openstack/barbican
Code Issues Proposed changes

migrate keystone_data to openstackclient

Browse Source 
keystoneclient's CLI will be removed and this script won't work;
update the script to use openstackclient instead.

Change-Id: I6486396c83ee960a07c2d4e3b1a3b97e920e47fb
This commit is contained in:
Steve Martinelli
2016-04-20 15:16:52 +00:00
parent f3efe0386b
commit 82a60ac231
1 changed files with 108 additions and 122 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/keystone_data.sh
+108 -122
View File
@@ -4,35 +4,31 @@
# the devstack way
# cd <devstack-home>
# source openrc nova service
# This sets up an admin user and the service tenant and passport in environment
# This sets up an admin user and the service project and passport in environment
#------------------------------------
# alternately export values for
export OS_AUTH_URL="http://localhost:5000/v2.0"
# your secret password
export OS_PASSWORD="password"
export OS_TENANT_NAME="service"
export OS_PROJECT_NAME="service"
export OS_USERNAME="nova"
# --------------------------------
# alternately service_token and endpoint
#export OS_SERVICE_TOKEN=orange
#export OS_SERVICE_ENDPOINT=http://localhost:35357/v2.0
#export OS_TOKEN=orange
#export OS_URL=http://localhost:35357/v2.0
# ========================================
echo " OS_SERVICE_ENDPOINT="$OS_SERVICE_ENDPOINT
echo " SERVICE_TOKEN="$OS_SERVICE_TOKEN
echo " OS_TENANT_NAME="$OS_TENANT_NAME
echo " OS_URL="$OS_URL
echo " OS_TOKEN="$OS_TOKEN
echo " OS_PROJECT_NAME="$OS_PROJECT_NAME
echo " OS_USERNAME="$OS_USERNAME
echo " OS_PASSWORD="$OS_PASSWORD
echo " OS_AUTH_URL="$OS_AUTH_URL
#test with
keystone tenant-list
function get_id {
echo `"$@" | awk '/ id / { print $4 }'`
}
openstack project list
#------------------------------------------------------------
# Adding the Key Manager Service: barbican
@@ -41,14 +37,13 @@ function get_id {
ENABLED_SERVICES="barbican"
SERVICE_PASSWORD="orange"
SERVICE_HOST="localhost"
SERVICE_TENANT_NAME="service"
SERVICE_PROJECT_NAME="service"
KEYSTONE_CATALOG_BACKEND='sql'
#============================
# Lookups
SERVICE_TENANT=$(get_id keystone tenant-create --name="$SERVICE_TENANT_NAME")
ADMIN_ROLE=$(keystone role-list | awk "/ admin / { print \$2 }")
MEMBER_ROLE=$(keystone role-list | awk "/ _member_ / { print \$2 }")
SERVICE_PROJECT=$(openstack project show "$SERVICE_PROJECT_NAME" -f value -c id)
ADMIN_ROLE=$(openstack role show admin -f value -c id)
# Ports to avoid: 3333, 5000, 8773, 8774, 8776, 9292, 9696, 35357
# Barbican
@@ -56,145 +51,136 @@ if [[ "$ENABLED_SERVICES" =~ "barbican" ]]; then
#
# Setup Default Admin User
#
BARBICAN_USER=$(get_id keystone user-create \
--name="barbican" \
--pass="$SERVICE_PASSWORD" \
--tenant_id="$SERVICE_TENANT" \
--email="barbican@example.com")
keystone user-role-add \
--tenant_id="$SERVICE_TENANT" \
--user_id="$BARBICAN_USER" \
--role_id="$ADMIN_ROLE"
BARBICAN_USER=$(openstack user create \
--password "$SERVICE_PASSWORD" \
--project $SERVICE_PROJECT \
--email "barbican@example.com" \
barbican -f value -c id)
