# Licensed under the Apache License, Version 3.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

# http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

import base64

import collections

import copy

import datetime

import functools

import hashlib

import ipaddress

import iso8601

import json

import jsonpatch

import operator

import os

import six

import threading

import time

# import types so that we can reference ListType in sphinx param declarations.

# We can't just use list, because sphinx gets confused by

# openstack.resource.Resource.list and openstack.resource2.Resource.list

import types # noqa

import warnings

import dogpile.cache

import munch

import requestsexceptions

from six.moves import urllib

import keystoneauth1.exceptions

import keystoneauth1.session

from openstack import version as openstack_version

from openstack import _adapter

from openstack import _log

from openstack.cloud.exc import * # noqa

from openstack.cloud._heat import event_utils

from openstack.cloud._heat import template_utils

from openstack.cloud import _normalize

from openstack.cloud import meta

from openstack.cloud import _utils

import openstack.config

import openstack.config.defaults

import openstack.connection

from openstack import task_manager

from openstack import utils

# TODO(shade) shade keys were x-object-meta-x-sdk-md5 - we need to add those

# to freshness checks so that a shade->sdk transition doens't

# result in a re-upload

OBJECT_MD5_KEY = 'x-object-meta-x-sdk-md5'

OBJECT_SHA256_KEY = 'x-object-meta-x-sdk-sha256'

OBJECT_AUTOCREATE_KEY = 'x-object-meta-x-sdk-autocreated'

OBJECT_AUTOCREATE_CONTAINER = 'images'

# TODO(shade) shade keys were owner_specified.shade.md5 - we need to add those

# to freshness checks so that a shade->sdk transition doens't

# result in a re-upload

IMAGE_MD5_KEY = 'owner_specified.openstack.md5'

IMAGE_SHA256_KEY = 'owner_specified.openstack.sha256'

IMAGE_OBJECT_KEY = 'owner_specified.openstack.object'

# Rackspace returns this for intermittent import errors

IMAGE_ERROR_396 = "Image cannot be imported. Error code: '396'"

DEFAULT_OBJECT_SEGMENT_SIZE = 1073741824 # 1GB

# This halves the current default for Swift

DEFAULT_MAX_FILE_SIZE = (5 * 1024 * 1024 * 1024 + 2) / 2

DEFAULT_SERVER_AGE = 5

DEFAULT_PORT_AGE = 5

DEFAULT_FLOAT_AGE = 5

_OCC_DOC_URL = "https://docs.openstack.org/developer/os-client-config"

OBJECT_CONTAINER_ACLS = {

'public': '.r:*,.rlistings',

'private': '',

}

def _no_pending_volumes(volumes):

"""If there are any volumes not in a steady state, don't cache"""

for volume in volumes:

if volume['status'] not in ('available', 'error', 'in-use'):

return False

return True

def _no_pending_images(images):

"""If there are any images not in a steady state, don't cache"""

for image in images:

if image.status not in ('active', 'deleted', 'killed'):

return False

return True

def _no_pending_stacks(stacks):

"""If there are any stacks not in a steady state, don't cache"""

for stack in stacks:

status = stack['stack_status']

if '_COMPLETE' not in status and '_FAILED' not in status:

return False

return True

class OpenStackCloud(_normalize.Normalizer):

"""Represent a connection to an OpenStack Cloud.

OpenStackCloud is the entry point for all cloud operations, regardless

of which OpenStack service those operations may ultimately come from.

The operations on an OpenStackCloud are resource oriented rather than

REST API operation oriented. For instance, one will request a Floating IP

and that Floating IP will be actualized either via neutron or via nova

depending on how this particular cloud has decided to arrange itself.

:param TaskManager manager: Optional task manager to use for running

OpenStack API tasks. Unless you're doing

rate limiting client side, you almost

certainly don't need this. (optional)

:param bool strict: Only return documented attributes for each resource

as per the Data Model contract. (Default False)

:param app_name: Name of the application to be appended to the user-agent

string. Optional, defaults to None.

