Fedora 20
Sponsored Link

OpenStack Havana - Keystone 設定#22013/12/23
 
Keystone に ユーザやロール、OpenStack 各コンポーネントが利用するサービスを登録しておきます。
[1] 環境変数を事前に読み込んでおく
「SERVICE_TOKEN」はkeystone.conf で「admin_token」に設定した値
「SERVICE_ENDPOINT」は Keystoneサーバーのホスト名またはIPアドレス
[root@dlp ~]#
export SERVICE_TOKEN=admintoken

[root@dlp ~]#
export SERVICE_ENDPOINT=http://10.0.0.30:35357/v2.0/

[2] テナント(グループ)を作成する
# admin テナント作成

[root@dlp ~]#
keystone tenant-create --name admin --description "Admin Tenant" --enabled true 

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |           Admin Tenant           |
|   enabled   |               True               |
|      id     | 28799bf2e54e4b23b59a55305af3f1b5 |
|     name    |              admin               |
+-------------+----------------------------------+
# service テナント作成

[root@dlp ~]#
keystone tenant-create --name service --description "Service Tenant" --enabled true 

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |          Service Tenant          |
|   enabled   |               True               |
|      id     | d8622d7497d141c4a7f25e437bcbac18 |
|     name    |             service              |
+-------------+----------------------------------+
# 設定確認

[root@dlp ~]#
keystone tenant-list 

+----------------------------------+---------+---------+
|                id                |   name  | enabled |
+----------------------------------+---------+---------+
| 28799bf2e54e4b23b59a55305af3f1b5 |  admin  |   True  |
| d8622d7497d141c4a7f25e437bcbac18 | service |   True  |
+----------------------------------+---------+---------+
[3] ロールを作成する
# admin ロール作成

[root@dlp ~]#
keystone role-create --name admin 

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|    id    | d51a645b454f4c3d80cc9de3ad5ddb09 |
|   name   |              admin               |
+----------+----------------------------------+
# Member ロール作成

[root@dlp ~]#
keystone role-create --name Member 

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|    id    | c04d5c7e9f2d4cdfbbcc500ce333e90e |
|   name   |              Member              |
+----------+----------------------------------+
# 設定確認

[root@dlp ~]#
keystone role-list 

+----------------------------------+----------+
|                id                |   name   |
+----------------------------------+----------+
| c04d5c7e9f2d4cdfbbcc500ce333e90e |  Member  |
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ |
| d51a645b454f4c3d80cc9de3ad5ddb09 |  admin   |
+----------------------------------+----------+
[4] ユーザーを作成する
# admin ユーザー作成 (admin テナント所属)

[root@dlp ~]#
keystone user-create --tenant admin --name admin --pass adminpassword --enabled true 

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |                                  |
| enabled  |               True               |
|    id    | d6481b169ba741148d162ccaf4636616 |
|   name   |              admin               |
| tenantId | 28799bf2e54e4b23b59a55305af3f1b5 |
+----------+----------------------------------+
# admin ユーザーを adminロール に加える

[root@dlp ~]#
keystone user-role-add --user admin --tenant admin --role admin
# glance ユーザー作成 (service テナント所属)

[root@dlp ~]#
keystone user-create --tenant service --name glance --pass servicepassword --enabled true 

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |                                  |
| enabled  |               True               |
|    id    | 615172a716bb4c28baae44d5de4268fe |
|   name   |              glance              |
| tenantId | d8622d7497d141c4a7f25e437bcbac18 |
+----------+----------------------------------+
# glance ユーザーを adminロール に加える

[root@dlp ~]#
keystone user-role-add --user glance --tenant service --role admin
# nova ユーザー作成 (service テナント)

[root@dlp ~]#
keystone user-create --tenant service --name nova --pass servicepassword --enabled true 

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |                                  |
| enabled  |               True               |
|    id    | d11f4f925b6945e1a8716099c22b433b |
|   name   |               nova               |
| tenantId | d8622d7497d141c4a7f25e437bcbac18 |
+----------+----------------------------------+
# nova ユーザーを adminロール に加える

[root@dlp ~]#
keystone user-role-add --user nova --tenant service --role admin
# 設定確認

[root@dlp ~]#
keystone user-list 

+----------------------------------+--------+---------+-------+
|                id                |  name  | enabled | email |
+----------------------------------+--------+---------+-------+
| d6481b169ba741148d162ccaf4636616 | admin  |   True  |       |
| 615172a716bb4c28baae44d5de4268fe | glance |   True  |       |
| d11f4f925b6945e1a8716099c22b433b |  nova  |   True  |       |
+----------------------------------+--------+---------+-------+
[5] サービス用のエントリを作成する
# keystone用サービスエントリ作成

[root@dlp ~]#
keystone service-create --name=keystone --type=identity --description="Keystone Identity Service" 

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |    Keystone Identity Service     |
|      id     | bfba0ddf19a040db8fada0b3af6c7f4b |
|     name    |             keystone             |
|     type    |             identity             |
+-------------+----------------------------------+
# glance用サービスエントリ作成

[root@dlp ~]#
keystone service-create --name=glance --type=image --description="Glance Image Service" 

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |       Glance Image Service       |
|      id     | 31faa7daabd545efade518fb4aba7c5c |
|     name    |              glance              |
|     type    |              image               |
+-------------+----------------------------------+
# nova用サービスエントリ作成

