blob: f6a6d667c2c71f0d1479e631472d50481f9c0174 [file] [log] [blame]
Dean Troyerd81a0272012-08-31 18:04:55 -05001# lib/keystone
2# Functions to control the configuration and operation of **Keystone**
3
4# Dependencies:
5# ``functions`` file
6# ``BASE_SQL_CONN``
7# ``SERVICE_HOST``
8# ``SERVICE_TOKEN``
9# ``S3_SERVICE_PORT`` (template backend only)
10
11
12# ``stack.sh`` calls the entry points in this order:
13#
14# install_keystone
15# configure_keystone
16# init_keystone
17# start_keystone
Dean Troyerd835de82012-11-29 17:11:35 -060018# create_keystone_accounts
Dean Troyerd81a0272012-08-31 18:04:55 -050019# stop_keystone
20# cleanup_keystone
21
Dean Troyer7903b792012-09-13 17:16:12 -050022# Save trace setting
23XTRACE=$(set +o | grep xtrace)
24set +o xtrace
Dean Troyerd81a0272012-08-31 18:04:55 -050025
26
27# Defaults
28# --------
29
30# <define global variables here that belong to this project>
31
32# Set up default directories
33KEYSTONE_DIR=$DEST/keystone
34KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
35KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
Dean Troyerbc071bc2012-10-01 14:06:44 -050036KEYSTONE_AUTH_CACHE_DIR=${KEYSTONE_AUTH_CACHE_DIR:-/var/cache/keystone}
Dean Troyerd81a0272012-08-31 18:04:55 -050037
38KEYSTONECLIENT_DIR=$DEST/python-keystoneclient
39
Dean Troyerbc071bc2012-10-01 14:06:44 -050040# Select the backend for Keystone's service catalog
Dean Troyerb80379c2012-09-10 18:30:37 -050041KEYSTONE_CATALOG_BACKEND=${KEYSTONE_CATALOG_BACKEND:-sql}
Dean Troyerd81a0272012-08-31 18:04:55 -050042KEYSTONE_CATALOG=$KEYSTONE_CONF_DIR/default_catalog.templates
43
Dean Troyerbc071bc2012-10-01 14:06:44 -050044# Select Keystone's token format
45# Choose from 'UUID' and 'PKI'
46KEYSTONE_TOKEN_FORMAT=${KEYSTONE_TOKEN_FORMAT:-PKI}
47
Dean Troyerd81a0272012-08-31 18:04:55 -050048# Set Keystone interface configuration
Dean Troyerd81a0272012-08-31 18:04:55 -050049KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
50KEYSTONE_AUTH_PORT=${KEYSTONE_AUTH_PORT:-35357}
51KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-http}
52KEYSTONE_SERVICE_HOST=${KEYSTONE_SERVICE_HOST:-$SERVICE_HOST}
53KEYSTONE_SERVICE_PORT=${KEYSTONE_SERVICE_PORT:-5000}
54KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-http}
55
56
57# Entry Points
58# ------------
59
60# cleanup_keystone() - Remove residual data files, anything left over from previous
61# runs that a clean run would need to clean up
62function cleanup_keystone() {
63 # kill instances (nova)
64 # delete image files (glance)
65 # This function intentionally left blank
66 :
67}
68
69# configure_keystoneclient() - Set config files, create data dirs, etc
70function configure_keystoneclient() {
71 setup_develop $KEYSTONECLIENT_DIR
72}
73
74# configure_keystone() - Set config files, create data dirs, etc
75function configure_keystone() {
76 setup_develop $KEYSTONE_DIR
77
78 if [[ ! -d $KEYSTONE_CONF_DIR ]]; then
79 sudo mkdir -p $KEYSTONE_CONF_DIR
80 sudo chown `whoami` $KEYSTONE_CONF_DIR
81 fi
82
83 if [[ "$KEYSTONE_CONF_DIR" != "$KEYSTONE_DIR/etc" ]]; then
84 cp -p $KEYSTONE_DIR/etc/keystone.conf.sample $KEYSTONE_CONF
85 cp -p $KEYSTONE_DIR/etc/policy.json $KEYSTONE_CONF_DIR
86 fi
87
88 # Rewrite stock ``keystone.conf``
Terry Wilson428af5a2012-11-01 16:12:39 -040089 local dburl
90 database_connection_url dburl keystone
Dean Troyerd81a0272012-08-31 18:04:55 -050091 iniset $KEYSTONE_CONF DEFAULT admin_token "$SERVICE_TOKEN"
Doug Hellmann4de55e92012-10-26 12:24:28 -040092 iniset $KEYSTONE_CONF signing token_format "$KEYSTONE_TOKEN_FORMAT"
Terry Wilson428af5a2012-11-01 16:12:39 -040093 iniset $KEYSTONE_CONF sql connection $dburl
Dean Troyerd81a0272012-08-31 18:04:55 -050094 iniset $KEYSTONE_CONF ec2 driver "keystone.contrib.ec2.backends.sql.Ec2"
95 sed -e "
