search

ClusterLabs / fence-agents

Fence agents
104 stars 160 forks source link

fence_openstack: added --auth-plugin option to allow usage of app credentials instead of user credentials #533

Open s0urc3c0d3 opened 1 year ago

s0urc3c0d3 commented 1 year ago

This allows users to user Barbican to generate app creds and put them in the clouds.yml:

clouds:
  openstack:
    auth:
      auth_url: http://CLOUD_ENDPOINT:5000
      application_credential_id: "SOMEID"
      application_credential_secret: "SOMELARGESECRET"
    region_name: "RegionOne"
    interface: "public"
    identity_api_version: 3
    auth_type: "v3applicationcredential"

The app creds can have smaller perm from user and they can be easly generated by users instead of full cloud accounts

To user this feature user can run: $ fence_openstack --cloud openstack -n INSTANCEUUID -o list --auth_plugin v3applicationcredential

knet-ci-bot commented 1 year ago

Can one of the admins verify this patch?

oalbrigt commented 1 year ago

You'll also have to run make xml-upload to update the metadata and attach it to the PR, so it doesnt fail CI when running make xml-check.

s0urc3c0d3 commented 1 year ago

ok thx for your time. I'm gonna fix the issues you pointed out and get back here :)

knet-jenkins[bot] commented 1 year ago

Can one of the admins check and authorise this run please: https://ci.kronosnet.org/job/fence-agents-pipeline/job/PR-533/1/input