blob: 20749bc6bdc15cfedfb66f30776b79a6a654fd04 [file] [log] [blame]
Jesse Andrews73e27b82011-09-12 17:55:00 -07001#!/bin/bash
Dean Troyerb7d1fbb2012-03-02 08:43:09 -06002#
3# Initial data for Keystone using python-keystoneclient
4#
Doug Hellmann4a2b1c62012-11-01 16:23:52 -04005# Tenant User Roles
Chmouel Boudjnah77b0e1d2012-02-29 16:55:43 +00006# ------------------------------------------------------------------
Doug Hellmann4a2b1c62012-11-01 16:23:52 -04007# admin admin admin
8# service glance admin
9# service nova admin, [ResellerAdmin (swift only)]
10# service quantum admin # if enabled
11# service swift admin # if enabled
12# service cinder admin # if enabled
13# service heat admin # if enabled
14# service ceilometer admin # if enabled
15# demo admin admin
16# demo demo Member, anotherrole
17# invisible_to_admin demo Member
Jay Pipesb297d2d2012-05-10 11:21:22 -040018# Tempest Only:
19# alt_demo alt_demo Member
Dean Troyerb7d1fbb2012-03-02 08:43:09 -060020#
21# Variables set before calling this script:
22# SERVICE_TOKEN - aka admin_token in keystone.conf
23# SERVICE_ENDPOINT - local Keystone admin endpoint
24# SERVICE_TENANT_NAME - name of tenant containing service accounts
Dean Troyer3f7c06f2012-04-03 17:19:36 -050025# SERVICE_HOST - host used for endpoint creation
Dean Troyerb7d1fbb2012-03-02 08:43:09 -060026# ENABLED_SERVICES - stack.sh's list of services to start
27# DEVSTACK_DIR - Top-level DevStack directory
Dean Troyer3f7c06f2012-04-03 17:19:36 -050028# KEYSTONE_CATALOG_BACKEND - used to determine service catalog creation
29
30# Defaults
31# --------
Dean Troyerb7d1fbb2012-03-02 08:43:09 -060032
33ADMIN_PASSWORD=${ADMIN_PASSWORD:-secrete}
34SERVICE_PASSWORD=${SERVICE_PASSWORD:-$ADMIN_PASSWORD}
Vishvananda Ishayad1f52432012-02-09 03:50:57 +000035export SERVICE_TOKEN=$SERVICE_TOKEN
36export SERVICE_ENDPOINT=$SERVICE_ENDPOINT
Dean Troyerb7d1fbb2012-03-02 08:43:09 -060037SERVICE_TENANT_NAME=${SERVICE_TENANT_NAME:-service}
Vishvananda Ishayad1f52432012-02-09 03:50:57 +000038
39function get_id () {
Dean Troyer3f7c06f2012-04-03 17:19:36 -050040 echo `"$@" | awk '/ id / { print $4 }'`
Vishvananda Ishayad1f52432012-02-09 03:50:57 +000041}
42
Dean Troyer3f7c06f2012-04-03 17:19:36 -050043
Dean Troyerb7d1fbb2012-03-02 08:43:09 -060044# Tenants
Dean Troyer3f7c06f2012-04-03 17:19:36 -050045# -------
46
Dean Troyerb7d1fbb2012-03-02 08:43:09 -060047ADMIN_TENANT=$(get_id keystone tenant-create --name=admin)
48SERVICE_TENANT=$(get_id keystone tenant-create --name=$SERVICE_TENANT_NAME)
49DEMO_TENANT=$(get_id keystone tenant-create --name=demo)
50INVIS_TENANT=$(get_id keystone tenant-create --name=invisible_to_admin)
termiea96a4182012-01-09 22:13:29 -080051
Jesse Andrews73e27b82011-09-12 17:55:00 -070052
53# Users
Dean Troyer3f7c06f2012-04-03 17:19:36 -050054# -----
55
Dean Troyerb7d1fbb2012-03-02 08:43:09 -060056ADMIN_USER=$(get_id keystone user-create --name=admin \
57 --pass="$ADMIN_PASSWORD" \
58 --email=admin@example.com)
59DEMO_USER=$(get_id keystone user-create --name=demo \
60 --pass="$ADMIN_PASSWORD" \
61 --email=demo@example.com)
Jesse Andrews73e27b82011-09-12 17:55:00 -070062
Dean Troyer0bd24102012-03-08 00:33:54 -060063
Jesse Andrews73e27b82011-09-12 17:55:00 -070064# Roles
Dean Troyer3f7c06f2012-04-03 17:19:36 -050065# -----
66
Dean Troyerb7d1fbb2012-03-02 08:43:09 -060067ADMIN_ROLE=$(get_id keystone role-create --name=admin)
68KEYSTONEADMIN_ROLE=$(get_id keystone role-create --name=KeystoneAdmin)
69KEYSTONESERVICE_ROLE=$(get_id keystone role-create --name=KeystoneServiceAdmin)
Anthony Youngae604982012-03-12 17:12:00 -070070# ANOTHER_ROLE demonstrates that an arbitrary role may be created and used
71# TODO(sleepsonthefloor): show how this can be used for rbac in the future!