[root@dlp ~]#
keystone service-create --name=nova --type=compute --description="Nova Compute Service" 

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |       Nova Compute Service       |
|      id     | bed8c5825c0e494f8a631d48096d4662 |
|     name    |               nova               |
|     type    |             compute              |
+-------------+----------------------------------+
# 設定確認

[root@dlp ~]#
keystone service-list 

+----------------------------------+----------+----------+---------------------------+
|                id                |   name   |   type   |        description        |
+----------------------------------+----------+----------+---------------------------+
| 31faa7daabd545efade518fb4aba7c5c |  glance  |  image   |    Glance Image Service   |
| bfba0ddf19a040db8fada0b3af6c7f4b | keystone | identity | Keystone Identity Service |
| bed8c5825c0e494f8a631d48096d4662 |   nova   | compute  |    Nova Compute Service   |
+----------------------------------+----------+----------+---------------------------+
[6] エンドポイントを作成する
# 自ホストを定義しておく

[root@dlp ~]#
export my_host=10.0.0.30
# keystone 用エンドポイント作成

[root@dlp ~]#
keystone endpoint-create --region RegionOne \
--service keystone \
--publicurl "http://$my_host:\$(public_port)s/v2.0" \
--internalurl "http://$my_host:\$(public_port)s/v2.0" \
--adminurl "http://$my_host:\$(admin_port)s/v2.0" 

+-------------+---------------------------------------+
|   Property  |                 Value                 |
+-------------+---------------------------------------+
|   adminurl  |  http://10.0.0.30:$(admin_port)s/v2.0 |
|      id     |    438a19bb6fbe458d84f70e5b513dd051   |
| internalurl | http://10.0.0.30:$(public_port)s/v2.0 |
|  publicurl  | http://10.0.0.30:$(public_port)s/v2.0 |
|    region   |               RegionOne               |
|  service_id |    bfba0ddf19a040db8fada0b3af6c7f4b   |
+-------------+---------------------------------------+
# glance 用エンドポイント作成

[root@dlp ~]#
keystone endpoint-create --region RegionOne \
--service glance \
--publicurl "http://$my_host:9292/v1" \
--internalurl "http://$my_host:9292/v1" \
--adminurl "http://$my_host:9292/v1" 

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
|   adminurl  |     http://10.0.0.30:9292/v1     |
|      id     | ca4e5888068f4226b3aff8f497ec2e59 |
| internalurl |     http://10.0.0.30:9292/v1     |
|  publicurl  |     http://10.0.0.30:9292/v1     |
|    region   |            RegionOne             |
|  service_id | 31faa7daabd545efade518fb4aba7c5c |
+-------------+----------------------------------+
# nova 用エンドポイント作成

[root@dlp ~]#
keystone endpoint-create --region RegionOne \
--service nova \
--publicurl "http://$my_host:\$(compute_port)s/v1.1/\$(tenant_id)s" \
--internalurl "http://$my_host:\$(compute_port)s/v1.1/\$(tenant_id)s" \
--adminurl "http://$my_host:\$(compute_port)s/v1.1/\$(tenant_id)s" 

+-------------+------------------------------------------------------+
|   Property  |                        Value                         |
+-------------+------------------------------------------------------+
|   adminurl  | http://10.0.0.30:$(compute_port)s/v1.1/$(tenant_id)s |
|      id     |           1c099e14d06841b99c3df5cf7bf4ea97           |
| internalurl | http://10.0.0.30:$(compute_port)s/v1.1/$(tenant_id)s |
|  publicurl  | http://10.0.0.30:$(compute_port)s/v1.1/$(tenant_id)s |
|    region   |                      RegionOne                       |
|  service_id |           bed8c5825c0e494f8a631d48096d4662           |
+-------------+------------------------------------------------------+
# 設定確認

[root@dlp ~]#
keystone endpoint-list 

+----------------------------------+-----------+
|                id                |   region  |
+----------------------------------+-----------+
| 1c099e14d06841b99c3df5cf7bf4ea97 | RegionOne |
| 438a19bb6fbe458d84f70e5b513dd051 | RegionOne |
| ca4e5888068f4226b3aff8f497ec2e59 | RegionOne |
+----------------------------------+-----------+
+------------------------------------------------------+
|                      publicurl                       |
+------------------------------------------------------+
| http://10.0.0.30:$(compute_port)s/v1.1/$(tenant_id)s |
|        http://10.0.0.30:$(public_port)s/v2.0         |
|               http://10.0.0.30:9292/v1               |
+------------------------------------------------------+
+------------------------------------------------------+
|                     internalurl                      |
+------------------------------------------------------+
| http://10.0.0.30:$(compute_port)s/v1.1/$(tenant_id)s |
|        http://10.0.0.30:$(public_port)s/v2.0         |
|               http://10.0.0.30:9292/v1               |
+------------------------------------------------------+
+------------------------------------------------------+----------------------------------+
|                       adminurl                       |            service_id            |
+------------------------------------------------------+----------------------------------+
| http://10.0.0.30:$(compute_port)s/v1.1/$(tenant_id)s | bed8c5825c0e494f8a631d48096d4662 |
|         http://10.0.0.30:$(admin_port)s/v2.0         | bfba0ddf19a040db8fada0b3af6c7f4b |
|               http://10.0.0.30:9292/v1               | 31faa7daabd545efade518fb4aba7c5c |
+------------------------------------------------------+----------------------------------+
関連コンテンツ