Initial commit: stateful OpenStack API laboratory simulator.

Ship Keystone auth, multi-service handlers (Yoga→Dalmatian), Compose/Helm packaging, API contract packs, and pytest/Pulumi coverage labs.
2026-07-18 04:26:48 +03:00
commit 6033967e6a
509 changed files with 464404 additions and 0 deletions
@@ -0,0 +1,80 @@
+**Language / Язык:** [English](authentication.md) | [Русский](ru/authentication.md)
+
+# Authentication
+
+The simulator implements **Keystone v3** password authentication and project
+scoping (lab subset).
+
+## Password auth
+
+```http
+POST /v3/auth/tokens
+Content-Type: application/json
+
+{
+  "auth": {
+    "identity": {
+      "methods": ["password"],
+      "password": {
+        "user": {
+          "name": "admin",
+          "domain": {"name": "Default"},
+          "password": "secret"
+        }
+      }
+    },
+    "scope": {
+      "project": {"name": "demo", "domain": {"name": "Default"}}
+    }
+  }
+}
+```
+
+Response:
+
+- Header **`X-Subject-Token`** — use as **`X-Auth-Token`** on subsequent calls
+- Body `token.catalog` — service endpoints (ports match [ports.md](ports.md))
+
+## Seeded principals
+
+Password for all users: **`secret`**. Domain: **`Default`**.
+
+### Minimal seed
+
+| User | Projects | Role |
+|---|---|---|
+| `admin` | `admin`, `demo` | admin |
+| `demo` | `demo` | member |
+
+### Demo cloud
+
+| User | Typical projects |
+|---|---|
+| `admin` | all |
+| `ops` | production, staging |
+| `developer` | development, staging |
+| `demo` / `auditor` | demo / production |
+
+## Unscoped / errors
+
+- Missing token → `401 Unauthorized`
+- Wrong password → `401`
+- Project-scoped APIs without project scope → `401` with a clear message
+
+## openstacksdk / CLI
+
+```bash
+export OS_AUTH_URL=http://127.0.0.1:5000/v3
+export OS_USERNAME=admin
+export OS_PASSWORD=secret
+export OS_PROJECT_NAME=demo
+export OS_USER_DOMAIN_NAME=Default
+export OS_PROJECT_DOMAIN_NAME=Default
+export OS_IDENTITY_API_VERSION=3
+
+openstack server list
+openstack network list
+```
+
+Against Helm Ingress, set `OS_AUTH_URL=https://os-sim.example.com/v3`
+(and trust the certificate or use `--insecure` in labs).