OpenStack Juno : Keystone 設定#22015/01/03

	Keystone にユーザやロール、OpenStack 各コンポーネントが利用するサービスを登録しておきます。
[1]	環境変数を事前に読み込んでおきます。「SERVICE_TOKEN」は keystone.conf で「admin_token」に設定した値「SERVICE_ENDPOINT」は Keystoneサーバーのホスト名またはIPアドレス

[root@dlp ~]#

export SERVICE_TOKEN=admintoken

[root@dlp ~]#

export SERVICE_ENDPOINT=http://10.0.0.30:35357/v2.0/

[2]	テナント(グループ)を作成します。

# admin テナント作成

[root@dlp ~]#

keystone tenant-create --name admin --description "Admin Tenant" --enabled true

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |           Admin Tenant           |
|   enabled   |               True               |
|      id     | cca5eb10f2744b2a9a68e89ec7dd382c |
|     name    |              admin               |
+-------------+----------------------------------+

# service テナント作成

[root@dlp ~]#

keystone tenant-create --name service --description "Service Tenant" --enabled true

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |          Service Tenant          |
|   enabled   |               True               |
|      id     | 853445ef0b654c4f8cdcea4441e8c76c |
|     name    |             service              |
+-------------+----------------------------------+

# 設定確認

[root@dlp ~]#

keystone tenant-list

+----------------------------------+---------+---------+
|                id                |   name  | enabled |
+----------------------------------+---------+---------+
| cca5eb10f2744b2a9a68e89ec7dd382c |  admin  |   True  |
| 853445ef0b654c4f8cdcea4441e8c76c | service |   True  |
+----------------------------------+---------+---------+

[3]	ロールを作成します。

# admin ロール作成

[root@dlp ~]#

keystone role-create --name admin

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|    id    | c9b5093fb48740bc93648e621a851138 |
|   name   |              admin               |
+----------+----------------------------------+

# Member ロール作成

[root@dlp ~]#

keystone role-create --name Member

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|    id    | 95b5ede7761e4566906aed4bd74b56ec |
|   name   |              Member              |
+----------+----------------------------------+

# 設定確認

[root@dlp ~]#

keystone role-list

+----------------------------------+--------+
|                id                |  name  |
+----------------------------------+--------+
| 95b5ede7761e4566906aed4bd74b56ec | Member |
| c7d4272c3fb44d0cb10ba904c11f89d8 | admin  |
+----------------------------------+--------+

[4]	ユーザーを作成します。

# admin ユーザー作成 (admin テナント所属)

[root@dlp ~]#

keystone user-create --tenant admin --name admin --pass adminpassword --enabled true

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |                                  |
| enabled  |               True               |
|    id    | 4bae962626bc4a29848038d41690e0fd |
|   name   |              admin               |
| tenantId | cca5eb10f2744b2a9a68e89ec7dd382c |
| username |              admin               |
+----------+----------------------------------+

# admin ユーザーを adminロールに加える

[root@dlp ~]#

keystone user-role-add --user admin --tenant admin --role admin

# glance ユーザー作成 (service テナント所属)

[root@dlp ~]#

keystone user-create --tenant service --name glance --pass servicepassword --enabled true

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |                                  |
| enabled  |               True               |
|    id    | 0487b13f40244680831177127369d2e9 |
|   name   |              glance              |
| tenantId | c57296226918412eaaa6cfe165ce1d96 |
| username |              glance              |
+----------+----------------------------------+

# glance ユーザーを adminロールに加える

[root@dlp ~]#

keystone user-role-add --user glance --tenant service --role admin

# nova ユーザー作成 (service テナント)

[root@dlp ~]#

keystone user-create --tenant service --name nova --pass servicepassword --enabled true

+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |                                  |
| enabled  |               True               |
|    id    | f48cdd97cc4d4977bb1958d9b4d22aa5 |
|   name   |               nova               |
| tenantId | 853445ef0b654c4f8cdcea4441e8c76c |
| username |               nova               |
+----------+----------------------------------+

# nova ユーザーを adminロールに加える

[root@dlp ~]#

keystone user-role-add --user nova --tenant service --role admin

# 設定確認

[root@dlp ~]#

keystone user-list

+----------------------------------+--------+---------+-------+
|                id                |  name  | enabled | email |
+----------------------------------+--------+---------+-------+
| 4bae962626bc4a29848038d41690e0fd | admin  |   True  |       |
| a96370f89c0a4059af9e80c935a77f51 | glance |   True  |       |
| f48cdd97cc4d4977bb1958d9b4d22aa5 |  nova  |   True  |       |
+----------------------------------+--------+---------+-------+

[5]	サービス用のエントリを作成します。

# keystone用サービスエントリ作成

[root@dlp ~]#

keystone service-create --name=keystone --type=identity --description="Keystone Identity Service"

+-------------+----------------------------------+
| description |    Keystone Identity Service     |
|   enabled   |               True               |
|      id     | ada6f56fba1141e98fb8d38af848ecba |
|     name    |             keystone             |
|     type    |             identity             |
+-------------+----------------------------------+

# glance用サービスエントリ作成

[root@dlp ~]#

keystone service-create --name=glance --type=image --description="Glance Image Service"

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |       Glance Image Service       |
|   enabled   |               True               |
|      id     | 874ba44f3a4a4ed6bed6e3684a6f87d7 |
|     name    |              glance              |
|     type    |              image               |
+-------------+----------------------------------+

