Keystone: package service/user additions

Instead of creating tenant/user/role and service/endpoint for all
openstack services in keystone postinstall, now each of the services
creates its own keystone identities by queueing them up in its postinstall
to a file /etc/keystone/service-user-setup. service-user-setup
script, when run as the last postinstall, calls identity.sh with keystone
identity parameters to create necessary identities for the services.

Signed-off-by: Andy Ning <andy.ning@windriver.com>

11 files changed, 298 insertions, 19 deletions

diff --git a/meta-openstack/recipes-devtools/python/python-barbican_git.bb b/meta-openstack/recipes-devtools/python/python-barbican_git.bb
index b0d32ae..86b86e6 100644
--- a/meta-openstack/recipes-devtools/python/python-barbican_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-barbican_git.bb
@@ -21,6 +21,24 @@ S = "${WORKDIR}/git"
 
 inherit update-rc.d setuptools identity hosts useradd default_configs
 
+SERVICECREATE_PACKAGES = "${SRCNAME}-setup"
+KEYSTONE_HOST="${CONTROLLER_IP}"
+
+# USERCREATE_PARAM and SERVICECREATE_PARAM contain the list of parameters to be set.
+# If the flag for a parameter in the list is not set here, the default value will be given to that parameter.
+# Parameters not in the list will be set to empty.
+
+USERCREATE_PARAM_${SRCNAME}-setup = "name pass tenant role email"
+SERVICECREATE_PARAM_${SRCNAME}-setup = "name type description region publicurl adminurl internalurl"
+python () {
+    flags = {'type':'keystore',\
+             'description':'Barbican Key Management Service',\
+             'publicurl':"'http://${KEYSTONE_HOST}:9311/v1'",\
+             'adminurl':"'http://${KEYSTONE_HOST}:9312/v1'",\
+             'internalurl':"'http://${KEYSTONE_HOST}:9313/v1'"}
+    d.setVarFlags("SERVICECREATE_PARAM_%s-setup" % d.getVar('SRCNAME',True), flags)
+}
+
 do_install_append() {
     TEMPLATE_CONF_DIR=${S}${sysconfdir}/${SRCNAME}
     BARBICAN_CONF_DIR=${D}${sysconfdir}/${SRCNAME}
diff --git a/meta-openstack/recipes-devtools/python/python-ceilometer_git.bb b/meta-openstack/recipes-devtools/python/python-ceilometer_git.bb
index c3354c0..6e58cac 100644
--- a/meta-openstack/recipes-devtools/python/python-ceilometer_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-ceilometer_git.bb
@@ -23,6 +23,32 @@ S = "${WORKDIR}/git"
 
 CEILOMETER_SECRET ?= "12121212"
 
+SERVICECREATE_PACKAGES = "${SRCNAME}-setup ${SRCNAME}-reseller"
+KEYSTONE_HOST="${CONTROLLER_IP}"
+
+# USERCREATE_PARAM and SERVICECREATE_PARAM contain the list of parameters to be set.
+# If the flag for a parameter in the list is not set here, the default value will be given to that parameter.
+# Parameters not in the list will be set to empty.
+
+USERCREATE_PARAM_${SRCNAME}-setup = "name pass tenant role email"
+SERVICECREATE_PARAM_${SRCNAME}-setup = "name type description region publicurl adminurl internalurl"
+python () {
+    flags = {'type':'metering',\
+             'description':'OpenStack Metering Service',\
+             'publicurl':"'http://${KEYSTONE_HOST}:8777/'",\
+             'adminurl':"'http://${KEYSTONE_HOST}:8777/'",\
+             'internalurl':"'http://${KEYSTONE_HOST}:8777/'"}
+
+    d.setVarFlags("SERVICECREATE_PARAM_%s-setup" % d.getVar('SRCNAME',True), flags)
+}
+
+# Add service user to service tenant as ResellerAdmin role
+USERCREATE_PARAM_${SRCNAME}-reseller = "name pass tenant role email"
+python () {
+    flags = {'role':'ResellerAdmin'}
+    d.setVarFlags("USERCREATE_PARAM_%s-reseller" % d.getVar('SRCNAME',True), flags)
+}
+
 do_configure_append() {
     # We are using postgresql support, hence this requirement is not valid
     # removing it, to avoid on-target runtime issues
@@ -104,8 +130,10 @@ PACKAGES += "${SRCNAME}-setup ${SRCNAME}-common ${SRCNAME}-api"
 PACKAGES += "${SRCNAME}-alarm-notifier ${SRCNAME}-alarm-evaluator"
 PACKAGES += "${SRCNAME}-agent-notification"
 PACKAGES += "${SRCNAME}-collector ${SRCNAME}-compute ${SRCNAME}-controller"
+PACKAGES += " ${SRCNAME}-reseller"
 
