_states/keystonev3.py

import logging


def __virtual__():
    return 'keystonev3' if 'keystonev3.endpoint_list' in __salt__ else False  # noqa


log = logging.getLogger(__name__)


def _keystonev3_call(fname, *args, **kwargs):
    return __salt__['keystonev3.{}'.format(fname)](*args, **kwargs)  # noqa


def endpoint_present(name, url, interface, service_id, cloud_name, **kwargs):

    service_id = _keystonev3_call(
        'service_get_details', service_id,
        cloud_name=cloud_name)['service']['id']

    endpoints = _keystonev3_call(
        'endpoint_list', name=name, service_id=service_id, interface=interface,
        cloud_name=cloud_name)['endpoints']

    if not endpoints:
        try:
            resp = _keystonev3_call(
                'endpoint_create', url=url, interface=interface,
                service_id=service_id, cloud_name=cloud_name, **kwargs
            )
        except Exception as e:
            log.error('Keystone endpoint create failed with {}'.format(e))
            return _create_failed(name, 'endpoint')
        return _created(name, 'endpoint', resp)
    elif len(endpoints) == 1:
        exact_endpoint = endpoints[0]
        endpoint_id = exact_endpoint['id']
        changable = (
            'url', 'region', 'interface', 'service_id'
        )
        to_update = {}
        to_check = {'url': url}
        to_check.update(kwargs)

        for key in to_check:
            if (key in changable and (key not in exact_endpoint or
                                      to_check[key] != exact_endpoint[key])):
                to_update[key] = to_check[key]
        if to_update:
            try:
                resp = _keystonev3_call(
                    'endpoint_update', endpoint_id=endpoint_id,
                    cloud_name=cloud_name, **to_update
                )
            except Exception as e:
                log.error('Keystone endpoint update failed with {}'.format(e))
                return _update_failed(name, 'endpoint')
            return _updated(name, 'endpoint', resp)
        else:
            return _no_changes(name, 'endpoint')
    else:
        return _find_failed(name, 'endpoint')


def endpoint_absent(name, service_id, interface, cloud_name):
    service_id = _keystonev3_call(
        'service_get_details', service_id,
        cloud_name=cloud_name)['service']['id']

    endpoints = _keystonev3_call(
        'endpoint_list', name=name, service_id=service_id, interface=interface,
        cloud_name=cloud_name)['endpoints']
    if not endpoints:
        return _absent(name, 'endpoint')
    elif len(endpoints) == 1:
        try:
            _keystonev3_call(
                'endpoint_delete', endpoints[0]['id'], cloud_name=cloud_name
            )
        except Exception as e:
            log.error('Keystone delete endpoint failed with {}'.format(e))
            return _delete_failed(name, 'endpoint')
        return _deleted(name, 'endpoint')
    else:
        return _find_failed(name, 'endpoint')


def service_present(name, type, cloud_name, **kwargs):

    service_id = ''

    try:
        exact_service = _keystonev3_call(
            'service_get_details', name,
            cloud_name=cloud_name)['service']
        service_id = exact_service['id']
    except Exception as e:
        if 'ResourceNotFound' in repr(e):
            pass
        else:
            log.error('Failed to get service {}'.format(e))
            return _create_failed(name, 'service')

    if not service_id:
        try:
            resp = _keystonev3_call(
                'service_create', name=name, type=type,
                cloud_name=cloud_name, **kwargs
            )
        except Exception as e:
            log.error('Keystone service create failed with {}'.format(e))
            return _create_failed(name, 'service')
        return _created(name, 'service', resp)

    else:
        changable = ('type', 'enabled', 'description')
        to_update = {}
        to_check = {'type': type}
        to_check.update(kwargs)

        for key in to_check:
            if (key in changable and (key not in exact_service or
                                      to_check[key] != exact_service[key])):
                    to_update[key] = to_check[key]
        if to_update:
            try:
                resp = _keystonev3_call(
                    'service_update', service_id=service_id,
                    cloud_name=cloud_name, **to_update
                )
            except Exception as e:
                log.error('Keystone service update failed with {}'.format(e))
                return _update_failed(name, 'service')
            return _updated(name, 'service', resp)
        else:
            return _no_changes(name, 'service')
    return _find_failed(name, 'service')


