e79dbbe6bb
This adds a keycloak server so we can start experimenting with it. It's based on the docker-compose file Matthieu made for Zuul (see https://review.opendev.org/819745 ) We should be able to configure a realm and federate with openstackid and other providers as described in the opendev auth spec. However, I am unable to test federation with openstackid due its inability to configure an oauth app at "localhost". Therefore, we will need an actual deployed system to test it. This should allow us to do so. It will also allow use to connect realms to the newly available Zuul admin api on opendev. It should be possible to configure the realm the way we want, then export its configuration into a JSON file and then have our playbooks or the docker-compose file import it. That would allow us to drive change to the configuration of the system through code review. Because of the above limitation with openstackid, I think we should regard the current implementation as experimental. Once we have a realm configuration that we like (which we will create using the GUI), we can chose to either continue to maintain the config with the GUI and appropriate file backups, or switch to a gitops model based on an export. My understanding is that all the data (realms configuration and session) are kept in an H2 database. This is probably sufficient for now and even production use with Zuul, but we should probably switch to mariadb before any heavy (eg gerrit, etc) production use. This is a partial implementation of https://docs.opendev.org/opendev/infra-specs/latest/specs/central-auth.html We can re-deploy with a new domain when it exists. Change-Id: I2e069b1b220dbd3e0a5754ac094c2b296c141753 Co-Authored-By: Matthieu Huin <mhuin@redhat.com>
227 lines
6.1 KiB
YAML
227 lines
6.1 KiB
YAML
plugin: yamlgroup
|
|
groups:
|
|
adns: adns*.open*.org
|
|
afs-server-common:
|
|
- afs[0-9]*.openstack.org
|
|
- afsdb[0-9]*.openstack.org
|
|
afs-file-server:
|
|
- afs[0-9]*.openstack.org
|
|
afs-db-server:
|
|
- afsdb[0-9]*.openstack.org
|
|
afs-client:
|
|
- mirror[0-9]*.opendev.org
|
|
- mirror-update[0-9]*.opendev.org
|
|
- ze[0-9]*.open*.org
|
|
- afsdb*.open*.org
|
|
- afs[0-9]*.open*.org
|
|
- static[0-9]*.opendev.org
|
|
borg-backup:
|
|
- etherpad[0-9]*.opendev.org
|
|
- gitea01.opendev.org
|
|
- review02.opendev.org
|
|
- zuul[0-9]*.opendev.org
|
|
- refstack01.openstack.org
|
|
- kdc03.openstack.org
|
|
- eavesdrop01.opendev.org
|
|
- paste01.opendev.org
|
|
# These are test specific hosts that we add to the backup
|
|
# group to mimic as much as possible what their prod version
|
|
# end up doing.
|
|
- gitea99.opendev.org
|
|
- review99.opendev.org
|
|
# All these servers are "special-cased" in specifically
|
|
# as they are puppet and should be replaced "soon"
|
|
- ethercalc02.openstack.org
|
|
- lists.openstack.org
|
|
- storyboard01.opendev.org
|
|
- translate01.openstack.org
|
|
borg-backup-server:
|
|
- backup02.ca-ymq-1.vexxhost.opendev.org
|
|
- backup01.ord.rax.opendev.org
|
|
cacti: cacti[0-9]*.open*.org
|
|
certcheck:
|
|
- cacti[0-9]*.open*.org
|
|
cloud-launcher:
|
|
- bridge.openstack.org
|
|
codesearch:
|
|
- codesearch[0-9]*.opendev.org
|
|
control-plane-clouds:
|
|
- bridge.openstack.org
|
|
disabled:
|
|
- wiki-dev01.openstack.org
|
|
- wiki-upgrade-test.openstack.org
|
|
dns:
|
|
- adns*.opendev.org
|
|
- ns*.opendev.org
|
|
eavesdrop: eavesdrop[0-9]*.opendev.org
|
|
elasticsearch: elasticsearch[0-9]*.open*.org
|
|
ethercalc: ethercalc*.open*.org
|
|
etherpad: etherpad[0-9]*.open*.org
|
|
gitea:
|
|
- gitea[0-9]*.opendev.org
|
|
gitea-lb:
|
|
- gitea-lb[0-9]*.opendev.org
|
|
grafana:
|
|
- grafana[0-9]*.opendev.org
|
|
graphite:
|
|
- graphite*.opendev.org
|
|
health:
|
|
- health[0-9]*.openstack.org
|
|
jvb:
|
|
- jvb[0-9]*.opendev.org
|
|
kerberos-client:
|
|
- afs[0-9]*.open*.org
|
|
- afsdb*.open*.org
|
|
- kdc[0-9]*.openstack.org
|
|
- mirror[0-9]*.opendev.org
|
|
- mirror-update[0-9]*.opendev.org
|
|
- static[0-9]*.opendev.org
|
|
- ze[0-9]*.open*.org
|
|
kerberos-kdc:
|
|
- kdc03.openstack.org
|
|
- kdc04.openstack.org