openstack role add --project $SERVICE_PROJECT \
--user $BARBICAN_USER \
$ADMIN_ROLE
#
# Setup Default service-admin User
#
SERVICE_ADMIN=$(get_id keystone user-create \
--name="service-admin" \
--pass="$SERVICE_PASSWORD" \
--email="service_admin@example.com")
SERVICE_ADMIN_ROLE=$(get_id keystone role-create \
--name="key-manager:service-admin")
keystone user-role-add \
--tenant_id="$SERVICE_TENANT" \
--user_id="$SERVICE_ADMIN" \
--role_id="$SERVICE_ADMIN_ROLE"
SERVICE_ADMIN=$(openstack user create \
--password "$SERVICE_PASSWORD" \
--email "service-admin@example.com" \
"service-admin" -f value -c id)
SERVICE_ADMIN_ROLE=$(openstack role create \
"key-manager:service-admin" -f value -c id)
openstack role add \
--user "$SERVICE_ADMIN" \
--project "$SERVICE_PROJECT" \
"$SERVICE_ADMIN_ROLE"
#
# Setup RBAC User Projects and Roles
#
USER_PASSWORD="barbican"
PROJECT_A_ID=$(get_id keystone tenant-create \
--name="project_a")
PROJECT_B_ID=$(get_id keystone tenant-create \
--name="project_b")
ROLE_ADMIN_ID=$(get_id keystone role-get admin)
ROLE_CREATOR_ID=$(get_id keystone role-create \
--name="creator")
ROLE_OBSERVER_ID=$(get_id keystone role-create \
--name="observer")
ROLE_AUDIT_ID=$(get_id keystone role-create \
--name="audit")
PASSWORD="barbican"
PROJECT_A_ID=$(openstack project create "project_a" -f value -c id)
PROJECT_B_ID=$(openstack project create "project_b" -f value -c id)
ROLE_ADMIN_ID=$(openstack role show admin -f value -c id)
ROLE_CREATOR_ID=$(openstack role create "creator" -f value -c id)
ROLE_OBSERVER_ID=$(openstack role create "observer" -f value -c id)
ROLE_AUDIT_ID=$(openstack role create "audit" -f value -c id)
#
# Setup RBAC Admin of Project A
#
USER_ID=$(get_id keystone user-create \
--name="project_a_admin" \
--pass="$USER_PASSWORD" \
--email="admin_a@example.net")
keystone user-role-add \
--user="$USER_ID" \
--role="$ROLE_ADMIN_ID" \
--tenant-id="$PROJECT_A_ID"
USER_ID=$(openstack user create \
--password "$PASSWORD" \
--email "admin_a@example.net" \
"project_a_admin" -f value -c id)
openstack role add \
--user "$USER_ID" \
--project "$PROJECT_A_ID" \
"$ROLE_ADMIN_ID"
#
# Setup RBAC Creator of Project A
#
USER_ID=$(get_id keystone user-create \
--name="project_a_creator" \
--pass="$USER_PASSWORD" \
--email="creator_a@example.net")
keystone user-role-add \
--user="$USER_ID" \
--role="$ROLE_CREATOR_ID" \
--tenant-id="$PROJECT_A_ID"
USER_ID=$(openstack user create \
--password "$PASSWORD" \
--email "creator_a@example.net" \
"project_a_creator" -f value -c id)
openstack role add \
--user "$USER_ID" \
--project "$PROJECT_A_ID" \
"$ROLE_CREATOR_ID"
#
# Setup RBAC Observer of Project A
#
USER_ID=$(get_id keystone user-create \
--name="project_a_observer" \
--pass="$USER_PASSWORD" \
--email="observer_a@example.net")
keystone user-role-add \
--user="$USER_ID" \
--role="$ROLE_OBSERVER_ID" \
--tenant-id="$PROJECT_A_ID"
USER_ID=$(openstack user create \
--password "$PASSWORD" \
--email "observer_a@example.net" \
"project_a_observer" -f value -c id)
openstack role add \
--user "$USER_ID" \
--project "$PROJECT_A_ID" \