72ANOTHER_ROLE=$(get_id keystone role-create --name=anotherrole)
termiea96a4182012-01-09 22:13:29 -080073
74
Dean Troyerb7d1fbb2012-03-02 08:43:09 -060075# Add Roles to Users in Tenants
Everett Toewsa143e732012-05-08 22:13:08 +000076keystone user-role-add --user_id $ADMIN_USER --role_id $ADMIN_ROLE --tenant_id $ADMIN_TENANT
77keystone user-role-add --user_id $ADMIN_USER --role_id $ADMIN_ROLE --tenant_id $DEMO_TENANT
78keystone user-role-add --user_id $DEMO_USER --role_id $ANOTHER_ROLE --tenant_id $DEMO_TENANT
termiea96a4182012-01-09 22:13:29 -080079
Dean Troyerb7d1fbb2012-03-02 08:43:09 -060080# TODO(termie): these two might be dubious
Everett Toewsa143e732012-05-08 22:13:08 +000081keystone user-role-add --user_id $ADMIN_USER --role_id $KEYSTONEADMIN_ROLE --tenant_id $ADMIN_TENANT
82keystone user-role-add --user_id $ADMIN_USER --role_id $KEYSTONESERVICE_ROLE --tenant_id $ADMIN_TENANT
Dean Troyerf4565c42012-02-23 11:21:10 -060083
Dean Troyerb7d1fbb2012-03-02 08:43:09 -060084
85# The Member role is used by Horizon and Swift so we need to keep it:
86MEMBER_ROLE=$(get_id keystone role-create --name=Member)
Everett Toewsa143e732012-05-08 22:13:08 +000087keystone user-role-add --user_id $DEMO_USER --role_id $MEMBER_ROLE --tenant_id $DEMO_TENANT
88keystone user-role-add --user_id $DEMO_USER --role_id $MEMBER_ROLE --tenant_id $INVIS_TENANT
Dean Troyerb7d1fbb2012-03-02 08:43:09 -060089
guillaume pernot901eed72012-11-29 08:44:58 +010090# The ResellerAdmin role is used by Nova and Ceilometer so we need to keep it.
91# The admin role in swift allows a user to act as an admin for their tenant,
92# but ResellerAdmin is needed for a user to act as any tenant. The name of this
93# role is also configurable in swift-proxy.conf
94RESELLER_ROLE=$(get_id keystone role-create --name=ResellerAdmin)
Jesse Andrews73e27b82011-09-12 17:55:00 -070095
Dean Troyer3f7c06f2012-04-03 17:19:36 -050096# Services
97# --------
termiea96a4182012-01-09 22:13:29 -080098
Dean Troyer3f7c06f2012-04-03 17:19:36 -050099# Keystone
100if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
Sean Daguea61eb6a2012-11-29 14:51:34 -0500101 KEYSTONE_SERVICE=$(get_id keystone service-create \
102 --name=keystone \
103 --type=identity \
104 --description="Keystone Identity Service")
105 keystone endpoint-create \
106 --region RegionOne \
107 --service_id $KEYSTONE_SERVICE \
108 --publicurl "http://$SERVICE_HOST:\$(public_port)s/v2.0" \
109 --adminurl "http://$SERVICE_HOST:\$(admin_port)s/v2.0" \
110 --internalurl "http://$SERVICE_HOST:\$(public_port)s/v2.0"
Dean Troyer3f7c06f2012-04-03 17:19:36 -0500111fi
Vishvananda Ishaya5f9473e2012-02-24 01:57:07 +0000112
Dean Troyer3f7c06f2012-04-03 17:19:36 -0500113# Nova
Akihiro MOTOKI766ae342012-11-22 20:04:02 +0900114if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
Dean Troyer3f7c06f2012-04-03 17:19:36 -0500115 NOVA_USER=$(get_id keystone user-create \
116 --name=nova \
117 --pass="$SERVICE_PASSWORD" \
118 --tenant_id $SERVICE_TENANT \
119 --email=nova@example.com)
120 keystone user-role-add \
121 --tenant_id $SERVICE_TENANT \
122 --user_id $NOVA_USER \
123 --role_id $ADMIN_ROLE
124 if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
125 NOVA_SERVICE=$(get_id keystone service-create \
126 --name=nova \
127 --type=compute \
128 --description="Nova Compute Service")
129 keystone endpoint-create \
130 --region RegionOne \
131 --service_id $NOVA_SERVICE \
Steve Baker8d6c9bc2012-09-11 10:05:14 +1200132 --publicurl "http://$SERVICE_HOST:\$(compute_port)s/v2/\$(tenant_id)s" \
133 --adminurl "http://$SERVICE_HOST:\$(compute_port)s/v2/\$(tenant_id)s" \
134 --internalurl "http://$SERVICE_HOST:\$(compute_port)s/v2/\$(tenant_id)s"
Dean Troyer3f7c06f2012-04-03 17:19:36 -0500135 fi
Chmouel Boudjnah77b0e1d2012-02-29 16:55:43 +0000136 # Nova needs ResellerAdmin role to download images when accessing
guillaume pernot901eed72012-11-29 08:44:58 +0100137 # swift through the s3 api.
Dean Troyer3f7c06f2012-04-03 17:19:36 -0500138 keystone user-role-add \
139 --tenant_id $SERVICE_TENANT \
140 --user_id $NOVA_USER \
141 --role_id $RESELLER_ROLE
Jesse Andrews9c7c9082011-11-23 10:10:53 -0800142fi
Dean Troyerb7d1fbb2012-03-02 08:43:09 -0600143
Steve Bakerbfdad752012-08-18 09:00:42 +1200144# Heat
145if [[ "$ENABLED_SERVICES" =~ "heat" ]]; then
146 HEAT_USER=$(get_id keystone user-create --name=heat \
147 --pass="$SERVICE_PASSWORD" \
148 --tenant_id $SERVICE_TENANT \
149 --email=heat@example.com)
150 keystone user-role-add --tenant_id $SERVICE_TENANT \
151 --user_id $HEAT_USER \
152 --role_id $ADMIN_ROLE
153 if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
Steve Baker36cf7ee2012-09-17 16:49:24 +1200154 HEAT_CFN_SERVICE=$(get_id keystone service-create \
Steve Bakerbb421be2012-10-10 13:19:10 +1300155 --name=heat-cfn \
156 --type=cloudformation \
157 --description="Heat CloudFormation Service")
Steve Bakerbfdad752012-08-18 09:00:42 +1200158 keystone endpoint-create \
159 --region RegionOne \
Angus Salkelde2790212012-09-11 11:24:09 +1000160 --service_id $HEAT_CFN_SERVICE \
161 --publicurl "http://$SERVICE_HOST:$HEAT_API_CFN_PORT/v1" \
162 --adminurl "http://$SERVICE_HOST:$HEAT_API_CFN_PORT/v1" \
163 --internalurl "http://$SERVICE_HOST:$HEAT_API_CFN_PORT/v1"
Steve Bakerbb421be2012-10-10 13:19:10 +1300164 HEAT_SERVICE=$(get_id keystone service-create \
165 --name=heat \
166 --type=orchestration \
167 --description="Heat Service")
168 keystone endpoint-create \
169 --region RegionOne \
170 --service_id $HEAT_SERVICE \
171 --publicurl "http://$SERVICE_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
172 --adminurl "http://$SERVICE_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s" \
173 --internalurl "http://$SERVICE_HOST:$HEAT_API_PORT/v1/\$(tenant_id)s"
Steve Bakerbfdad752012-08-18 09:00:42 +1200174 fi
175fi
176
Dean Troyer3f7c06f2012-04-03 17:19:36 -0500177# Glance
178if [[ "$ENABLED_SERVICES" =~ "g-api" ]]; then
179 GLANCE_USER=$(get_id keystone user-create \
180 --name=glance \
181 --pass="$SERVICE_PASSWORD" \
182 --tenant_id $SERVICE_TENANT \
183 --email=glance@example.com)
184 keystone user-role-add \
185 --tenant_id $SERVICE_TENANT \
186 --user_id $GLANCE_USER \
187 --role_id $ADMIN_ROLE
188 if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
189 GLANCE_SERVICE=$(get_id keystone service-create \
190 --name=glance \
191 --type=image \
192 --description="Glance Image Service")
193 keystone endpoint-create \
194 --region RegionOne \
195 --service_id $GLANCE_SERVICE \
Steve Baker8d6c9bc2012-09-11 10:05:14 +1200196 --publicurl "http://$SERVICE_HOST:9292" \
197 --adminurl "http://$SERVICE_HOST:9292" \
198 --internalurl "http://$SERVICE_HOST:9292"
Dean Troyer3f7c06f2012-04-03 17:19:36 -0500199 fi
200fi
201
202# Swift
203if [[ "$ENABLED_SERVICES" =~ "swift" ]]; then
204 SWIFT_USER=$(get_id keystone user-create \
205 --name=swift \
206 --pass="$SERVICE_PASSWORD" \
207 --tenant_id $SERVICE_TENANT \
208 --email=swift@example.com)
209 keystone user-role-add \
210 --tenant_id $SERVICE_TENANT \
211 --user_id $SWIFT_USER \
212 --role_id $ADMIN_ROLE
213 if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
214 SWIFT_SERVICE=$(get_id keystone service-create \
215 --name=swift \
216 --type="object-store" \
217 --description="Swift Service")
218 keystone endpoint-create \
219 --region RegionOne \
220 --service_id $SWIFT_SERVICE \
221 --publicurl "http://$SERVICE_HOST:8080/v1/AUTH_\$(tenant_id)s" \
Steve Baker8d6c9bc2012-09-11 10:05:14 +1200222 --adminurl "http://$SERVICE_HOST:8080" \
Dean Troyer3f7c06f2012-04-03 17:19:36 -0500223 --internalurl "http://$SERVICE_HOST:8080/v1/AUTH_\$(tenant_id)s"
224 fi
225fi
226
227if [[ "$ENABLED_SERVICES" =~ "q-svc" ]]; then
228 QUANTUM_USER=$(get_id keystone user-create \
229 --name=quantum \
230 --pass="$SERVICE_PASSWORD" \
231 --tenant_id $SERVICE_TENANT \
232 --email=quantum@example.com)
233 keystone user-role-add \
234 --tenant_id $SERVICE_TENANT \
235 --user_id $QUANTUM_USER \
236 --role_id $ADMIN_ROLE
237 if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
238 QUANTUM_SERVICE=$(get_id keystone service-create \
239 --name=quantum \
240 --type=network \
241 --description="Quantum Service")
242 keystone endpoint-create \
243 --region RegionOne \
244 --service_id $QUANTUM_SERVICE \
245 --publicurl "http://$SERVICE_HOST:9696/" \
246 --adminurl "http://$SERVICE_HOST:9696/" \
247 --internalurl "http://$SERVICE_HOST:9696/"
248 fi
249fi
250
Doug Hellmann4a2b1c62012-11-01 16:23:52 -0400251if [[ "$ENABLED_SERVICES" =~ "ceilometer" ]]; then
252 CEILOMETER_USER=$(get_id keystone user-create --name=ceilometer \
253 --pass="$SERVICE_PASSWORD" \
254 --tenant_id $SERVICE_TENANT \
255 --email=ceilometer@example.com)
256 keystone user-role-add --tenant_id $SERVICE_TENANT \
257 --user_id $CEILOMETER_USER \
258 --role_id $ADMIN_ROLE
guillaume pernot901eed72012-11-29 08:44:58 +0100259 # Ceilometer needs ResellerAdmin role to access swift account stats.
260 keystone user-role-add --tenant_id $SERVICE_TENANT \
261 --user_id $CEILOMETER_USER \
262 --role_id $RESELLER_ROLE
Julien Danjouf36afe52012-10-04 18:00:10 +0200263 if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
264 CEILOMETER_SERVICE=$(get_id keystone service-create \
265 --name=ceilometer \
266 --type=metering \
267 --description="Ceilometer Service")
268 keystone endpoint-create \
269 --region RegionOne \
270 --service_id $CEILOMETER_SERVICE \
271 --publicurl "http://$SERVICE_HOST:8777/" \
272 --adminurl "http://$SERVICE_HOST:8777/" \
273 --internalurl "http://$SERVICE_HOST:8777/"
274 fi
275fi
276
Dean Troyer3f7c06f2012-04-03 17:19:36 -0500277# EC2
278if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
279 if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
280 EC2_SERVICE=$(get_id keystone service-create \
281 --name=ec2 \
282 --type=ec2 \
283 --description="EC2 Compatibility Layer")
284 keystone endpoint-create \
285 --region RegionOne \
286 --service_id $EC2_SERVICE \
287 --publicurl "http://$SERVICE_HOST:8773/services/Cloud" \
288 --adminurl "http://$SERVICE_HOST:8773/services/Admin" \
289 --internalurl "http://$SERVICE_HOST:8773/services/Cloud"
290 fi
291fi
292
293# S3
294if [[ "$ENABLED_SERVICES" =~ "n-obj" || "$ENABLED_SERVICES" =~ "swift" ]]; then
295 if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
296 S3_SERVICE=$(get_id keystone service-create \
297 --name=s3 \
298 --type=s3 \
299 --description="S3")
300 keystone endpoint-create \
301 --region RegionOne \
302 --service_id $S3_SERVICE \
303 --publicurl "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
304 --adminurl "http://$SERVICE_HOST:$S3_SERVICE_PORT" \
305 --internalurl "http://$SERVICE_HOST:$S3_SERVICE_PORT"
306 fi
Gabriel Hurleya3a496f2012-02-13 12:29:23 -0800307fi
Jay Pipesb297d2d2012-05-10 11:21:22 -0400308
309if [[ "$ENABLED_SERVICES" =~ "tempest" ]]; then
310 # Tempest has some tests that validate various authorization checks
311 # between two regular users in separate tenants
Dean Troyer3f7c06f2012-04-03 17:19:36 -0500312 ALT_DEMO_TENANT=$(get_id keystone tenant-create \
313 --name=alt_demo)
314 ALT_DEMO_USER=$(get_id keystone user-create \
315 --name=alt_demo \
316 --pass="$ADMIN_PASSWORD" \
317 --email=alt_demo@example.com)
318 keystone user-role-add \
319 --tenant_id $ALT_DEMO_TENANT \
320 --user_id $ALT_DEMO_USER \
321 --role_id $MEMBER_ROLE
Jay Pipesb297d2d2012-05-10 11:21:22 -0400322fi
Dean Troyer67787e62012-05-02 11:48:15 -0500323
Chmouel Boudjnahd55509d2012-07-20 15:00:02 +0000324if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
Dean Troyer67787e62012-05-02 11:48:15 -0500325 CINDER_USER=$(get_id keystone user-create --name=cinder \
326 --pass="$SERVICE_PASSWORD" \
327 --tenant_id $SERVICE_TENANT \
328 --email=cinder@example.com)
329 keystone user-role-add --tenant_id $SERVICE_TENANT \
330 --user_id $CINDER_USER \
331 --role_id $ADMIN_ROLE
Anthony Young1cdf5fa2012-07-03 13:57:39 -0700332 if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
333 CINDER_SERVICE=$(get_id keystone service-create \
334 --name=cinder \
335 --type=volume \
336 --description="Cinder Service")
337 keystone endpoint-create \
338 --region RegionOne \
339 --service_id $CINDER_SERVICE \
340 --publicurl "http://$SERVICE_HOST:8776/v1/\$(tenant_id)s" \
341 --adminurl "http://$SERVICE_HOST:8776/v1/\$(tenant_id)s" \
342 --internalurl "http://$SERVICE_HOST:8776/v1/\$(tenant_id)s"
343 fi
Dean Troyer67787e62012-05-02 11:48:15 -0500344fi