def service_absent(name, cloud_name):
    try:
        _keystonev3_call(
            'service_get_details', name,
            cloud_name=cloud_name)['service']
    except Exception as e:
        if 'ResourceNotFound' in repr(e):
            return _absent(name, 'service')
        else:
            log.error('Failed to get service {}'.format(e))
            return _find_failed(name, 'service')
    try:
        _keystonev3_call('service_delete', name, cloud_name=cloud_name)
    except Exception:
        return _delete_failed(name, 'service')
    return _deleted(name, 'service')



def project_present(name, domain_id, cloud_name, **kwargs):

    projects = _keystonev3_call(
        'project_list', name=name, domain_id=domain_id, cloud_name=cloud_name
    )['projects']

    if not projects:
        try:
            resp = _keystonev3_call(
                'project_create', domain_id=domain_id, name=name,
                cloud_name=cloud_name, **kwargs
            )
        except Exception as e:
            log.error('Keystone project create failed with {}'.format(e))
            return _create_failed(name, 'project')
        return _created(name, 'project', resp)
    elif len(projects) == 1:
        exact_project = projects[0]
        project_id = exact_project['id']
        changable = (
            'is_domain', 'description', 'domain_id', 'enabled',
            'parent_id', 'tags'
        )
        to_update = {}

        for key in kwargs:
            if (key in changable and (key not in exact_project or
                                      kwargs[key] != exact_project[key])):
                    to_update[key] = kwargs[key]

        if to_update:
            try:
                resp = _keystonev3_call(
                    'project_update', project_id=project_id,
                    cloud_name=cloud_name, **to_update
                )
            except Exception as e:
                log.error('Keystone project update failed with {}'.format(e))
                return _update_failed(name, 'project')
            return _updated(name, 'project', resp)
        else:
            return _no_changes(name, 'project')
    else:
        return _find_failed(name, 'project')


def project_absent(name, cloud_name):
    try:
        _keystonev3_call('project_get_details',
                         project_id=name, cloud_name=cloud_name)
    except Exception as e:
        if 'ResourceNotFound' in repr(e):
            return _absent(name, 'project')
        else:
            log.error('Failed to get project {}'.format(e))
            return _find_failed(name, 'project')
    try:
        _keystonev3_call('project_delete', project_id=name,
                         cloud_name=cloud_name)
    except Exception:
        return _delete_failed(name, 'project')
    return _deleted(name, 'project')


def user_present(name, cloud_name, password_reset=False, **kwargs):

    users = _keystonev3_call(
        'user_list', name=name, cloud_name=cloud_name
    )['users']

    if 'default_project_id' in kwargs:
        kwargs['default_project_id'] = _keystonev3_call(
             'project_get_details', kwargs['default_project_id'],
             cloud_name=cloud_name)['project']['id']

    if not users:
        try:
            resp = _keystonev3_call(
                'user_create', name=name, cloud_name=cloud_name, **kwargs
            )
        except Exception as e:
            log.error('Keystone user create failed with {}'.format(e))
            return _create_failed(name, 'user')
        return _created(name, 'user', resp)

    elif len(users) == 1:
        exact_user = users[0]
        user_id = exact_user['id']
        changable = (
            'default_project_id', 'domain_id', 'enabled', 'email'
        )
        if password_reset:
            changable += ('password',)
        to_update = {}

        for key in kwargs:
            if (key in changable and (key not in exact_user or
                                      kwargs[key] != exact_user[key])):
                    to_update[key] = kwargs[key]

        if to_update:
            log.info('Updating keystone user {} with: {}'.format(user_id,
                                                                 to_update))
            try:
                resp = _keystonev3_call(
                    'user_update', user_id=user_id,
                    cloud_name=cloud_name, **to_update
                )
            except Exception as e:
                log.error('Keystone user update failed with {}'.format(e))
                return _update_failed(name, 'user')
            return _updated(name, 'user', resp)
        else:
            return _no_changes(name, 'user')
    else:
        return _find_failed(name, 'user')