:param app_version: Version of the application to be appended to the

user-agent string. Optional, defaults to None.

:param CloudRegion cloud_config: Cloud config object from os-client-config

In the future, this will be the only way

to pass in cloud configuration, but is

being phased in currently.

"""

def __init__(

self,

cloud_config=None,

manager=None,

strict=False,

app_name=None,

app_version=None,

use_direct_get=False,

**kwargs):

self.log = _log.setup_logging('openstack')

if not cloud_config:

config = openstack.config.OpenStackConfig(

app_name=app_name, app_version=app_version)

cloud_config = config.get_one(**kwargs)

self.name = cloud_config.name

self.auth = cloud_config.get_auth_args()

self.region_name = cloud_config.region_name

self.default_interface = cloud_config.get_interface()

self.private = cloud_config.config.get('private', False)

self.image_api_use_tasks = cloud_config.config['image_api_use_tasks']

self.secgroup_source = cloud_config.config['secgroup_source']

self.force_ipv4 = cloud_config.force_ipv4

self.strict_mode = strict

# TODO(shade) The openstack.cloud default for get_flavor_extra_specs

# should be changed and this should be removed completely

self._extra_config = cloud_config._openstack_config.get_extra_config(

'shade', {

'get_flavor_extra_specs': True,

})

if manager is not None:

self.manager = manager

else:

self.manager = task_manager.TaskManager(

name=':'.join([self.name, self.region_name]))

self._external_ipv4_names = cloud_config.get_external_ipv4_networks()

self._internal_ipv4_names = cloud_config.get_internal_ipv4_networks()

self._external_ipv6_names = cloud_config.get_external_ipv6_networks()

self._internal_ipv6_names = cloud_config.get_internal_ipv6_networks()

self._nat_destination = cloud_config.get_nat_destination()

self._default_network = cloud_config.get_default_network()

self._floating_ip_source = cloud_config.config.get(

'floating_ip_source')

if self._floating_ip_source:

if self._floating_ip_source.lower() == 'none':

self._floating_ip_source = None

else:

self._floating_ip_source = self._floating_ip_source.lower()

self._use_external_network = cloud_config.config.get(

'use_external_network', True)

self._use_internal_network = cloud_config.config.get(

'use_internal_network', True)

# Work around older TaskManager objects that don't have submit_task

if not hasattr(self.manager, 'submit_task'):

self.manager.submit_task = self.manager.submitTask

(self.verify, self.cert) = cloud_config.get_requests_verify_args()

# Turn off urllib3 warnings about insecure certs if we have

# explicitly configured requests to tell it we do not want

# cert verification

if not self.verify:

self.log.debug(

"Turning off Insecure SSL warnings since verify=False")

category = requestsexceptions.InsecureRequestWarning

if category:

# InsecureRequestWarning references a Warning class or is None

warnings.filterwarnings('ignore', category=category)

self._disable_warnings = {}

self.use_direct_get = use_direct_get

self._servers = None

self._servers_time = 0

self._servers_lock = threading.Lock()

self._ports = None

self._ports_time = 0

self._ports_lock = threading.Lock()

self._floating_ips = None

self._floating_ips_time = 0

self._floating_ips_lock = threading.Lock()

self._floating_network_by_router = None

self._floating_network_by_router_run = False

self._floating_network_by_router_lock = threading.Lock()

self._networks_lock = threading.Lock()

self._reset_network_caches()

cache_expiration_time = int(cloud_config.get_cache_expiration_time())

cache_class = cloud_config.get_cache_class()

cache_arguments = cloud_config.get_cache_arguments()

self._resource_caches = {}

if cache_class != 'dogpile.cache.null':

self.cache_enabled = True

self._cache = self._make_cache(

cache_class, cache_expiration_time, cache_arguments)

expirations = cloud_config.get_cache_expiration()

for expire_key in expirations.keys():

