CentOS 7
Sponsored Link

OpenStack Icehouse : Configure Keystone#2
2014/08/31
 
Add Users or Roles, Services and so on in Keystone.
[1] Load environment variables first.
Set value for "SERVICE_TOKEN" from the value "admin_token" in keystone.conf.
[root@dlp ~]#
export SERVICE_TOKEN=admintoken

[root@dlp ~]#
export SERVICE_ENDPOINT=http://10.0.0.30:35357/v2.0/

[2] Add Tenants ( like group ).
# add admin tenant

[root@dlp ~]#
keystone tenant-create --name admin --description "Admin Tenant" --enabled true 

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |           Admin Tenant           |
|   enabled   |               True               |
|      id     | 2b658c66b2c647b7ad03083636d31464 |
|     name    |              admin               |
+-------------+----------------------------------+
# add service tenant

[root@dlp ~]#
keystone tenant-create --name service --description "Service Tenant" --enabled true 

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |          Service Tenant          |
|   enabled   |               True               |
|      id     | c57296226918412eaaa6cfe165ce1d96 |
|     name    |             service              |
+-------------+----------------------------------+
# confirm settings

[root@dlp ~]#
keystone tenant-list 

+----------------------------------+---------+---------+
|                id                |   name  | enabled |
+----------------------------------+---------+---------+
| 2b658c66b2c647b7ad03083636d31464 |  admin  |   True  |
| c57296226918412eaaa6cfe165ce1d96 | service |   True  |
+----------------------------------+---------+---------+
[3] Add Roles.
# add admin role

[root@dlp ~]#
keystone role-create --name admin 

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|    id    | c9b5093fb48740bc93648e621a851138 |
|   name   |              admin               |
+----------+----------------------------------+
# add Member role

[root@dlp ~]#
keystone role-create --name Member 

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|    id    | 47a053c6a58f455384bfb4aee1000f82 |
|   name   |              Member              |
+----------+----------------------------------+
# confirm settings

[root@dlp ~]#
keystone role-list 

+----------------------------------+----------+
|                id                |   name   |
+----------------------------------+----------+
| 47a053c6a58f455384bfb4aee1000f82 |  Member  |
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ |
| c9b5093fb48740bc93648e621a851138 |  admin   |
+----------------------------------+----------+
[4] Add Users.
# add admin user (set in admin tenant)

[root@dlp ~]#
keystone user-create --tenant admin --name admin --pass adminpassword --enabled true 

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |                                  |
| enabled  |               True               |
|    id    | d754c4a4287f4636a7ca8820eb50481c |
|   name   |              admin               |
| tenantId | 2b658c66b2c647b7ad03083636d31464 |
| username |              admin               |
+----------+----------------------------------+
# add admin user in admin role

[root@dlp ~]#
keystone user-role-add --user admin --tenant admin --role admin
# add glance user (set in service tenant)

[root@dlp ~]#
keystone user-create --tenant service --name glance --pass servicepassword --enabled true 

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |                                  |
| enabled  |               True               |
|    id    | 0487b13f40244680831177127369d2e9 |
|   name   |              glance              |
| tenantId | c57296226918412eaaa6cfe165ce1d96 |
| username |              glance              |
+----------+----------------------------------+
# add glance user in admin role

[root@dlp ~]#
keystone user-role-add --user glance --tenant service --role admin
# add nova user (set in service tenant)

[root@dlp ~]#
keystone user-create --tenant service --name nova --pass servicepassword --enabled true 

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |                                  |
| enabled  |               True               |
|    id    | b671c7ecd7cc45abb353f98b7e895142 |
|   name   |               nova               |
| tenantId | c57296226918412eaaa6cfe165ce1d96 |
| username |               nova               |
+----------+----------------------------------+
# add nova user in admin role

[root@dlp ~]#
keystone user-role-add --user nova --tenant service --role admin
# confirm settings

[root@dlp ~]#
keystone user-list 

+----------------------------------+--------+---------+-------+
|                id                |  name  | enabled | email |
+----------------------------------+--------+---------+-------+
| d754c4a4287f4636a7ca8820eb50481c | admin  |   True  |       |
| 0487b13f40244680831177127369d2e9 | glance |   True  |       |
| b671c7ecd7cc45abb353f98b7e895142 |  nova  |   True  |       |
+----------------------------------+--------+---------+-------+
[5] Add entries for services
# add for keystone

[root@dlp ~]#
keystone service-create --name=keystone --type=identity --description="Keystone Identity Service" 

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |    Keystone Identity Service     |
|   enabled   |               True               |
|      id     | 42aace5bb5e64ff3acb93471a8db2fa3 |
|     name    |             keystone             |
|     type    |             identity             |
+-------------+----------------------------------+
# add for glance

[root@dlp ~]#
keystone service-create --name=glance --type=image --description="Glance Image Service" 

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |       Glance Image Service       |
|   enabled   |               True               |
|      id     | cce11ba3a7d046bb9c0cf041af37d9f5 |
|     name    |              glance              |
|     type    |              image               |
+-------------+----------------------------------+
# add for nova

[root@dlp ~]#
keystone service-create --name=nova --type=compute --description="Nova Compute Service" 

