~annegentle/openstack-devel/working

<title>Managing Compute Users</title><meta name="generator" content="DocBook XSL Stylesheets V1.76.1"/><link rel="home" href="index.html" title="OpenStack Compute Administration Manual"/><link rel="up" href="ch07.html" title="Chapter 7. Running OpenStack Compute"/><link rel="prev" href="ch07s03.html" title="Managing the Cloud"/><link rel="next" href="ch08.html" title="Chapter 8. OpenStack Interfaces"/><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/><script type="text/javascript">

//The id for tree cookie

var treeCookieId = "treeview-2255";

var language = "en";

var w = new Object();

//Localization

txt_filesfound = 'Results';

txt_enter_at_least_1_char = "You must enter at least one character.";

txt_browser_not_supported = "Your browser is not supported. Use of Mozilla Firefox is recommended.";

txt_please_wait = "Please wait. Search in progress...";

txt_results_for = "Results for: ";

</script><style type="text/css">

input {

margin-bottom: 5px;

margin-top: 2px;

}

.folder {

display: block;

height: 22px;

padding-left: 20px;

background: transparent url(../common/jquery/treeview/images/folder.gif) 0 0px no-repeat;

}

</style><link rel="shortcut icon" href="../favicon.ico" type="image/x-icon"/><link rel="stylesheet" type="text/css" href="../common/css/positioning.css"/><link rel="stylesheet" type="text/css" href="../common/jquery/theme-redmond/jquery-ui-1.8.2.custom.css"/><link rel="stylesheet" type="text/css" href="../common/jquery/treeview/jquery.treeview.css"/><script type="text/javascript" src="../common/jquery/jquery-1.4.2.min.js"></script><script type="text/javascript" src="../common/jquery/jquery-ui-1.8.2.custom.min.js"></script><script type="text/javascript" src="../common/jquery/jquery.cookie.js"></script><script type="text/javascript" src="../common/jquery/treeview/jquery.treeview.min.js"></script><script type="text/javascript" src="search/htmlFileList.js"></script><script type="text/javascript" src="search/htmlFileInfoList.js"></script><script type="text/javascript" src="search/nwSearchFnt.js"></script><script type="text/javascript" src="search/stemmers/en_stemmer.js"/><script type="text/javascript" src="search/index-1.js"></script><script type="text/javascript" src="search/index-2.js"></script><script type="text/javascript" src="search/index-3.js"></script></head><body><div id="header"><img src="../common/images/openstack-logo.png" alt="OpenStack Documentation" width="157" height="47"/><p class="breadcrumbs"><a href="#">OpenStack Manuals</a><a href="#">Object Storage</a></p><h1>Managing Compute Users<br/>Chapter 7. Running OpenStack Compute</h1><div id="navheader" align="right"><table class="navLinks"><tr><td><a id="showHideButton" onclick="showHideToc();" class="pointLeft" title="Hide TOC tree">Sidebar

</a></td><td><a accesskey="p" class="navLinkPrevious" href="ch07s03.html">Prev</a>

<a accesskey="n" class="navLinkNext" href="ch08.html">Next</a></td></tr></table></div></div><div id="content"><div class="section" title="Managing Compute Users"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="d5e532"/>Managing Compute Users</h2></div></div></div>

<p>Access to the Euca2ools (ec2) API is controlled by an access and secret key. The

user’s access key needs to be included in the request, and the request must be

signed with the secret key. Upon receipt of API requests, Compute will verify the

signature and execute commands on behalf of the user. </p>

<p>In order to begin using nova, you will need a to create a user. This can be easily

accomplished using the user create or user admin commands in nova-manage. user

create will create a regular user, whereas user admin will create an admin user. The

syntax of the command is nova-manage user create username [access] [secret]. For

example: </p>

<p><code class="code">nova-manage user create john my-access-key a-super-secret-key</code></p>

<p>If you do not specify an access or secret key, a random uuid will be created

automatically.</p>

<div class="simplesect" title="Credentials"><div class="titlepage"><div><div><h3 class="title"><a id="d5e539"/>Credentials</h3></div></div></div>

