OpenStack API 101
log in to openstack horizon,
In project -> API access you will be able to find a list of endpoint
Identity is for token
Compute is for servers(instances)
different token type :
https://docs.openstack.org/ocata/admin-guide/identity-tokens.html
Project-scoped tokens
Projects are containers for resources, like volumes or instances. Project-scoped tokens express your authorization to operate in a specific tenancy of the cloud and are useful for things like spinning up compute resources or carving off block storage. They contain a service catalog, a set of roles, and information about the project.
Most end-users need role assignments on projects to consume resources in a deployment.
Domain-scoped tokens
Domains are namespaces for projects, users, and groups. A domain-scoped token expresses your authorization to operate on the contents of a domain or the domain itself.
While some OpenStack services are still adopting the domain concept, domains are fully supported in keystone. This means users with authorization on a domain have the ability to manage things within the domain. For example, a domain administrator can create new users and projects within that domain.
Domain-scoped tokens contain a service catalog, roles, and information about the domain.
People who need to manage users and projects typically need domain-level access.
System-scoped tokens
Some OpenStack APIs fit nicely within the concept of projects (e.g., creating an instance) or domains (e.g., creating a new user), but there are also APIs that affect the entire deployment system (e.g. modifying endpoints, service management, or listing information about hypervisors). These operations are typically reserved for operators and require system-scoped tokens, which represents the role assignments a user has to operate on the deployment as a whole. The term system refers to the deployment system, which is a collection of hardware (e.g., compute nodes) and services (e.g., nova, cinder, neutron, barbican, keystone) that provide Infrastructure-as-a-Service.
System-scoped tokens contain a service catalog, roles, and information about the system. System role assignments and system-scoped tokens are typically reserved for operators and cloud administrators.
// domain of user can be checked in Identity -> users -> click ur user
------------------------------------
the correct way is to first use user name, password to get default scope(unscoped) token
then use default scope(unscoped) token to get user project list
then use one of desired project and username and passowrd to get project scoped token
then use project scoped token to get servers(instances in a project)
------------------------------------------
Token -> <IdentiyAPIEndPoint>
POST
<IdentiyAPIEndPoint>/v3/auth/tokens
// default scope
request(or unscoped_ :
{
"auth": {
"identity": {
"methods": [
"password"
],
"password": {
"user": {
"domain": {
"name": "Default"
},
"name": "xxx",
"password": "xxxx"
}
}
}
}
}
// project scoped:
{
"auth": {
"identity": {
"methods": [
"password"
],
"password": {
"user": {
"domain": {
"name": "Default"
},
"name": "xxx",
"password": "xxx"
}
}
},
"scope": {
"project": {
"domain": {
"id": "default"
},
"name": "<projectName>"
}
}
}
}
response:
unscoped :
x-subject-token <token>
-----------------------
project scoped:
x-subject-token <token>
--------------
Project list of user
<IdentiyAPIEndPoint>
POST
<IdentiyAPIEndPoint>/v3/user/<user_id>/projects
get a list of projects user belong to https://os.vancouver-a.fortistack.corp.fortinet.com:5000/v3/users/<user_id>/projects
x-subject-token unscoped token
{
"projects": [
{
"id": "xxxxxx",
"name": "projectA",
"domain_id": "default",
.....
],
"links": {
"next": null,
"self": "https://os.vancouver-a.fortistack.corp.fortinet.com:5000/v3/users/<user_id>/projects",
"previous": null
}
}
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
server list of user
<ComputeAPIEndPoint>
POST
<IdentiyAPIEndPoint>/servers
get list of instances (servers) need projet scoped token :
<IdentiyAPIEndPoint>/servers
x-auth-token <project scoped token>
{
"servers": [
{
"id": "xxxxx",
"name": "testA",
"links": [
{
"rel": "self",
"href": "ddddd"
},
....
]
}
]
}
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
<ComputeAPIEndPoint>
request :
<ComputeAPIEndPoint>flavors
x-auth-token
resp:
{
"flavors": [
........
]
}
-------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
CMD LINE
(All OpenStack command-line tools are implemented by using the Python SDK)
sudo pip install python-openstackclient
openstack image list
Authentication :
https://docs.openstack.org/api-quick-start/api-quick-start.html#authentication-and-api-request-workflow
Detailed:
https://docs.openstack.org/api-ref/identity/v3/#token-authentication-with-unscoped-authorization
// get a token
$ curl -v -s -X POST $OS_AUTH_URL/auth/tokens?nocatalog -H "Content-Type: application/json" -d '{ "auth": { "identity": { "methods": ["password"],"password": {"user": {"domain": {"name": "'"$OS_USER_DOMAIN_NAME"'"},"name": "'"$OS_USERNAME"'", "password": "'"$OS_PASSWORD"'"} } }, "scope": { "project": { "domain": { "name": "'"$OS_PROJECT_DOMAIN_NAME"'" }, "name": "'"$OS_PROJECT_NAME"'" } } }}' \
| python -m json.tool
token returned from server will be in header :
X-Subject-Token
header
//
Trying 192.168.56.101...
* Connected to controller (192.168.56.101) port 5000 (#0)
> POST /v3/auth/tokens?nocatalog HTTP/1.1
> Host: controller:5000
> User-Agent: curl/7.47.0
----------------------------------------------------------
string
The authentication token. An authentication response returns the token ID in this header rather than in the response body.
https://docs.openstack.org/api-ref/identity/v3/#token-authentication-with-unscoped-authorization
------------------------------------------------------------------------------------------------------------------------
if its 1 hour, upload image causing it expired?
token expired will result 401
https://github.com/hashicorp/packer/issues/2928
// sample call with compute API :
$ curl -s -H "X-Auth-Token: $OS_TOKEN" \
$OS_COMPUTE_API/flavors \
| python -m json.tool
Get instances(servers):
https://docs.openstack.org/api-ref/compute/#list-servers
Normal response codes: 200
Error response codes: badRequest(400), unauthorized(401), forbidden(403)
// submit together with a X-Service-Token :
https://specs.openstack.org/openstack/keystone-specs/specs/keystonemiddleware/juno/service-tokens.html
| X-AUTH-TOKEN: <end user token>
| X-SERVICE-TOKEN: None
Reason is user token expires while some services in NOVA takes long time ,
to add a service user need to change nova config file :
https://docs.openstack.org/cinder/latest/configuration/block-storage/service-token.html
https://docs.openstack.org/nova/latest/configuration/config.html#service_user
https://specs.openstack.org/openstack/keystone-specs/specs/keystonemiddleware/juno/service-tokens.html
Summary default user token
token API resp header
X-Subject-Token
Call openstack API request header
X-Auth-Token
Summary default service token
token API resp header ( will be send together with X-Subject-Token)
?
Call openstack API request header (need to send together with X-Auth-Token)
X-Service-Token
------------------------------------------------------------------------------------------------------------------------
No comments:
Post a Comment