Skip to content

Commit bfb5273

Browse files
jeblairjeblair
committed
Merge redux branch (keystone light)
Change-Id: I2cb5b198a06848f42f919ea49e338443131e263e
2 parents 0f470d2 + 258c95d commit bfb5273

File tree

8 files changed

+245
-203
lines changed

8 files changed

+245
-203
lines changed

‎files/apts/keystone‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,4 +12,4 @@ python-greenlet
1212
python-routes
1313
libldap2-dev
1414
libsasl2-dev
15-
15+
python-bcrypt

‎files/default_catalog.templates‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# config for TemplatedCatalog, using camelCase because I don't want to do
2+
# translations for legacy compat
3+
catalog.RegionOne.identity.publicURL = http://%SERVICE_HOST%:$(public_port)s/v2.0
4+
catalog.RegionOne.identity.adminURL = http://%SERVICE_HOST%:$(admin_port)s/v2.0
5+
catalog.RegionOne.identity.internalURL = http://%SERVICE_HOST%:$(public_port)s/v2.0
6+
catalog.RegionOne.identity.name = 'Identity Service'
7+
8+
9+
catalog.RegionOne.compute.publicURL = http://%SERVICE_HOST%:8774/v1.1/$(tenant_id)s
10+
catalog.RegionOne.compute.adminURL = http://%SERVICE_HOST%:8774/v1.1/$(tenant_id)s
11+
catalog.RegionOne.compute.internalURL = http://%SERVICE_HOST%:8774/v1.1/$(tenant_id)s
12+
catalog.RegionOne.compute.name = 'Compute Service'
13+
14+
15+
catalog.RegionOne.ec2.publicURL = http://%SERVICE_HOST%:8773/services/Cloud
16+
catalog.RegionOne.ec2.adminURL = http://%SERVICE_HOST%:8773/services/Admin
17+
catalog.RegionOne.ec2.internalURL = http://%SERVICE_HOST%:8773/services/Cloud
18+
catalog.RegionOne.ec2.name = 'EC2 Service'
19+
20+
21+
catalog.RegionOne.image.publicURL = http://%SERVICE_HOST%:9292/v1
22+
catalog.RegionOne.image.adminURL = http://%SERVICE_HOST%:9292/v1
23+
catalog.RegionOne.image.internalURL = http://%SERVICE_HOST%:9292/v1
24+
catalog.RegionOne.image.name = 'Image Service'
25+
26+
27+
catalog.RegionOne.object_store.publicURL = http://%SERVICE_HOST%:8080/v1/AUTH_$(tenant_id)s
28+
catalog.RegionOne.object_store.adminURL = http://%SERVICE_HOST%:8080/
29+
catalog.RegionOne.object_store.internalURL = http://%SERVICE_HOST%:8080/v1/AUTH_$(tenant_id)s
30+
catalog.RegionOne.object_store.name = 'Swift Service'

‎files/keystone.conf‎

Lines changed: 67 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -1,112 +1,92 @@
11
[DEFAULT]
2-
# Show more verbose log output (sets INFO log level output)
3-
verbose = False
4-
5-
# Show debugging output in logs (sets DEBUG log level output)
6-
debug = False
7-
8-
# Which backend store should Keystone use by default.
9-
# Default: 'sqlite'
10-
# Available choices are 'sqlite' [future will include LDAP, PAM, etc]
11-
default_store = sqlite
12-
13-
# Log to this file. Make sure you do not set the same log
14-
# file for both the API and registry servers!
15-
log_file = %DEST%/keystone/keystone.log
16-
17-
# List of backends to be configured
18-
backends = keystone.backends.sqlalchemy
19-
#For LDAP support, add: ,keystone.backends.ldap
2+
public_port = 5000
3+
admin_port = 35357
4+
admin_token = %SERVICE_TOKEN%
5+
compute_port = 3000
6+
verbose = True
7+
debug = True
8+
# commented out so devstack logs to stdout
9+
# log_file = %DEST%/keystone/keystone.log
2010

