OpenStack Havana - Keystone 設定#22013/10/22

	Keystone にユーザやロール、OpenStack 各コンポーネントが利用するサービスを登録しておきます。
[1]	環境変数を事前に読み込んでおく「SERVICE_TOKEN」はkeystone.conf で「admin_token」に設定した値「SERVICE_ENDPOINT」は Keystoneサーバーのホスト名またはIPアドレス

[root@dlp ~]#

export SERVICE_TOKEN=admintoken

[root@dlp ~]#

export SERVICE_ENDPOINT=http://10.0.0.30:35357/v2.0/

[2]	テナント(グループ)を作成する

# admin テナント作成

[root@dlp ~]#

keystone tenant-create --name admin --description "Admin Tenant" --enabled true

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |           Admin Tenant           |
|   enabled   |               True               |
|      id     | 97be94660c2043e58fee407bc9cde0d5 |
|     name    |              admin               |
+-------------+----------------------------------+

# service テナント作成

[root@dlp ~]#

keystone tenant-create --name service --description "Service Tenant" --enabled true

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |          Service Tenant          |
|   enabled   |               True               |
|      id     | 17867024fb23470f8005a15c6ccfed44 |
|     name    |             service              |
+-------------+----------------------------------+

# 設定確認

[root@dlp ~]#

keystone tenant-list

+----------------------------------+---------+---------+
|                id                |   name  | enabled |
+----------------------------------+---------+---------+
| 97be94660c2043e58fee407bc9cde0d5 |  admin  |   True  |
| 17867024fb23470f8005a15c6ccfed44 | service |   True  |
+----------------------------------+---------+---------+

[3]

ロールを作成する

# admin ロール作成

[root@dlp ~]#

keystone role-create --name admin

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|    id    | 51077b36f67b47e299cfc275157eb5a6 |
|   name   |              admin               |
+----------+----------------------------------+

# Member ロール作成

[root@dlp ~]#

keystone role-create --name Member

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|    id    | e67eabd9c4ff4559b3f3e09666473bc6 |
|   name   |              Member              |
+----------+----------------------------------+

# 設定確認

[root@dlp ~]#

keystone role-list

+----------------------------------+----------+
|                id                |   name   |
+----------------------------------+----------+
| e67eabd9c4ff4559b3f3e09666473bc6 |  Member  |
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ |
| 51077b36f67b47e299cfc275157eb5a6 |  admin   |
+----------------------------------+----------+

[4]

ユーザーを作成する

# admin ユーザー作成 (admin テナント所属)

[root@dlp ~]#

keystone user-create --tenant admin --name admin --pass adminpassword --enabled true

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |                                  |
| enabled  |               True               |
|    id    | 279ade4f97014020b0e7855f2f72e40f |
|   name   |              admin               |
| tenantId | 97be94660c2043e58fee407bc9cde0d5 |
+----------+----------------------------------+

# admin ユーザーを adminロールに加える

[root@dlp ~]#

keystone user-role-add --user admin --tenant admin --role admin

# cinder ユーザー作成 (service テナント所属)

[root@dlp ~]#

keystone user-create --tenant service --name cinder --pass servicepassword --enabled true

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |                                  |
| enabled  |               True               |
|    id    | 68fb4adcb2664dcb8747be70a12173ff |
|   name   |              cinder              |
| tenantId | 17867024fb23470f8005a15c6ccfed44 |
+----------+----------------------------------+

# cinder ユーザーを adminロールに加える

[root@dlp ~]#

keystone user-role-add --user cinder --tenant service --role admin

# glance ユーザー作成 (service テナント所属)

[root@dlp ~]#

keystone user-create --tenant service --name glance --pass servicepassword --enabled true

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |                                  |
| enabled  |               True               |
|    id    | ea825d2bae8c4b27bd2fea1186c433bb |
|   name   |              glance              |
| tenantId | 17867024fb23470f8005a15c6ccfed44 |
+----------+----------------------------------+

# glance ユーザーを adminロールに加える

[root@dlp ~]#

keystone user-role-add --user glance --tenant service --role admin

# nova ユーザー作成 (service テナント)

[root@dlp ~]#

keystone user-create --tenant service --name nova --pass servicepassword --enabled true

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |                                  |
| enabled  |               True               |
|    id    | 66abd2503a7c40d8b3d6fe9a733787ec |
|   name   |               nova               |
| tenantId | 17867024fb23470f8005a15c6ccfed44 |
+----------+----------------------------------+