<p>Nova can generate a handy set of credentials for a user. These credentials include a CA for bundling images and a file for setting environment variables to be used by euca2ools. If you don’t need to bundle images, just the environment script is required. You can export one with the project environment command. The syntax of the command is nova-manage project environment project_id user_id [filename]. If you don’t specify a filename, it will be exported as novarc. After generating the file, you can simply source it in bash to add the variables to your environment:</p>

nova-manage project environment john_project john

. novarc</pre>

<p>If you do need to bundle images, you will need to get all of the credentials using project zipfile. Note that zipfile will give you an error message if networks haven’t been created yet. Otherwise zipfile has the same syntax as environment, only the default file name is nova.zip. Example usage:

</p>

nova-manage project zipfile john_project john

unzip nova.zip

. novarc

</pre></div>

<div class="simplesect" title="Role Based Access Control"><div class="titlepage"><div><div><h3 class="title"><a id="d5e545"/>Role Based Access Control</h3></div></div></div>

<p>Roles control the API actions that a user is allowed to perform. For example, a user

cannot allocate a public ip without the netadmin role. It is important to remember

that a users de facto permissions in a project is the intersection of user (global)

roles and project (local) roles. So for john to have netadmin permissions in his

project, he needs to separate roles specified. You can add roles with role add. The

syntax is nova-manage role add user_id role [project_id]. Let’s give john the

netadmin role for his project:</p>

nova-manage role add john netadmin

nova-manage role add john netadmin john_project</pre>

<p>Role-based access control (RBAC) is an approach to restricting system access to authorized users based on an individual’s role within an organization. Various employee functions require certain levels of system access in order to be successful. These functions are mapped to defined roles and individuals are categorized accordingly. Since users are not assigned permissions directly, but only acquire them through their role (or roles), management of individual user rights becomes a matter of assigning appropriate roles to the user. This simplifies common operations, such as adding a user, or changing a user’s department.

</p>

<p>Nova’s rights management system employs the RBAC model and currently supports the following five roles:</p>

<div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Cloud Administrator. (admin) Users of this class enjoy complete system access.</p></li><li class="listitem"><p>IT Security. (itsec) This role is limited to IT security personnel. It permits role holders to quarantine instances.</p></li><li class="listitem"><p>Project Manager. (projectmanager)The default for project owners, this role affords users the ability to add other users to a project, interact with project images, and launch and terminate instances.</p></li><li class="listitem"><p>Network Administrator. (netadmin) Users with this role are permitted to allocate and assign publicly accessible IP addresses as well as create and modify firewall rules.</p></li><li class="listitem"><p>Developer. This is a general purpose role that is assigned to users by default.</p></li></ul></div>