# Only build caches for things we have list operations for

if getattr(

self, 'list_{0}'.format(expire_key), None):

self._resource_caches[expire_key] = self._make_cache(

cache_class, expirations[expire_key], cache_arguments)

self._SERVER_AGE = DEFAULT_SERVER_AGE

self._PORT_AGE = DEFAULT_PORT_AGE

self._FLOAT_AGE = DEFAULT_FLOAT_AGE

else:

self.cache_enabled = False

def _fake_invalidate(unused):

pass

class _FakeCache(object):

def invalidate(self):

pass

# Don't cache list_servers if we're not caching things.

# Replace this with a more specific cache configuration

# soon.

self._SERVER_AGE = 0

self._PORT_AGE = 0

self._FLOAT_AGE = 0

self._cache = _FakeCache()

# Undecorate cache decorated methods. Otherwise the call stacks

# wind up being stupidly long and hard to debug

for method in _utils._decorated_methods:

meth_obj = getattr(self, method, None)

if not meth_obj:

continue

if (hasattr(meth_obj, 'invalidate')

and hasattr(meth_obj, 'func')):

new_func = functools.partial(meth_obj.func, self)

new_func.invalidate = _fake_invalidate

setattr(self, method, new_func)

# If server expiration time is set explicitly, use that. Otherwise

# fall back to whatever it was before

self._SERVER_AGE = cloud_config.get_cache_resource_expiration(

'server', self._SERVER_AGE)

self._PORT_AGE = cloud_config.get_cache_resource_expiration(

'port', self._PORT_AGE)

self._FLOAT_AGE = cloud_config.get_cache_resource_expiration(

'floating_ip', self._FLOAT_AGE)

self._container_cache = dict()

self._file_hash_cache = dict()

self._keystone_session = None

self._raw_clients = {}

self._local_ipv6 = (

_utils.localhost_supports_ipv6() if not self.force_ipv4 else False)

self.cloud_config = cloud_config

self._conn_object = None

@property

def _conn(self):

if not self._conn_object:

self._conn_object = openstack.connection.Connection(

config=self.cloud_config, session=self._keystone_session)

return self._conn_object

def connect_as(self, **kwargs):

"""Make a new OpenStackCloud object with new auth context.

Take the existing settings from the current cloud and construct a new

OpenStackCloud object with some of the auth settings overridden. This

is useful for getting an object to perform tasks with as another user,

or in the context of a different project.

.. code-block:: python

cloud = openstack.cloud.openstack_cloud(cloud='example')

# Work normally

servers = cloud.list_servers()

cloud2 = cloud.connect_as(username='different-user', password='')

# Work as different-user

servers = cloud2.list_servers()

:param kwargs: keyword arguments can contain anything that would

normally go in an auth dict. They will override the same

settings from the parent cloud as appropriate. Entries

that do not want to be overridden can be ommitted.

"""

config = openstack.config.OpenStackConfig(

app_name=self.cloud_config._app_name,

app_version=self.cloud_config._app_version,

load_yaml_config=False)

params = copy.deepcopy(self.cloud_config.config)

# Remove profile from current cloud so that overridding works

params.pop('profile', None)

# Utility function to help with the stripping below.

def pop_keys(params, auth, name_key, id_key):

if name_key in auth or id_key in auth:

params['auth'].pop(name_key, None)

params['auth'].pop(id_key, None)

# If there are user, project or domain settings in the incoming auth

# dict, strip out both id and name so that a user can say:

# cloud.connect_as(project_name='foo')

# and have that work with clouds that have a project_id set in their

# config.

for prefix in ('user', 'project'):

if prefix == 'user':

name_key = 'username'

else:

name_key = 'project_name'

id_key = '{prefix}_id'.format(prefix=prefix)

pop_keys(params, kwargs, name_key, id_key)

id_key = '{prefix}_domain_id'.format(prefix=prefix)

name_key = '{prefix}_domain_name'.format(prefix=prefix)

pop_keys(params, kwargs, name_key, id_key)

for key, value in kwargs.items():

params['auth'][key] = value

# TODO(mordred) Replace this chunk with the next patch that allows

# passing a Session to CloudRegion.

# Closure to pass to OpenStackConfig to ensure the new cloud shares

# the Session with the current cloud. This will ensure that version

# discovery cache will be re-used.

def session_constructor(*args, **kwargs):

