os-keystone.yml

---
- hosts: [os_controllers]
  vars:
    verbose: true
  tasks:
    - name: create keystone database
      mysql_db: name=keystone state=present login_user=root login_password="{{ mariadb_root_pass }}"

    - name: grant privileges to keystone user in keystonedb
      mysql_user: host="{{ item }}"
                  name=keystone
                  password="{{ KEYSTONE_DBPASS }}"
                  priv=keystone.*:ALL
                  state=present
                  login_user=root
                  login_password="{{ mariadb_root_pass }}"
      with_items:
        - localhost
        - "%"

    - name: Disable the keystone service from starting automatically after installation
      lineinfile: dest=/etc/init/keystone.override create=yes
                  regexp="manual"
                  line="manual"
                  state=present

    - name: "Install keystone"
      apt: name="{{ item }}" update_cache=yes state=latest
      with_items:
        - keystone
        - apache2
        - libapache2-mod-wsgi
        - memcached
        - python-memcache

    - name: "write conf files"
      template: src=./templates/keystone.conf.j2 dest=/etc/keystone/keystone.conf

    - name: "populate database"
      shell: su -s /bin/sh -c "keystone-manage db_sync" keystone

    - name: "ServerName option to reference the controller node"
      lineinfile: dest=/etc/apache2/apache2.conf
                  regexp="ServerName"
                  line="ServerName controller"
                  state=present

    - name: "create wsgi-keystone.conf"
      copy: src=./keystone/wsgi-keystone.conf
            dest=/etc/apache2/sites-available/wsgi-keystone.conf
            owner=root
            group=root
            mode=0644

    - name: "Enable the Identity service virtual hosts"
      file: src=/etc/apache2/sites-available/wsgi-keystone.conf
            dest=/etc/apache2/sites-enabled/wsgi-keystone.conf
            state=link

    - name: "restart apache2"
      service: name=apache2 state=restarted

    - name: "remove SQLite database"
      file: path=/var/lib/keystone/keystone.db state=absent

    - name: "wait for keystone to come up"
      wait_for: host="{{ keystone_host }}" port="{{ item }}" timeout=20 delay=1
      with_items:
        - "{{ keystone_admin_port }}"
        - "{{ keystone_service_port }}"

    - name: "find the identity service entity"
      command: openstack
               --os-token {{ admin_token }}
               --os-url http://{{ keystone_host }}:{{ keystone_admin_port }}/v3
               --os-identity-api-version 3
               service show identity
      register: found
      ignore_errors: True

    - name: "create the identity service entity"
      command: openstack
               --os-token {{ admin_token }}
               --os-url http://{{ keystone_host }}:{{ keystone_admin_port }}/v3
               --os-identity-api-version 3
               service create
               --name keystone
               --description "OpenStack Identity"
               identity
      when: found | failed

    - name: "find the identity endpoint"
      command: openstack
               --os-token {{ admin_token }}
               --os-url http://{{ keystone_host }}:{{ keystone_admin_port }}/v2.0
               endpoint show identity
      register: found
      ignore_errors: True

    - name: "create the Identity service API endpoints"
      command: openstack
               --os-token {{ admin_token }}
               --os-url http://{{ keystone_host }}:{{ keystone_admin_port }}/v3
               --os-identity-api-version 3
               endpoint create
               --region RegionOne
               identity {{ item.endpoint }} http://controller:{{ item.port }}/v2.0
      with_items:
        - { endpoint: public, port: 5000 }
        - { endpoint: internal, port: 5000 }
        - { endpoint: admin, port: 35357 }
      when: found | failed

    - name: "find the admin project"
      command: openstack
               --os-token {{ admin_token }}
               --os-url http://{{ keystone_host }}:{{ keystone_admin_port }}/v3
               --os-identity-api-version 3
               project show admin
      register: found
      ignore_errors: True

    - name: "create the admin project"
      command: openstack
               --os-token {{ admin_token }}
               --os-url http://{{ keystone_host }}:{{ keystone_admin_port }}/v3
               --os-identity-api-version 3
               project create
               --domain default
               --description "Admin Project"
               admin
      when: found | failed

    - name: "find the admin user"
      command: openstack
               --os-token {{ admin_token }}
               --os-url http://{{ keystone_host }}:{{ keystone_admin_port }}/v3
               --os-identity-api-version 3
               user show admin
      register: found
      ignore_errors: True

    - name: "create the admin user"
      command: openstack
               --os-token {{ admin_token }}
               --os-url http://{{ keystone_host }}:{{ keystone_admin_port }}/v3
               --os-identity-api-version 3
               user create
               --domain default
               --password admin
               admin
      when: found | failed

    - name: "find the admin role"
      command: openstack
               --os-token {{ admin_token }}
               --os-url http://{{ keystone_host }}:{{ keystone_admin_port }}/v3
               --os-identity-api-version 3
               role show admin
      register: found
      ignore_errors: True

    - name: "create the admin role"
      command: openstack
               --os-token {{ admin_token }}
               --os-url http://{{ keystone_host }}:{{ keystone_admin_port }}/v3
               --os-identity-api-version 3
               role create
               admin
      when: found | failed

    - name: "add the admin role to the admin project and user"
      command: openstack
               --os-token {{ admin_token }}
               --os-url http://{{ keystone_host }}:{{ keystone_admin_port }}/v3
               --os-identity-api-version 3
               role add
               --project admin
               --user admin
               admin
      when: found | failed

    - name: "find the service project"
      command: openstack
               --os-token {{ admin_token }}
               --os-url http://{{ keystone_host }}:{{ keystone_admin_port }}/v3
               --os-identity-api-version 3
               project show service
      register: found
      ignore_errors: True

    - name: "create the service project"
      command: openstack
               --os-token {{ admin_token }}
               --os-url http://{{ keystone_host }}:{{ keystone_admin_port }}/v3
               --os-identity-api-version 3
               project create
               --domain default
               --description "Service Project"
               service
      when: found | failed

    - name: "Create OpenStack admin client environment script"
      copy: src=./keystone/admin-openrc.sh
            dest=/root/admin-openrc.sh
            owner=root
            group=root
            mode=0644

#    - name: "Keystone test"
#      tags: keytest
#      keystone:
#        command: "list"