|
...
|
...
|
@@ -58,19 +58,19 @@ ANOTHER_ROLE=$(get_id keystone role-create --name=anotherrole)
|
|
58
|
58
|
|
|
59
|
59
|
|
|
60
|
60
|
# Add Roles to Users in Tenants
|
|
61
|
|
-keystone user-role-add --user $ADMIN_USER --role $ADMIN_ROLE --tenant_id $ADMIN_TENANT
|
|
62
|
|
-keystone user-role-add --user $ADMIN_USER --role $ADMIN_ROLE --tenant_id $DEMO_TENANT
|
|
63
|
|
-keystone user-role-add --user $DEMO_USER --role $ANOTHER_ROLE --tenant_id $DEMO_TENANT
|
|
|
61
|
+keystone user-role-add --user_id $ADMIN_USER --role_id $ADMIN_ROLE --tenant_id $ADMIN_TENANT
|
|
|
62
|
+keystone user-role-add --user_id $ADMIN_USER --role_id $ADMIN_ROLE --tenant_id $DEMO_TENANT
|
|
|
63
|
+keystone user-role-add --user_id $DEMO_USER --role_id $ANOTHER_ROLE --tenant_id $DEMO_TENANT
|
|
64
|
64
|
|
|
65
|
65
|
# TODO(termie): these two might be dubious
|
|
66
|
|
-keystone user-role-add --user $ADMIN_USER --role $KEYSTONEADMIN_ROLE --tenant_id $ADMIN_TENANT
|
|
67
|
|
-keystone user-role-add --user $ADMIN_USER --role $KEYSTONESERVICE_ROLE --tenant_id $ADMIN_TENANT
|
|
|
66
|
+keystone user-role-add --user_id $ADMIN_USER --role_id $KEYSTONEADMIN_ROLE --tenant_id $ADMIN_TENANT
|
|
|
67
|
+keystone user-role-add --user_id $ADMIN_USER --role_id $KEYSTONESERVICE_ROLE --tenant_id $ADMIN_TENANT
|
|
68
|
68
|
|
|
69
|
69
|
|
|
70
|
70
|
# The Member role is used by Horizon and Swift so we need to keep it:
|
|
71
|
71
|
MEMBER_ROLE=$(get_id keystone role-create --name=Member)
|
|
72
|
|
-keystone user-role-add --user $DEMO_USER --role $MEMBER_ROLE --tenant_id $DEMO_TENANT
|
|
73
|
|
-keystone user-role-add --user $DEMO_USER --role $MEMBER_ROLE --tenant_id $INVIS_TENANT
|
|
|
72
|
+keystone user-role-add --user_id $DEMO_USER --role_id $MEMBER_ROLE --tenant_id $DEMO_TENANT
|
|
|
73
|
+keystone user-role-add --user_id $DEMO_USER --role_id $MEMBER_ROLE --tenant_id $INVIS_TENANT
|
|
74
|
74
|
|
|
75
|
75
|
|
|
76
|
76
|
# Configure service users/roles
|
|
...
|
...
|
@@ -79,16 +79,16 @@ NOVA_USER=$(get_id keystone user-create --name=nova \
|
|
79
|
79
|
--tenant_id $SERVICE_TENANT \
|
|
80
|
80
|
--email=nova@example.com)
|
|
81
|
81
|
keystone user-role-add --tenant_id $SERVICE_TENANT \
|
|
82
|
|
- --user $NOVA_USER \
|
|
83
|
|
- --role $ADMIN_ROLE
|
|
|
82
|
+ --user_id $NOVA_USER \
|
|
|
83
|
+ --role_id $ADMIN_ROLE
|
|
84
|
84
|
|
|
85
|
85
|
GLANCE_USER=$(get_id keystone user-create --name=glance \
|
|
86
|
86
|
--pass="$SERVICE_PASSWORD" \
|
|
87
|
87
|
--tenant_id $SERVICE_TENANT \
|
|
88
|
88
|
--email=glance@example.com)
|
|
89
|
89
|
keystone user-role-add --tenant_id $SERVICE_TENANT \
|
|
90
|
|
- --user $GLANCE_USER \
|
|
91
|
|
- --role $ADMIN_ROLE
|
|
|
90
|
+ --user_id $GLANCE_USER \
|
|
|
91
|
+ --role_id $ADMIN_ROLE
|
|
92
|
92
|
|
|
93
|
93
|
if [[ "$ENABLED_SERVICES" =~ "swift" ]]; then
|
|
94
|
94
|
SWIFT_USER=$(get_id keystone user-create --name=swift \
|
|
...
|
...
|
@@ -96,8 +96,8 @@ if [[ "$ENABLED_SERVICES" =~ "swift" ]]; then
|
|
96
|
96
|
--tenant_id $SERVICE_TENANT \
|
|
97
|
97
|
--email=swift@example.com)
|
|
98
|
98
|
keystone user-role-add --tenant_id $SERVICE_TENANT \
|
|
99
|
|
- --user $SWIFT_USER \
|
|
100
|
|
- --role $ADMIN_ROLE
|
|
|
99
|
+ --user_id $SWIFT_USER \
|
|
|
100
|
+ --role_id $ADMIN_ROLE
|
|
101
|
101
|
# Nova needs ResellerAdmin role to download images when accessing
|
|
102
|
102
|
# swift through the s3 api. The admin role in swift allows a user
|
|
103
|
103
|
# to act as an admin for their tenant, but ResellerAdmin is needed
|
|
...
|
...
|
@@ -105,8 +105,8 @@ if [[ "$ENABLED_SERVICES" =~ "swift" ]]; then
|
|
105
|
105
|
# configurable in swift-proxy.conf
|
|
106
|
106
|
RESELLER_ROLE=$(get_id keystone role-create --name=ResellerAdmin)
|
|
107
|
107
|
keystone user-role-add --tenant_id $SERVICE_TENANT \
|
|
108
|
|
- --user $NOVA_USER \
|
|
109
|
|
- --role $RESELLER_ROLE
|
|
|
108
|
+ --user_id $NOVA_USER \
|
|
|
109
|
+ --role_id $RESELLER_ROLE
|
|
110
|
110
|
fi
|
|
111
|
111
|
|
|
112
|
112
|
if [[ "$ENABLED_SERVICES" =~ "quantum" ]]; then
|
|
...
|
...
|
@@ -115,8 +115,8 @@ if [[ "$ENABLED_SERVICES" =~ "quantum" ]]; then
|
|
115
|
115
|
--tenant_id $SERVICE_TENANT \
|
|
116
|
116
|
--email=quantum@example.com)
|
|
117
|
117
|
keystone user-role-add --tenant_id $SERVICE_TENANT \
|
|
118
|
|
- --user $QUANTUM_USER \
|
|
119
|
|
- --role $ADMIN_ROLE
|
|
|
118
|
+ --user_id $QUANTUM_USER \
|
|
|
119
|
+ --role_id $ADMIN_ROLE
|
|
120
|
120
|
fi
|
|
121
|
121
|
|
|
122
|
122
|
if [[ "$ENABLED_SERVICES" =~ "tempest" ]]; then
|