# We need to pass our current keystone session to the Session

# Constructor, otherwise the new auth plugin doesn't get used.

return keystoneauth1.session.Session(session=self.keystone_session)

# Use cloud='defaults' so that we overlay settings properly

cloud_config = config.get_one(

cloud='defaults',

session_constructor=session_constructor,

**params)

# Override the cloud name so that logging/location work right

cloud_config.name = self.name

cloud_config.config['profile'] = self.name

# Use self.__class__ so that we return whatever this if, like if it's

# a subclass in the case of shade wrapping sdk.

return self.__class__(cloud_config=cloud_config)

def connect_as_project(self, project):

"""Make a new OpenStackCloud object with a new project.

Take the existing settings from the current cloud and construct a new

OpenStackCloud object with the project settings overridden. This

is useful for getting an object to perform tasks with as another user,

or in the context of a different project.

.. code-block:: python

cloud = openstack.cloud.openstack_cloud(cloud='example')

# Work normally

servers = cloud.list_servers()

cloud2 = cloud.connect_as_project('different-project')

# Work in different-project

servers = cloud2.list_servers()

:param project: Either a project name or a project dict as returned by

`list_projects`.

"""

auth = {}

if isinstance(project, dict):

auth['project_id'] = project.get('id')

auth['project_name'] = project.get('name')

if project.get('domain_id'):

auth['project_domain_id'] = project['domain_id']

else:

auth['project_name'] = project

return self.connect_as(**auth)

def _make_cache(self, cache_class, expiration_time, arguments):

return dogpile.cache.make_region(

function_key_generator=self._make_cache_key

).configure(

cache_class,

expiration_time=expiration_time,

arguments=arguments)

def _make_cache_key(self, namespace, fn):

fname = fn.__name__

if namespace is None:

name_key = self.name

else:

name_key = '%s:%s' % (self.name, namespace)

def generate_key(*args, **kwargs):

arg_key = ','.join(args)

kw_keys = sorted(kwargs.keys())

kwargs_key = ','.join(

['%s:%s' % (k, kwargs[k]) for k in kw_keys if k != 'cache'])

ans = "_".join(

[str(name_key), fname, arg_key, kwargs_key])

return ans

return generate_key

def _get_cache(self, resource_name):

if resource_name and resource_name in self._resource_caches:

return self._resource_caches[resource_name]

else:

return self._cache

def _get_major_version_id(self, version):

if isinstance(version, int):

return version

elif isinstance(version, six.string_types + (tuple,)):

return int(version[0])

return version

def _get_versioned_client(

self, service_type, min_version=None, max_version=None):

config_version = self.cloud_config.get_api_version(service_type)

config_major = self._get_major_version_id(config_version)

max_major = self._get_major_version_id(max_version)

min_major = self._get_major_version_id(min_version)

# TODO(shade) This should be replaced with use of Connection. However,

# we need to find a sane way to deal with this additional

# logic - or we need to give up on it. If we give up on it,

# we need to make sure we can still support it in the shade

# compat layer.

# NOTE(mordred) This logic for versions is slightly different

# than the ksa Adapter constructor logic. openstack.cloud knows the

# versions it knows, and uses them when it detects them. However, if

# a user requests a version, and it's not found, and a different one

# openstack.cloud does know about is found, that's a warning in

# openstack.cloud.

if config_version:

if min_major and config_major < min_major:

raise OpenStackCloudException(

"Version {config_version} requested for {service_type}"

" but shade understands a minimum of {min_version}".format(

config_version=config_version,

service_type=service_type,

min_version=min_version))

elif max_major and config_major > max_major:

raise OpenStackCloudException(

"Version {config_version} requested for {service_type}"

" but openstack.cloud understands a maximum of"