96 /^pipeline.*ec2_extension crud_/s|ec2_extension crud_extension|ec2_extension s3_extension crud_extension|;
97 " -i $KEYSTONE_CONF
98
99 # Append the S3 bits
100 iniset $KEYSTONE_CONF filter:s3_extension paste.filter_factory "keystone.contrib.s3:S3Extension.factory"
101
102 if [[ "$KEYSTONE_CATALOG_BACKEND" = "sql" ]]; then
103 # Configure ``keystone.conf`` to use sql
104 iniset $KEYSTONE_CONF catalog driver keystone.catalog.backends.sql.Catalog
105 inicomment $KEYSTONE_CONF catalog template_file
106 else
107 cp -p $FILES/default_catalog.templates $KEYSTONE_CATALOG
108
109 # Add swift endpoints to service catalog if swift is enabled
110 if is_service_enabled swift; then
111 echo "catalog.RegionOne.object_store.publicURL = http://%SERVICE_HOST%:8080/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
112 echo "catalog.RegionOne.object_store.adminURL = http://%SERVICE_HOST%:8080/" >> $KEYSTONE_CATALOG
113 echo "catalog.RegionOne.object_store.internalURL = http://%SERVICE_HOST%:8080/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
114 echo "catalog.RegionOne.object_store.name = Swift Service" >> $KEYSTONE_CATALOG
115 fi
116
117 # Add quantum endpoints to service catalog if quantum is enabled
118 if is_service_enabled quantum; then
119 echo "catalog.RegionOne.network.publicURL = http://%SERVICE_HOST%:$Q_PORT/" >> $KEYSTONE_CATALOG
120 echo "catalog.RegionOne.network.adminURL = http://%SERVICE_HOST%:$Q_PORT/" >> $KEYSTONE_CATALOG
121 echo "catalog.RegionOne.network.internalURL = http://%SERVICE_HOST%:$Q_PORT/" >> $KEYSTONE_CATALOG
122 echo "catalog.RegionOne.network.name = Quantum Service" >> $KEYSTONE_CATALOG
123 fi
124
125 sudo sed -e "
126 s,%SERVICE_HOST%,$SERVICE_HOST,g;
127 s,%S3_SERVICE_PORT%,$S3_SERVICE_PORT,g;
128 " -i $KEYSTONE_CATALOG
129
130 # Configure ``keystone.conf`` to use templates
131 iniset $KEYSTONE_CONF catalog driver "keystone.catalog.backends.templated.TemplatedCatalog"
132 iniset $KEYSTONE_CONF catalog template_file "$KEYSTONE_CATALOG"
133 fi
134
135 # Set up logging
136 LOGGING_ROOT="devel"
137 if [ "$SYSLOG" != "False" ]; then
138 LOGGING_ROOT="$LOGGING_ROOT,production"
139 fi
140 KEYSTONE_LOG_CONFIG="--log-config $KEYSTONE_CONF_DIR/logging.conf"
141 cp $KEYSTONE_DIR/etc/logging.conf.sample $KEYSTONE_CONF_DIR/logging.conf
142 iniset $KEYSTONE_CONF_DIR/logging.conf logger_root level "DEBUG"
143 iniset $KEYSTONE_CONF_DIR/logging.conf logger_root handlers "devel,production"
144
145}
146
Dean Troyerd835de82012-11-29 17:11:35 -0600147# create_keystone_accounts() - Sets up common required keystone accounts
148
149# Tenant User Roles
150# ------------------------------------------------------------------
151# service -- --
152# -- -- Member
153# admin admin admin
154# demo admin admin
155# demo demo Member, anotherrole
156# invisible_to_admin demo Member
157
158# Migrated from keystone_data.sh
159create_keystone_accounts() {
160
161 # admin
162 ADMIN_TENANT=$(keystone tenant-create \
163 --name admin \
164 | grep " id " | get_field 2)
165 ADMIN_USER=$(keystone user-create \
166 --name admin \
167 --pass "$ADMIN_PASSWORD" \
168 --email admin@example.com \
169 | grep " id " | get_field 2)
170 ADMIN_ROLE=$(keystone role-create \
171 --name admin \
172 | grep " id " | get_field 2)
173 keystone user-role-add \
174 --user_id $ADMIN_USER \
175 --role_id $ADMIN_ROLE \
176 --tenant_id $ADMIN_TENANT
177
178 # service
179 SERVICE_TENANT=$(keystone tenant-create \
180 --name $SERVICE_TENANT_NAME \
181 | grep " id " | get_field 2)
182
183 # The Member role is used by Horizon and Swift so we need to keep it:
184 MEMBER_ROLE=$(keystone role-create --name=Member | grep " id " | get_field 2)
185 # ANOTHER_ROLE demonstrates that an arbitrary role may be created and used
186 # TODO(sleepsonthefloor): show how this can be used for rbac in the future!