21-
# Dictionary Maps every service to a header.Missing services would get header
22-
# X_(SERVICE_NAME) Key => Service Name, Value => Header Name
23-
service_header_mappings = {
24-
'nova' : 'X-Server-Management-Url',
25-
'swift' : 'X-Storage-Url',
26-
'cdn' : 'X-CDN-Management-Url'}
11+
# ================= Syslog Options ============================
12+
# Send logs to syslog (/dev/log) instead of to file specified
13+
# by `log-file`
14+
use_syslog = False
2715

28-
#List of extensions currently supported
29-
extensions= osksadm,oskscatalog
16+
# Facility to use. If unset defaults to LOG_USER.
17+
# syslog_log_facility = LOG_LOCAL0
3018

31-
# Address to bind the API server
32-
# TODO Properties defined within app not available via pipeline.
33-
service_host = 0.0.0.0
19+
[sql]
20+
connection = %SQL_CONN%
21+
idle_timeout = 30
22+
min_pool_size = 5
23+
max_pool_size = 10
24+
pool_timeout = 200
3425

35-
# Port the bind the API server to
36-
service_port = 5000
26+
[identity]
27+
driver = keystone.identity.backends.sql.Identity
3728

38-
# SSL for API server
39-
service_ssl = False
29+
[catalog]
30+
driver = keystone.catalog.backends.templated.TemplatedCatalog
31+
template_file = %KEYSTONE_DIR%/etc/default_catalog.templates
4032

41-
# Address to bind the Admin API server
42-
admin_host = 0.0.0.0
33+
[token]
34+
driver = keystone.token.backends.kvs.Token
4335

44-
# Port the bind the Admin API server to
45-
admin_port = 35357
36+
[policy]
37+
driver = keystone.policy.backends.simple.SimpleMatch
4638

47-
# SSL for API Admin server
48-
admin_ssl = False
39+
[ec2]
40+
driver = keystone.contrib.ec2.backends.sql.Ec2
4941

50-
# Keystone certificate file (modify as needed)
51-
# Only required if *_ssl is set to True
52-
certfile = /etc/keystone/ssl/certs/keystone.pem
42+
[filter:debug]
43+
paste.filter_factory = keystone.common.wsgi:Debug.factory
5344

54-
# Keystone private key file (modify as needed)
55-
# Only required if *_ssl is set to True
56-
keyfile = /etc/keystone/ssl/private/keystonekey.pem
45+
[filter:token_auth]
46+
paste.filter_factory = keystone.middleware:TokenAuthMiddleware.factory
5747

58-
# Keystone trusted CA certificates (modify as needed)
59-
# Only required if *_ssl is set to True
60-
ca_certs = /etc/keystone/ssl/certs/ca.pem
48+
[filter:admin_token_auth]
49+
paste.filter_factory = keystone.middleware:AdminTokenAuthMiddleware.factory
6150

62-
# Client certificate required
63-
# Only relevant if *_ssl is set to True
64-
cert_required = True
51+
[filter:json_body]
52+
paste.filter_factory = keystone.middleware:JsonBodyMiddleware.factory
6553

66-
#Role that allows to perform admin operations.
67-
keystone_admin_role = admin
54+
[filter:crud_extension]
55+
paste.filter_factory = keystone.contrib.admin_crud:CrudExtension.factory
6856

69-
#Role that allows to perform service admin operations.
70-
keystone_service_admin_role = KeystoneServiceAdmin
57+
[filter:ec2_extension]
58+
paste.filter_factory = keystone.contrib.ec2:Ec2Extension.factory
7159

72-
#Tells whether password user need to be hashed in the backend
73-
hash_password = True
60+
[app:public_service]
61+
paste.app_factory = keystone.service:public_app_factory
7462

75-
[keystone.backends.sqlalchemy]
76-
# SQLAlchemy connection string for the reference implementation registry
77-
# server. Any valid SQLAlchemy connection string is fine.
78-
# See: http://bit.ly/ideIpI
79-
sql_connection = %SQL_CONN%
80-
backend_entities = ['UserRoleAssociation', 'Endpoints', 'Role', 'Tenant',
81-
'User', 'Credentials', 'EndpointTemplates', 'Token',
82-
'Service']
63+
[app:admin_service]
64+
paste.app_factory = keystone.service:admin_app_factory
8365

