OpenStack Liberty : Configure Keystone#22015/12/23

	Add Users or Roles, Services and others in Keystone.
[1]	Load environment variables first. Set value for "OS_TOKEN" from the value "admin_token" in keystone.conf. For "OS_URL", specify Keystone server's hostname or IP address.

root@dlp:~#

export OS_TOKEN=admintoken

root@dlp:~#

export OS_URL=http://10.0.0.30:35357/v3

root@dlp:~#

export OS_IDENTITY_API_VERSION=3

[2]	Add Projects.

# add admin project

root@dlp:~#

openstack project create --domain default --description "Admin Project" admin

+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Admin Project                    |
| domain_id   | default                          |
| enabled     | True                             |
| id          | aec599ff5b764f56b24378f4b687fa75 |
| is_domain   | False                            |
| name        | admin                            |
| parent_id   | None                             |
+-------------+----------------------------------+

# add service project

root@dlp:~#

openstack project create --domain default --description "Service Project" service

+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Service Project                  |
| domain_id   | default                          |
| enabled     | True                             |
| id          | 54015368c27f4e9b92094d7032228086 |
| is_domain   | False                            |
| name        | service                          |
| parent_id   | None                             |
+-------------+----------------------------------+

# confirm settings

root@dlp:~#

openstack project list

+----------------------------------+---------+
| ID                               | Name    |
+----------------------------------+---------+
| 54015368c27f4e9b92094d7032228086 | service |
| aec599ff5b764f56b24378f4b687fa75 | admin   |
+----------------------------------+---------+

[3]	Add Roles.

# add admin role

root@dlp:~#

openstack role create admin

+-------+----------------------------------+
| Field | Value                            |
+-------+----------------------------------+
| id    | 00a6a5d4d8c24796974de26f79b73477 |
| name  | admin                            |
+-------+----------------------------------+

# add Member role

root@dlp:~#

openstack role create Member

+-------+----------------------------------+
| Field | Value                            |
+-------+----------------------------------+
| id    | 208971585fce417ab78c77c0b3fc926b |
| name  | Member                           |
+-------+----------------------------------+

# confirm settings

root@dlp:~#

openstack role list

+----------------------------------+--------+
| ID                               | Name   |
+----------------------------------+--------+
| 00a6a5d4d8c24796974de26f79b73477 | admin  |
| 208971585fce417ab78c77c0b3fc926b | Member |
+----------------------------------+--------+

[4]	Add User Accounts.

# add admin user (set in admin project)

root@dlp:~#

openstack user create --domain default --project admin --password adminpassword admin

+--------------------+----------------------------------+
| Field              | Value                            |
+--------------------+----------------------------------+
| default_project_id | aec599ff5b764f56b24378f4b687fa75 |
| domain_id          | default                          |
| enabled            | True                             |
| id                 | 57df2f052e46428aae0c02e405f37e6f |
| name               | admin                            |
+--------------------+----------------------------------+

# add admin user in admin role

root@dlp:~#

openstack role add --project admin --user admin admin

# confirm settings

root@dlp:~#

openstack user list

+----------------------------------+-------+
| ID                               | Name  |
+----------------------------------+-------+
| 57df2f052e46428aae0c02e405f37e6f | admin |
+----------------------------------+-------+

[5]	Add entries for services.

# add for keystone

root@dlp:~#

openstack service create --name keystone --description "OpenStack Identity" identity

+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | OpenStack Identity               |
| enabled     | True                             |
| id          | fd3e8762b0c44daca819894d2cd085ad |
| name        | keystone                         |
| type        | identity                         |
+-------------+----------------------------------+

# confirm settings

root@dlp:~#

openstack service list

+----------------------------------+----------+----------+
| ID                               | Name     | Type     |
+----------------------------------+----------+----------+
| fd3e8762b0c44daca819894d2cd085ad | keystone | identity |
+----------------------------------+----------+----------+

[6]	Add Endpoints.

# define this host

root@dlp:~#

export controller=10.0.0.30

# add endpoint for keystone (public)

root@dlp:~#

openstack endpoint create --region RegionOne identity public http://$controller:5000/v2.0

+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | a56afa66c33e4d9f8ad46ef84cf6b507 |
| interface    | public                           |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | fd3e8762b0c44daca819894d2cd085ad |
| service_name | keystone                         |
| service_type | identity                         |
| url          | http://10.0.0.30:5000/v2.0       |
+--------------+----------------------------------+

# add endpoint for keystone (internal )

root@dlp:~#

openstack endpoint create --region RegionOne identity internal http://$controller:5000/v2.0

+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | d6413fda84b447c9a35e216e18ba6eb9 |
| interface    | internal                         |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | fd3e8762b0c44daca819894d2cd085ad |
| service_name | keystone                         |
| service_type | identity                         |
| url          | http://10.0.0.30:5000/v2.0       |
+--------------+----------------------------------+

# add endpoint for keystone (admin )

root@dlp:~#

openstack endpoint create --region RegionOne identity admin http://$controller:35357/v2.0

+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | 238a0aa47af14942838faf92b6f5e152 |
| interface    | admin                            |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | fd3e8762b0c44daca819894d2cd085ad |
| service_name | keystone                         |
| service_type | identity                         |
| url          | http://10.0.0.30:35357/v2.0      |
+--------------+----------------------------------+

# confirm settings

root@dlp:~#

openstack endpoint list

+----------------------------------+-----------+--------------+--------------+---------+-----------+-----------------------------+
| ID                               | Region    | Service Name | Service Type | Enabled | Interface | URL                         |
+----------------------------------+-----------+--------------+--------------+---------+-----------+-----------------------------+
| 238a0aa47af14942838faf92b6f5e152 | RegionOne | keystone     | identity     | True    | admin     | http://10.0.0.30:35357/v2.0 |
| a56afa66c33e4d9f8ad46ef84cf6b507 | RegionOne | keystone     | identity     | True    | public    | http://10.0.0.30:5000/v2.0  |
| d6413fda84b447c9a35e216e18ba6eb9 | RegionOne | keystone     | identity     | True    | internal  | http://10.0.0.30:5000/v2.0  |
+----------------------------------+-----------+--------------+--------------+---------+-----------+-----------------------------+

Matched Content