187 ANOTHER_ROLE=$(keystone role-create --name=anotherrole | grep " id " | get_field 2)
188
189 # invisible tenant - admin can't see this one
190 INVIS_TENANT=$(keystone tenant-create --name=invisible_to_admin | grep " id " | get_field 2)
191
192 # demo
193 DEMO_TENANT=$(keystone tenant-create \
194 --name=demo \
195 | grep " id " | get_field 2)
196 DEMO_USER=$(keystone user-create \
197 --name demo \
198 --pass "$ADMIN_PASSWORD" \
199 --email demo@example.com \
200 | grep " id " | get_field 2)
201 keystone user-role-add --user_id $DEMO_USER --role_id $MEMBER_ROLE --tenant_id $DEMO_TENANT
202 keystone user-role-add --user_id $ADMIN_USER --role_id $ADMIN_ROLE --tenant_id $DEMO_TENANT
203 keystone user-role-add --user_id $DEMO_USER --role_id $ANOTHER_ROLE --tenant_id $DEMO_TENANT
204 keystone user-role-add --user_id $DEMO_USER --role_id $MEMBER_ROLE --tenant_id $INVIS_TENANT
205
206 # Keystone
207 if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
208 KEYSTONE_SERVICE=$(keystone service-create \
209 --name keystone \
210 --type identity \
211 --description "Keystone Identity Service" \
212 | grep " id " | get_field 2)
213 keystone endpoint-create \
214 --region RegionOne \
215 --service_id $KEYSTONE_SERVICE \
216 --publicurl "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:\$(public_port)s/v2.0" \
217 --adminurl "$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:\$(admin_port)s/v2.0" \
218 --internalurl "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:\$(public_port)s/v2.0"
219 fi
220
221 # TODO(dtroyer): This is part of a series of changes...remove these when
222 # complete if they are really unused
223# KEYSTONEADMIN_ROLE=$(keystone role-create \
224# --name KeystoneAdmin \
225# | grep " id " | get_field 2)
226# KEYSTONESERVICE_ROLE=$(keystone role-create \
227# --name KeystoneServiceAdmin \
228# | grep " id " | get_field 2)
229
230 # TODO(termie): these two might be dubious
231# keystone user-role-add \
232# --user_id $ADMIN_USER \
233# --role_id $KEYSTONEADMIN_ROLE \
234# --tenant_id $ADMIN_TENANT
235# keystone user-role-add \
236# --user_id $ADMIN_USER \
237# --role_id $KEYSTONESERVICE_ROLE \
238# --tenant_id $ADMIN_TENANT
239}
240
Dean Troyerd81a0272012-08-31 18:04:55 -0500241# init_keystone() - Initialize databases, etc.
242function init_keystone() {
243 # (Re)create keystone database
Terry Wilson428af5a2012-11-01 16:12:39 -0400244 recreate_database keystone utf8
Dean Troyerd81a0272012-08-31 18:04:55 -0500245
246 # Initialize keystone database
247 $KEYSTONE_DIR/bin/keystone-manage db_sync
248
Dean Troyerbc071bc2012-10-01 14:06:44 -0500249 if [[ "$KEYSTONE_TOKEN_FORMAT" == "PKI" ]]; then
250 # Set up certificates
251 $KEYSTONE_DIR/bin/keystone-manage pki_setup
252
253 # Create cache dir
254 sudo mkdir -p $KEYSTONE_AUTH_CACHE_DIR
255 sudo chown `whoami` $KEYSTONE_AUTH_CACHE_DIR
256 fi
Dean Troyerd81a0272012-08-31 18:04:55 -0500257}
258
259# install_keystoneclient() - Collect source and prepare
260function install_keystoneclient() {
261 git_clone $KEYSTONECLIENT_REPO $KEYSTONECLIENT_DIR $KEYSTONECLIENT_BRANCH
262}
263
264# install_keystone() - Collect source and prepare
265function install_keystone() {
266 git_clone $KEYSTONE_REPO $KEYSTONE_DIR $KEYSTONE_BRANCH
267}
268
269# start_keystone() - Start running processes, including screen
270function start_keystone() {
271 # Start Keystone in a screen window
272 screen_it key "cd $KEYSTONE_DIR && $KEYSTONE_DIR/bin/keystone-all --config-file $KEYSTONE_CONF $KEYSTONE_LOG_CONFIG -d --debug"
Dean Troyerd835de82012-11-29 17:11:35 -0600273 echo "Waiting for keystone to start..."
274 if ! timeout $SERVICE_TIMEOUT sh -c "while ! http_proxy= curl -s $KEYSTONE_AUTH_PROTOCOL://$SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v2.0/ >/dev/null; do sleep 1; done"; then
275 echo "keystone did not start"
276 exit 1
277 fi
Dean Troyerd81a0272012-08-31 18:04:55 -0500278}
279
280# stop_keystone() - Stop running processes
281function stop_keystone() {
282 # Kill the Keystone screen window
283 screen -S $SCREEN_NAME -p key -X kill
284}
Dean Troyer7903b792012-09-13 17:16:12 -0500285
286# Restore xtrace
287$XTRACE