" {max_version}".format(

config_version=config_version,

service_type=service_type,

max_version=max_version))

request_min_version = config_version

request_max_version = '{version}.latest'.format(

version=config_major)

adapter = _adapter.ShadeAdapter(

session=self.keystone_session,

task_manager=self.manager,

service_type=self.cloud_config.get_service_type(service_type),

service_name=self.cloud_config.get_service_name(service_type),

interface=self.cloud_config.get_interface(service_type),

endpoint_override=self.cloud_config.get_endpoint(service_type),

region_name=self.cloud_config.region_name,

min_version=request_min_version,

max_version=request_max_version)

if adapter.get_endpoint():

return adapter

adapter = _adapter.ShadeAdapter(

session=self.keystone_session,

task_manager=self.manager,

service_type=self.cloud_config.get_service_type(service_type),

service_name=self.cloud_config.get_service_name(service_type),

interface=self.cloud_config.get_interface(service_type),

endpoint_override=self.cloud_config.get_endpoint(service_type),

region_name=self.cloud_config.region_name,

min_version=min_version,

max_version=max_version)

# data.api_version can be None if no version was detected, such

# as with neutron

api_version = adapter.get_api_major_version(

endpoint_override=self.cloud_config.get_endpoint(service_type))

api_major = self._get_major_version_id(api_version)

# If we detect a different version that was configured, warn the user.

# shade still knows what to do - but if the user gave us an explicit

# version and we couldn't find it, they may want to investigate.

if api_version and (api_major != config_major):

warning_msg = (

'{service_type} is configured for {config_version}'

' but only {api_version} is available. shade is happy'

' with this version, but if you were trying to force an'

' override, that did not happen. You may want to check'

' your cloud, or remove the version specification from'

' your config.'.format(

service_type=service_type,

config_version=config_version,

api_version='.'.join([str(f) for f in api_version])))

self.log.debug(warning_msg)

warnings.warn(warning_msg)

return adapter

# TODO(shade) This should be replaced with using openstack Connection

# object.

def _get_raw_client(

self, service_type, api_version=None, endpoint_override=None):

return _adapter.ShadeAdapter(

session=self.keystone_session,

task_manager=self.manager,

service_type=self.cloud_config.get_service_type(service_type),

service_name=self.cloud_config.get_service_name(service_type),

interface=self.cloud_config.get_interface(service_type),

endpoint_override=self.cloud_config.get_endpoint(

service_type) or endpoint_override,

region_name=self.cloud_config.region_name)

def _is_client_version(self, client, version):

client_name = '_{client}_client'.format(client=client)

client = getattr(self, client_name)

return client._version_matches(version)

@property

def _application_catalog_client(self):

if 'application-catalog' not in self._raw_clients:

self._raw_clients['application-catalog'] = self._get_raw_client(

'application-catalog')

return self._raw_clients['application-catalog']

@property

def _baremetal_client(self):

if 'baremetal' not in self._raw_clients:

client = self._get_raw_client('baremetal')

# Do this to force version discovery. We need to do that, because

# the endpoint-override trick we do for neutron because

# ironicclient just appends a /v1 won't work and will break

# keystoneauth - because ironic's versioned discovery endpoint

# is non-compliant and doesn't return an actual version dict.

client = self._get_versioned_client(

'baremetal', min_version=1, max_version='1.latest')

self._raw_clients['baremetal'] = client

return self._raw_clients['baremetal']

@property

def _container_infra_client(self):

if 'container-infra' not in self._raw_clients:

self._raw_clients['container-infra'] = self._get_raw_client(

'container-infra')

return self._raw_clients['container-infra']

@property

def _database_client(self):

if 'database' not in self._raw_clients:

self._raw_clients['database'] = self._get_raw_client('database')

return self._raw_clients['database']

@property

def _dns_client(self):

if 'dns' not in self._raw_clients:

dns_client = self._get_versioned_client(

'dns', min_version=2, max_version='2.latest')

self._raw_clients['dns'] = dns_client

return self._raw_clients['dns']

