2e933dceb5
A system-scoped token implies the user has authorization to act on the deployment system. These tokens are useful for interacting with resources that affect the deployment as a whole, or exposes resources that may otherwise violate project or domain isolation. Since Queens, the keystone-manage bootstrap command assigns the admin role to the admin user with system scope, as well as in the admin project. This patch transitions the Keystone admin user from authenticating using project scoped tokens to system scoped tokens. This is a necessary step towards being able to enable the updated oslo policies in services that allow finer grained access to system-level resources and APIs. An etherpad with discussion about the transition to the new oslo service policies is: https://etherpad.opendev.org/p/enabling-system-scope-in-kolla-ansible Change-Id: Ib631e2211682862296cce9ea179f2661c90fa585 Signed-off-by: Niklas Hagman <ubuntu@post.blinkiz.com>
154 lines
5.3 KiB
Bash
Executable File
154 lines
5.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -o errexit
|
|
set -o pipefail
|
|
|
|
KOLLA_DEBUG=${KOLLA_DEBUG:-0}
|
|
|
|
KOLLA_OPENSTACK_COMMAND=openstack
|
|
|
|
if [[ $KOLLA_DEBUG -eq 1 ]]; then
|
|
set -o xtrace
|
|
KOLLA_OPENSTACK_COMMAND="$KOLLA_OPENSTACK_COMMAND --debug"
|
|
fi
|
|
|
|
# This script is meant to be run once after running start for the first
|
|
# time. This script downloads a cirros image and registers it. Then it
|
|
# configures networking and nova quotas to allow 40 m1.small instances
|
|
# to be created.
|
|
|
|
ARCH=$(uname -m)
|
|
IMAGE_PATH=/opt/cache/files/
|
|
IMAGE_URL=https://github.com/cirros-dev/cirros/releases/download/0.5.1/
|
|
IMAGE=cirros-0.5.1-${ARCH}-disk.img
|
|
IMAGE_NAME=cirros
|
|
IMAGE_TYPE=linux
|
|
|
|
# This EXT_NET_CIDR is your public network,that you want to connect to the internet via.
|
|
ENABLE_EXT_NET=${ENABLE_EXT_NET:-1}
|
|
EXT_NET_CIDR=${EXT_NET_CIDR:-'10.0.2.0/24'}
|
|
EXT_NET_RANGE=${EXT_NET_RANGE:-'start=10.0.2.150,end=10.0.2.199'}
|
|
EXT_NET_GATEWAY=${EXT_NET_GATEWAY:-'10.0.2.1'}
|
|
|
|
# Sanitize language settings to avoid commands bailing out
|
|
# with "unsupported locale setting" errors.
|
|
unset LANG
|
|
unset LANGUAGE
|
|
LC_ALL=C
|
|
export LC_ALL
|
|
for i in curl openstack; do
|
|
if [[ ! $(type ${i} 2>/dev/null) ]]; then
|
|
if [ "${i}" == 'curl' ]; then
|
|
echo "Please install ${i} before proceeding"
|
|
else
|
|
echo "Please install python-${i}client before proceeding"
|
|
fi
|
|
exit
|
|
fi
|
|
done
|
|
|
|
# Test for credentials set
|
|
if [[ "${OS_USERNAME}" == "" ]]; then
|
|
echo "No Keystone credentials specified. Try running source /etc/kolla/admin-openrc.sh command"
|
|
exit
|
|
fi
|
|
|
|
# Test to ensure configure script is run only once
|
|
if $KOLLA_OPENSTACK_COMMAND image list | grep -q cirros; then
|
|
echo "This tool should only be run once per deployment."
|
|
exit
|
|
fi
|
|
|
|
echo Checking for locally available cirros image.
|
|
# Let's first try to see if the image is available locally
|
|
# nodepool nodes caches them in $IMAGE_PATH
|
|
if ! [ -f "${IMAGE_PATH}/${IMAGE}" ]; then
|
|
IMAGE_PATH='./'
|
|
if ! [ -f "${IMAGE_PATH}/${IMAGE}" ]; then
|
|
echo None found, downloading cirros image.
|
|
curl --fail -L -o ${IMAGE_PATH}/${IMAGE} ${IMAGE_URL}/${IMAGE}
|
|
fi
|
|
else
|
|
echo Using cached cirros image from the nodepool node.
|
|
fi
|
|
|
|
echo Creating glance image.
|
|
$KOLLA_OPENSTACK_COMMAND image create --disk-format qcow2 --container-format bare --public \
|
|
--property os_type=${IMAGE_TYPE} --file ${IMAGE_PATH}/${IMAGE} ${IMAGE_NAME}
|
|
|
|
echo Configuring neutron.