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |       Nova Compute Service       |
|   enabled   |               True               |
|      id     | b91aef6fe34b4b49a634c3d95747eb57 |
|     name    |               nova               |
|     type    |             compute              |
+-------------+----------------------------------+
# confirm settings

[root@dlp ~]#
keystone service-list 

+----------------------------------+----------+----------+---------------------------+
|                id                |   name   |   type   |        description        |
+----------------------------------+----------+----------+---------------------------+
| cce11ba3a7d046bb9c0cf041af37d9f5 |  glance  |  image   |    Glance Image Service   |
| 42aace5bb5e64ff3acb93471a8db2fa3 | keystone | identity | Keystone Identity Service |
| b91aef6fe34b4b49a634c3d95747eb57 |   nova   | compute  |    Nova Compute Service   |
+----------------------------------+----------+----------+---------------------------+
[6] Add Endpoints.
# define my host

[root@dlp ~]#
export my_host=10.0.0.30
# add endpoint for keystone

[root@dlp ~]#
keystone endpoint-create --region RegionOne \
--service keystone \
--publicurl "http://$my_host:\$(public_port)s/v2.0" \
--internalurl "http://$my_host:\$(public_port)s/v2.0" \
--adminurl "http://$my_host:\$(admin_port)s/v2.0" 

+-------------+---------------------------------------+
|   Property  |                 Value                 |
+-------------+---------------------------------------+
|   adminurl  |  http://10.0.0.30:$(admin_port)s/v2.0 |
|      id     |    cc72c49ec5784deabac8f4e44b6ac000   |
| internalurl | http://10.0.0.30:$(public_port)s/v2.0 |
|  publicurl  | http://10.0.0.30:$(public_port)s/v2.0 |
|    region   |               RegionOne               |
|  service_id |    42aace5bb5e64ff3acb93471a8db2fa3   |
+-------------+---------------------------------------+
# add endpoint for glance

[root@dlp ~]#
keystone endpoint-create --region RegionOne \
--service glance \
--publicurl "http://$my_host:9292/v1" \
--internalurl "http://$my_host:9292/v1" \
--adminurl "http://$my_host:9292/v1" 

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
|   adminurl  |     http://10.0.0.30:9292/v1     |
|      id     | ec36057322c54800a3a369fc8d9703ba |
| internalurl |     http://10.0.0.30:9292/v1     |
|  publicurl  |     http://10.0.0.30:9292/v1     |
|    region   |            RegionOne             |
|  service_id | cce11ba3a7d046bb9c0cf041af37d9f5 |
+-------------+----------------------------------+
# add endpoint for nova

[root@dlp ~]#
keystone endpoint-create --region RegionOne \
--service nova \
--publicurl "http://$my_host:\$(compute_port)s/v2/\$(tenant_id)s" \
--internalurl "http://$my_host:\$(compute_port)s/v2/\$(tenant_id)s" \
--adminurl "http://$my_host:\$(compute_port)s/v2/\$(tenant_id)s" 

+-------------+----------------------------------------------------+
|   Property  |                       Value                        |
+-------------+----------------------------------------------------+
|   adminurl  | http://10.0.0.30:$(compute_port)s/v2/$(tenant_id)s |
|      id     |          535046f3e765445faeba9c9573df526d          |
| internalurl | http://10.0.0.30:$(compute_port)s/v2/$(tenant_id)s |
|  publicurl  | http://10.0.0.30:$(compute_port)s/v2/$(tenant_id)s |
|    region   |                     RegionOne                      |
|  service_id |          b91aef6fe34b4b49a634c3d95747eb57          |
+-------------+----------------------------------------------------+
# confirm settings

[root@dlp ~]#
keystone endpoint-list 

+----------------------------------+-----------+----------------------------------------------------+
|                id                |   region  |                     publicurl                      |
+----------------------------------+-----------+----------------------------------------------------+
| 535046f3e765445faeba9c9573df526d | RegionOne | http://10.0.0.30:$(compute_port)s/v2/$(tenant_id)s |
| cc72c49ec5784deabac8f4e44b6ac000 | RegionOne |       http://10.0.0.30:$(public_port)s/v2.0        |
| ec36057322c54800a3a369fc8d9703ba | RegionOne |              http://10.0.0.30:9292/v1              |
+----------------------------------+-----------+----------------------------------------------------+
+----------------------------------------------------+----------------------------------------------------+
|                    internalurl                     |                      adminurl                      |
+----------------------------------------------------+----------------------------------------------------+
| http://10.0.0.30:$(compute_port)s/v2/$(tenant_id)s | http://10.0.0.30:$(compute_port)s/v2/$(tenant_id)s |
|       http://10.0.0.30:$(public_port)s/v2.0        |        http://10.0.0.30:$(admin_port)s/v2.0        |
|              http://10.0.0.30:9292/v1              |              http://10.0.0.30:9292/v1              |
+----------------------------------------------------+----------------------------------------------------+
+----------------------------------+
|            service_id            |
+----------------------------------+
| b91aef6fe34b4b49a634c3d95747eb57 |
| 42aace5bb5e64ff3acb93471a8db2fa3 |
| cce11ba3a7d046bb9c0cf041af37d9f5 |
+----------------------------------+
 
Tweet