Comment 16 for bug 1475091

Puppet Openstack cannot use trusts unless something is done.

Because when Puppet runs as a daemon, which is mostly the case in production, then every time the puppet catalog would be executed, all the trusts declared in the catalog will created (added), an infinity of trusts is going to be there very quickly, this is not acceptable for puppet users. This is basically breaking idem-potency rules where the same state is guaranteed.

BTW, Puppet initial need for trusts is to configure heat properly.

A Puppet manifest example:

keystone_trust {'adminv3 trust for user1':
  trustor => 'adminv3::admin_domain',
  trustee => 'user1::admin_domain',
  project => 'openstackv3::admin_domain',
  roles => ['admin'],
  impersonate => true,
  ensure => present
}

Because a trust is unique only by its ID, everytime the latter is executed, a new trust to be created.
Effectively, several trusts with the same properties can exists:

  $ trust create adminv3 user1 --role admin --project openstackv3 -f shell
  deleted_at="None"
  expires_at="None"
  id="00cf1f149fd0463994ad62ec0939ec71"
  impersonation="False"
  project_id="cf31bbe1ab4e4135a83b1b923d733b0d"
  redelegation_count="0"
  remaining_uses="None"
  roles="admin"
  trustee_user_id="e057d0ac9c394f5c833c6a746d76bc17"
  trustor_user_id="b0fa819e150a4005a10ebdfc9d1b97d4"

  $ trust create adminv3 user1 --role admin --project openstackv3 -f shell
  deleted_at="None"
  expires_at="None"
  id="0ae2d20042d6418b8f3b8832ab43360e"
  impersonation="False"
  project_id="cf31bbe1ab4e4135a83b1b923d733b0d"
  redelegation_count="0"
  remaining_uses="None"
  roles="admin"
  trustee_user_id="e057d0ac9c394f5c833c6a746d76bc17"
  trustor_user_id="b0fa819e150a4005a10ebdfc9d1b97d4"

$ openstack trust list -f csv
"ID","Expires At","Impersonation","Project ID","Trustee User ID","Trustor User ID"
  "00cf1f149fd0463994ad62ec0939ec71","",False,"cf31bbe1ab4e4135a83b1b923d733b0d","e057d0ac9c394f5c833c6a746d76bc17","b0fa819e150a4005a10ebdfc9d1b97d4"
  "0ae2d20042d6418b8f3b8832ab43360e","",False,"cf31bbe1ab4e4135a83b1b923d733b0d","e057d0ac9c394f5c833c6a746d76bc17","b0fa819e150a4005a10ebdfc9d1b97d4"

$ openstack trust show 00cf1f149fd0463994ad62ec0939ec71 -f shell
deleted_at="None"
expires_at="None"
id="00cf1f149fd0463994ad62ec0939ec71"
impersonation="False"
project_id="cf31bbe1ab4e4135a83b1b923d733b0d"
redelegation_count="0"
remaining_uses="None"
roles="admin"
trustee_user_id="e057d0ac9c394f5c833c6a746d76bc17"
trustor_user_id="b0fa819e150a4005a10ebdfc9d1b97d4"

$ openstack trust show 0ae2d20042d6418b8f3b8832ab43360e -f shell
deleted_at="None"
expires_at="None"
id="0ae2d20042d6418b8f3b8832ab43360e"
impersonation="False"
project_id="cf31bbe1ab4e4135a83b1b923d733b0d"
redelegation_count="0"
remaining_uses="None"
roles="admin"
trustee_user_id="e057d0ac9c394f5c833c6a746d76bc17"
trustor_user_id="b0fa819e150a4005a10ebdfc9d1b97d4"