|
|
kerberos-kdc-primary:
|
|
- kdc03.openstack.org
|
|
kerberos-kdc-replica:
|
|
- kdc04.openstack.org
|
|
keycloak: keycloak[0-9]*.opendev.org
|
|
letsencrypt:
|
|
- codesearch[0-9]*.opendev.org
|
|
- eavesdrop[0-9]*.opendev.org
|
|
- etherpad[0-9]*.opendev.org
|
|
- ethercalc[0-9]*.open*.org
|
|
- gitea[0-9]*.opendev.org
|
|
- grafana[0-9]*.opendev.org
|
|
- graphite[0-9]*.opendev.org
|
|
- insecure-ci-registry[0-9]*.opendev.org
|
|
- keycloak[0-9]*.opendev.org
|
|
- meetpad[0-9]*.opendev.org
|
|
- mirror[0-9]*.opendev.org
|
|
- nb[0-9]*.opendev.org
|
|
- paste[0-9]*.opendev.org
|
|
- refstack[0-9]*.openstack.org
|
|
- review[0-9]*.opendev.org
|
|
- static[0-9]*.opendev.org
|
|
- storyboard[0-9]*.opendev.org
|
|
- translate[0-9]*.open*.org
|
|
- zuul[0-9]*.opendev.org
|
|
logstash:
|
|
- logstash[0-9]*.open*.org
|
|
logstash-worker:
|
|
- logstash-worker[0-9]*.open*.org
|
|
mailman:
|
|
- lists*.katacontainers.io
|
|
- lists*.open*.org
|
|
meetpad:
|
|
- meetpad[0-9]*.opendev.org
|
|
mirror:
|
|
- mirror[0-9]*.opendev.org
|
|
mirror-update:
|
|
- mirror-update[0-9]*.opendev.org
|
|
nodepool:
|
|
- nb[0-9]*.opendev.org
|
|
- nl[0-9]*.open*.org
|
|
nodepool-builder:
|
|
- nb[0-9]*.opendev.org
|
|
nodepool-launcher:
|
|
- nl[0-9]*.open*.org
|
|
ns:
|
|
- ns[0-9]*.open*.org
|
|
paste:
|
|
- paste[0-9]*.opendev.org
|
|
puppet:
|
|
- cacti[0-9]*.open*.org
|
|
- elasticsearch[0-9]*.open*.org
|
|
- ethercalc[0-9]*.open*.org
|
|
- health[0-9]*.openstack.org
|
|
- logstash-worker[0-9]*.open*.org
|
|
- logstash[0-9]*.open*.org
|
|
- status*.open*.org
|
|
- storyboard-dev[0-9]*.opendev.org
|
|
- storyboard[0-9]*.opendev.org
|
|
- subunit-worker[0-9]*.open*.org
|
|
- translate-dev[0-9]*.open*.org
|
|
- translate[0-9]*.open*.org
|
|
- wiki-dev[0-9]*.openstack.org
|
|
- wiki[0-9]*.openstack.org
|
|
puppet4:
|
|
- cacti[0-9]*.open*.org
|
|
- elasticsearch[0-9]*.open*.org
|
|
- ethercalc[0-9]*.open*.org
|
|
- health[0-9]*.openstack.org
|
|
- logstash-worker[0-9]*.open*.org
|
|
- logstash[0-9]*.open*.org
|
|
- status*.open*.org
|
|
- storyboard[0-9]*.opendev.org
|
|
- storyboard-dev[0-9]*.opendev.org
|
|
- subunit-worker[0-9]*.open*.org
|
|
- translate[0-9]*.open*.org
|
|
- translate-dev[0-9]*.open*.org
|
|
- wiki[0-9]*.openstack.org
|
|
- wiki-dev[0-9]*.openstack.org
|
|
refstack:
|
|
- refstack[0-9]*.openstack.org
|
|
registry:
|
|
- insecure-ci-registry[0-9]*.opendev.org
|
|
review:
|
|
- review[0-9]*.opendev.org
|
|
# This group disables operations like project-managment and
|
|
# replication. It is intended for staging new production servers.
|
|
#review-staging:
|
|
static:
|
|
- static[0-9]*.opendev.org
|
|
status:
|
|
- status*.open*.org
|
|
storyboard:
|
|
- storyboard[0-9]*.opendev.org
|
|
storyboard-dev:
|
|
- storyboard-dev[0-9]*.opendev.org
|
|
subunit-worker:
|
|
- subunit-worker[0-9]*.open*.org
|
|
translate-dev:
|
|
- translate-dev[0-9]*.open*.org
|
|
translate:
|
|
- translate[0-9]*.open*.org
|
|
webservers:
|
|
- cacti[0-9]*.open*.org
|
|
- codesearch[0-9]*.opendev.org
|
|
# eavesdrop has its own group with custom ports
|
|
- ethercalc[0-9]*.open*.org
|
|
- etherpad[0-9]*.open*.org
|
|
- grafana[0-9]*.opendev.org
|
|
- graphite*.opendev.org
|
|
- health[0-9]*.openstack.org
|
|
- keycloak[0-9]*.opendev.org
|
|
- nb[0-9]*.opendev.org
|
|
- nl[0-9]*.open*.org
|
|
- paste[0-9]*.opendev.org
|
|
- refstack[0-9]*.openstack.org
|
|
- static[0-9]*.opendev.org
|
|
- status*.open*.org
|
|
- storyboard-dev[0-9]*.opendev.org
|
|
- storyboard[0-9]*.opendev.org
|
|
- translate-dev[0-9]*.open*.org
|
|
- translate[0-9]*.open*.org
|
|
- wiki-dev[0-9]*.openstack.org
|
|
- wiki[0-9]*.openstack.org
|
|
wiki:
|
|
- wiki[0-9]*.openstack.org
|
|
wiki-dev:
|
|
- wiki-dev[0-9]*.openstack.org
|
|
zookeeper:
|
|
- zk[0-9]*.open*.org
|
|
zuul:
|
|
- ze[0-9]*.opendev.org
|
|
- zm[0-9]*.opendev.org
|
|
- zuul[0-9]*.opendev.org
|
|
zuul-executor:
|
|
- ze[0-9]*.opendev.org
|
|
zuul-merger:
|
|
- zm[0-9]*.opendev.org
|
|
zuul-preview:
|
|
- zp[0-9]*.opendev.org
|
|
zuul-scheduler:
|
|
- zuul[0-9]*.opendev.org
|
|
zuul-web:
|
|
- zuul[0-9]*.opendev.org
|