 ALLOW_EMPTY_${SRCNAME}-setup = "1"
+ALLOW_EMPTY_${SRCNAME}-reseller = "1"
 
 FILES_${PN} = "${libdir}/*"
 
@@ -199,12 +227,13 @@ RDEPENDS_${PN} += " \
         python-pysnmp \
         "
 
-RDEPENDS_${SRCNAME}-controller = "${PN} ${SRCNAME}-common ${SRCNAME}-alarm-notifier ${SRCNAME}-alarm-evaluator ${SRCNAME}-agent-notification \
+RDEPENDS_${SRCNAME}-controller = "${PN} ${SRCNAME}-common ${SRCNAME}-alarm-notifier ${SRCNAME}-alarm-evaluator ${SRCNAME}-agent-notification ${SRCNAME}-reseller \
                                   postgresql postgresql-client python-psycopg2 tgt"
 RDEPENDS_${SRCNAME}-api = "${SRCNAME}-controller"
 RDEPENDS_${SRCNAME}-collector = "${SRCNAME}-controller"
 RDEPENDS_${SRCNAME}-compute = "${PN} ${SRCNAME}-common python-ceilometerclient libvirt"
 RDEPENDS_${SRCNAME}-setup = "postgresql sudo ${SRCNAME}-controller"
+RDEPENDS_${SRCNAME}-reseller = "postgresql sudo ${SRCNAME}-controller"
 
 INITSCRIPT_PACKAGES =  "${SRCNAME}-api ${SRCNAME}-collector ${SRCNAME}-compute ${SRCNAME}-controller"
 INITSCRIPT_PACKAGES += "${SRCNAME}-alarm-notifier ${SRCNAME}-alarm-evaluator ${SRCNAME}-agent-notification"
diff --git a/meta-openstack/recipes-devtools/python/python-cinder_git.bb b/meta-openstack/recipes-devtools/python/python-cinder_git.bb
index 2d7e76c..acabfa0 100644
--- a/meta-openstack/recipes-devtools/python/python-cinder_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-cinder_git.bb
@@ -24,10 +24,29 @@ SRCREV="81259f36f57e91b31009fbd209ea2a07a2ceb213"
 PV="2013.2.3+git${SRCPV}"
 S = "${WORKDIR}/git"
 
-inherit setuptools update-rc.d identity default_configs
+inherit setuptools update-rc.d identity default_configs hosts
 
 CINDER_BACKUP_BACKEND_DRIVER ?= "cinder.backup.drivers.swift"
 
+SERVICECREATE_PACKAGES = "${SRCNAME}-setup"
+KEYSTONE_HOST="${CONTROLLER_IP}"
+
+# USERCREATE_PARAM and SERVICECREATE_PARAM contain the list of parameters to be set.
+# If the flag for a parameter in the list is not set here, the default value will be given to that parameter.
+# Parameters not in the list will be set to empty.
+
+USERCREATE_PARAM_${SRCNAME}-setup = "name pass tenant role email"
+SERVICECREATE_PARAM_${SRCNAME}-setup = "name type description region publicurl adminurl internalurl"
+python () {
+    flags = {'type':'volume',\
+             'description':'OpenStack Volume Service',\
+             'publicurl':"'http://${KEYSTONE_HOST}:8776/v1/\$(tenant_id)s'",\
+             'adminurl':"'http://${KEYSTONE_HOST}:8776/v1/\$(tenant_id)s'",\
+             'internalurl':"'http://${KEYSTONE_HOST}:8776/v1/\$(tenant_id)s'"}
+
+    d.setVarFlags("SERVICECREATE_PARAM_%s-setup" % d.getVar('SRCNAME',True), flags)
+}
+
 do_install_prepend() {
     sed 's:%PYTHON_SITEPACKAGES_DIR%:${PYTHON_SITEPACKAGES_DIR}:g' -i ${S}/${SRCNAME}/tests/conf_fixture.py
     sed 's:%PYTHON_SITEPACKAGES_DIR%:${PYTHON_SITEPACKAGES_DIR}:g' -i ${S}/${SRCNAME}/tests/fake_flags.py
diff --git a/meta-openstack/recipes-devtools/python/python-glance_git.bb b/meta-openstack/recipes-devtools/python/python-glance_git.bb
index 57ad34c..1f94939 100644
--- a/meta-openstack/recipes-devtools/python/python-glance_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-glance_git.bb
@@ -17,10 +17,29 @@ PV="2013.2.3+git${SRCPV}"
 
