Ensure that the keystone user is present with the specified properties.
name
The name of the user to manage
password
The password to use for this user.
.. note::
If the user already exists and a different password was set for
the user than the one specified here, the password for the user
will be updated. Please set the ``password_reset`` option to
``False`` if this is not the desired behavior.
password_reset
Whether or not to reset password after initial set. Defaults to
``True``.
email
The email address for this user
tenant
The tenant (name) for this user
project
The project (name) for this user (overrides tenant in api v3)
enabled
Availability state for this user
roles
The roles the user should have under given tenants.
Passed as a dictionary mapping tenant names to a list
of roles in this tenant, i.e.::
roles:
admin: # tenant
- admin # role
service:
- admin
- Member
T�User "�" will be updated��name�changes�result�commentr N�keystone.tenant_get�r r �ErrorFr �Tenant / project "z" does not existr �id�keystone.user_get�email�enabledz keystone.user_verify_password)r �passwordr �test�Will be updatedr ZEmailz Will be True�EnabledzWill be added to "z" tenant�TenantZPasswordz" is already presentzkeystone.user_update)r r r �" has been updated�Updated)r r r �Now )r �tenantr z
Added to "z keystone.user_password_update)Z user_nameZ tenant_namer zkeystone.user_role_listz!User roles "{}" will been updated)�user�roler( r zkeystone.user_role_add�roleszkeystone.user_role_removezKeystone user "�" will be added�Will be created�Userzkeystone.user_create)r r r r r r zKeystone user z has been added�Createdr )
r r �getr �__opts__�dict�format�append�list�set)r r r r( r r+ r Zpassword_resetZprojectr �retZ
tenantdatar r) Z change_emailZchange_enabledZ
change_tenantZchange_password�argsZ tenant_rolesr* ZaddargsZnewroleZroles_to_removeZoldroler r r � user_presenti s` 9
���
��
���� �� ������
��
� ��� � � ��� �2 � �� �
�� r9 c K � | i dd| � d�d�}t d d| |d�|��}d|vrHt�d�r.d |d
< d| � d �|d < |S t d
d| |d�|�� d| � d�|d < d|d d< |S )zo
Ensure that the keystone user is absent.
name
The name of the user that should not exist
Tr �" is already absentr r r r r! Nr �" will be deletedr zkeystone.user_delete�" has been deleted�Deletedr r. r �r r1 r0 )r r r r7 r) r r r � user_absentT �
�
r@ c K s� | i dd| � d�d�}t d%d|i|�� td d%| |d�|��}d|vr�|| �d d
�|krct�d �rGd
|d < d| � d
�|d< d|d d< |S td d%| |||d�|�� d| � d�|d< d|d d< || �dd
�|kr�t�d �r�d
|d < d| � d
�|d< d|� �|d d< |S td d%| |||d�|�� d| � d�|d< d|� �|d d< |S t�d �r�d
|d < d| � d�|d< d|d d < |S td kr�td d%| d |||d �|��}ntd! d%| |||d�|��}|du r�d"nd#|d d < ||d < d| � d$�|d< |S )&z�
Ensures that the keystone tenant exists
name
The name of the tenant to manage
description
The description to use for this tenant
enabled
Availability state for this tenant
Tr �" already existsr r r r r � descriptionNr! r r r r" r Z Descriptionzkeystone.tenant_update)r rC r r r% r& r zWill be r# r' r, r- r$ r zkeystone.project_create�default)r �domainrC r r zkeystone.tenant_creater/ ZFailed�" has been addedr )r r r0 r1 r
)r rC r r r r7 r( �createdr r r �tenant_presentq s�
���
��
��
� �� ��rH c K r: )zs
Ensure that the keystone tenant is absent.
name
The name of the tenant that should not exist
Tr r; r r r r r! Nr r< r zkeystone.tenant_deleter= r> r zTenant/Projectr r? )r r r r7 r( r r r �
tenant_absent� �.
���
�� rI c K s t | f|||d�|��S )a�
Ensures that the keystone project exists
Alias for tenant_present from V2 API to fulfill
V3 API naming convention.
.. versionadded:: 2016.11.0
name
The name of the project to manage
description
The description to use for this project
enabled
Availability state for this project
.. code-block:: yaml
nova:
keystone.project_present:
- enabled: True
- description: 'Nova Compute Service'
)rC r r )rH )r rC r r r r r r �project_present� s ���rK c K s t | fd|i|��S )aY
Ensure that the keystone project is absent.
Alias for tenant_absent from V2 API to fulfill
V3 API naming convention.
