ceph-rgw should not use the keystone admin token

Bug #1642524 reported by Giulio Fidente on 2016-11-17
18
This bug affects 2 people
Affects Status Importance Assigned to Milestone
tripleo
High
Emilien Macchi

Bug Description

Currently the ceph-rgw service is given access to keystone via admin token, this is insecure and will be deprecated. We should migrate the ceph-rgw config to use keystone v3 instead.

Changed in tripleo:
milestone: none → ocata-2
Changed in tripleo:
assignee: nobody → Keith Schincke (keith-schincke)
Keith Schincke (keith-schincke) wrote :

puppet-ceph provides needed support for this request.
tht and puppet-tripleo need to be updated to provide support for new feature.

Changed in tripleo:
assignee: Keith Schincke (keith-schincke) → Emilien Macchi (emilienm)
status: Confirmed → In Progress

Reviewed: https://review.openstack.org/405429
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=f33475840c871f4fc6f638577e25733d60dba94a
Submitter: Jenkins
Branch: master

commit f33475840c871f4fc6f638577e25733d60dba94a
Author: Emilien Macchi <email address hidden>
Date: Thu Dec 1 10:00:18 2016 -0500

    ceph-rgw: add missing user parameter

    'user' is required or puppet-ceph will complain that the Keystone_user
    has no title:
    Evaluation Error: Missing title. The title expression resulted in undef
    at /etc/puppet/modules/ceph/manifests/rgw/keystone/auth.pp

    The value is set to Swift, as we use the same credentials as Swift
    service.

    Closes-Bug: #1642524
    Change-Id: Ib4a7c07086b0b3354c8e589612f330ecdffdc637

Changed in tripleo:
status: In Progress → Fix Released

This issue was fixed in the openstack/tripleo-heat-templates 6.0.0.0b2 development milestone.

Reviewed: https://review.openstack.org/423526
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=c705c5fa9b0b8136e1129ccd8815e0dcfc0b1e22
Submitter: Jenkins
Branch: stable/newton

commit c705c5fa9b0b8136e1129ccd8815e0dcfc0b1e22
Author: Emilien Macchi <email address hidden>
Date: Thu Dec 1 10:00:18 2016 -0500

    ceph-rgw: add missing user parameter

    'user' is required or puppet-ceph will complain that the Keystone_user
    has no title:
    Evaluation Error: Missing title. The title expression resulted in undef
    at /etc/puppet/modules/ceph/manifests/rgw/keystone/auth.pp

    The value is set to Swift, as we use the same credentials as Swift
    service.

    Closes-Bug: #1642524
    Change-Id: Ib4a7c07086b0b3354c8e589612f330ecdffdc637
    (cherry picked from commit f33475840c871f4fc6f638577e25733d60dba94a)

tags: added: in-stable-newton

This issue was fixed in the openstack/tripleo-heat-templates 5.3.0 release.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers