2020# SERVICE_TOKEN - aka admin_token in keystone.conf
2121# SERVICE_ENDPOINT - local Keystone admin endpoint
2222# SERVICE_TENANT_NAME - name of tenant containing service accounts
23+ # SERVICE_HOST - host used for endpoint creation
2324# ENABLED_SERVICES - stack.sh's list of services to start
2425# DEVSTACK_DIR - Top-level DevStack directory
26+ # KEYSTONE_CATALOG_BACKEND - used to determine service catalog creation
27+
28+ # Defaults
29+ # --------
2530
2631ADMIN_PASSWORD=${ADMIN_PASSWORD:- secrete}
2732SERVICE_PASSWORD=${SERVICE_PASSWORD:- $ADMIN_PASSWORD }
@@ -30,17 +35,22 @@ export SERVICE_ENDPOINT=$SERVICE_ENDPOINT
3035SERVICE_TENANT_NAME=${SERVICE_TENANT_NAME:- service}
3136
3237function get_id () {
33- echo ` $@ | awk ' / id / { print $4 }' `
38+ echo ` " $@ " | awk ' / id / { print $4 }' `
3439}
3540
41+
3642# Tenants
43+ # -------
44+
3745ADMIN_TENANT=$( get_id keystone tenant-create --name=admin)
3846SERVICE_TENANT=$( get_id keystone tenant-create --name=$SERVICE_TENANT_NAME )
3947DEMO_TENANT=$( get_id keystone tenant-create --name=demo)
4048INVIS_TENANT=$( get_id keystone tenant-create --name=invisible_to_admin)
4149
4250
4351# Users
52+ # -----
53+
4454ADMIN_USER=$( get_id keystone user-create --name=admin \
4555 --pass=" $ADMIN_PASSWORD " \
4656 --email=admin@example.com)
@@ -50,6 +60,8 @@ DEMO_USER=$(get_id keystone user-create --name=demo \
5060
5161
5262# Roles
63+ # -----
64+
5365ADMIN_ROLE=$( get_id keystone role-create --name=admin)
5466KEYSTONEADMIN_ROLE=$( get_id keystone role-create --name=KeystoneAdmin)
5567KEYSTONESERVICE_ROLE=$( get_id keystone role-create --name=KeystoneServiceAdmin)
@@ -74,60 +86,193 @@ keystone user-role-add --user_id $DEMO_USER --role_id $MEMBER_ROLE --tenant_id $
7486keystone user-role-add --user_id $DEMO_USER --role_id $MEMBER_ROLE --tenant_id $INVIS_TENANT
7587
7688
77- # Configure service users/roles
78- NOVA_USER=$( get_id keystone user-create --name=nova \
79- --pass=" $SERVICE_PASSWORD " \
80- --tenant_id $SERVICE_TENANT \
81- --email=nova@example.com)
82- keystone user-role-add --tenant_id $SERVICE_TENANT \
83- --user_id $NOVA_USER \
84- --role_id $ADMIN_ROLE
89+ # Services
90+ # --------
8591
86- GLANCE_USER=$( get_id keystone user-create --name=glance \
87- --pass=" $SERVICE_PASSWORD " \
88- --tenant_id $SERVICE_TENANT \
89- --email=glance@example.com)
90- keystone user-role-add --tenant_id $SERVICE_TENANT \
91- --user_id $GLANCE_USER \
92- --role_id $ADMIN_ROLE
92+ # Keystone
93+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
94+ KEYSTONE_SERVICE=$( get_id keystone service-create \
95+ --name=keystone \
96+ --type=identity \
97+ --description=" Keystone Identity Service" )
98+ keystone endpoint-create \
99+ --region RegionOne \
100+ --service_id $KEYSTONE_SERVICE \
101+ --publicurl " http://$SERVICE_HOST :\$ (public_port)s/v2.0" \
102+ --adminurl " http://$SERVICE_HOST :\$ (admin_port)s/v2.0" \
103+ --internalurl " http://$SERVICE_HOST :\$ (admin_port)s/v2.0"
104+ fi
93105
94- if [[ " $ENABLED_SERVICES " =~ " swift" ]]; then
95- SWIFT_USER=$( get_id keystone user-create --name=swift \
96- --pass=" $SERVICE_PASSWORD " \
97- --tenant_id $SERVICE_TENANT \
98- --email=swift@example.com)
99- keystone user-role-add --tenant_id $SERVICE_TENANT \
100- --user_id $SWIFT_USER \
101- --role_id $ADMIN_ROLE
106+ # Nova
107+ if [[ " $ENABLED_SERVICES " =~ " n-cpu" ]]; then
108+ NOVA_USER=$( get_id keystone user-create \
109+ --name=nova \
110+ --pass=" $SERVICE_PASSWORD " \
111+ --tenant_id $SERVICE_TENANT \
112+ --email=nova@example.com)
113+ keystone user-role-add \
114+ --tenant_id $SERVICE_TENANT \
115+ --user_id $NOVA_USER \
116+ --role_id $ADMIN_ROLE
117+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
118+ NOVA_SERVICE=$( get_id keystone service-create \
119+ --name=nova \
120+ --type=compute \
121+ --description=" Nova Compute Service" )
122+ keystone endpoint-create \
123+ --region RegionOne \
124+ --service_id $NOVA_SERVICE \
125+ --publicurl " http://$SERVICE_HOST :\$ (compute_port)s/v1.1/\$ (tenant_id)s" \
126+ --adminurl " http://$SERVICE_HOST :\$ (compute_port)s/v1.1/\$ (tenant_id)s" \
127+ --internalurl " http://$SERVICE_HOST :\$ (compute_port)s/v1.1/\$ (tenant_id)s"
128+ fi
102129 # Nova needs ResellerAdmin role to download images when accessing
103130 # swift through the s3 api. The admin role in swift allows a user
104131 # to act as an admin for their tenant, but ResellerAdmin is needed
105132 # for a user to act as any tenant. The name of this role is also
106133 # configurable in swift-proxy.conf
107134 RESELLER_ROLE=$( get_id keystone role-create --name=ResellerAdmin)
108- keystone user-role-add --tenant_id $SERVICE_TENANT \
109- --user_id $NOVA_USER \
110- --role_id $RESELLER_ROLE
135+ keystone user-role-add \
136+ --tenant_id $SERVICE_TENANT \
137+ --user_id $NOVA_USER \
138+ --role_id $RESELLER_ROLE
111139fi
112140
113- if [[ " $ENABLED_SERVICES " =~ " quantum" ]]; then
114- QUANTUM_USER=$( get_id keystone user-create --name=quantum \
115- --pass=" $SERVICE_PASSWORD " \
116- --tenant_id $SERVICE_TENANT \
117- --email=quantum@example.com)
118- keystone user-role-add --tenant_id $SERVICE_TENANT \
119- --user_id $QUANTUM_USER \
120- --role_id $ADMIN_ROLE
141+ # Volume
142+ if [[ " $ENABLED_SERVICES " =~ " n-vol" ]]; then
143+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
144+ VOLUME_SERVICE=$( get_id keystone service-create \
145+ --name=volume \
146+ --type=volume \
147+ --description=" Volume Service" )
148+ keystone endpoint-create \
149+ --region RegionOne \
150+ --service_id $VOLUME_SERVICE \
151+ --publicurl " http://$SERVICE_HOST :8776/v1/\$ (tenant_id)s" \
152+ --adminurl " http://$SERVICE_HOST :8776/v1/\$ (tenant_id)s" \
153+ --internalurl " http://$SERVICE_HOST :8776/v1/\$ (tenant_id)s"
154+ fi
155+ fi
156+
157+ # Glance
158+ if [[ " $ENABLED_SERVICES " =~ " g-api" ]]; then
159+ GLANCE_USER=$( get_id keystone user-create \
160+ --name=glance \
161+ --pass=" $SERVICE_PASSWORD " \
162+ --tenant_id $SERVICE_TENANT \
163+ --email=glance@example.com)
164+ keystone user-role-add \
165+ --tenant_id $SERVICE_TENANT \
166+ --user_id $GLANCE_USER \
167+ --role_id $ADMIN_ROLE
168+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
169+ GLANCE_SERVICE=$( get_id keystone service-create \
170+ --name=glance \
171+ --type=image \
172+ --description=" Glance Image Service" )
173+ keystone endpoint-create \
174+ --region RegionOne \
175+ --service_id $GLANCE_SERVICE \
176+ --publicurl " http://$SERVICE_HOST :9292/v1" \
177+ --adminurl " http://$SERVICE_HOST :9292/v1" \
178+ --internalurl " http://$SERVICE_HOST :9292/v1"
179+ fi
180+ fi
181+
182+ # Swift
183+ if [[ " $ENABLED_SERVICES " =~ " swift" ]]; then
184+ SWIFT_USER=$( get_id keystone user-create \
185+ --name=swift \
186+ --pass=" $SERVICE_PASSWORD " \
187+ --tenant_id $SERVICE_TENANT \
188+ --email=swift@example.com)
189+ keystone user-role-add \
190+ --tenant_id $SERVICE_TENANT \