# nova ユーザーを adminロールに加える

[root@dlp ~]#

keystone user-role-add --user nova --tenant service --role admin

# 設定確認

[root@dlp ~]#

keystone user-list

+----------------------------------+--------+---------+-------+
|                id                |  name  | enabled | email |
+----------------------------------+--------+---------+-------+
| 279ade4f97014020b0e7855f2f72e40f | admin  |   True  |       |
| 68fb4adcb2664dcb8747be70a12173ff | cinder |   True  |       |
| ea825d2bae8c4b27bd2fea1186c433bb | glance |   True  |       |
| 66abd2503a7c40d8b3d6fe9a733787ec |  nova  |   True  |       |
+----------------------------------+--------+---------+-------+

[5]	サービス用のエントリを作成する

# keystone用サービスエントリ作成

[root@dlp ~]#

keystone service-create --name=keystone --type=identity --description="Keystone Identity Service"

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |    Keystone Identity Service     |
|      id     | 90e34600f87043dc95488a5cf6f30118 |
|     name    |             keystone             |
|     type    |             identity             |
+-------------+----------------------------------+

# cinder用サービスエントリ作成

[root@dlp ~]#

keystone service-create --name=cinder --type=volume --description="Cinder Service"

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |          Cinder Service          |
|      id     | 8214ec203d6e434f8a0eb2687ef7aa0c |
|     name    |              cinder              |
|     type    |              volume              |
+-------------+----------------------------------+

# glance用サービスエントリ作成

[root@dlp ~]#

keystone service-create --name=glance --type=image --description="Glance Image Service"

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |       Glance Image Service       |
|      id     | d364dd1bb04741ff86a303c36cee4a47 |
|     name    |              glance              |
|     type    |              image               |
+-------------+----------------------------------+

# nova用サービスエントリ作成

[root@dlp ~]#

keystone service-create --name=nova --type=compute --description="Nova Compute Service"

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |       Nova Compute Service       |
|      id     | 8d2ff23b12144ce3a645aeb85cbbeec3 |
|     name    |               nova               |
|     type    |             compute              |
+-------------+----------------------------------+

# 設定確認

[root@dlp ~]#

keystone service-list

+----------------------------------+----------+----------+---------------------------+
|                id                |   name   |   type   |        description        |
+----------------------------------+----------+----------+---------------------------+
| 8214ec203d6e434f8a0eb2687ef7aa0c |  cinder  |  volume  |       Cinder Service      |
| d364dd1bb04741ff86a303c36cee4a47 |  glance  |  image   |    Glance Image Service   |
| 90e34600f87043dc95488a5cf6f30118 | keystone | identity | Keystone Identity Service |
| 8d2ff23b12144ce3a645aeb85cbbeec3 |   nova   | compute  |    Nova Compute Service   |
+----------------------------------+----------+----------+---------------------------+

[6]	エンドポイントを作成する

# 自ホストを定義しておく

[root@dlp ~]#

export my_host=10.0.0.30

# keystone 用エンドポイント作成

[root@dlp ~]#

keystone endpoint-create --region RegionOne \
--service keystone \
--publicurl "http://$my_host:\$(public_port)s/v2.0" \
--internalurl "http://$my_host:\$(public_port)s/v2.0" \
--adminurl "http://$my_host:\$(admin_port)s/v2.0"

+-------------+---------------------------------------+
|   Property  |                 Value                 |
+-------------+---------------------------------------+
|   adminurl  |  http://10.0.0.30:$(admin_port)s/v2.0 |
|      id     |    8abd184835d849c89e2853b1d5e110d5   |
| internalurl | http://10.0.0.30:$(public_port)s/v2.0 |
|  publicurl  | http://10.0.0.30:$(public_port)s/v2.0 |
|    region   |               RegionOne               |
|  service_id |    90e34600f87043dc95488a5cf6f30118   |
+-------------+---------------------------------------+

# cinder 用エンドポイント作成

[root@dlp ~]#

keystone endpoint-create --region RegionOne \
--service cinder \
--publicurl "http://$my_host:8776/v1/\$(tenant_id)s" \
--internalurl "http://$my_host:8776/v1/\$(tenant_id)s" \
--adminurl "http://$my_host:8776/v1/\$(tenant_id)s"