|
|
|
|
$KOLLA_OPENSTACK_COMMAND router create demo-router
|
|
|
|
$KOLLA_OPENSTACK_COMMAND network create demo-net
|
|
$KOLLA_OPENSTACK_COMMAND subnet create --subnet-range 10.0.0.0/24 --network demo-net \
|
|
--gateway 10.0.0.1 --dns-nameserver 8.8.8.8 demo-subnet
|
|
$KOLLA_OPENSTACK_COMMAND router add subnet demo-router demo-subnet
|
|
|
|
if [[ $ENABLE_EXT_NET -eq 1 ]]; then
|
|
$KOLLA_OPENSTACK_COMMAND network create --external --provider-physical-network physnet1 \
|
|
--provider-network-type flat public1
|
|
$KOLLA_OPENSTACK_COMMAND subnet create --no-dhcp \
|
|
--allocation-pool ${EXT_NET_RANGE} --network public1 \
|
|
--subnet-range ${EXT_NET_CIDR} --gateway ${EXT_NET_GATEWAY} public1-subnet
|
|
$KOLLA_OPENSTACK_COMMAND router set --external-gateway public1 demo-router
|
|
fi
|
|
|
|
# Get admin user and tenant IDs
|
|
ADMIN_PROJECT_ID=$($KOLLA_OPENSTACK_COMMAND project list | awk '/ admin / {print $2}')
|
|
ADMIN_SEC_GROUP=$($KOLLA_OPENSTACK_COMMAND security group list --project ${ADMIN_PROJECT_ID} | awk '/ default / {print $2}')
|
|
|
|
# Sec Group Config
|
|
$KOLLA_OPENSTACK_COMMAND security group rule create --ingress --ethertype IPv4 \
|
|
--protocol icmp ${ADMIN_SEC_GROUP}
|
|
$KOLLA_OPENSTACK_COMMAND security group rule create --ingress --ethertype IPv4 \
|
|
--protocol tcp --dst-port 22 ${ADMIN_SEC_GROUP}
|
|
# Open heat-cfn so it can run on a different host
|
|
$KOLLA_OPENSTACK_COMMAND security group rule create --ingress --ethertype IPv4 \
|
|
--protocol tcp --dst-port 8000 ${ADMIN_SEC_GROUP}
|
|
$KOLLA_OPENSTACK_COMMAND security group rule create --ingress --ethertype IPv4 \
|
|
--protocol tcp --dst-port 8080 ${ADMIN_SEC_GROUP}
|
|
|
|
if [ ! -f ~/.ssh/id_rsa.pub ]; then
|
|
echo Generating ssh key.
|
|
ssh-keygen -t rsa -N '' -f ~/.ssh/id_rsa
|
|
fi
|
|
if [ -r ~/.ssh/id_rsa.pub ]; then
|
|
echo Configuring nova public key and quotas.
|
|
$KOLLA_OPENSTACK_COMMAND keypair create --public-key ~/.ssh/id_rsa.pub mykey
|
|
fi
|
|
|
|
# Increase the quota to allow 40 m1.small instances to be created
|
|
|
|
# 40 instances
|
|
$KOLLA_OPENSTACK_COMMAND quota set --instances 40 ${ADMIN_PROJECT_ID}
|
|
|
|
# 40 cores
|
|
$KOLLA_OPENSTACK_COMMAND quota set --cores 40 ${ADMIN_PROJECT_ID}
|
|
|
|
# 96GB ram
|
|
$KOLLA_OPENSTACK_COMMAND quota set --ram 96000 ${ADMIN_PROJECT_ID}
|
|
|
|
# add default flavors, if they don't already exist
|
|
if ! $KOLLA_OPENSTACK_COMMAND flavor list | grep -q m1.tiny; then
|
|
$KOLLA_OPENSTACK_COMMAND flavor create --id 1 --ram 512 --disk 1 --vcpus 1 m1.tiny
|
|
$KOLLA_OPENSTACK_COMMAND flavor create --id 2 --ram 2048 --disk 20 --vcpus 1 m1.small
|
|
$KOLLA_OPENSTACK_COMMAND flavor create --id 3 --ram 4096 --disk 40 --vcpus 2 m1.medium
|
|
$KOLLA_OPENSTACK_COMMAND flavor create --id 4 --ram 8192 --disk 80 --vcpus 4 m1.large
|
|
$KOLLA_OPENSTACK_COMMAND flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 m1.xlarge
|
|
fi
|
|
|
|
cat << EOF
|
|
|
|
Done.
|
|
|
|
To deploy a demo instance, run:
|
|
|
|
openstack server create \\
|
|
--image ${IMAGE_NAME} \\
|
|
--flavor m1.tiny \\
|
|
--key-name mykey \\
|
|
--network demo-net \\
|
|
demo1
|
|
EOF
|