X-Git-Url: https://osm.etsi.org/gitweb/?a=blobdiff_plain;f=installers%2Fcharm%2Fkeystone%2Fsrc%2Fcharm.py;h=8300b88d31654cba1184bd3cfc80f4849643fb7f;hb=8f0f66f4bcf6340f706f0ca019d00ac16c21c32b;hp=a8c69fe65ca6d2b60ac60327ea3ca009626ef9b9;hpb=c753dc5f89180d11c1049f6398d74a4f99d7acd5;p=osm%2Fdevops.git

diff --git a/installers/charm/keystone/src/charm.py b/installers/charm/keystone/src/charm.py
index a8c69fe6..8300b88d 100755
--- a/installers/charm/keystone/src/charm.py
+++ b/installers/charm/keystone/src/charm.py
@@ -80,6 +80,9 @@ class ConfigModel(ModelValidator):
     site_url: Optional[str]
     ingress_whitelist_source_range: Optional[str]
     tls_secret_name: Optional[str]
+    mysql_host: Optional[str]
+    mysql_port: Optional[int]
+    mysql_root_password: Optional[str]
 
     @validator("max_file_size")
     def validate_max_file_size(cls, v):
@@ -101,6 +104,12 @@ class ConfigModel(ModelValidator):
             ip_network(v)
         return v
 
+    @validator("mysql_port")
+    def validate_mysql_port(cls, v):
+        if v and (v <= 0 or v >= 65535):
+            raise ValueError("Mysql port out of range")
+        return v
+
 
 class ConfigLdapModel(ModelValidator):
     ldap_enabled: bool
@@ -118,7 +127,7 @@ class ConfigLdapModel(ModelValidator):
     ldap_user_filter: Optional[str]
     ldap_user_enabled_attribute: Optional[str]
     ldap_user_enabled_mask: Optional[int]
-    ldap_user_enabled_default: Optional[bool]
+    ldap_user_enabled_default: Optional[str]
     ldap_user_enabled_invert: Optional[bool]
     ldap_group_objectclass: Optional[str]
     ldap_group_tree_dn: Optional[str]
@@ -126,6 +135,13 @@ class ConfigLdapModel(ModelValidator):
     ldap_tls_cacert_base64: Optional[str]
     ldap_tls_req_cert: Optional[str]
 
+    @validator
+    def validate_ldap_user_enabled_default(cls, v):
+        if v:
+            if v not in ["true", "false"]:
+                raise ValueError('must be equal to "true" or "false"')
+        return v
+
 
 class KeystoneCharm(CharmedOsmBase):
     def __init__(self, *args) -> NoReturn:
@@ -163,11 +179,19 @@ class KeystoneCharm(CharmedOsmBase):
 
     def _check_missing_dependencies(self, config: ConfigModel):
         missing_relations = []
-        if self.mysql_client.is_missing_data_in_unit():
+        if not config.mysql_host and self.mysql_client.is_missing_data_in_unit():
             missing_relations.append("mysql")
         if missing_relations:
             raise RelationsMissing(missing_relations)
 
+    def _validate_mysql_config(self, config: ConfigModel):
+        invalid_values = []
+        if not config.mysql_root_password:
+            invalid_values.append("Mysql root password must be provided")
+
+        if invalid_values:
+            raise ValueError("Invalid values: " + ", ".join(invalid_values))
+
     def _generate_keys(self) -> Tuple[List[str], List[str]]:
         """Generating new fernet tokens.
 
@@ -222,13 +246,23 @@ class KeystoneCharm(CharmedOsmBase):
         # Validate config
         config = ConfigModel(**dict(self.config))
         config_ldap = ConfigLdapModel(**dict(self.config))
+
+        if config.mysql_host and not self.mysql_client.is_missing_data_in_unit():
+            raise Exception("Mysql data cannot be provided via config and relation")
+
+        if config.mysql_host:
+            self._validate_mysql_config(config)
+
         # Check relations
         self._check_missing_dependencies(config)
+
         # Create Builder for the PodSpec
         pod_spec_builder = PodSpecV3Builder()
+
         # Build Container
         container_builder = ContainerV3Builder(self.app.name, image_info)
         container_builder.add_port(name=self.app.name, port=PORT)
+
         # Build files
         credential_files, fernet_files = self._build_files(config)
         container_builder.add_volume_config(
@@ -239,10 +273,11 @@ class KeystoneCharm(CharmedOsmBase):
         )
         container_builder.add_envs(
             {
-                "DB_HOST": self.mysql_client.host,
-                "DB_PORT": self.mysql_client.port,
+                "DB_HOST": config.mysql_host or self.mysql_client.host,
+                "DB_PORT": config.mysql_port or self.mysql_client.port,
                 "ROOT_DB_USER": "root",
-                "ROOT_DB_PASSWORD": self.mysql_client.root_password,
+                "ROOT_DB_PASSWORD": config.mysql_root_password
+                or self.mysql_client.root_password,
                 "KEYSTONE_DB_PASSWORD": config.keystone_db_password,
                 "REGION_ID": config.region_id,
                 "KEYSTONE_HOST": self.app.name,
@@ -256,7 +291,6 @@ class KeystoneCharm(CharmedOsmBase):
         )
 
         if config_ldap.ldap_enabled:
-
             container_builder.add_envs(
                 {
                     "LDAP_AUTHENTICATION_DOMAIN_NAME": config_ldap.ldap_authentication_domain_name,
@@ -309,6 +343,11 @@ class KeystoneCharm(CharmedOsmBase):
                     {"LDAP_GROUP_TREE_DN": config_ldap.ldap_group_tree_dn}
                 )
 
+            if config_ldap.ldap_tls_cacert_base64:
+                container_builder.add_envs(
+                    {"LDAP_TLS_CACERT_BASE64": config_ldap.ldap_tls_cacert_base64}
+                )
+
             if config_ldap.ldap_use_starttls:
                 container_builder.add_envs(
                     {
@@ -318,8 +357,10 @@ class KeystoneCharm(CharmedOsmBase):
                     }
                 )
         container = container_builder.build()
+
         # Add container to pod spec
         pod_spec_builder.add_container(container)
+
         # Add ingress resources to pod spec if site url exists
         if config.site_url:
             parsed = urlparse(config.site_url)
@@ -329,6 +370,7 @@ class KeystoneCharm(CharmedOsmBase):
                     if config.max_file_size > 0
                     else config.max_file_size
                 ),
+                "kubernetes.io/ingress.class": "public",
             }
             ingress_resource_builder = IngressResourceV3Builder(
                 f"{self.app.name}-ingress", annotations