191+ --user_id $SWIFT_USER \
192+ --role_id $ADMIN_ROLE
193+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
194+ SWIFT_SERVICE=$( get_id keystone service-create \
195+ --name=swift \
196+ --type=" object-store" \
197+ --description=" Swift Service" )
198+ keystone endpoint-create \
199+ --region RegionOne \
200+ --service_id $SWIFT_SERVICE \
201+ --publicurl " http://$SERVICE_HOST :8080/v1/AUTH_\$ (tenant_id)s" \
202+ --adminurl " http://$SERVICE_HOST :8080/v1" \
203+ --internalurl " http://$SERVICE_HOST :8080/v1/AUTH_\$ (tenant_id)s"
204+ fi
205+ fi
206+
207+ if [[ " $ENABLED_SERVICES " =~ " q-svc" ]]; then
208+ QUANTUM_USER=$( get_id keystone user-create \
209+ --name=quantum \
210+ --pass=" $SERVICE_PASSWORD " \
211+ --tenant_id $SERVICE_TENANT \
212+ --email=quantum@example.com)
213+ keystone user-role-add \
214+ --tenant_id $SERVICE_TENANT \
215+ --user_id $QUANTUM_USER \
216+ --role_id $ADMIN_ROLE
217+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
218+ QUANTUM_SERVICE=$( get_id keystone service-create \
219+ --name=quantum \
220+ --type=network \
221+ --description=" Quantum Service" )
222+ keystone endpoint-create \
223+ --region RegionOne \
224+ --service_id $QUANTUM_SERVICE \
225+ --publicurl " http://$SERVICE_HOST :9696/" \
226+ --adminurl " http://$SERVICE_HOST :9696/" \
227+ --internalurl " http://$SERVICE_HOST :9696/"
228+ fi
229+ fi
230+
231+ # EC2
232+ if [[ " $ENABLED_SERVICES " =~ " n-api" ]]; then
233+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
234+ EC2_SERVICE=$( get_id keystone service-create \
235+ --name=ec2 \
236+ --type=ec2 \
237+ --description=" EC2 Compatibility Layer" )
238+ keystone endpoint-create \
239+ --region RegionOne \
240+ --service_id $EC2_SERVICE \
241+ --publicurl " http://$SERVICE_HOST :8773/services/Cloud" \
242+ --adminurl " http://$SERVICE_HOST :8773/services/Admin" \
243+ --internalurl " http://$SERVICE_HOST :8773/services/Cloud"
244+ fi
245+ fi
246+
247+ # S3
248+ if [[ " $ENABLED_SERVICES " =~ " n-obj" || " $ENABLED_SERVICES " =~ " swift" ]]; then
249+ if [[ " $KEYSTONE_CATALOG_BACKEND " = ' sql' ]]; then
250+ S3_SERVICE=$( get_id keystone service-create \
251+ --name=s3 \
252+ --type=s3 \
253+ --description=" S3" )
254+ keystone endpoint-create \
255+ --region RegionOne \
256+ --service_id $S3_SERVICE \
257+ --publicurl " http://$SERVICE_HOST :$S3_SERVICE_PORT " \
258+ --adminurl " http://$SERVICE_HOST :$S3_SERVICE_PORT " \
259+ --internalurl " http://$SERVICE_HOST :$S3_SERVICE_PORT "
260+ fi
121261fi
122262
123263if [[ " $ENABLED_SERVICES " =~ " tempest" ]]; then
124264 # Tempest has some tests that validate various authorization checks
125265 # between two regular users in separate tenants
126- ALT_DEMO_TENANT=$( get_id keystone tenant-create --name=alt_demo)
127- ALT_DEMO_USER=$( get_id keystone user-create --name=alt_demo \
128- --pass=" $ADMIN_PASSWORD " \
129- --email=alt_demo@example.com)
130- keystone user-role-add --user $ALT_DEMO_USER --role $MEMBER_ROLE --tenant_id $ALT_DEMO_TENANT
266+ ALT_DEMO_TENANT=$( get_id keystone tenant-create \
267+ --name=alt_demo)
268+ ALT_DEMO_USER=$( get_id keystone user-create \
269+ --name=alt_demo \
270+ --pass=" $ADMIN_PASSWORD " \
271+ --email=alt_demo@example.com)
272+ keystone user-role-add \
273+ --tenant_id $ALT_DEMO_TENANT \
274+ --user_id $ALT_DEMO_USER \
275+ --role_id $MEMBER_ROLE
131276fi
132277
133278if [[ " $ENABLED_SERVICES " =~ " cinder" ]]; then
0 commit comments