84-
# Period in seconds after which SQLAlchemy should reestablish its connection
85-
# to the database.
86-
sql_idle_timeout = 30
66+
[pipeline:public_api]
67+
pipeline = token_auth admin_token_auth json_body debug ec2_extension public_service
8768

88-
[pipeline:admin]
89-
pipeline =
90-
urlrewritefilter
91-
admin_api
69+
[pipeline:admin_api]
70+
pipeline = token_auth admin_token_auth json_body debug ec2_extension crud_extension admin_service
9271

93-
[pipeline:keystone-legacy-auth]
94-
pipeline =
95-
urlrewritefilter
96-
legacy_auth
97-
service_api
72+
[app:public_version_service]
73+
paste.app_factory = keystone.service:public_version_app_factory
9874

99-
[app:service_api]
100-
paste.app_factory = keystone.server:service_app_factory
75+
[app:admin_version_service]
76+
paste.app_factory = keystone.service:admin_version_app_factory
10177

102-
[app:admin_api]
103-
paste.app_factory = keystone.server:admin_app_factory
78+
[pipeline:public_version_api]
79+
pipeline = public_version_service
10480

105-
[filter:urlrewritefilter]
106-
paste.filter_factory = keystone.middleware.url:filter_factory
81+
[pipeline:admin_version_api]
82+
pipeline = admin_version_service
10783

108-
[filter:legacy_auth]
109-
paste.filter_factory = keystone.frontends.legacy_token_auth:filter_factory
84+
[composite:main]
85+
use = egg:Paste#urlmap
86+
/v2.0 = public_api
87+
/ = public_version_api
11088

111-
[filter:debug]
112-
paste.filter_factory = keystone.common.wsgi:debug_filter_factory
89+
[composite:admin]
90+
use = egg:Paste#urlmap
91+
/v2.0 = admin_api
92+
/ = admin_version_service

‎files/keystone_data.sh‎

Lines changed: 78 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,91 @@
11
#!/bin/bash
2-
BIN_DIR=${BIN_DIR:-.}
32
# Tenants
4-
$BIN_DIR/keystone-manage tenant add admin
5-
$BIN_DIR/keystone-manage tenant add demo
6-
$BIN_DIR/keystone-manage tenant add invisible_to_admin
3+
export SERVICE_TOKEN=$SERVICE_TOKEN
4+
export SERVICE_ENDPOINT=$SERVICE_ENDPOINT
5+
6+
function get_id () {
7+
echo `$@ | grep id | awk '{print $4}'`
8+
}
9+
10+
ADMIN_TENANT=`get_id keystone tenant-create --name=admin`
11+
DEMO_TENANT=`get_id keystone tenant-create --name=demo`
12+
INVIS_TENANT=`get_id keystone tenant-create --name=invisible_to_admin`
13+
714

815
# Users
9-
$BIN_DIR/keystone-manage user add admin %ADMIN_PASSWORD%
10-
$BIN_DIR/keystone-manage user add demo %ADMIN_PASSWORD%
16+
ADMIN_USER=`get_id keystone user-create \
17+
--name=admin \
18+
--pass="$ADMIN_PASSWORD" \
19+
[email protected]`
20+
DEMO_USER=`get_id keystone user-create \
21+
--name=demo \
22+
--pass="$ADMIN_PASSWORD" \
23+
[email protected]`
1124