@property

def _identity_client(self):

if 'identity' not in self._raw_clients:

self._raw_clients['identity'] = self._get_versioned_client(

'identity', min_version=2, max_version='3.latest')

return self._raw_clients['identity']

@property

def _raw_image_client(self):

if 'raw-image' not in self._raw_clients:

image_client = self._get_raw_client('image')

self._raw_clients['raw-image'] = image_client

return self._raw_clients['raw-image']

@property

def _image_client(self):

if 'image' not in self._raw_clients:

self._raw_clients['image'] = self._get_versioned_client(

'image', min_version=1, max_version='2.latest')

return self._raw_clients['image']

@property

def _network_client(self):

if 'network' not in self._raw_clients:

client = self._get_raw_client('network')

# TODO(mordred) I don't care if this is what neutronclient does,

# fix this.

# Don't bother with version discovery - there is only one version

# of neutron. This is what neutronclient does, fwiw.

endpoint = client.get_endpoint()

if not endpoint.rstrip().rsplit('/')[1] == 'v2.0':

if not endpoint.endswith('/'):

endpoint += '/'

endpoint = urllib.parse.urljoin(

endpoint, 'v2.0')

client.endpoint_override = endpoint

self._raw_clients['network'] = client

return self._raw_clients['network']

@property

def _object_store_client(self):

if 'object-store' not in self._raw_clients:

raw_client = self._get_raw_client('object-store')

self._raw_clients['object-store'] = raw_client

return self._raw_clients['object-store']

@property

def _orchestration_client(self):

if 'orchestration' not in self._raw_clients:

raw_client = self._get_raw_client('orchestration')

self._raw_clients['orchestration'] = raw_client

return self._raw_clients['orchestration']

@property

def _volume_client(self):

if 'volume' not in self._raw_clients:

self._raw_clients['volume'] = self._get_raw_client('volume')

return self._raw_clients['volume']

def pprint(self, resource):

"""Wrapper aroud pprint that groks munch objects"""

# import late since this is a utility function

import pprint

new_resource = _utils._dictify_resource(resource)

pprint.pprint(new_resource)

def pformat(self, resource):

"""Wrapper aroud pformat that groks munch objects"""

# import late since this is a utility function

import pprint

new_resource = _utils._dictify_resource(resource)

return pprint.pformat(new_resource)

@property

def keystone_session(self):

if self._keystone_session is None:

try:

self._keystone_session = self.cloud_config.get_session()

if hasattr(self._keystone_session, 'additional_user_agent'):

self._keystone_session.additional_user_agent.append(

('openstacksdk', openstack_version.__version__))

except Exception as e:

raise OpenStackCloudException(

"Error authenticating to keystone: %s " % str(e))

return self._keystone_session

@property

def _keystone_catalog(self):

return self.keystone_session.auth.get_access(

self.keystone_session).service_catalog

@property

def service_catalog(self):

return self._keystone_catalog.catalog

def endpoint_for(self, service_type, interface='public'):

return self._keystone_catalog.url_for(

service_type=service_type, interface=interface)

@property

def auth_token(self):

# Keystone's session will reuse a token if it is still valid.

# We don't need to track validity here, just get_token() each time.

return self.keystone_session.get_token()

@property

def current_user_id(self):

"""Get the id of the currently logged-in user from the token."""

return self.keystone_session.auth.get_access(

self.keystone_session).user_id

@property

def current_project_id(self):

"""Get the current project ID.

Returns the project_id of the current token scope. None means that

the token is domain scoped or unscoped.

:raises keystoneauth1.exceptions.auth.AuthorizationFailure:

if a new token fetch fails.

:raises keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin:

if a plugin is not available.