def user_absent(name, cloud_name):
    try:
        _keystonev3_call('user_get_details', user_id=name,
                         cloud_name=cloud_name)
    except Exception as e:
        if 'ResourceNotFound' in repr(e):
            return _absent(name, 'user')
        else:
            log.error('Failed to get user {}'.format(e))
            return _find_failed(name, 'user')
    try:
        _keystonev3_call('user_delete', user_id=name, cloud_name=cloud_name)
    except Exception:
        return _delete_failed(name, 'user')
    return _deleted(name, 'user')


def user_role_assigned(name, role_id, cloud_name, project_id=None,
                       domain_id=None, role_domain_id=None, **kwargs):

    user_id = _keystonev3_call(
              'user_get_details', name,
              cloud_name=cloud_name)['user']['id']

    if project_id:
        project_id = _keystonev3_call(
                 'project_get_details', project_id,
                 cloud_name=cloud_name)['project']['id']

    if domain_id:
        domain_id  = _keystonev3_call(
            'domain_get_details', domain_id,
            cloud_name=cloud_name)['domain']['id']


    if (project_id and domain_id) or (not project_id and not domain_id):
        return {
            'name': name,
            'changes': {},
            'result': False,
            'comment': 'Use project_id or domain_id (only one of them)'
        }


    if role_domain_id:
        role_domain_id  = _keystonev3_call(
            'domain_get_details', role_domain_id,
            cloud_name=cloud_name)['domain']['id']

    if role_id:
        role_id = _keystonev3_call(
            'role_get_details', role_id, domain_id=role_domain_id,
            cloud_name=cloud_name)['role']['id']

    req_kwargs = {'role.id': role_id, 'user.id': user_id,
                  'cloud_name': cloud_name}
    if domain_id:
        req_kwargs['domain_id'] = domain_id
    if project_id:
        req_kwargs['project_id'] = project_id

    role_assignments = _keystonev3_call(
                 'role_assignment_list', **req_kwargs)['role_assignments']

    req_kwargs = {'cloud_name': cloud_name, 'user_id': user_id,
                  'role_id': role_id}
    if domain_id:
        req_kwargs['domain_id'] = domain_id
    if project_id:
        req_kwargs['project_id'] = project_id

    if not role_assignments:
        method_type = 'project' if project_id else 'domain'
        method = 'role_assign_for_user_on_{}'.format(method_type)
        try:
            resp = _keystonev3_call(method, **req_kwargs)
        except Exception as e:
            log.error('Keystone user role assignment with {}'.format(e))
            return _create_failed(name, 'user_role_assignment')
        # We check for exact assignment when did role_assignment_list
        # on this stage we already just assigned role if it was missed.
        return _created(name, 'user_role_assignment', resp)
    return _no_changes(name, 'user_role_assignment')


def user_role_unassign(name, role_id, cloud_name, project_id=None,
                       domain_id=None, role_domain_id=None):
    user_id = _keystonev3_call(
        'user_get_details', name,
        cloud_name=cloud_name)['user']['id']

    if project_id:
        project_id = _keystonev3_call(
            'project_get_details', project_id,
            cloud_name=cloud_name)['project']['id']

    if domain_id:
        domain_id = _keystonev3_call(
            'domain_get_details', domain_id,
            cloud_name=cloud_name)['domain']['id']

    if (project_id and domain_id) or (not project_id and not domain_id):
        return {
            'name': name,
            'changes': {},
            'result': False,
            'comment': 'Use project_id or domain_id (only one of them)'
        }

    if role_domain_id:
        role_domain_id = _keystonev3_call(
            'domain_get_details', role_domain_id,
            cloud_name=cloud_name)['domain']['id']

    if role_id:
        role_id = _keystonev3_call(
            'role_get_details', role_id, domain_id=role_domain_id,
            cloud_name=cloud_name)['role']['id']

    req_kwargs = {'role.id': role_id, 'user.id': user_id,
                  'cloud_name': cloud_name}
    if domain_id:
        req_kwargs['domain_id'] = domain_id
    if project_id:
        req_kwargs['project_id'] = project_id

    role_assignments = _keystonev3_call(
        'role_assignment_list', **req_kwargs)['role_assignments']

    req_kwargs = {'cloud_name': cloud_name, 'user_id': user_id,
                  'role_id': role_id}
    if domain_id:
        req_kwargs['domain_id'] = domain_id
    if project_id:
        req_kwargs['project_id'] = project_id