<p>RBAC management is exposed through the dashboard for simplified user management.</p></div></div><script type="text/javascript" src="../common/main.js"></script><div class="navfooter"><hr/><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ch07s03.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ch07.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="ch08.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top"> </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> </td></tr></table></div></div><div><div id="leftnavigation" style="padding-top:3px; background-color:white;"><div id="tabs"><ul><li><a href="#treeDiv"><span class="contentsTab">Contents</span></a></li><li><a href="#searchDiv"><span class="searchTab">Search</span></a></li></ul><div id="treeDiv"><img src="../common/images/loading.gif" alt="loading table of contents..." id="tocLoading" style="display:block;"/><div id="ulTreeDiv" style="display:none"><ul id="tree" class="filetree"><li><span class="file"><a href="ch01.html">Getting Started with OpenStack</a></span><ul><li><span class="file"><a href="ch01s01.html">What is OpenStack?</a></span></li><li><span class="file"><a href="ch01s02.html">Components of OpenStack</a></span></li><li><span class="file"><a href="ch01s03.html">Why Cloud?</a></span></li></ul></li><li><span class="file"><a href="ch02.html">Introduction to OpenStack Compute</a></span><ul><li><span class="file"><a href="ch02s01.html">Users and Projects</a></span></li><li><span class="file"><a href="ch02s02.html">Images and Instances</a></span></li></ul></li><li><span class="file"><a href="ch03.html">Introduction to OpenStack Imaging Service</a></span><ul><li><span class="file"><a href="ch03s01.html">Overview of Architecture</a></span></li><li><span class="file"><a href="ch03s02.html">OpenStack Imaging Service API Server</a></span></li><li><span class="file"><a href="ch03s03.html">OpenStack Imaging Service Registry Servers</a></span></li></ul></li><li><span class="file"><a href="ch04.html">Installing and Configuring OpenStack Compute</a></span><ul><li><span class="file"><a href="ch04s01.html">System Requirements</a></span></li><li><span class="file"><a href="ch04s02.html">Installing OpenStack Compute on Ubuntu </a></span><ul><li><span class="file"><a href="ch04s02.html#d5e155">Example Installation Architecture</a></span></li><li><span class="file"><a href="ch04s02.html#d5e167">Scripted Installation</a></span></li><li><span class="file"><a href="ch04s02.html#d5e201">Manual Installation</a></span><ul><li><span class="file"><a href="ch04s02.html#d5e205">Installing the Cloud Controller</a></span><ul><li><span class="file"><a href="ch04s02.html#d5e226">Setting up the SQL Database (MySQL) on the Cloud Controller</a></span></li></ul></li><li><span class="file"><a href="ch04s02.html#d5e242">Installing the Compute Node</a></span></li><li><span class="file"><a href="ch04s02.html#d5e252">Restart All Relevant Services on the Compute Node</a></span></li></ul></li></ul></li><li><span class="file"><a href="ch04s03.html">Configuring OpenStack Compute</a></span><ul><li><span class="file"><a href="ch04s03.html#d5e260">Set Up OpenStack Compute Environment on the Compute Node</a></span></li><li><span class="file"><a href="ch04s03.html#d5e269">Create Certifications</a></span></li><li><span class="file"><a href="ch04s03.html#d5e276">Setting Flags in the nova.conf File</a></span></li><li><span class="file"><a href="ch04s03.html#d5e336">Enable Access to VMs on the Compute Node</a></span></li></ul></li></ul></li><li><span class="file"><a href="ch05.html">Installing and Configuring OpenStack Imaging Service</a></span><ul><li><span class="file"><a href="ch05s01.html">System Requirements</a></span></li><li><span class="file"><a href="ch05s02.html">Installing OpenStack Imaging Service on Ubuntu </a></span><ul><li><span class="file"><a href="ch05s02.html#d5e361">Example Installation Architecture</a></span></li><li><span class="file"><a href="ch05s02.html#d5e364">Installing the OpenStack Imaging Service</a></span><ul><li><span class="file"><a href="ch05s02.html#d5e379">Setting up the SQL Database</a></span></li></ul></li></ul></li></ul></li><li><span class="file"><a href="ch06.html">Networking</a></span><ul><li><span class="file"><a href="ch06s01.html">Networking Options</a></span></li><li><span class="file"><a href="ch06s02.html">Configuring Networking on the Compute Node</a></span><ul><li><span class="file"><a href="ch06s02.html#d5e423">Configuring Flat Networking</a></span></li><li><span class="file"><a href="ch06s02.html#d5e434">Configuring Flat DHCP Networking</a></span></li><li><span class="file"><a href="ch06s02.html#d5e441">Configuring VLAN Networking</a></span></li><li><span class="file"><a href="ch06s02.html#d5e444">Enabling Ping and SSH on VMs</a></span></li></ul></li></ul></li><li><span class="file"><a href="ch07.html">Running OpenStack Compute</a></span><ul><li><span class="file"><a href="ch07s01.html">Understanding How Compute Runs Clouds</a></span></li><li><span class="file"><a href="ch07s02.html">Understanding the Compute Service