Skip to content

Commit 767ea1e

Browse files
xekxek
committed
Add OIDC federation configuration on OSP17
The new configuration will be used to test OIDC adoption.
1 parent 423b9b6 commit 767ea1e

File tree

4 files changed

+135
-0
lines changed

4 files changed

+135
-0
lines changed

‎hooks/playbooks/federation-osp17-pre-deploy.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
- name: Configure OSP 17.1 for OIDC federation (render env + Keystone setup)
3+
hosts: "{{ cifmw_target_host | default('localhost') }}"
4+
gather_facts: true
5+
vars:
6+
_cloud_name: "{{ cifmw_adoption_osp_deploy_scenario.stacks[0].stackname | default('overcloud') }}"
7+
tasks:
8+
- name: Set urls for install type uni
9+
ansible.builtin.set_fact:
10+
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps.ocp.openstack.lab'
11+
when: cifmw_federation_deploy_type == "uni"
12+
13+
- name: Set urls for install type crc
14+
ansible.builtin.set_fact:
15+
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps-crc.testing'
16+
when: cifmw_federation_deploy_type == "crc"
17+
18+
- name: OSP 17.1 OIDC setup via federation role
19+
ansible.builtin.import_role:
20+
name: federation
21+
tasks_from: run_osp17_oidc_setup.yml
22+
23+

‎roles/adoption_osp_deploy/tasks/deploy_overcloud.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,12 @@
6262
dest: "{{ _private_overcloud_conf_file }}"
6363
mode: "0644"
6464

65+
- name: Check if OIDC federation env file exists
66+
delegate_to: "osp-undercloud-0"
67+
ansible.builtin.stat:
68+
path: "{{ ansible_user_dir }}/enable-federation-openidc.yaml"
69+
register: _oidc_env_stat
70+
6571
- name: Run overcloud deploy
6672
delegate_to: "osp-undercloud-0"
6773
vars:
@@ -72,6 +78,7 @@
7278
--roles-file {{ _roles_file_dest }}
7379
-n {{ _network_data_file_dest }}
7480
--ntp-server {{ cifmw_adoption_osp_deploy_ntp_server }}
81+
{{ _oidc_env_stat.stat.exists | ternary('-e ' ~ ansible_user_dir ~ '/enable-federation-openidc.yaml', '') }}
7582
-e {{ _overcloud_vars }}
7683
-e {{ ansible_user_dir }}/containers-prepare-parameters.yaml
7784
-e {{ ansible_user_dir }}/config_download_{{ _overcloud_name }}.yaml