# nova用サービスエントリ作成

[root@dlp ~]#

keystone service-create --name=nova --type=compute --description="Nova Compute Service"

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |       Nova Compute Service       |
|   enabled   |               True               |
|      id     | bd096f7d71eb4ebb942c93eb9a13609d |
|     name    |               nova               |
|     type    |             compute              |
+-------------+----------------------------------+

# 設定確認

[root@dlp ~]#

keystone service-list

+----------------------------------+----------+----------+---------------------------+
|                id                |   name   |   type   |        description        |
+----------------------------------+----------+----------+---------------------------+
| 874ba44f3a4a4ed6bed6e3684a6f87d7 |  glance  |  image   |    Glance Image Service   |
| ada6f56fba1141e98fb8d38af848ecba | keystone | identity | Keystone Identity Service |
| bd096f7d71eb4ebb942c93eb9a13609d |   nova   | compute  |    Nova Compute Service   |
+----------------------------------+----------+----------+---------------------------+

[6]	エンドポイントを作成します。

# 自ホストを定義しておく

[root@dlp ~]#

export my_host=10.0.0.30

# keystone 用エンドポイント作成

[root@dlp ~]#

keystone endpoint-create --region RegionOne \
--service keystone \
--publicurl "http://$my_host:\$(public_port)s/v2.0" \
--internalurl "http://$my_host:\$(public_port)s/v2.0" \
--adminurl "http://$my_host:\$(admin_port)s/v2.0"

+-------------+---------------------------------------+
|   Property  |                 Value                 |
+-------------+---------------------------------------+
|   adminurl  |  http://10.0.0.30:$(admin_port)s/v2.0 |
|      id     |    f5b2dadfdc1d4d368148eaad68247de4   |
| internalurl | http://10.0.0.30:$(public_port)s/v2.0 |
|  publicurl  | http://10.0.0.30:$(public_port)s/v2.0 |
|    region   |               RegionOne               |
|  service_id |    ada6f56fba1141e98fb8d38af848ecba   |
+-------------+---------------------------------------+

# glance 用エンドポイント作成

[root@dlp ~]#

keystone endpoint-create --region RegionOne \
--service glance \
--publicurl "http://$my_host:9292/v1" \
--internalurl "http://$my_host:9292/v1" \
--adminurl "http://$my_host:9292/v1"

+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
|   adminurl  |     http://10.0.0.30:9292/v1     |
|      id     | 9ed8002a013f4412bbb490ad626555cf |
| internalurl |     http://10.0.0.30:9292/v1     |
|  publicurl  |     http://10.0.0.30:9292/v1     |
|    region   |            RegionOne             |
|  service_id | 874ba44f3a4a4ed6bed6e3684a6f87d7 |
+-------------+----------------------------------+

# nova 用エンドポイント作成

[root@dlp ~]#

keystone endpoint-create --region RegionOne \
--service nova \
--publicurl "http://$my_host:\$(compute_port)s/v2/\$(tenant_id)s" \
--internalurl "http://$my_host:\$(compute_port)s/v2/\$(tenant_id)s" \
--adminurl "http://$my_host:\$(compute_port)s/v2/\$(tenant_id)s"

+-------------+----------------------------------------------------+
|   Property  |                       Value                        |
+-------------+----------------------------------------------------+
|   adminurl  | http://10.0.0.30:$(compute_port)s/v2/$(tenant_id)s |
|      id     |          f6da1350b0f14559825e02b8c4ca2634          |
| internalurl | http://10.0.0.30:$(compute_port)s/v2/$(tenant_id)s |
|  publicurl  | http://10.0.0.30:$(compute_port)s/v2/$(tenant_id)s |
|    region   |                     RegionOne                      |
|  service_id |          bd096f7d71eb4ebb942c93eb9a13609d          |
+-------------+----------------------------------------------------+

# 設定確認

[root@dlp ~]#

keystone endpoint-list

+----------------------------------+-----------+----------------------------------------------------+
|                id                |   region  |                     publicurl                      |
+----------------------------------+-----------+----------------------------------------------------+
| 9ed8002a013f4412bbb490ad626555cf | RegionOne |              http://10.0.0.30:9292/v1              |
| f5b2dadfdc1d4d368148eaad68247de4 | RegionOne |       http://10.0.0.30:$(public_port)s/v2.0        |
| f6da1350b0f14559825e02b8c4ca2634 | RegionOne | http://10.0.0.30:$(compute_port)s/v2/$(tenant_id)s |
+----------------------------------+-----------+----------------------------------------------------+
+----------------------------------------------------+----------------------------------------------------+
|                    internalurl                     |                      adminurl                      |
+----------------------------------------------------+----------------------------------------------------+
|              http://10.0.0.30:9292/v1              |              http://10.0.0.30:9292/v1              |
|       http://10.0.0.30:$(public_port)s/v2.0        |        http://10.0.0.30:$(admin_port)s/v2.0        |
| http://10.0.0.30:$(compute_port)s/v2/$(tenant_id)s | http://10.0.0.30:$(compute_port)s/v2/$(tenant_id)s |
+----------------------------------------------------+----------------------------------------------------+
+----------------------------------+
|            service_id            |
+----------------------------------+
| 874ba44f3a4a4ed6bed6e3684a6f87d7 |
| ada6f56fba1141e98fb8d38af848ecba |
| bd096f7d71eb4ebb942c93eb9a13609d |
+----------------------------------+