Steven Hardy [Mon, 2 Sep 2013 15:32:40 +0000 (16:32 +0100)]
Migrate stored credentials to keystone trusts
Migrate the stored user_creds, which currently only supports
storing username/password credentials to use the keystone v3
API OS-TRUST extension, which allows explicit impersonation of
users calling heat (trustors) by the heat service user (the
trustee)
Note this feature is made optional via a new config option,
defaulted to off, and it requires the following patches to
keystoneclient (in 0.3.2 release) and keystone to work:
Also note that if the feature is enabled, by setting
deferred_auth_method=trusts in heat.conf, you must add
a keystone_authtoken section, which is also used by the
keystoneclient auth_token middleware.
When getting a database record by ID, it is much more efficient to get() it
directly than to perform a query or the database to obtain the ID (again)
and then get it.
Since stack_get() returns only a single record that can be trivially
checked for deletion in code, do this rather than performing a query with a
filter.
Russell Bryant [Fri, 30 Aug 2013 21:57:29 +0000 (17:57 -0400)]
Sync rpc from oslo-incubator
This includes the following changes:
76972e2 Support a new qpid topology 284b13a Raise timeout in fake RPC if no consumers found 9721129 exception: remove 7b0cb37 Don't eat callback exceptions 69abf38 requeue instead of reject
Jeff Peeler [Fri, 23 Aug 2013 20:44:37 +0000 (16:44 -0400)]
Make security groups associated with Neutron port work
The security group names are now translated to UUIDs which is required
when using the python API. The lookup has been improved to find
existing security groups not part of the stack as well.
Steven Hardy [Fri, 30 Aug 2013 10:12:24 +0000 (11:12 +0100)]
Remove localhost references from tests
Using localhost in dummy URLs is a bad idea, because if you get
your mocking slightly wrong, some tests try to connect to the
services running in your local test environment.
Steve Baker [Sun, 18 Aug 2013 23:12:59 +0000 (11:12 +1200)]
Implement native nova server resource
Some notes on the implementation:
- extends Resource rather than Instance since most of the
complexity of Instance is in the handling of the Volumes
attribute
- exposed properties and attributes map as closely as possible
to the underlying v1 nova API (rather than the nova client library)
- property or attribute key namespaces have been stripped to provide
a cleaner API and avoid YAML quoting.
(eg instance_name -> 'OS-EXT-SRV-ATTR:instance_name')
- an assumption is currently made that any volumes specified
in block_device_mapping should not be detached on suspend
- Network address properties attempt to cater for simple and
advanced use-cases:
- 'first_private_address' and 'first_public_address' for simple
template attribute scenarios, and to aid with AWS::EC2::Instance
transition
- 'networks' for a simple data structure which provides all addresses
- 'addresses' for the raw data structure returned by the API
Liang Chen [Wed, 28 Aug 2013 14:55:42 +0000 (22:55 +0800)]
Fix CFN API error responses
A remote exception (included in conf.allowed_rpc_exception_modules)
is now restored to a subclass of its original type (with the
exception of non heap types which will always be restored to its
original type). Catching rpc_common.RemoteError is not enough
anymore.
Clint Byrum [Tue, 27 Aug 2013 16:10:54 +0000 (09:10 -0700)]
Provide user control for maximum nesting depth
In the case of an infinitely recursing stack, Heat will continue to
keep nesting stacks until python's maximum stack recursion depth
is reached. By this point a lot of memory and time may have been
spent parsing/loading/etc.
The default of 3 is enough to deploy a stack of stacks of stacks. It
can be raised by deployers if there is a desire to do larger and more
complicated stacks, at the cost of more resource utilization.
Steven Hardy [Fri, 23 Aug 2013 10:28:01 +0000 (11:28 +0100)]
Remove unnecessary aws_* from user_creds
We currently store aws_creds, but it's never used in any of the clients
which consume the stored context. It makes sense to remove it from the
DB, but leave it in heat/common/context.py; then the credentials used for
real requests *to* heat (authenticated via the ec2token middleware) are
obtainable in the context, but we don't populate them in context to be
used in client connections for requests going *from* heat.