1225
# Roles
13-
$BIN_DIR/keystone-manage role add admin
14-
$BIN_DIR/keystone-manage role add Member
15-
$BIN_DIR/keystone-manage role add KeystoneAdmin
16-
$BIN_DIR/keystone-manage role add KeystoneServiceAdmin
17-
$BIN_DIR/keystone-manage role add sysadmin
18-
$BIN_DIR/keystone-manage role add netadmin
19-
$BIN_DIR/keystone-manage role grant admin admin admin
20-
$BIN_DIR/keystone-manage role grant Member demo demo
21-
$BIN_DIR/keystone-manage role grant sysadmin demo demo
22-
$BIN_DIR/keystone-manage role grant netadmin demo demo
23-
$BIN_DIR/keystone-manage role grant Member demo invisible_to_admin
24-
$BIN_DIR/keystone-manage role grant admin admin demo
25-
$BIN_DIR/keystone-manage role grant admin admin
26-
$BIN_DIR/keystone-manage role grant KeystoneAdmin admin
27-
$BIN_DIR/keystone-manage role grant KeystoneServiceAdmin admin
26+
ADMIN_ROLE=`get_id keystone role-create --name=admin`
27+
MEMBER_ROLE=`get_id keystone role-create --name=Member`
28+
KEYSTONEADMIN_ROLE=`get_id keystone role-create --name=KeystoneAdmin`
29+
KEYSTONESERVICE_ROLE=`get_id keystone role-create --name=KeystoneServiceAdmin`
30+
SYSADMIN_ROLE=`get_id keystone role-create --name=sysadmin`
31+
NETADMIN_ROLE=`get_id keystone role-create --name=netadmin`
32+
33+
34+
# Add Roles to Users in Tenants
35+
36+
keystone add-user-role $ADMIN_USER $ADMIN_ROLE $ADMIN_TENANT
37+
keystone add-user-role $DEMO_USER $MEMBER_ROLE $DEMO_TENANT
38+
keystone add-user-role $DEMO_USER $SYSADMIN_ROLE $DEMO_TENANT
39+
keystone add-user-role $DEMO_USER $NETADMIN_ROLE $DEMO_TENANT
40+
keystone add-user-role $DEMO_USER $MEMBER_ROLE $INVIS_TENANT
41+
keystone add-user-role $ADMIN_USER $ADMIN_ROLE $DEMO_TENANT
42+
43+
# TODO(termie): these two might be dubious
44+
keystone add-user-role $ADMIN_USER $KEYSTONEADMIN_ROLE $ADMIN_TENANT
45+
keystone add-user-role $ADMIN_USER $KEYSTONESERVICE_ROLE $ADMIN_TENANT
2846

2947
# Services
30-
$BIN_DIR/keystone-manage service add nova compute "Nova Compute Service"
31-
$BIN_DIR/keystone-manage service add ec2 ec2 "EC2 Compatability Layer"
32-
$BIN_DIR/keystone-manage service add glance image "Glance Image Service"
33-
$BIN_DIR/keystone-manage service add keystone identity "Keystone Identity Service"
34-
if [[ "$ENABLED_SERVICES" =~ "swift" ]]; then
35-
$BIN_DIR/keystone-manage service add swift object-store "Swift Service"
36-
fi
48+
keystone service-create \
49+
--name=nova \
50+
--type=compute \
51+
--description="Nova Compute Service"
52+
53+
keystone service-create \
54+
--name=ec2 \
55+
--type=ec2 \
56+
--description="EC2 Compatibility Layer"
3757

38-
#endpointTemplates
39-
$BIN_DIR/keystone-manage $* endpointTemplates add RegionOne nova http://%SERVICE_HOST%:8774/v1.1/%tenant_id% http://%SERVICE_HOST%:8774/v1.1/%tenant_id% http://%SERVICE_HOST%:8774/v1.1/%tenant_id% 1 1
40-
$BIN_DIR/keystone-manage $* endpointTemplates add RegionOne ec2 http://%SERVICE_HOST%:8773/services/Cloud http://%SERVICE_HOST%:8773/services/Admin http://%SERVICE_HOST%:8773/services/Cloud 1 1
41-
$BIN_DIR/keystone-manage $* endpointTemplates add RegionOne glance http://%SERVICE_HOST%:9292/v1 http://%SERVICE_HOST%:9292/v1 http://%SERVICE_HOST%:9292/v1 1 1
42-
$BIN_DIR/keystone-manage $* endpointTemplates add RegionOne keystone %KEYSTONE_SERVICE_PROTOCOL%://%KEYSTONE_SERVICE_HOST%:%KEYSTONE_SERVICE_PORT%/v2.0 %KEYSTONE_AUTH_PROTOCOL%://%KEYSTONE_AUTH_HOST%:%KEYSTONE_AUTH_PORT%/v2.0 %KEYSTONE_SERVICE_PROTOCOL%://%KEYSTONE_SERVICE_HOST%:%KEYSTONE_SERVICE_PORT%/v2.0 1 1
58+
keystone service-create \
59+
--name=glance \
60+
--type=image \
61+
--description="Glance Image Service"
62+
63+
keystone service-create \
64+
--name=keystone \
65+
--type=identity \
66+
--description="Keystone Identity Service"
4367
if [[ "$ENABLED_SERVICES" =~ "swift" ]]; then
44-
$BIN_DIR/keystone-manage $* endpointTemplates add RegionOne swift http://%SERVICE_HOST%:8080/v1/AUTH_%tenant_id% http://%SERVICE_HOST%:8080/ http://%SERVICE_HOST%:8080/v1/AUTH_%tenant_id% 1 1
68+
keystone service-create \
69+
--name=swift \
70+
--type="object-store" \
71+
--description="Swift Service"
4572
fi
4673

