4bf765758c
This patch works several files that were not in common use back into the documents they should live with. The intended end result of this activity is to make common as lean as possible so it can be more easily translated. Also: Don't include configdrive table in user-guide since it's not relevant for audience Change-Id: Iacd5c68c639e60e8c711cb18351543e477444299
170 lines
9.4 KiB
XML
170 lines
9.4 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
version="5.0"
|
|
xml:id="adding-users-tenants-and-roles-with-python-keystoneclient">
|
|
<?dbhtml stop-chunking?>
|
|
<title>Create and manage services and service users</title>
|
|
<para>The Identity Service enables you to define services, as
|
|
follows:</para>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>Service catalog template. The Identity Service acts
|
|
as a service catalog of endpoints for other OpenStack
|
|
services. The
|
|
<literal>etc/default_catalog.templates</literal>
|
|
template file defines the endpoints for services. When
|
|
the Identity Service uses a template file back end,
|
|
any changes that are made to the endpoints are cached.
|
|
These changes do not persist when you restart the
|
|
service or reboot the machine.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>A SQL back end for the catalog service. When the
|
|
Identity Service is online, you must add the services
|
|
to the catalog. When you deploy a system for
|
|
production, use the SQL back end.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
<para>The <literal>auth_token</literal> middleware supports the
|
|
use of either a shared secret or users for each
|
|
service.</para>
|
|
<para>To authenticate users against the Identity Service, you must
|
|
create a service user for each OpenStack service. For example,
|
|
create a service user for the Compute, Block Storage, and
|
|
Networking services.</para>
|
|
<para>To configure the OpenStack services with service users,
|
|
create a project for all services and create users for each
|
|
service. Assign the admin role to each service user and
|
|
project pair. This role enables users to validate tokens and
|
|
authenticate and authorize other user requests.</para>
|
|
<section xml:id="cli_service-create">
|
|
<title>Create a service</title>
|
|
<procedure>
|
|
<step>
|
|
<para>List the available services:</para>
|
|
<screen><prompt>$</prompt> <userinput>keystone service-list</userinput></screen>
|
|
<screen><computeroutput>+----------------------------------+----------+----------+---------------------------+
|
|
| id | name | type | description |
|
|
+----------------------------------+----------+----------+---------------------------+
|
|
| 9816f1faaa7c4842b90fb4821cd09223 | cinder | volume | Cinder Volume Service |
|
|
| da8cf9f8546b4a428c43d5e032fe4afc | ec2 | ec2 | EC2 Compatibility Layer |
|
|
| 5f105eeb55924b7290c8675ad7e294ae | glance | image | Glance Image Service |
|
|
| dcaa566e912e4c0e900dc86804e3dde0 | keystone | identity | Keystone Identity Service |
|
|
| 4a715cfbc3664e9ebf388534ff2be76a | nova | compute | Nova Compute Service |
|
|
| 6feb2e0b98874d88bee221974770e372 | s3 | s3 | S3 |
|
|
+----------------------------------+----------+----------+---------------------------+</computeroutput></screen>
|
|
</step>
|
|
<step>
|
|
<para>To create a service, run this command:</para>
|
|
<screen><prompt>$</prompt> <userinput>keystone service-create --name <replaceable>service_name</replaceable> --type <replaceable>service_type</replaceable> --description <replaceable>service_description</replaceable></userinput></screen>
|
|
<para>The arguments are:</para>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para><code><replaceable>service_name</replaceable></code>.
|
|
The unique name of the new service.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para><code><replaceable>service_type</replaceable></code>.
|
|
The service type, such as
|
|
<code>identity</code>,
|
|
<code>compute</code>,
|
|
<code>network</code>,
|
|
<code>image</code>,
|
|
<code>object-store</code> or any other
|
|
service identifier string.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para><code><replaceable>service_description</replaceable></code>.