"""

return self.keystone_session.get_project_id()

@property

def current_project(self):

"""Return a ``munch.Munch`` describing the current project"""

return self._get_project_info()

def _get_project_info(self, project_id=None):

project_info = munch.Munch(

id=project_id,

name=None,

domain_id=None,

domain_name=None,

)

if not project_id or project_id == self.current_project_id:

# If we don't have a project_id parameter, it means a user is

# directly asking what the current state is.

# Alternately, if we have one, that means we're calling this

# from within a normalize function, which means the object has

# a project_id associated with it. If the project_id matches

# the project_id of our current token, that means we can supplement

# the info with human readable info about names if we have them.

# If they don't match, that means we're an admin who has pulled

# an object from a different project, so adding info from the

# current token would be wrong.

auth_args = self.cloud_config.config.get('auth', {})

project_info['id'] = self.current_project_id

project_info['name'] = auth_args.get('project_name')

project_info['domain_id'] = auth_args.get('project_domain_id')

project_info['domain_name'] = auth_args.get('project_domain_name')

return project_info

@property

def current_location(self):

"""Return a ``munch.Munch`` explaining the current cloud location."""

return self._get_current_location()

def _get_current_location(self, project_id=None, zone=None):

return munch.Munch(

cloud=self.name,

region_name=self.region_name,

zone=zone,

project=self._get_project_info(project_id),

)

def _get_identity_location(self):

'''Identity resources do not exist inside of projects.'''

return munch.Munch(

cloud=self.name,

region_name=None,

zone=None,

project=munch.Munch(

id=None,

name=None,

domain_id=None,

domain_name=None))

def _get_project_id_param_dict(self, name_or_id):

if name_or_id:

project = self.get_project(name_or_id)

if not project:

return {}

if self._is_client_version('identity', 3):

return {'default_project_id': project['id']}

else:

return {'tenant_id': project['id']}

else:

return {}

def _get_domain_id_param_dict(self, domain_id):

"""Get a useable domain."""

# Keystone v3 requires domains for user and project creation. v2 does

# not. However, keystone v2 does not allow user creation by non-admin

# users, so we can throw an error to the user that does not need to

# mention api versions

if self._is_client_version('identity', 3):

if not domain_id:

raise OpenStackCloudException(

"User or project creation requires an explicit"

" domain_id argument.")

else:

return {'domain_id': domain_id}

else:

return {}

def _get_identity_params(self, domain_id=None, project=None):

"""Get the domain and project/tenant parameters if needed.

keystone v2 and v3 are divergent enough that we need to pass or not

pass project or tenant_id or domain or nothing in a sane manner.

"""

ret = {}

ret.update(self._get_domain_id_param_dict(domain_id))

ret.update(self._get_project_id_param_dict(project))

return ret

def range_search(self, data, filters):

"""Perform integer range searches across a list of dictionaries.

Given a list of dictionaries, search across the list using the given

dictionary keys and a range of integer values for each key. Only

dictionaries that match ALL search filters across the entire original

data set will be returned.

It is not a requirement that each dictionary contain the key used

for searching. Those without the key will be considered non-matching.

The range values must be string values and is either a set of digits

representing an integer for matching, or a range operator followed by

a set of digits representing an integer for matching. If a range

operator is not given, exact value matching will be used. Valid

operators are one of: <,>,<=,>=

:param data: List of dictionaries to be searched.

:param filters: Dict describing the one or more range searches to

perform. If more than one search is given, the result will be the

members of the original data set that match ALL searches. An

example of filtering by multiple ranges::

{"vcpus": "<=5", "ram": "<=2048", "disk": "1"}

:returns: A list subset of the original data set.

:raises: OpenStackCloudException on invalid range expressions.

"""

filtered = []

for key, range_value in filters.items():

# We always want to operate on the full data set so that

# calculations for minimum and maximum are correct.

results = _utils.range_filter(data, key, range_value)

if not filtered:

# First set of results

filtered = results

else:

# The combination of all searches should be the intersection of

# all result sets from each search. So adjust the current set

# of filtered data by computing its intersection with the

# latest result set.

filtered = [r for r in results for f in filtered if r == f]

return filtered

def _get_and_munchify(self, key, data):

"""Wrapper around meta.get_and_munchify.

Some of the methods expect a `meta` attribute to be passed in as

part of the method signature. In those methods the meta param is

overriding the meta module making the call to meta.get_and_munchify

to fail.

