Ask Your Question
0

how to assign a service like glance to more than one project, on the same domain and also two different domains

asked 2018-12-28 01:57:30 -0500

esxzawq gravatar image

updated 2018-12-28 02:43:48 -0500

hello everybody

1- suppose I have 2 project in a domain

Domain test : Project a and Project b

openstack project create --domain test --description "Project a" a

openstack project create --domain test --description "Project b" b

how to assign a service like glance to both of them .

openstack role add --project a --user glance admin

openstack role add --project b --user glance admin

am I right ?!!

and

2- suppose I have 2 domain each have a project

Domain test1 : project a and Domain test2 : project aa

openstack domain create --description "Domain test1" test1

openstack domain create --description "Domain test2" test2

how to assign a service like glance to both project a and project aa that are on two sperate domains

should I first create the two glance user for domain test1 and domain test2

openstack user create --domain test1 --password-prompt glance

openstack user create --domain test2 --password-prompt glance

and then assign the service to the project with role !!

openstack role add --domain test1 --project a --user glance admin

openstack role add --domain test2 --project aa --user glance admin

edit retag flag offensive close merge delete

1 answer

Sort by » oldest newest most voted
1

answered 2018-12-28 02:47:29 -0500

It’s not clear to me what your aim is. Service users normally belong to the default domain and have a non-admin role in the service project, which also belongs to the same default domain.

Question 1: yes. After this, user glance has role admin in these two projects in the test domain. Note that we are talking about user glance in the default domain, since I don’t think you created a user named glance in test.

Question 2: If you create users in domains test1 and test2, they are different from each other and from user glance in the default domain. This doesn’t affect the service user glance. So, if you insist that service user glance have a role in those projects, either don’t create users with this name in test1 and test2, or add the option --os-user-domain default.

Again, I don’t understand what you want to achieve. You normally don’t associate service users with other projects than service. I suspect that you misunderstand something.

edit flag offensive delete link more

Comments

Thank you, for the Question one I got it .Yes I have created a user named glance in domain named test and the user glance belongs to service image. So both project a and b must be able to use image service. correct !?

esxzawq gravatar imageesxzawq ( 2018-12-29 09:10:03 -0500 )edit

for Question 2 : how to allow two projects in two different domains (project a in domain test1 and project aa in domain test2) be able to use image service ( image service's user named glance ) should I create a glance user in both domains !!?

esxzawq gravatar imageesxzawq ( 2018-12-29 09:15:37 -0500 )edit

also good to mention , I don't want to work with default domain, I have created my own domains : like test1 and test2. and creating users in these domains

esxzawq gravatar imageesxzawq ( 2018-12-29 09:27:40 -0500 )edit

If you don't want to work with the default domain, that's fine. However, the service project and the service users like nova, keystone, neutron, glance and so on should live in the default domain, even if you give it a different name than default.

Bernd Bausch gravatar imageBernd Bausch ( 2018-12-29 21:04:35 -0500 )edit

Perhaps you can create user glance in other domains, or associate the glance user with projects in other domains, but it is a waste of time. Besides, I am not sure if it causes any problems.

In short, don't do it.

Bernd Bausch gravatar imageBernd Bausch ( 2018-12-29 21:07:59 -0500 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Get to know Ask OpenStack

Resources for moderators

Question Tools

1 follower

Stats

Asked: 2018-12-28 01:57:30 -0500

Seen: 33 times

Last updated: Dec 28 '18