1919# SERVICE_TOKEN - aka admin_token in keystone.conf
2020# SERVICE_ENDPOINT - local Keystone admin endpoint
2121# SERVICE_TENANT_NAME - name of tenant containing service accounts
22+ # SERVICE_HOST - host used for endpoint creation
2223# ENABLED_SERVICES - stack.sh's list of services to start
2324# DEVSTACK_DIR - Top-level DevStack directory
25+ # KEYSTONE_CATALOG_BACKEND - used to determine service catalog creation
26+
27+ # Defaults
28+ # --------
2429
2530ADMIN_PASSWORD=${ADMIN_PASSWORD:- secrete}
2631SERVICE_PASSWORD=${SERVICE_PASSWORD:- $ADMIN_PASSWORD }
@@ -29,17 +34,22 @@ export SERVICE_ENDPOINT=$SERVICE_ENDPOINT
2934SERVICE_TENANT_NAME=${SERVICE_TENANT_NAME:- service}
3035
3136function get_id () {
32- echo ` $@ | awk ' / id / { print $4 }' `
37+ echo ` " $@ " | awk ' / id / { print $4 }' `
3338}
3439
40+
3541# Tenants
42+ # -------
43+
3644ADMIN_TENANT=$( get_id keystone tenant-create --name=admin)
3745SERVICE_TENANT=$( get_id keystone tenant-create --name=$SERVICE_TENANT_NAME )
3846DEMO_TENANT=$( get_id keystone tenant-create --name=demo)
3947INVIS_TENANT=$( get_id keystone tenant-create --name=invisible_to_admin)
4048
4149
4250# Users
51+ # -----
52+
4353ADMIN_USER=$( get_id keystone user-create --name=admin \
4454 --pass=" $ADMIN_PASSWORD " \
4555 --email=admin@example.com)
@@ -49,6 +59,8 @@ DEMO_USER=$(get_id keystone user-create --name=demo \
4959
5060
5161# Roles
62+ # -----
63+
5264ADMIN_ROLE=$( get_id keystone role-create --name=admin)
5365KEYSTONEADMIN_ROLE=$( get_id keystone role-create --name=KeystoneAdmin)
5466KEYSTONESERVICE_ROLE=$( get_id keystone role-create --name=KeystoneServiceAdmin)
@@ -73,58 +85,191 @@ keystone user-role-add --user_id $DEMO_USER --role_id $MEMBER_ROLE --tenant_id $
7385keystone user-role-add --user_id $DEMO_USER --role_id $MEMBER_ROLE --tenant_id $INVIS_TENANT
7486
7587
76- # Configure service users/roles
77- NOVA_USER=$( get_id keystone user-create --name=nova \
78- --pass=" $SERVICE_PASSWORD " \
79- --tenant_id $SERVICE_TENANT \
80- --email=nova@example.com)
81- keystone user-role-add --tenant_id $SERVICE_TENANT \
82- --user_id $NOVA_USER \
83- --role_id $ADMIN_ROLE
88+ # Services
89+ # --------
8490
85- GLANCE_USER=$( get_id keystone user-create --name=glance \
86- --pass=" $SERVICE_PASSWORD " \
87- --tenant_id $SERVICE_TENANT \
88- --email=glance@example.com)
89- keystone user-role-add --tenant_id $SERVICE_TENANT \
90- --user_id $GLANCE_USER \
91- --role_id $ADMIN_ROLE
91+ # Keystone
92+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
93+ KEYSTONE_SERVICE=$( get_id keystone service-create \
94+ --name=keystone \
95+ --type=identity \
96+ --description=" Keystone Identity Service" )
97+ keystone endpoint-create \
98+ --region RegionOne \
99+ --service_id $KEYSTONE_SERVICE \
100+ --publicurl " http://$SERVICE_HOST :\$ (public_port)s/v2.0" \
101+ --adminurl " http://$SERVICE_HOST :\$ (admin_port)s/v2.0" \
102+ --internalurl " http://$SERVICE_HOST :\$ (admin_port)s/v2.0"
103+ fi
92104
93- if [[ " $ENABLED_SERVICES " =~ " swift" ]]; then
94- SWIFT_USER=$( get_id keystone user-create --name=swift \
95- --pass=" $SERVICE_PASSWORD " \
96- --tenant_id $SERVICE_TENANT \
97- --email=swift@example.com)
98- keystone user-role-add --tenant_id $SERVICE_TENANT \
99- --user_id $SWIFT_USER \
100- --role_id $ADMIN_ROLE
105+ # Nova
106+ if [[ " $ENABLED_SERVICES " =~ " n-cpu" ]]; then
107+ NOVA_USER=$( get_id keystone user-create \
108+ --name=nova \
