curl调用openstack API总结

curl命令是Linux下一个可以使用多种协议收发数据的工具,包括http协议。
openstack的API接口都是URL地址:
http://controller:35357/v3
可以使用curl命令进行调用。

本文主要示例如何调用V3版本API。对于V2版本,使用keystone命令加--debug参数,可以看到keystone调用curl的具体写法:
[root@controller ~]# keystone --debug role-list
DEBUG:keystoneclient.auth.identity.v2:Making authentication request to http://controller:35357/v2.0/tokens
INFO:urllib3.connectionpool:Starting new HTTP connection (1): controller
DEBUG:urllib3.connectionpool:"POST /v2.0/tokens HTTP/1.1" 200 3348
DEBUG:keystoneclient.session:REQ: curl -i -X GET http://controller:35357/v2.0/OS-KSADM/roles -H "User-Agent: python-keystoneclient" -H "X-Auth-Token: TOKEN_REDACTED"
INFO:urllib3.connectionpool:Starting new HTTP connection (1): controller
DEBUG:urllib3.connectionpool:"GET /v2.0/OS-KSADM/roles HTTP/1.1" 200 410
DEBUG:keystoneclient.session:RESP: [200] {'date': 'Fri, 04 Dec 2015 10:26:12 GMT', 'content-type': 'application/json', 'content-length': '410', 'vary': 'X-Auth-Token'}
RESP BODY: {"roles": [{"id": "298083b7a87743f8bc23396ffafa3c69", "name": "evecom"}, {"id": "503d8c52cb034f6d87b5c1bb451c42ee", "name": "admin"}, {"id": "7c947e8a06454b51a486d7fb20d5b469", "name": "ResellerAdmin"}, {"id": "8ee269abb5904744b7ed608176f103fb", "name": "heat_stack_user"}, {"id": "9fe2ff9ee4384b1894a90878d3e92bab", "name": "_member_"}, {"id": "abbef7735094459ab0800b94846daead", "name": "heat_stack_owner"}]}

+----------------------------------+------------------+
| id | name |
+----------------------------------+------------------+
| 7c947e8a06454b51a486d7fb20d5b469 | ResellerAdmin |
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ |
| 503d8c52cb034f6d87b5c1bb451c42ee | admin |
| abbef7735094459ab0800b94846daead | heat_stack_owner |
| 8ee269abb5904744b7ed608176f103fb | heat_stack_user |
+----------------------------------+------------------+
则查看角色可以用curl写成:
# curl http://controller:35357/v2.0/OS-KSADM/roles -H "Content-type: application/json" -H "X-Auth-Token:0c17632a554a43bcaf9194dfa01b6f38"|python -mjson.tool


“X-Auth-Token:0c17632a554a43bcaf9194dfa01b6f38”代表token是0c17632a554a43bcaf9194dfa01b6f38。token是用户登录后获得的票据,代表这个用户的权限。token只能使用一段时间,不能无限期使用。除登录本身,其它API调用都需要传递token。V2和V3的token是通用的。


提供user_id和密码,获得token:
# curl -i -X POST http://controller:35357/v3/auth/tokens -H "Content-type: application/json" -d '{"auth": {"identity": {"methods": ["password"],"password": {"user": {"id": "0ebdfa91267c48ee88876d9f5ee1369b","password": "123456"}}},"scope": {"project": {"id": "f7b8022f0794462ba55accbadf8fda37"}}}}'|grep X-Subject-Token
X-Subject-Token: 81d579ec7c2d48f1a5fe28d7e1258f56
# curl -i -X POST http://controller:35357/v3/auth/tokens -H "Content-type: application/json" -d '{"auth": {"identity": {"methods": ["password"],"password": {"user": {"id": "0355aaaf717f491792161850435878da","password": "123456"}}},"scope": {"domain": {"id": "660450adcc194c0bbf9e462bb21b0935"}}}}'|grep X-Subject-Token
X-Subject-Token: d703659e3560480fbf5a92b772d0d4e4
由于V3版本用户认证通过后,token的值返回在HTTP-header当中,故curl命令要加-i参数,表示把HTTP-header也输出在屏幕,其它API调用不需要加-i参数。
“scope”字段是很重要的,可以指定用户所属的domain_id或者project_id。如果不指定,获得的token没有权限。


使用admin的token列出所有用户:
# curl http://controller:35357/v3/users -H "X-Auth-Token:81d579ec7c2d48f1a5fe28d7e1258f56"|python -mjson.tool

只列出domain_id为660450adcc194c0bbf9e462bb21b0935的用户:
# curl http://controller:35357/v3/users?domain_id=660450adcc194c0bbf9e462bb21b0935 -H "X-Auth-Token:81d579ec7c2d48f1a5fe28d7e1258f56"|python -mjson.tool

想具体查找其它调用的URL或可传递的参数,需要查看API文档。我现在查看的API文档叫:openstack-api-ref.pdf


列出所有域:
# curl http://controller:35357/v3/domains -H "X-Auth-Token:81d579ec7c2d48f1a5fe28d7e1258f56"|python -mjson.tool


创建用户:
# curl -X POST http://controller:35357/v3/users -H "Content-type: application/json" -H "X-Auth-Token:81d579ec7c2d48f1a5fe28d7e1258f56" -d '{"user": {"default_project_id": "c0d6c4a09b7649a19c394a6cd946f53f","domain_id": "660450adcc194c0bbf9e462bb21b0935","enabled": true,"name": "test001","password":"123456"}}'|python -mjson.tool
# curl -X POST http://controller:35357/v3/users -H "Content-type: application/json" -H "X-Auth-Token:81d579ec7c2d48f1a5fe28d7e1258f56" -d '{"user": {"domain_id": "660450adcc194c0bbf9e462bb21b0935","enabled": true,"name": "test002","password":"123456"}}'|python -mjson.tool


授权用户_member_角色(role_id=9fe2ff9ee4384b1894a90878d3e92bab)以访问项目(project_id=c0d6c4a09b7649a19c394a6cd946f53f):
# curl -X PUT http://controller:35357/v3/projects/c0d6c4a09b7649a19c394a6cd946f53f/users/735c4d1fc8eb4bf8b96ee6866b441d9d/roles/9fe2ff9ee4384b1894a90878d3e92bab -H "X-Auth-Token:22142d114ddc454a9fbf6d282793840e"

授权用户_member_角色(role_id=9fe2ff9ee4384b1894a90878d3e92bab)以访问项目(domain_id=660450adcc194c0bbf9e462bb21b0935):
# curl -X PUT http://controller:35357/v3/domains/660450adcc194c0bbf9e462bb21b0935/users/735c4d1fc8eb4bf8b96ee6866b441d9d/roles/9fe2ff9ee4384b1894a90878d3e92bab -H "X-Auth-Token:22142d114ddc454a9fbf6d282793840e"

如果用户没有任何角色,无法获得token。


删除用户(user_id=31d38aec54684281a993e248835e6d9b)
# curl -X DELETE http://controller:35357/v3/users/31d38aec54684281a993e248835e6d9b -H "X-Auth-Token:81d579ec7c2d48f1a5fe28d7e1258f56"


至于curl -X参数的类型,需要查看API文档,如果是GET类型,则不需要加-X参数。

 

posted @ 2015-12-04 11:00  Endoresu  阅读(8815)  评论(3编辑  收藏  举报