‎roles/federation/tasks/run_osp17_oidc_setup.yml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
---
2+
- name: Render enable-federation-openidc.yaml to undercloud
3+
delegate_to: osp-undercloud-0
4+
ansible.builtin.template:
5+
src: "enable-federation-openidc.yaml.j2"
6+
dest: "{{ ansible_user_dir }}/enable-federation-openidc.yaml"
7+
mode: "0644"
8+
9+
- name: Create federation mapping file on undercloud
10+
delegate_to: osp-undercloud-0
11+
ansible.builtin.copy:
12+
dest: "{{ ansible_user_dir }}/mapping.json"
13+
mode: "0644"
14+
content: |
15+
[
16+
{
17+
"local": [
18+
{
19+
"user": {"name": "{0}"},
20+
"group": {
21+
"domain": {"name": "{{ cifmw_federation_domain }}"},
22+
"name": "{{ cifmw_federation_group_name }}"
23+
}
24+
}
25+
],
26+
"remote": [
27+
{"type": "OIDC-preferred_username"}
28+
]
29+
}
30+
]
31+
32+
- name: Ensure federation domain exists (OSP 17.1)
33+
delegate_to: osp-undercloud-0
34+
environment:
35+
OS_CLOUD: "{{ cifmw_adoption_osp_deploy_scenario.stacks[0].stackname | default('overcloud') }}"
36+
ansible.builtin.shell: |
37+
set -e
38+
openstack domain show {{ cifmw_federation_domain }} >/dev/null 2>&1 || \
39+
openstack domain create {{ cifmw_federation_domain }}
40+
41+
- name: Ensure identity provider exists (OSP 17.1)
42+
delegate_to: osp-undercloud-0
43+
environment:
44+
OS_CLOUD: "{{ cifmw_adoption_osp_deploy_scenario.stacks[0].stackname | default('overcloud') }}"
45+
ansible.builtin.shell: |
46+
set -e
47+
IDP_URL="{{ cifmw_federation_keycloak_url }}/auth/realms/{{ cifmw_federation_keycloak_realm }}"
48+
openstack identity provider show {{ cifmw_federation_IdpName }} >/dev/null 2>&1 || \
49+
openstack identity provider create --remote-id ${IDP_URL} --domain {{ cifmw_federation_domain }} {{ cifmw_federation_IdpName }}
50+
51+
- name: Ensure mapping exists (OSP 17.1)
52+
delegate_to: osp-undercloud-0
53+
environment:
54+
OS_CLOUD: "{{ cifmw_adoption_osp_deploy_scenario.stacks[0].stackname | default('overcloud') }}"
55+
ansible.builtin.shell: |
56+
set -e
57+
openstack mapping show {{ cifmw_federation_mapping_name }} >/dev/null 2>&1 || \
58+
openstack mapping create --rules {{ ansible_user_dir }}/mapping.json {{ cifmw_federation_mapping_name }}
59+
60+
- name: Ensure federated group exists (OSP 17.1)
61+
delegate_to: osp-undercloud-0
62+
environment:
63+
OS_CLOUD: "{{ cifmw_adoption_osp_deploy_scenario.stacks[0].stackname | default('overcloud') }}"
64+
ansible.builtin.shell: |
65+
set -e
66+
openstack group show {{ cifmw_federation_group_name }} --domain {{ cifmw_federation_domain }} >/dev/null 2>&1 || \
67+
openstack group create --domain {{ cifmw_federation_domain }} {{ cifmw_federation_group_name }}
68+
69+
- name: Ensure project exists (OSP 17.1)
70+
delegate_to: osp-undercloud-0
71+
environment:
72+
OS_CLOUD: "{{ cifmw_adoption_osp_deploy_scenario.stacks[0].stackname | default('overcloud') }}"
73+
ansible.builtin.shell: |
74+
set -e
75+
openstack project show {{ cifmw_federation_project_name }} --domain {{ cifmw_federation_domain }} >/dev/null 2>&1 || \
76+
openstack project create --domain {{ cifmw_federation_domain }} {{ cifmw_federation_project_name }}
77+
78+
- name: Ensure role binding exists (OSP 17.1)
79+
delegate_to: osp-undercloud-0
80+
environment:
81+
OS_CLOUD: "{{ cifmw_adoption_osp_deploy_scenario.stacks[0].stackname | default('overcloud') }}"
82+
ansible.builtin.shell: |
83+
set -e
84+
openstack role add --group {{ cifmw_federation_group_name }} --group-domain {{ cifmw_federation_domain }} --project {{ cifmw_federation_project_name }} --project-domain {{ cifmw_federation_domain }} member || true
85+
86+
- name: Ensure federation protocol exists (OSP 17.1)
87+
delegate_to: osp-undercloud-0
88+
environment:
89+
OS_CLOUD: "{{ cifmw_adoption_osp_deploy_scenario.stacks[0].stackname | default('overcloud') }}"
90+
ansible.builtin.shell: |
91+
set -e
92+
openstack federation protocol show openid --identity-provider {{ cifmw_federation_IdpName }} >/dev/null 2>&1 || \
93+
openstack federation protocol create openid --mapping {{ cifmw_federation_mapping_name }} --identity-provider {{ cifmw_federation_IdpName }}
94+
95+

‎roles/federation/templates/enable-federation-openidc.yaml.j2‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
parameter_defaults:
2+
KeystoneAuthMethods: password,token,oauth1,mapped,application_credential,openid
3+
KeystoneOpenIdcClientId: {{ cifmw_keystone_OIDC_ClientID | quote }}
4+
KeystoneOpenIdcClientSecret: {{ cifmw_keystone_OIDC_ClientSecret | quote }}
5+
KeystoneOpenIdcCryptoPassphrase: {{ cifmw_keystone_OIDC_CryptoPassphrase | default('openstack') | quote }}
6+
KeystoneOpenIdcIdpName: {{ cifmw_keystone_OIDC_provider_name | default('kcIDP') | quote }}
7+
KeystoneOpenIdcIntrospectionEndpoint: {{ cifmw_keystone_OIDC_OAuthIntrospectionEndpoint | quote }}
8+
KeystoneOpenIdcProviderMetadataUrl: {{ cifmw_keystone_OIDC_ProviderMetadataURL | quote }}
9+
KeystoneOpenIdcRemoteIdAttribute: HTTP_OIDC_ISS
10+

0 commit comments

Comments
 (0)