109+ --pass=" $SERVICE_PASSWORD " \
110+ --tenant_id $SERVICE_TENANT \
111+ --email=nova@example.com)
112+ keystone user-role-add \
113+ --tenant_id $SERVICE_TENANT \
114+ --user_id $NOVA_USER \
115+ --role_id $ADMIN_ROLE
116+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
117+ NOVA_SERVICE=$( get_id keystone service-create \
118+ --name=nova \
119+ --type=compute \
120+ --description=" Nova Compute Service" )
121+ keystone endpoint-create \
122+ --region RegionOne \
123+ --service_id $NOVA_SERVICE \
124+ --publicurl " http://$SERVICE_HOST :\$ (compute_port)s/v1.1/\$ (tenant_id)s" \
125+ --adminurl " http://$SERVICE_HOST :\$ (compute_port)s/v1.1/\$ (tenant_id)s" \
126+ --internalurl " http://$SERVICE_HOST :\$ (compute_port)s/v1.1/\$ (tenant_id)s"
127+ fi
101128 # Nova needs ResellerAdmin role to download images when accessing
102129 # swift through the s3 api. The admin role in swift allows a user
103130 # to act as an admin for their tenant, but ResellerAdmin is needed
104131 # for a user to act as any tenant. The name of this role is also
105132 # configurable in swift-proxy.conf
106133 RESELLER_ROLE=$( get_id keystone role-create --name=ResellerAdmin)
107- keystone user-role-add --tenant_id $SERVICE_TENANT \
108- --user_id $NOVA_USER \
109- --role_id $RESELLER_ROLE
134+ keystone user-role-add \
135+ --tenant_id $SERVICE_TENANT \
136+ --user_id $NOVA_USER \
137+ --role_id $RESELLER_ROLE
110138fi
111139
112- if [[ " $ENABLED_SERVICES " =~ " quantum" ]]; then
113- QUANTUM_USER=$( get_id keystone user-create --name=quantum \
114- --pass=" $SERVICE_PASSWORD " \
115- --tenant_id $SERVICE_TENANT \
116- --email=quantum@example.com)
117- keystone user-role-add --tenant_id $SERVICE_TENANT \
118- --user_id $QUANTUM_USER \
119- --role_id $ADMIN_ROLE
140+ # Volume
141+ if [[ " $ENABLED_SERVICES " =~ " n-vol" ]]; then
142+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
143+ VOLUME_SERVICE=$( get_id keystone service-create \
144+ --name=volume \
145+ --type=volume \
146+ --description=" Volume Service" )
147+ keystone endpoint-create \
148+ --region RegionOne \
149+ --service_id $VOLUME_SERVICE \
150+ --publicurl " http://$SERVICE_HOST :8776/v1/\$ (tenant_id)s" \
151+ --adminurl " http://$SERVICE_HOST :8776/v1/\$ (tenant_id)s" \
152+ --internalurl " http://$SERVICE_HOST :8776/v1/\$ (tenant_id)s"
153+ fi
154+ fi
155+
156+ # Glance
157+ if [[ " $ENABLED_SERVICES " =~ " g-api" ]]; then
158+ GLANCE_USER=$( get_id keystone user-create \
159+ --name=glance \
160+ --pass=" $SERVICE_PASSWORD " \
161+ --tenant_id $SERVICE_TENANT \
162+ --email=glance@example.com)
163+ keystone user-role-add \
164+ --tenant_id $SERVICE_TENANT \
165+ --user_id $GLANCE_USER \
166+ --role_id $ADMIN_ROLE
167+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
168+ GLANCE_SERVICE=$( get_id keystone service-create \
169+ --name=glance \
170+ --type=image \
171+ --description=" Glance Image Service" )
172+ keystone endpoint-create \
173+ --region RegionOne \
174+ --service_id $GLANCE_SERVICE \
175+ --publicurl " http://$SERVICE_HOST :9292/v1" \
176+ --adminurl " http://$SERVICE_HOST :9292/v1" \
177+ --internalurl " http://$SERVICE_HOST :9292/v1"
178+ fi
179+ fi
180+
181+ # Swift
182+ if [[ " $ENABLED_SERVICES " =~ " swift" ]]; then
183+ SWIFT_USER=$( get_id keystone user-create \
184+ --name=swift \
185+ --pass=" $SERVICE_PASSWORD " \
186+ --tenant_id $SERVICE_TENANT \
187+ --email=swift@example.com)
