define keystone_user from openstack/puppet-keystone via hiera?

I am using https://github.com/openstack/puppet-keystone to set up an OpenStack management/controller node. I need to add the 'glance' user to keystone. I want to try and do as much as I can in my hiera data so my manifest will be simple.

Here is my manifest:

class kilo2_keystone {
    include controller_ceph
    include keystone
    include keystone::config
    include keystone::user
#    keystone_user { 'glance':
#        ensure => present,
#    }

}

The commented out section works, but I want to be able to do include keystone::user and supply the parameters in my hiera data like so:

keystone::user: 
   "%{hiera('glance_admin_user')}":
      ensure: present

But when I run puppet agent -t on my node I get this error:

Could not find class ::keystone::user

The commented-out code declares a resource of type keystone_user, not a class. Presumably its type, keystone_user, is provided by the puppet-keystone module. The include() family of functions are for declaring classes, not resources, so they are inapplicable to keystone_user.

There is more than one way you could proceed. If you don't anticipate wanting to anything more complicated than declaring one or more keystone_users present, then I'd recommend giving your class a parameter for the user name(s), to which you can assign a value via Hiera:

class kilo2_keystone($usernames = []) {
  include controller_ceph
  include keystone
  include keystone::config

  keystone_user { $usernames:
    ensure => present,
  }
}

On the other hand, if you want to be able to declare multiple users, each with its own set of attributes, then the create_resources() function is probably the path of least resistance. You still want to parameterize your class so that it gets the data from Hiera via automated data binding, but now you want the data to be structured differently, as described in the create_resources() docs: as a hash mapping resource titles (usernames, in your case) to inner hashes of resource parameters to corresponding values.

For example, your class might look like this:

class kilo2_keystone($userdata = {}) {
  include controller_ceph
  include keystone
  include keystone::config

  create_resources('keystone_user', $userdata)
}

The corresponding data for this class might look like this:

kilo2_keystone::userdata:
  glance:
    ensure: present
    enabled: true
  another_user:
    ensure: absent

Note also that you are placing your kilo2_keystone class in the top scope. You really ought to put it in a module and assign it to that module's namespace. The latter would look like this:

class mymodule::kilo2_keystone($userdata = {}) {
  # ...
}