Clint Byrum [Tue, 27 Aug 2013 16:04:28 +0000 (09:04 -0700)]
Change localhost references in test_nested_stack
These references are using localhost which may be running a server and
provide valid responses, contaminating the test. Using RFC2606's
recommended test TLD of '.test' ensures that these will never resolve.
This gets rid of the code to delete failed instances in
InstanceGroup so that administrators can debug what happened
if any instances fail to start. It also allows the resize operation
to raise an error, so the InstanceGroup should be in a FAILED state
after a failed resize operation.
Simon Pasquier [Wed, 21 Aug 2013 09:52:27 +0000 (11:52 +0200)]
Add VPCZoneIdentifier attribute for autoscaling
For now, only one subnet can be specified in the launch configuration because
Neutron doesn't have the ability to map subnets with availability zones.
See bug #1096017 for details.
Liang Chen [Tue, 27 Aug 2013 05:05:05 +0000 (13:05 +0800)]
Make logical_resource_id renaming backward compatible
The rename of logical_resource_id to resource_name changed the
return value of resource and event API. Adding a redundant
logical_resource_id back to make the change backward compatible.
YangLei [Tue, 27 Aug 2013 04:27:17 +0000 (12:27 +0800)]
Add the missing heat.po files into heat
There is only one file "heat.pot" in heat/locale/.
We need to add the missing heat.po files.
I updated "heat.pot" file and added the supported languages
(Take glance po files as reference).
The added files are used for
setting up the structure of directory.
The po file doesn't have any translated strings.
Angus Salkeld [Tue, 27 Aug 2013 00:26:53 +0000 (10:26 +1000)]
Add the api config opts in groups to deal with the single heat.conf
So first off, I also don't like the replicating of the api_opts in wsgi.py
but if I don't do that the sample generator doesn't work:(
We add the wsgi options into a group for each of the api servers with
the deprecated group of "DEFAULT" so it still deals with the flat layout.
The behaviour is as follows (assuming heat-api):
1) if you have both (/etc/heat/{heat.conf, heat-api.conf}
the value in heat-api.conf wins over heat.conf
2) if you have just one of the config files but a value in both the
[DEFAULT] section and the [heat-api] section then the value in heat-api
wins.
Zane Bitter [Mon, 26 Aug 2013 19:11:59 +0000 (21:11 +0200)]
Add a DB API to swap two resources between stacks
When rolling back a stack update, we will need to swap the current and
previous (backup) resources so that the former moves to the backup stack
while the latter returns to the current stack. This API allows us to effect
the switch using a database transaction (thus avoiding having to create a
*third* stack).
Zane Bitter [Mon, 26 Aug 2013 19:11:59 +0000 (21:11 +0200)]
Add a "rollback" parameter to StackUpdate
We can only consider restoring backup resources during a rollback
operation. If they are present during a standard update, there is no way of
testing whether or not they match the new template definition, so we need
to treat them differently in this case.
Zane Bitter [Mon, 26 Aug 2013 19:11:58 +0000 (21:11 +0200)]
Always resolve properties against the current stack
During an update, resources can get moved around between stacks. Ensure
that the properties are always resolved against whatever the current stack
is, without needing to replace self.properties.
Liang Chen [Sun, 18 Aug 2013 12:48:49 +0000 (20:48 +0800)]
Remove the rest references to exception.py
Remove the rest references to Oslo exception.py in Heat code base, so that Oslo
maintainer can go ahead and remove the openstack/common/exception.py file.
Thomas Herve [Mon, 26 Aug 2013 12:46:49 +0000 (14:46 +0200)]
Support native naming in InstanceGroup
The branch adds support for the native neutron load balancer resource in
in InstanceGroup. It also raises an error if a non load balancer
resource is passed.
Tim Smith [Sun, 25 Aug 2013 01:07:23 +0000 (18:07 -0700)]
Autoload Nova extensions
This patch adds logic to autoload standard novaclient extensions
(e.g. baremetal) and any third-party extensions that might
be installed. Thus, resource plugins that make use of
installed extensions are able to use the standard OpenStackClients
rather than have to a) subclass and override OpenStackClients
or b) create a shadow nova client within the resource plugin
with the desired extension loaded.
Code Review / openstack-build / heat-build.git / log