188+ keystone user-role-add \
189+ --tenant_id $SERVICE_TENANT \
190+ --user_id $SWIFT_USER \
191+ --role_id $ADMIN_ROLE
192+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
193+ SWIFT_SERVICE=$( get_id keystone service-create \
194+ --name=swift \
195+ --type=" object-store" \
196+ --description=" Swift Service" )
197+ keystone endpoint-create \
198+ --region RegionOne \
199+ --service_id $SWIFT_SERVICE \
200+ --publicurl " http://$SERVICE_HOST :8080/v1/AUTH_\$ (tenant_id)s" \
201+ --adminurl " http://$SERVICE_HOST :8080/v1" \
202+ --internalurl " http://$SERVICE_HOST :8080/v1/AUTH_\$ (tenant_id)s"
203+ fi
204+ fi
205+
206+ if [[ " $ENABLED_SERVICES " =~ " q-svc" ]]; then
207+ QUANTUM_USER=$( get_id keystone user-create \
208+ --name=quantum \
209+ --pass=" $SERVICE_PASSWORD " \
210+ --tenant_id $SERVICE_TENANT \
211+ --email=quantum@example.com)
212+ keystone user-role-add \
213+ --tenant_id $SERVICE_TENANT \
214+ --user_id $QUANTUM_USER \
215+ --role_id $ADMIN_ROLE
216+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
217+ QUANTUM_SERVICE=$( get_id keystone service-create \
218+ --name=quantum \
219+ --type=network \
220+ --description=" Quantum Service" )
221+ keystone endpoint-create \
222+ --region RegionOne \
223+ --service_id $QUANTUM_SERVICE \
224+ --publicurl " http://$SERVICE_HOST :9696/" \
225+ --adminurl " http://$SERVICE_HOST :9696/" \
226+ --internalurl " http://$SERVICE_HOST :9696/"
227+ fi
228+ fi
229+
230+ # EC2
231+ if [[ " $ENABLED_SERVICES " =~ " n-api" ]]; then
232+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
233+ EC2_SERVICE=$( get_id keystone service-create \
234+ --name=ec2 \
235+ --type=ec2 \
236+ --description=" EC2 Compatibility Layer" )
237+ keystone endpoint-create \
238+ --region RegionOne \
239+ --service_id $EC2_SERVICE \
240+ --publicurl " http://$SERVICE_HOST :8773/services/Cloud" \
241+ --adminurl " http://$SERVICE_HOST :8773/services/Admin" \
242+ --internalurl " http://$SERVICE_HOST :8773/services/Cloud"
243+ fi
244+ fi
245+
246+ # S3
247+ if [[ " $ENABLED_SERVICES " =~ " n-obj" || " $ENABLED_SERVICES " =~ " swift" ]]; then
248+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
249+ S3_SERVICE=$( get_id keystone service-create \
250+ --name=s3 \
251+ --type=s3 \
252+ --description=" S3" )
253+ keystone endpoint-create \
254+ --region RegionOne \
255+ --service_id $S3_SERVICE \
256+ --publicurl " http://$SERVICE_HOST :$S3_SERVICE_PORT " \
257+ --adminurl " http://$SERVICE_HOST :$S3_SERVICE_PORT " \
258+ --internalurl " http://$SERVICE_HOST :$S3_SERVICE_PORT "
259+ fi
120260fi
121261
122262if [[ " $ENABLED_SERVICES " =~ " tempest" ]]; then
123263 # Tempest has some tests that validate various authorization checks
124264 # between two regular users in separate tenants
125- ALT_DEMO_TENANT=$( get_id keystone tenant-create --name=alt_demo)
126- ALT_DEMO_USER=$( get_id keystone user-create --name=alt_demo \
127- --pass=" $ADMIN_PASSWORD " \
128- --email=alt_demo@example.com)
129- keystone user-role-add --user $ALT_DEMO_USER --role $MEMBER_ROLE --tenant_id $ALT_DEMO_TENANT
265+ ALT_DEMO_TENANT=$( get_id keystone tenant-create \
266+ --name=alt_demo)
267+ ALT_DEMO_USER=$( get_id keystone user-create \
268+ --name=alt_demo \
269+ --pass=" $ADMIN_PASSWORD " \
270+ --email=alt_demo@example.com)
271+ keystone user-role-add \
272+ --tenant_id $ALT_DEMO_TENANT \
273+ --user_id $ALT_DEMO_USER \
274+ --role_id $MEMBER_ROLE
130275fi
0 commit comments