 S = "${WORKDIR}/git"
 
-inherit setuptools update-rc.d identity default_configs
+inherit setuptools update-rc.d identity default_configs hosts
 
 GLANCE_DEFAULT_STORE ?= "file"
 
+SERVICECREATE_PACKAGES = "${SRCNAME}-setup"
+KEYSTONE_HOST="${CONTROLLER_IP}"
+
+# USERCREATE_PARAM and SERVICECREATE_PARAM contain the list of parameters to be set.
+# If the flag for a parameter in the list is not set here, the default value will be given to that parameter.
+# Parameters not in the list will be set to empty.
+
+USERCREATE_PARAM_${SRCNAME}-setup = "name pass tenant role email"
+SERVICECREATE_PARAM_${SRCNAME}-setup = "name type description region publicurl adminurl internalurl"
+python () {
+    flags = {'type':'image',\
+             'description':'OpenStack Image Service',\
+             'publicurl':"'http://${KEYSTONE_HOST}:9292/v2'",\
+             'adminurl':"'http://${KEYSTONE_HOST}:9292/v2'",\
+             'internalurl':"'http://${KEYSTONE_HOST}:9292/v2'"}
+
+    d.setVarFlags("SERVICECREATE_PARAM_%s-setup" % d.getVar('SRCNAME',True), flags)
+}
+
 do_install_prepend() {
     sed 's:%PYTHON_SITEPACKAGES_DIR%:${PYTHON_SITEPACKAGES_DIR}:g' -i ${S}/${SRCNAME}/tests/functional/__init__.py
     sed 's:%PYTHON_SITEPACKAGES_DIR%:${PYTHON_SITEPACKAGES_DIR}:g' -i ${S}/${SRCNAME}/tests/unit/base.py
diff --git a/meta-openstack/recipes-devtools/python/python-heat_git.bb b/meta-openstack/recipes-devtools/python/python-heat_git.bb
index 8b7db6a..176cfa1 100644
--- a/meta-openstack/recipes-devtools/python/python-heat_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-heat_git.bb
@@ -20,6 +20,44 @@ SRCREV="58de9e6415f5bdabde708c8584b21b59b7e96a88"
 PV="2013.2.3+git${SRCPV}"
 S = "${WORKDIR}/git"
 