    if not role_assignments:
        return _absent(name, 'user_role_assignment')
    else:
        method_type = 'project' if project_id else 'domain'
        method = 'role_unassign_for_user_on_{}'.format(method_type)
        try:
            _keystonev3_call(method, **req_kwargs)
        except Exception:
            return _delete_failed(name, 'user_role_assignment')
    return _deleted(name, 'user_role_assignment')


def role_present(name, cloud_name, **kwargs):

    roles = _keystonev3_call(
        'role_list', name=name, cloud_name=cloud_name
    )['roles']

    if 'domain_id' in kwargs:
        kwargs['domain_id'] = _keystonev3_call(
            'domain_get_details', kwargs['domain_id'],
            cloud_name=cloud_name)['domains']

    if not roles:
        try:
            resp = _keystonev3_call(
                'role_create', name=name, cloud_name=cloud_name, **kwargs
            )
        except Exception as e:
            log.error('Keystone role create failed with {}'.format(e))
            return _create_failed(name, 'role')
        return _created(name, 'role', resp)
    elif len(roles) == 1:
        exact_role = roles[0]
        role_id = exact_role['id']
        changable = ('domain_id')
        to_update = {}

        for key in kwargs:
            if (key in changable and (key not in exact_role or
                                      kwargs[key] != exact_role[key])):
                to_update[key] = kwargs[key]

        if to_update:
            try:
                resp = _keystonev3_call(
                    'role_update', role_id=role_id,
                    cloud_name=cloud_name, **to_update
                )
            except Exception as e:
                log.error('Keystone role update failed with {}'.format(e))
                return _update_failed(name, 'role')
            return _updated(name, 'role', resp)
        else:
            return _no_changes(name, 'role')
    else:
        return _find_failed(name, 'role')


def role_absent(name, cloud_name):
    try:
        _keystonev3_call('role_get_details', role_id=name,
                         cloud_name=cloud_name)
    except Exception as e:
        if 'ResourceNotFound' in repr(e):
            return _absent(name, 'role')
        else:
            log.error('Failed to get role {}'.format(e))
            return _find_failed(name, 'role')
    try:
        _keystonev3_call('role_delete', role_id=name, cloud_name=cloud_name)
    except Exception:
        return _delete_failed(name, 'role')
    return _deleted(name, 'role')


def _created(name, resource, resource_definition):
    changes_dict = {
        'name': name,
        'changes': resource_definition,
        'result': True,
        'comment': '{}{} created'.format(resource, name)
    }
    return changes_dict


def _updated(name, resource, resource_definition):
    changes_dict = {
        'name': name,
        'changes': resource_definition,
        'result': True,
        'comment': '{}{} updated'.format(resource, name)
    }
    return changes_dict


def _no_changes(name, resource):
    changes_dict = {
        'name': name,
        'changes': {},
        'result': True,
        'comment': '{}{} is in desired state'.format(resource, name)
    }
    return changes_dict


def _deleted(name, resource):
    changes_dict = {
        'name': name,
        'changes': {},
        'result': True,
        'comment': '{}{} removed'.format(resource, name)
    }
    return changes_dict


def _absent(name, resource):
    changes_dict = {'name': name,
                    'changes': {},
                    'comment': '{0} {1} not present'.format(resource, name),
                    'result': True}
    return changes_dict


def _delete_failed(name, resource):
    changes_dict = {'name': name,
                    'changes': {},
                    'comment': '{0} {1} failed to delete'.format(resource,
                                                                 name),
                    'result': False}
    return changes_dict


def _create_failed(name, resource):
    changes_dict = {'name': name,
                    'changes': {},
                    'comment': '{0} {1} failed to create'.format(resource,
                                                                 name),
                    'result': False}
    return changes_dict


def _update_failed(name, resource):
    changes_dict = {'name': name,
                    'changes': {},
                    'comment': '{0} {1} failed to update'.format(resource,
                                                                 name),
                    'result': False}
    return changes_dict


def _find_failed(name, resource):
    changes_dict = {
        'name': name,
        'changes': {},
        'comment': '{0} {1} found multiple {0}'.format(resource, name),
        'result': False,
    }
    return changes_dict