Init keystone data step by step ( by quqi99 )

Init keystone data step by step ( by quqi99 )

作者：张华 发表于：2013-01-02

版权声明：可以任意转载，转载时请务必以超链接形式标明文章原始出处和作者信息及本版权声明

( http://blog.csdn.net/quqi99 )

8.1 Create the services:

COMPUTE_ID=$(keystone service-create --name=nova --type=compute --description="Nova Compute Service" |awk -F "|" '$2 ~ /id/ {print $3}')

keystone service-create --name nova-volume --type volume --description 'OpenStack Nova Volume Service'

keystone service-create --name glance --type image --description 'OpenStack Image Service'

keystone service-create --name keystone --type identity --description 'OpenStack Identity Service'

keystone service-create --name quantum --type network --description 'Openstack Network Service'

[root@node1 ~]# keystone service-list

+----------------------------------+-------------+----------+-------------------------------+

| id | name | type | description |

+----------------------------------+-------------+----------+-------------------------------+

| 08c9dda3576347c49290eebebb7a39cb | quantum | network | Openstack Network Service |

| 5c4fd5fb7b054ce4af29ac4c17b7bee0 | nova | compute | OpenStack Compute Service |

| 70490f9d704e4c368e697126c771e250 | keystone | identity | OpenStack Identity Service |

| 7955a55492064fa8b70783616688f881 | glance | image | OpenStack Image Service |

| d0e33c89f72b4cffa2738a6e0ffb1828 | nova-volume | volume | OpenStack Nova Volume Service |

+----------------------------------+-------------+----------+-------------------------------+

8.2 Create the endpoints:

IDENTITY_ID=70490f9d704e4c368e697126c771e250

COMPUTE_ID=5c4fd5fb7b054ce4af29ac4c17b7bee0

VOLUME_ID=d0e33c89f72b4cffa2738a6e0ffb1828

IMAGE_ID=7955a55492064fa8b70783616688f881

NETWORD_ID=08c9dda3576347c49290eebebb7a39cb

keystone endpoint-create --region=RegionOne --service_id=$IDENTITY_ID --publicurl='http://node1:$(public_port)s/v2.0' --internalurl='http://node1:$(public_port)s/v2.0' --adminurl='http://node1:$(admin_port)s/v2.0'

keystone endpoint-create --region=RegionOne --service_id=$COMPUTE_ID --publicurl='http://node1:$(compute_port)s/v1.1/$(tenant_id)s' --internalurl='http://node1:$(compute_port)s/v1.1/$(tenant_id)s' --adminurl='http://node1:$(compute_port)s/v1.1/$(tenant_id)s'

keystone endpoint-create --region=RegionOne --service_id=$VOLUME_ID --publicurl='http://node1:8776/v1/$(tenant_id)s' --internalurl='http://node1:8776/v1/$(tenant_id)s' --adminurl='http://node1:8776/v1/$(tenant_id)s'

keystone endpoint-create --region=RegionOne --service_id=$IMAGE_ID --publicurl='http://node1:9292/v1' --internalurl='http://node1:9292/v1' --adminurl='http://node1:9292/v1'

keystone endpoint-create --region=RegionOne --service_id=$NETWORD_ID --publicurl='http://node1:9696/' --internalurl='http://node1:9696/' --adminurl='http://node1:9696/'

8.3 You can use following scripts to create admin user:

SERVICE_TOKEN=ADMIN

ADMIN_PASSWORD=password

SERVICE_ENDPOINT=http://node1:35357/v2.0

export SERVICE_TOKEN=$SERVICE_TOKEN

export SERVICE_ENDPOINT=$SERVICE_ENDPOINT

function get_id(){

echo`$@ |grep id |awk '{print$4}'`

}

ADMIN_TENANT=`get_id keystonetenant-create --name=admin`

ADMIN_USER=`get_id keystoneuser -create --name=admin --pass="$ADMIN_PASSWORD" --email=admin@example.com`

ADMIN_ROLE=`get_id keystonerole -create --name=admin`

KEYSTONESERVICE_ROLE=`get_id keystonerole -create --name=KeystoneServiceAdmin`

keystone user-role-add --user-id $ADMIN_USER --role-id $ADMIN_ROLE --tenant_id $ADMIN_TENANT

keystone user-role-add --user-id $ADMIN_USER --role-id $KEYSTONESERVICE_ROLE --tenant_id$ADMIN_TENANT

echo$?