Architecture</a></span><ul><li><span class="file"><a href="ch07s02.html#d5e474">API Server</a></span></li><li><span class="file"><a href="ch07s02.html#d5e478">Message Queue</a></span></li><li><span class="file"><a href="ch07s02.html#d5e482">Compute Worker</a></span></li><li><span class="file"><a href="ch07s02.html#d5e498">Network Controller</a></span></li><li><span class="file"><a href="ch07s02.html#d5e508">Volume Workers</a></span></li></ul></li><li><span class="file"><a href="ch07s03.html">Managing the Cloud</a></span><ul><li><span class="file"><a href="ch07s03.html#d5e523">Using the nova-manage command</a></span></li></ul></li><li id="webhelp-currentid"><span class="file"><a href="ch07s04.html">Managing Compute Users</a></span><ul><li><span class="file"><a href="ch07s04.html#d5e539">Credentials</a></span></li><li><span class="file"><a href="ch07s04.html#d5e545">Role Based Access Control</a></span></li></ul></li></ul></li><li><span class="file"><a href="ch08.html">OpenStack Interfaces</a></span><ul><li><span class="file"><a href="ch08s01.html">System Requirements</a></span></li><li><span class="file"><a href="ch08s02.html">Installation Steps</a></span><ul><li><span class="file"><a href="ch08s02.html#d5e593">Get the source for both projects</a></span></li><li><span class="file"><a href="ch08s02.html#d5e604">(Optional) Build django-nova</a></span></li><li><span class="file"><a href="ch08s02.html#d5e622">Build and Configure Openstack-Dashboard</a></span></li><li><span class="file"><a href="ch08s02.html#d5e646">Run the Server</a></span></li></ul></li></ul></li><li><span class="file"><a href="ch09.html">OpenStack Compute Tutorials</a></span><ul><li><span class="file"><a href="ch09s01.html">Running Your First Elastic Web Application on the Cloud</a></span><ul><li><span class="file"><a href="ch09s01.html#d5e668">Part I: Setting Up the Cloud Infrastructure</a></span><ul><li><span class="file"><a href="ch09s01.html#d5e671">Configuring the network</a></span></li><li><span class="file"><a href="ch09s01.html#d5e693">Ensure the Database is Up-to-date</a></span></li><li><span class="file"><a href="ch09s01.html#d5e697">Creating a user</a></span></li><li><span class="file"><a href="ch09s01.html#d5e704">Creating a project and related credentials</a></span></li></ul></li><li><span class="file"><a href="ch09s01.html#d5e720">Part II: Getting Virtual Machines to Run the Virtual Servers</a></span></li><li><span class="file"><a href="ch09s01.html#d5e731">Part III: Installing the Needed Software for the Web-Scale Scenario</a></span><ul><li><span class="file"><a href="ch09s01.html#d5e740">On the first VM, install Wordpress</a></span></li><li><span class="file"><a href="ch09s01.html#d5e750">On a second VM, install MySQL</a></span></li><li><span class="file"><a href="ch09s01.html#d5e754">On a third VM, install Memcache</a></span></li><li><span class="file"><a href="ch09s01.html#d5e759">Configure the Wordpress Memcache plugin</a></span></li></ul></li></ul></li></ul></li><li><span class="file"><a href="ch10.html">Support and Troubleshooting</a></span><ul><li><span class="file"><a href="ch10s01.html">Community Support</a></span><ul><li><span class="file"><a href="ch10s01.html#d5e768">The Launchpad Answers area </a></span></li><li><span class="file"><a href="ch10s01.html#d5e773">OpenStack mailing list</a></span></li><li><span class="file"><a href="ch10s01.html#d5e778">The OpenStack Wiki search </a></span></li><li><span class="file"><a href="ch10s01.html#d5e781">The Launchpad Bugs area </a></span></li><li><span class="file"><a href="ch10s01.html#d5e797">The OpenStack IRC channel </a></span></li><li><span class="file"><a href="ch10s01.html#d5e800">OpenStack Mailing Lists </a></span></li></ul></li><li><span class="file"><a href="ch10s02.html">Troubleshooting OpenStack Object Storage</a></span><ul><li><span class="file"><a href="ch10s02.html#d5e806">Handling Drive Failure</a></span></li><li><span class="file"><a href="ch10s02.html#d5e810">Handling Server Failure</a></span></li><li><span class="file"><a href="ch10s02.html#d5e815">Detecting Failed Drives</a></span></li></ul></li><li><span class="file"><a href="ch10s03.html">Troubleshooting OpenStack Compute</a></span><ul><li><span class="file"><a href="ch10s03.html#d5e822">Log files for OpenStack Compute</a></span></li><li><span class="file"><a href="ch10s03.html#d5e826">Common Errors and Fixes for OpenStack Compute</a></span></li></ul></li></ul></li></ul></div></div><div id="searchDiv"><div id="search"><form onsubmit="Verifie(ditaSearch_Form);return false" name="ditaSearch_Form" class="searchForm"><fieldset class="searchFieldSet"><legend>Search</legend><center><input id="textToSearch" name="textToSearch" type="text" class="searchText"/>   <input onclick="Verifie(ditaSearch_Form)" type="button" class="searchButton" value="Go" id="doSearch"/></center></fieldset></form></div><div id="searchResults"><center/></div><p class="searchHighlight"><a href="#" onclick="toggleHighlight()">Search Highlighter (On/Off)</a></p></div></div></div></div></body></html>

b'\\ No newline at end of file'

Older »