.. versionadded:: 2016.11.0
name
The name of the project that should not exist
.. code-block:: yaml
delete_nova:
keystone.project_absent:
- name: nova
r )rI )r r r r r r �project_absent s rL c K s� | i dd| � d�d�}t d d| |d�|��}d|vr |S t�d�r0d |d
< d| � d �|d < |S t d
| fd|i|�� d| � d�|d < d|d d< |S )zn'
Ensures that the keystone role exists
name
The name of the role that should be present
T�Role "rB r �keystone.role_getr r r! Nr r, r zkeystone.role_creater rF r/ r �Roler r? �r r r r7 r* r r r � role_present& s
�
rQ c K r: )zo
Ensure that the keystone role is absent.
name
The name of the role that should not exist
TrM r; r rN r r r! Nr r< r zkeystone.role_deleter= r> r rO r r? rP r r r � role_absentE rA rR c K s� | i dd| � d�d�}t d d| |d�|��}d|vr |S t�d�r0d |d
< d| � d �|d < |S t d
| ||fd|i|�� d| � d�|d < d|d d< |S )z�
Ensure service present in Keystone catalog
name
The name of the service
service_type
The type of Openstack Service
description (optional)
Description of the service
T� Service "rB r �keystone.service_getr r r! Nr r, r zkeystone.service_creater rF r/ r �Servicer r? )r Z service_typerC r r r7 r* r r r �service_presentb s4
���
��� rV c K r: )z�
Ensure that the service doesn't exist in Keystone catalog
name
The name of the service that should not exist
TrS r; r rT r r r! Nr r< r zkeystone.service_deleter= r> r rU r r? rP r r r �service_absent� rJ rW c
s( �i ddd��t d(d�i��� td ��f��d����} �fdd�}
� ��������� f
d d
�} | �r^d | v�r^| �d ��k�r^td
kr�d} d}
| �dd�� krc|
d�| �dd�� ���d< d} | �dd��kr{|
d�| �dd�����d< d}
t�d�r�| s�|
r�d�d< d�d d< �d d���7 < �S | r�� �d d< |
r���d d< n�d}d}d}| �dd��kr�d}|
d �| �dd�����d< | �d d�� kr�d}|
d �| �d d�� ���d< | �d d��kr�d}|
d �| �d d�����d< t�d��r |�s |�s |�r d�d< �d d���7 < d�d d< �S |�r)��d d< |�r2� �d d < |�r;��d d < �d �r]td! ��f��d���� | � �d d"�� d#�7 < n%t�d��rxd�d< d$�d d< d"�� d%��d< �S | � d"�� d&��d< �d dk�r�d"�� d'��d< �S ))a
Ensure the specified endpoints exists for service
name
The Service name
publicurl
The public url of service endpoint (for V2 API)
internalurl
The internal url of service endpoint (for V2 API)
adminurl
The admin url of the service endpoint (for V2 API)
region
The region of the endpoint
url
The endpoint URL (for V3 API)
interface
The interface type, which describes the visibility
of the endpoint. (for V3 API)
T� r r �keystone.endpoint_get�r � interfacec s � � dd�| d S )Nr rX �
)r0 )�desc)r7 r r �_changes� s z"endpoint_present.<locals>._changesc sV t dkrtd �f�� ��d�����d< d S td �f��� ��d�����d< d S )Nr zkeystone.endpoint_create)�region�urlr[ r r )r_ � publicurl�adminurl� internalurlr )r
r r �
rb r r[ rc r r ra r_ r7 r` r r �_create_endpoint� s, ��� ���z*endpoint_present.<locals>._create_endpointr r_ r Fr` Nz URL changes from "{}" to "{}"r r[ z#Interface changes from "{}" to "{}"r! r r" r ZEndpointz)Endpoint for service "{}" will be updatedra z$Public URL changes from "{}" to "{}"rb z#Admin URL changes from "{}" to "{}"rc z&Internal URL changes from "{}" to "{}"�keystone.endpoint_delete�Endpoint for service "r% r- r, rF rB r )r r r0 r
r3 r1 )r ra rc rb r_ r r` r[ r �endpointr^ re Z
change_urlZchange_interfaceZchange_publicurlZchange_adminurlZchange_internalurlr rd r �endpoint_present� s� %��� �� �� � � �� �� �� ��� �
���� ri c K s� | i dd� | |durd|� d�nd�d�}td | |f||d �|��}|s'|S t�d
�r:d|d < d | � d
�|d< |S td | |f||d �|�� d� | |durUd|� d�nd�|d< d|d d< |S )ad
Ensure that the endpoint for a service doesn't exist in Keystone catalog
name
The name of the service whose endpoints should not exist
region (optional)
The region of the endpoint. Defaults to ``RegionOne``.
interface
The interface type, which describes the visibility
of the endpoint. (for V3 API)
Tz-Endpoint for service "{}"{} is already absentNz
, interface "z",rX r rY rZ r! r rg r< r rf z,Endpoint for service "{}"{} has been deletedr> r rh )r3 r r1 r0 )r r_ r r[ r r7 rh r r r �endpoint_absent` sD �� ���
���� rj )N)NTNNTN)NTN)NN)NNNNNNN)NNN)�__doc__r r
r r r9 r@ rH rI rK rL rQ rR rV rW ri rj r r r r �<module> sF E
�
l
�
Z"
�
%
�
,#
� 2