Skip to content

Commit a0d3efa

Browse files
committed
feat: add Readonly user documentation
This change will permit readonly access to a given project/domain. Signed-off-by: Kevin Carter <[email protected]>
1 parent 8b58594 commit a0d3efa

File tree

4 files changed

+102
-51
lines changed

4 files changed

+102
-51
lines changed

docs/openstack-keystone-federation.md

+2-51
Original file line numberDiff line numberDiff line change
@@ -17,61 +17,12 @@ openstack --os-cloud default identity provider create --remote-id rackspace --do
1717
You're also welcome to generate your own mapping to suit your needs; however, if you want to use the example mapping (which is suitable for production) you can.
1818

1919
``` json
20-
[
21-
{
22-
"local": [
23-
{
24-
"user": {
25-
"name": "{0}",
26-
"email": "{1}"
27-
}
28-
},
29-
{
30-
"projects": [
31-
{
32-
"name": "{2}_Flex",
33-
"roles": [
34-
{
35-
"name": "member"
36-
},
37-
{
38-
"name": "load-balancer_member"
39-
},
40-
{
41-
"name": "heat_stack_user"
42-
}
43-
]
44-
}
45-
]
46-
}
47-
],
48-
"remote": [
49-
{
50-
"type": "RXT_UserName"
51-
},
52-
{
53-
"type": "RXT_Email"
54-
},
55-
{
56-
"type": "RXT_TenantName"
57-
},
58-
{
59-
"type": "RXT_orgPersonType",
60-
"any_one_of": [
61-
"admin",
62-
"default",
63-
"user-admin",
64-
"tenant-access"
65-
]
66-
}
67-
]
68-
}
69-
]
20+
--8<-- "etc/keystone/mapping.json"
7021
```
7122

7223
!!! tip
7324

74-
Save the mapping to a local file before uploading it to keystone. In the examples, the mapping is stored at `/tmp/mapping.json`.
25+
The example mapping **JSON** file can be found within the genestack repository at `etc/keystone/mapping.json`.
7526

7627
Now register the mapping within Keystone.
7728

docs/openstack-keystone-readonly.md

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Create a Readonly User
2+
3+
The following commands will setup a readonly user which is able to read data across domains.
4+
5+
## Create the VMM user and project
6+
7+
After running the following commands, a readonly user (example: `vmm`) will have read only access to everything under the `default` and `rackspace_cloud_domain` domains.
8+
9+
### Create a project
10+
11+
``` shell
12+
openstack --os-cloud default project create --description 'vmm enablement' vmm --domain default
13+
```
14+
15+
### Create a new user
16+
17+
!!! tip "Make sure to set the password accordingly"
18+
19+
``` shell
20+
PASSWORD=SuperSecrete
21+
```
22+
23+
``` shell
24+
openstack --os-cloud default user create --project vmm --password ${PASSWORD} vmm --domain default
25+
```
26+
27+
### Add the member role to the new user
28+
29+
``` shell
30+
openstack --os-cloud default role add --user vmm --project vmm member --inherited
31+
```
32+
33+
### Add the reader roles for user `vmm` to the `default` domain
34+
35+
``` shell
36+
openstack --os-cloud default role add --user vmm --domain default reader --inherited
37+
```
38+
39+
### Add the reader role for user `vmm` to the `rackspace_cloud_domain` domain
40+
41+
``` shell
42+
openstack --os-cloud default role add --user vmm --domain rackspace_cloud_domain reader --inherited
43+
```
44+
45+
### Add the reader role for user `vmm` to the system
46+
47+
``` shell
48+
openstack --os-cloud default role add --user vmm --system all reader
49+
```

etc/keystone/mapping.json

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
[
2+
{
3+
"local": [
4+
{
5+
"user": {
6+
"name": "{0}",
7+
"email": "{1}"
8+
}
9+
},
10+
{
11+
"projects": [
12+
{
13+
"name": "{2}_Flex",
14+
"roles": [
15+
{
16+
"name": "member"
17+
},
18+
{
19+
"name": "load-balancer_member"
20+
},
21+
{
22+
"name": "heat_stack_user"
23+
}
24+
]
25+
}
26+
]
27+
}
28+
],
29+
"remote": [
30+
{
31+
"type": "RXT_UserName"
32+
},
33+
{
34+
"type": "RXT_Email"
35+
},
36+
{
37+
"type": "RXT_TenantName"
38+
},
39+
{
40+
"type": "RXT_orgPersonType",
41+
"any_one_of": [
42+
"admin",
43+
"default",
44+
"user-admin",
45+
"tenant-access"
46+
]
47+
}
48+
]
49+
}
50+
]

mkdocs.yml

+1
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,7 @@ nav:
209209
- OpenStack:
210210
- Generating Clouds YAML: openstack-clouds.md
211211
- Keystone Federation to Rackspace: openstack-keystone-federation.md
212+
- Keystone Readonly Users: openstack-keystone-readonly.md
212213
- Nova Flavor Creation: openstack-flavors.md
213214
- Nova CPU Allocation Ratio: openstack-cpu-allocation-ratio.md
214215
- Creating Networks: openstack-neutron-networks.md

0 commit comments

Comments
 (0)