+-------------+----------------------------------------+
|   Property  |                 Value                  |
+-------------+----------------------------------------+
|   adminurl  | http://10.0.0.30:8776/v1/$(tenant_id)s |
|      id     |    e1e864f12648435fa7ad1ed4d94729c5    |
| internalurl | http://10.0.0.30:8776/v1/$(tenant_id)s |
|  publicurl  | http://10.0.0.30:8776/v1/$(tenant_id)s |
|    region   |               RegionOne                |
|  service_id |    8214ec203d6e434f8a0eb2687ef7aa0c    |
+-------------+----------------------------------------+

# glance 用エンドポイント作成

[root@dlp ~]#

keystone endpoint-create --region RegionOne \
--service glance \
--publicurl "http://$my_host:9292/v1" \
--internalurl "http://$my_host:9292/v1" \
--adminurl "http://$my_host:9292/v1"

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
|   adminurl  |     http://10.0.0.30:9292/v1     |
|      id     | 99a80cd8a9f3495a88bdb9d446735663 |
| internalurl |     http://10.0.0.30:9292/v1     |
|  publicurl  |     http://10.0.0.30:9292/v1     |
|    region   |            RegionOne             |
|  service_id | d364dd1bb04741ff86a303c36cee4a47 |
+-------------+----------------------------------+

# nova 用エンドポイント作成

[root@dlp ~]#

keystone endpoint-create --region RegionOne \
--service nova \
--publicurl "http://$my_host:\$(compute_port)s/v1.1/\$(tenant_id)s" \
--internalurl "http://$my_host:\$(compute_port)s/v1.1/\$(tenant_id)s" \
--adminurl "http://$my_host:\$(compute_port)s/v1.1/\$(tenant_id)s"

+-------------+------------------------------------------------------+
|   Property  |                        Value                         |
+-------------+------------------------------------------------------+
|   adminurl  | http://10.0.0.30:$(compute_port)s/v1.1/$(tenant_id)s |
|      id     |           a7358113abe64724a52877ab45dab0f5           |
| internalurl | http://10.0.0.30:$(compute_port)s/v1.1/$(tenant_id)s |
|  publicurl  | http://10.0.0.30:$(compute_port)s/v1.1/$(tenant_id)s |
|    region   |                      RegionOne                       |
|  service_id |           8d2ff23b12144ce3a645aeb85cbbeec3           |
+-------------+------------------------------------------------------+

# 設定確認

[root@dlp ~]#

keystone endpoint-list

+----------------------------------+-----------+
|                id                |   region  |
+----------------------------------+-----------+
| 8abd184835d849c89e2853b1d5e110d5 | RegionOne |
| 99a80cd8a9f3495a88bdb9d446735663 | RegionOne |
| a7358113abe64724a52877ab45dab0f5 | RegionOne |
| e1e864f12648435fa7ad1ed4d94729c5 | RegionOne |
+----------------------------------+-----------+
+------------------------------------------------------+
|                      publicurl                       |
+------------------------------------------------------+
|        http://10.0.0.30:$(public_port)s/v2.0         |
|               http://10.0.0.30:9292/v1               |
| http://10.0.0.30:$(compute_port)s/v1.1/$(tenant_id)s |
|        http://10.0.0.30:8776/v1/$(tenant_id)s        |
+------------------------------------------------------+
+------------------------------------------------------+
|                     internalurl                      |
+------------------------------------------------------+
|        http://10.0.0.30:$(public_port)s/v2.0         |
|               http://10.0.0.30:9292/v1               |
| http://10.0.0.30:$(compute_port)s/v1.1/$(tenant_id)s |
|        http://10.0.0.30:8776/v1/$(tenant_id)s        |
+------------------------------------------------------+
+------------------------------------------------------+
|                       adminurl                       |
+------------------------------------------------------+
|         http://10.0.0.30:$(admin_port)s/v2.0         |
|               http://10.0.0.30:9292/v1               |
| http://10.0.0.30:$(compute_port)s/v1.1/$(tenant_id)s |
|        http://10.0.0.30:8776/v1/$(tenant_id)s        |
+------------------------------------------------------+
+----------------------------------+
|            service_id            |
+----------------------------------+
| 90e34600f87043dc95488a5cf6f30118 |
| d364dd1bb04741ff86a303c36cee4a47 |
| 8d2ff23b12144ce3a645aeb85cbbeec3 |
| 8214ec203d6e434f8a0eb2687ef7aa0c |
+----------------------------------+