Or you can do it step by step as bellow:

8.3.1 Create the roles:

keystone role-create --name KeystoneServiceAdmin

keystone role-create --name Admin

keystone role-create --name Member

keystone role-create --name sysadmin

keystone role-create --name netadmin

8.3.2 Create users and tenants, one user can visit multi tenants, admin user can visit all tenants.

keystone tenant-create --name admin

keystone tenant-create --name tenant1

keystone tenant-create --name tenant2

keystone user-create --name admin --tenant_id cfdf5ed5e5b44d04a608627775a8c5ed --pass password --email admin@cn.ibm.com --enabled true

keystone user-create --name hua --tenant_id 82f45edf672b4d9280b59a046d906ef9 --pass password --email hua@cn.ibm.com --enabled true

Note: for another tenant of user hua, we will associate using following command in the bellow:

keystone user-role-add --user-id 10b10ece31cb4617ac36dac10249791c --role-id 0e79b691e5934e2ab41882f931fa8b7d --tenant_id=0215ab0266c54f578d34614d01a7d05d

[root@node1 ~]# keystone tenant-list

+----------------------------------+---------+---------+

| id | name | enabled |

+----------------------------------+---------+---------+

| 0215ab0266c54f578d34614d01a7d05d | tenant2 | True |

| 82f45edf672b4d9280b59a046d906ef9 | tenant1 | True |

| cfdf5ed5e5b44d04a608627775a8c5ed | admin | True |

+----------------------------------+---------+---------+

[root@node1 ~]# keystone user-list

+----------------------------------+-------+---------+------------------+

| id | name | enabled | email |

+----------------------------------+-------+---------+------------------+

| 10b10ece31cb4617ac36dac10249791c | hua | True | hua@cn.ibm.com |

| 198cb7a91a5d4e03b959924a16bf2fc9 | admin | True | admin@cn.ibm.com |

+----------------------------------+-------+---------+------------------+

[root@node1 ~]# keystone role-list

+----------------------------------+----------------------+

| id | name |

+----------------------------------+----------------------+

| 0e79b691e5934e2ab41882f931fa8b7d | Member |

| 1fc6404b6b194e768a6b79b365c15523 | sysadmin |

| 5beddbed11c6457989ef29295a3b6a05 | KeystoneServiceAdmin |

| 968b63e22684429fa3e66d99865038c4 | Admin |

| c81ea6a629274de6bc5863640723d6bf | netadmin |

+----------------------------------+----------------------+

8.3.3 Only admin user can manage keystone, so need add the KeystoneServiceAdmin role to the admin user for each tenant:

keystone user-role-add --user-id 198cb7a91a5d4e03b959924a16bf2fc9 --role-id 5beddbed11c6457989ef29295a3b6a05 --tenant_id=0215ab0266c54f578d34614d01a7d05d

keystone user-role-add --user-id 198cb7a91a5d4e03b959924a16bf2fc9 --role-id 5beddbed11c6457989ef29295a3b6a05 --tenant_id=82f45edf672b4d9280b59a046d906ef9

keystone user-role-add --user-id 198cb7a91a5d4e03b959924a16bf2fc9 --role-id 5beddbed11c6457989ef29295a3b6a05 --tenant_id=cfdf5ed5e5b44d04a608627775a8c5ed

8.3.4 Add the Admin role to the admin user for each tenant:

keystone user-role-add --user-id 198cb7a91a5d4e03b959924a16bf2fc9 --role-id 968b63e22684429fa3e66d99865038c4 --tenant_id=0215ab0266c54f578d34614d01a7d05d

keystone user-role-add --user-id 198cb7a91a5d4e03b959924a16bf2fc9 --role-id 968b63e22684429fa3e66d99865038c4 --tenant_id=82f45edf672b4d9280b59a046d906ef9

keystone user-role-add --user-id 198cb7a91a5d4e03b959924a16bf2fc9 --role-id 968b63e22684429fa3e66d99865038c4 --tenant_id=cfdf5ed5e5b44d04a608627775a8c5ed

8.3.5 The common user hua have two tenants, should add the Member role to the hua user for each tenant:

keystone user-role-add --user-id 10b10ece31cb4617ac36dac10249791c --role-id 0e79b691e5934e2ab41882f931fa8b7d --tenant_id=0215ab0266c54f578d34614d01a7d05d

keystone user-role-add --user-id 10b10ece31cb4617ac36dac10249791c --role-id 0e79b691e5934e2ab41882f931fa8b7d --tenant_id=82f45edf672b4d9280b59a046d906ef9