"$ROLE_OBSERVER_ID"
#
# Setup RBAC Auditor of Project A
#
USER_ID=$(get_id keystone user-create \
--name="project_a_auditor" \
--pass="$USER_PASSWORD" \
--email="auditor_a@example.net")
keystone user-role-add \
--user="$USER_ID" \
--role="$ROLE_AUDIT_ID" \
--tenant-id="$PROJECT_A_ID"
USER_ID=$(openstack user create \
--password "$PASSWORD" \
--email "auditor_a@example.net" \
"project_a_auditor" -f value -c id)
openstack role add \
--user "$USER_ID" \
--project "$PROJECT_A_ID" \
"$ROLE_AUDIT_ID"
#
# Setup RBAC Admin of Project B
#
USER_ID=$(get_id keystone user-create \
--name="project_b_admin" \
--pass="$USER_PASSWORD" \
--email="admin_b@example.net")
keystone user-role-add \
--user="$USER_ID" \
--role="$ROLE_ADMIN_ID" \
--tenant-id="$PROJECT_B_ID"
USER_ID=$(openstack user create \
--password "$PASSWORD" \
--email "admin_b@example.net" \
"project_b_admin" -f value -c id)
openstack role add \
--user "$USER_ID" \
--project "$PROJECT_B_ID" \
"$ROLE_ADMIN_ID"
#
# Setup RBAC Creator of Project B
#
USER_ID=$(get_id keystone user-create \
--name="project_b_creator" \
--pass="$USER_PASSWORD" \
--email="creator_b@example.net")
keystone user-role-add \
--user="$USER_ID" \
--role="$ROLE_CREATOR_ID" \
--tenant-id="$PROJECT_B_ID"
USER_ID=$(openstack user create \
--password "$PASSWORD" \
--email "creator_b@example.net" \
"project_b_creator" -f value -c id)
openstack role add \
--user "$USER_ID" \
--project "$PROJECT_B_ID" \
"$ROLE_CREATOR_ID"
#
# Setup RBAC Observer of Project B
#
USER_ID=$(get_id keystone user-create \
--name="project_b_observer" \
--pass="$USER_PASSWORD" \
--email="observer_b@example.net")
keystone user-role-add \
--user="$USER_ID" \
--role="$ROLE_OBSERVER_ID" \
--tenant-id="$PROJECT_B_ID"
USER_ID=$(openstack user create \
--password "$PASSWORD" \
--email "observer_b@example.net" \
"project_b_observer" -f value -c id)
openstack role add \
--user "$USER_ID" \
--project "$PROJECT_B_ID" \
"$ROLE_OBSERVER_ID"
#
# Setup RBAC Auditor of Project B
# Setup RBAC auditor of Project B
#
USER_ID=$(get_id keystone user-create \
--name="project_b_auditor" \
--pass="$USER_PASSWORD" \
--email="auditor_b@example.net")
keystone user-role-add \
--user="$USER_ID" \
--role="$ROLE_AUDIT_ID" \
--tenant-id="$PROJECT_B_ID"
USER_ID=$(openstack user create \
--password "$PASSWORD" \
--email "auditor_b@example.net" \
"project_b_auditor" -f value -c id)
openstack role add \
--user "$USER_ID" \
--project "$PROJECT_B_ID" \
"$ROLE_AUDIT_ID"
#
# Setup Admin Endpoint
# Setup Barbican Endpoint
#
if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
BARBICAN_SERVICE=$(get_id keystone service-create \
--name=barbican \
--type="key-manager" \
--description="Barbican Key Management Service")
keystone endpoint-create \
BARBICAN_SERVICE=$(openstack service create \
--name barbican \
--description "Barbican Service" \
'key-manager' -f value -c id)
openstack endpoint create \
$BARBICAN_SERVICE \
--region RegionOne \
--service_id $BARBICAN_SERVICE \
--publicurl "http://$SERVICE_HOST:9311" \
--internalurl "http://$SERVICE_HOST:9311"
fi