|
|
The description of the service.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
<para>For example, to create a
|
|
<literal>swift</literal> service of type
|
|
<literal>object-store</literal>, run this
|
|
command:</para>
|
|
<screen><prompt>$</prompt> <userinput>keystone service-create --name swift --type object-store --description "object store service"</userinput></screen>
|
|
<screen><computeroutput>+-------------+----------------------------------+
|
|
| Property | Value |
|
|
+-------------+----------------------------------+
|
|
| description | object store service |
|
|
| enabled | True |
|
|
| id | 84c23f4b942c44c38b9c42c5e517cd9a |
|
|
| name | swift |
|
|
| type | object-store |
|
|
+-------------+----------------------------------+</computeroutput></screen>
|
|
</step>
|
|
<step>
|
|
<para>To get details for a service, run this
|
|
command:</para>
|
|
<screen><prompt>$</prompt> <userinput>keystone service-get <replaceable>service_ID</replaceable></userinput></screen>
|
|
<para>For example:</para>
|
|
<screen><prompt>$</prompt> <userinput>keystone service-get 84c23f4b942c44c38b9c42c5e517cd9a</userinput></screen>
|
|
<screen><computeroutput>+-------------+----------------------------------+
|
|
| Property | Value |
|
|
+-------------+----------------------------------+
|
|
| description | object store service |
|
|
| enabled | True |
|
|
| id | 84c23f4b942c44c38b9c42c5e517cd9a |
|
|
| name | swift |
|
|
| type | object-store |
|
|
+-------------+----------------------------------+</computeroutput></screen>
|
|
</step>
|
|
</procedure>
|
|
</section>
|
|
<section xml:id="cli_create_service_users">
|
|
<title>Create service users</title>
|
|
<procedure>
|
|
<step>
|
|
<para>Create a project for the service users.
|
|
Typically, this project is named
|
|
<literal>service</literal>, but choose any
|
|
name you like:</para>
|
|
<screen><prompt>$</prompt> <userinput>keystone tenant-create --name service</userinput></screen>
|
|
<para>The output shows the ID for the project.</para>
|
|
<para>Make a note of this ID. You need it to create
|
|
service users and assign roles.</para>
|
|
<screen><computeroutput>+-------------+----------------------------------+
|
|
| Property | Value |
|
|
+-------------+----------------------------------+
|
|
| description | |
|
|
| enabled | True |
|
|
| id | 3e9f3f5399624b2db548d7f871bd5322 |
|
|
| name | service |
|
|
+-------------+----------------------------------+</computeroutput></screen>
|
|
</step>
|
|
<step>
|
|
<para>Create service users for the relevant services
|
|
for your deployment.</para>
|
|
</step>
|
|
<step>
|
|
<para>To assign the admin role to the service
|
|
user-project pairs, run this command to get the ID
|
|
of the admin role:</para>
|
|
<screen><prompt>$</prompt> <userinput>keystone role-list</userinput></screen>
|
|
<screen><computeroutput>+----------------------------------+---------------+
|
|
| id | name |
|
|
+----------------------------------+---------------+
|
|
| 71ccc37d41c8491c975ae72676db687f | Member |
|
|
| 149f50a1fe684bfa88dae76a48d26ef7 | ResellerAdmin |
|
|
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ |
|
|
| 6ecf391421604da985db2f141e46a7c8 | admin |
|
|
| deb4fffd123c4d02a907c2c74559dccf | anotherrole |
|
|
| bef1f95537914b1295da6aa038ef4de6 | new-role |
|
|
+----------------------------------+---------------+</computeroutput></screen>
|
|
</step>
|
|
<step>
|
|
<para>Assign the admin role to the user-project
|
|
pair:</para>
|
|
<screen><prompt>$</prompt> <userinput>keystone user-role-add --user <replaceable>SERVICE_USER_ID</replaceable> --role <replaceable>ADMIN_ROLE_ID</replaceable> --tenant <replaceable>SERVICE_PROJECT_ID</replaceable></userinput></screen>
|
|
</step>
|
|
</procedure>
|
|
</section>
|
|
<section xml:id="cli_delete_service">
|
|
<title>Delete a service</title>
|
|
<para>To delete a specified service, specify its ID:</para>
|
|
<screen><prompt>$</prompt> <userinput>keystone service-delete <replaceable>SERVICE_ID</replaceable></userinput></screen>
|
|
</section>
|
|
</section>
|