Agency support

.stestr.blacklist.functional

@@ -1,6 +1,8 @@
 otcextensions.tests.functional.osclient.obs*
 otcextensions.tests.functional.osclient.rds.v3.test_instance*
 otcextensions.tests.functional.osclient.volume_backup*
+otcextensions.tests.functional.osclient.nat*
+otcextensions.tests.functional.osclient.rds*
 otcextensions.tests.functional.sdk.cce.v1*
 otcextensions.tests.functional.sdk.kms*
 otcextensions.tests.functional.sdk.volume_backup*

doc/source/install/configuration.rst

@@ -27,7 +27,7 @@ A sample clouds.yaml file is listed below to connect with Open Telekom Cloud:
     otc:
       profile: otc
       auth:
-       username: '<USER_NAME>'
+        username: '<USER_NAME>'
         password: '<PASSWORD>'
         project_name: '<eu-de_project>'
         # or project_id: '<123456_PROJECT_ID>'
@@ -73,7 +73,7 @@ to the file as shown below:
     otcfirstproject:
       profile: otc
       auth:
-       username: '<USER_NAME>'
+        username: '<USER_NAME>'
         password: '<PASSWORD>'
         project_name: '<eu-de_project>'
         # or project_id: '<123456_PROJECT_ID>'
@@ -114,7 +114,7 @@ secret which is left out from ``clouds.yaml``:
     otc:
       profile: otc
       auth:
-       username: '<USER_NAME>'
+        username: '<USER_NAME>'
         project_name: '<eu-de_project>'
         # or project_id: '<123456_PROJECT_ID>'
         user_domain_name: 'OTC00000000001000000xxx'
@@ -136,6 +136,33 @@ secret which is left out from ``clouds.yaml``:
 
 .. _environment-variables:
 
+Agency based authorization
+^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Open Telekom Cloud supports a concept of agencies. One domain delegates access
+to resources to another domain. After trust relationship is established the
+following configuration can be used in ``clouds.yaml``:
+
+.. code-block:: yaml
+
+  clouds:
+    otc:
+      profile: otc
+      auth_type: agency
+      auth:
+        username: '<USER_NAME>'
+        project_name: '<eu-de_project>'
+        # or project_id: '<123456_PROJECT_ID>'
+        user_domain_name: 'OTC00000000001000000xxx'
+        # or user_domain_id: '<123456_DOMAIN_ID>'
+        auth_url: 'https://iam.eu-de.otc.t-systems.com:443/v3'
+        target_domain_id: '<123456_DOMAIN_ID>' # Domain where agency is created
+        # or target_domain_name: '<123456_DOMAIN_NAME'
+        target_agency_name: 'test_agency' # name of the agency
+        target_project_name: '<123456_PROJECT_NAME>' # project scoped operations
+        # or target_project_id: '<123456_PROJECT_ID>'
+        # When target_project_xx is not set - domain scope is selected
+
 Configuration of Environment Variables
 --------------------------------------
 

doc/source/sdk/proxies/identity_v3.rst

@@ -10,6 +10,18 @@ The identity high-level interface is available through the ``identity``
 member of a :class:`~openstack.connection.Connection` object.  The
 ``identity`` member will only be added if the service is detected.
 
+Agency Operations
+^^^^^^^^^^^^^^^^^
+
+.. autoclass:: otcextensions.sdk.identity.v3._proxy.Proxy
+  :noindex:
+  :members: create_agency, update_agency, delete_agency,
+            get_agency, find_agency, agencies,
+            agency_project_roles, check_agency_project_role,
+            grant_agency_project_role, revoke_agency_project_role,
+            agency_domain_roles, check_agency_domain_role,
+            grant_agency_domain_role, revoke_agency_domain_role,
+
 Credential Operations
 ^^^^^^^^^^^^^^^^^^^^^
 

doc/source/sdk/resources/identity/index.rst

@@ -4,6 +4,8 @@ Identity v3 Resources
 .. toctree::
    :maxdepth: 1
 
+   v3/agency
+   v3/agency_role
    v3/credential
    v3/domain
    v3/endpoint

doc/source/sdk/resources/identity/v3/agency.rst

@@ -0,0 +1,12 @@
+otcextensions.sdk.identity.v3.agency
+====================================
+
+.. automodule:: otcextensions.sdk.identity.v3.agency
+
+The Agency Class
+----------------
+
+The ``Agency`` class inherits from :class:`~openstack.resource.Resource`.
+
+.. autoclass:: otcextensions.sdk.identity.v3.agency.Agency
+   :members:

doc/source/sdk/resources/identity/v3/agency_role.rst

@@ -0,0 +1,12 @@
+otcextensions.sdk.identity.v3.agency_role
+=========================================
+
+.. automodule:: otcextensions.sdk.identity.v3.agency_role
+
+The AgencyRole Class
+--------------------
+
+The ``AgencyRole`` class inherits from :class:`~openstack.resource.Resource`.
+
+.. autoclass:: otcextensions.sdk.identity.v3.agency_role.AgencyRole
+   :members:

examples/identity/create_credential.py

@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+"""
+Create AK/SK credentials
+"""
+import openstack
+
+
+openstack.enable_logging(True)
+conn = openstack.connect(cloud='otc')
+
+credential = conn.identity.create_credential(
+    description='my creds',
+    user_id='user_id'
+)
+print(credential)

examples/identity/delete_credential.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python3
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+"""
+Delete AK/SK credentials
+"""
+import openstack
+
+
+openstack.enable_logging(True)
+conn = openstack.connect(cloud='otc')
+
+
+name_or_id = 'AK'
+credential = conn.identity.find_credential(name_or_id, ignore_missing=False)
+response = conn.identity.delete_credential(credential)

examples/identity/find_credential.py

@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+"""
+Get AK/SK credentials
+"""
+import openstack
+
+
+openstack.enable_logging(True)
+conn = openstack.connect(cloud='otc')
+
+credential = 'AK'
+credential = conn.identity.find_credential(credential)
+print(credential)

examples/identity/get_credential.py

@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+"""
+Get AK/SK credentials
+"""
+import openstack
+
+
+openstack.enable_logging(True)
+conn = openstack.connect(cloud='otc')
+
+credential = 'AK'
+credential = conn.identity.get_credential(credential)
+print(credential)

examples/identity/list_credentials.py

@@ -0,0 +1,23 @@
+#!/usr/bin/env python3
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+"""
+List all AK/SK credentials
+"""
+import openstack
+
+
+openstack.enable_logging(True)
+conn = openstack.connect(cloud='otc')
+
+for cred in conn.identity.credentials():
+    print(cred)

examples/identity/update_credential.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+"""
+Update AK/SK credentials description or status
+"""
+import openstack
+
+
+openstack.enable_logging(True)
+conn = openstack.connect(cloud='otc')
+
+
+name_or_id = 'AK'
+credential = conn.identity.find_credential(name_or_id, ignore_missing=False)
+response = conn.identity.update_credential(
+    credential,
+    description='my creds',
+    status='inactive'
+)
+print(response)