"""

return meta.get_and_munchify(key, data)

@_utils.cache_on_arguments()

def list_projects(self, domain_id=None, name_or_id=None, filters=None):

"""List projects.

With no parameters, returns a full listing of all visible projects.

:param domain_id: domain ID to scope the searched projects.

:param name_or_id: project name or ID.

:param filters: a dict containing additional filters to use

OR

A string containing a jmespath expression for further filtering.

Example:: "[?last_name==`Smith`] | [?other.gender]==`Female`]"

:returns: a list of ``munch.Munch`` containing the projects

:raises: ``OpenStackCloudException``: if something goes wrong during

the OpenStack API call.

"""

kwargs = dict(

filters=filters,

domain_id=domain_id)

if self._is_client_version('identity', 3):

kwargs['obj_name'] = 'project'

pushdown, filters = _normalize._split_filters(**kwargs)

try:

if self._is_client_version('identity', 3):

key = 'projects'

else:

key = 'tenants'

data = self._identity_client.get(

'/{endpoint}'.format(endpoint=key), params=pushdown)

projects = self._normalize_projects(

self._get_and_munchify(key, data))

except Exception as e:

self.log.debug("Failed to list projects", exc_info=True)

raise OpenStackCloudException(str(e))

return _utils._filter_list(projects, name_or_id, filters)

def search_projects(self, name_or_id=None, filters=None, domain_id=None):

'''Backwards compatibility method for search_projects

search_projects originally had a parameter list that was name_or_id,

filters and list had domain_id first. This method exists in this form

to allow code written with positional parameter to still work. But

really, use keyword arguments.

'''

return self.list_projects(

domain_id=domain_id, name_or_id=name_or_id, filters=filters)

def get_project(self, name_or_id, filters=None, domain_id=None):

"""Get exactly one project.

:param name_or_id: project name or ID.

:param filters: a dict containing additional filters to use.

:param domain_id: domain ID (identity v3 only).

:returns: a list of ``munch.Munch`` containing the project description.

:raises: ``OpenStackCloudException``: if something goes wrong during

the OpenStack API call.

"""

return _utils._get_entity(self, 'project', name_or_id, filters,

domain_id=domain_id)

@_utils.valid_kwargs('description')

def update_project(self, name_or_id, enabled=None, domain_id=None,

**kwargs):

with _utils.shade_exceptions(

"Error in updating project {project}".format(

project=name_or_id)):

proj = self.get_project(name_or_id, domain_id=domain_id)

if not proj:

raise OpenStackCloudException(

"Project %s not found." % name_or_id)

if enabled is not None:

kwargs.update({'enabled': enabled})

# NOTE(samueldmq): Current code only allow updates of description

# or enabled fields.

if self._is_client_version('identity', 3):

data = self._identity_client.patch(

'/projects/' + proj['id'], json={'project': kwargs})

project = self._get_and_munchify('project', data)

else:

data = self._identity_client.post(

'/tenants/' + proj['id'], json={'tenant': kwargs})

project = self._get_and_munchify('tenant', data)

project = self._normalize_project(project)

self.list_projects.invalidate(self)

return project

def create_project(

self, name, description=None, domain_id=None, enabled=True):

"""Create a project."""

with _utils.shade_exceptions(

"Error in creating project {project}".format(project=name)):

project_ref = self._get_domain_id_param_dict(domain_id)

project_ref.update({'name': name,

'description': description,

'enabled': enabled})

endpoint, key = ('tenants', 'tenant')

if self._is_client_version('identity', 3):

endpoint, key = ('projects', 'project')

data = self._identity_client.post(

'/{endpoint}'.format(endpoint=endpoint),

json={key: project_ref})

project = self._normalize_project(

self._get_and_munchify(key, data))

self.list_projects.invalidate(self)

return project

def delete_project(self, name_or_id, domain_id=None):

"""Delete a project.

:param string name_or_id: Project name or ID.

:param string domain_id: Domain ID containing the project(identity v3

only).