Murano Engine uses keystone_authtoken configuration section

[Alexander Tivelkov]

Murano engine needs to authenticate in Keystone using some service user. It is used to create/remove trusts, list available services in service catalog etc.

This requires appropriate connectivity configuration: identity uri, credentials of service user, project, domain etc.

Currently murano uses [keystone_authtoken] configuration section to read this options, which is technically incorrect: that configuration is intended to be used only to validate the token at WSGI middleware, not for everything else.

This leads to a) inability to fine-tune role-based privileges for service-user going to execute trust-delegated tasks
b) implicit dependency of murano engine on the implementation details of keystonemiddleware and its plugins: if the middleware deprecates one of its configuration properties, Murano engine won't be able to maintain backwards compatibility with its config.

[Dr. Jens Harbott (j-harbott)]

Any chance of progress here? We will not be able to deploy Murano unless it supports identity-v3-only and tls-proxy, see related bug https://launchpad.net/bugs/1658648.

Btw., having backwards compatible config files seems like a pretty strange goal to me, never seen that in any other OpenStack project.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/450671
Committed: https://git.openstack.org/cgit/openstack/murano/commit/?id=75b47bbabd876bca80a9c08e82112f0935bbbf5b
Submitter: Jenkins
Branch: master

commit 75b47bbabd876bca80a9c08e82112f0935bbbf5b
Author: zhurong <email address hidden>
Date: Tue Mar 28 17:19:08 2017 +0800

    Make murano auth with murano_auth section instend of keystone_authtoken

    This patch add a murano_auth for murano auth with keystone,
    This gives ability to fine-tune role-based privileges for
    service-user going to execute trust-delegated tasks and the auth
    configuration properties do not need to change when keystonemiddleware
    deprecates its configuration properties.

    Closes-Bug: #1643583
    Closes-Bug: #1658648
    Change-Id: If10fa8c938c264c7b5cadb3c3ed77f39488dcab7

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/murano 4.0.0.0b2 development milestone.