47-
# Tokens
48-
$BIN_DIR/keystone-manage token add %SERVICE_TOKEN% admin admin 2015-02-05T00:00
74+
# create ec2 creds and parse the secret and access key returned
75+
RESULT=`keystone ec2-create-credentials --tenant_id=$ADMIN_TENANT --user_id=$ADMIN_USER`
76+
echo `$@ | grep id | awk '{print $4}'`
77+
ADMIN_ACCESS=`echo "$RESULT" | grep access | awk '{print $4}'`
78+
ADMIN_SECRET=`echo "$RESULT" | grep secret | awk '{print $4}'`
79+
80+
81+
RESULT=`keystone ec2-create-credentials --tenant_id=$DEMO_TENANT --user_id=$DEMO_USER`
82+
DEMO_ACCESS=`echo "$RESULT" | grep access | awk '{print $4}'`
83+
DEMO_SECRET=`echo "$RESULT" | grep secret | awk '{print $4}'`
4984

50-
# EC2 related creds - note we are setting the secret key to ADMIN_PASSWORD
51-
# but keystone doesn't parse them - it is just a blob from keystone's
52-
# point of view
53-
$BIN_DIR/keystone-manage credentials add admin EC2 'admin' '%ADMIN_PASSWORD%' admin || echo "no support for adding credentials"
54-
$BIN_DIR/keystone-manage credentials add demo EC2 'demo' '%ADMIN_PASSWORD%' demo || echo "no support for adding credentials"
85+
# write the secret and access to ec2rc
86+
cat > $DEVSTACK_DIR/ec2rc <<EOF
87+
ADMIN_ACCESS=$ADMIN_ACCESS
88+
ADMIN_SECRET=$ADMIN_SECRET
89+
DEMO_ACCESS=$DEMO_ACCESS
90+
DEMO_SECRET=$DEMO_SECRET
91+
EOF

‎files/pips/keystone‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
PassLib
2+
pycli

‎openrc‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ export OS_PASSWORD=${NOVA_PASSWORD}
4242
#
4343
# *NOTE*: Using the 2.0 *auth api* does not mean that compute api is 2.0. We
4444
# will use the 1.1 *compute api*
45-
export NOVA_URL=${NOVA_URL:-http://$SERVICE_HOST:5000/v2.0/}
45+
export NOVA_URL=${NOVA_URL:-http://$SERVICE_HOST:5000/v2.0}
4646
export OS_AUTH_URL=${NOVA_URL}
4747

4848
# Currently novaclient needs you to specify the *compute api* version. This
@@ -56,10 +56,10 @@ export NOVA_REGION_NAME=${NOVA_REGION_NAME:-RegionOne}
5656
export EC2_URL=${EC2_URL:-http://$SERVICE_HOST:8773/services/Cloud}
5757

5858
# Access key is set in the initial keystone data to be the same as username
59-
export EC2_ACCESS_KEY=${USERNAME:-demo}
59+
export EC2_ACCESS_KEY=${DEMO_ACCESS}
6060

6161
# Secret key is set in the initial keystone data to the admin password
62-
export EC2_SECRET_KEY=${ADMIN_PASSWORD:-secrete}
62+
export EC2_SECRET_KEY=${DEMO_SECRET}
6363

6464
# Euca2ools Certificate stuff for uploading bundles
6565
# You can get your certs using ./tools/get_certs.sh

0 commit comments

Comments
 (0)