+SERVICECREATE_PACKAGES = "${SRCNAME}-setup ${SRCNAME}-templates ${SRCNAME}-cfn"
+KEYSTONE_HOST="${CONTROLLER_IP}"
+
+# USERCREATE_PARAM and SERVICECREATE_PARAM contain the list of parameters to be set.
+# If the flag for a parameter in the list is not set here, the default value will be given to that parameter.
+# Parameters not in the list will be set to empty.
+
+USERCREATE_PARAM_${SRCNAME}-setup = "name pass tenant role email"
+SERVICECREATE_PARAM_${SRCNAME}-setup = "name type description region publicurl adminurl internalurl"
+python () {
+    flags = {'type':'orchestration',\
+             'description':'OpenStack Orchestration Service',\
+             'publicurl':"'http://${KEYSTONE_HOST}:8004/v1/\$(tenant_id)s'",\
+             'adminurl':"'http://${KEYSTONE_HOST}:8004/v1/\$(tenant_id)s'",\
+             'internalurl':"'http://${KEYSTONE_HOST}:8004/v1/\$(tenant_id)s'"}
+
+    d.setVarFlags("SERVICECREATE_PARAM_%s-setup" % d.getVar('SRCNAME',True), flags)
+}
+
+# heat stack template user role
+USERCREATE_PARAM_${SRCNAME}-templates = "role"
+python () {
+    flags = {'role':'heat_stack_user'}
+    d.setVarFlags("USERCREATE_PARAM_%s-templates" % d.getVar('SRCNAME',True), flags)
+}
+
+# api-cfn service
+SERVICECREATE_PARAM_${SRCNAME}-cfn = "name type description region publicurl adminurl internalurl"
+python () {
+    flags = {'name':'heat-cfn',\
+             'type':'cloudformation',\
+             'description':'OpenStack Cloudformation Service',\
+             'publicurl':"'http://${KEYSTONE_HOST}:8000/v1'",\
+             'adminurl':"'http://${KEYSTONE_HOST}:8000/v1'",\
+             'internalurl':"'http://${KEYSTONE_HOST}:8000/v1'"}
+    d.setVarFlags("SERVICECREATE_PARAM_%s-cfn" % d.getVar('SRCNAME',True), flags)
+}
+
 do_install_append() {
     TEMPLATE_CONF_DIR=${S}${sysconfdir}/${SRCNAME}
     HEAT_CONF_DIR=${D}${sysconfdir}/${SRCNAME}
@@ -89,8 +127,11 @@ inherit setuptools identity hosts update-rc.d default_configs
 
 PACKAGES += "${SRCNAME}-tests ${SRCNAME}-templates ${SRCNAME}-common ${SRCNAME}-api ${SRCNAME}-api-cfn ${SRCNAME}-engine"
 PACKAGES += "${SRCNAME}-setup"
+PACKAGES += "${SRCNAME}-cfn"
 
 ALLOW_EMPTY_${SRCNAME}-setup = "1"
+ALLOW_EMPTY_${SRCNAME}-templates = "1"
+ALLOW_EMPTY_${SRCNAME}-cfn = "1"
 
 FILES_${PN} = "${libdir}/*"
 
@@ -164,10 +205,12 @@ RDEPENDS_${PN} += " \
         python-pbr \
         "
 
-RDEPENDS_${SRCNAME}-engine = "${PN} ${SRCNAME}-templates ${SRCNAME}-common postgresql postgresql-client python-psycopg2 tgt"
+RDEPENDS_${SRCNAME}-engine = "${PN} ${SRCNAME}-templates ${SRCNAME}-common postgresql postgresql-client python-psycopg2 tgt ${SRCNAME}-cfn"
 RDEPENDS_${SRCNAME}-api = "${SRCNAME}-engine"
 RDEPENDS_${SRCNAME}-api-cfn = "${SRCNAME}-engine"
 RDEPENDS_${SRCNAME}-setup = "postgresql sudo ${SRCNAME}-engine"
+RDEPENDS_${SRCNAME}-templates = "postgresql sudo"
+RDEPENDS_${SRCNAME}-cfn = "postgresql sudo"
 
 INITSCRIPT_PACKAGES = "${SRCNAME}-api ${SRCNAME}-api-cfn ${SRCNAME}-engine"
 INITSCRIPT_NAME_${SRCNAME}-api = "${SRCNAME}-api"
diff --git a/meta-openstack/recipes-devtools/python/python-keystone_git.bb b/meta-openstack/recipes-devtools/python/python-keystone_git.bb
index 96ce440..ec5d775 100644
--- a/meta-openstack/recipes-devtools/python/python-keystone_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-keystone_git.bb
@@ -31,6 +31,33 @@ TOKEN_FORMAT ?= "PKI"
 
 LDAP_DN ?= "dc=my-domain,dc=com"
 
+SERVICECREATE_PACKAGES = "${SRCNAME}-setup"
+KEYSTONE_HOST="${CONTROLLER_IP}"
+
+# USERCREATE_PARAM and SERVICECREATE_PARAM contain the list of parameters to be set.
+# If the flag for a parameter in the list is not set here, the default value will be given to that parameter.
+# Parameters not in the list will be set to empty.
+
+USERCREATE_PARAM_${SRCNAME}-setup = "name pass tenant role email"
+python () {
+    flags = {'name':'${ADMIN_USER}',\
+             'pass':'${ADMIN_PASSWORD}',\
+             'tenant':'${ADMIN_TENANT}',\
+             'role':'${ADMIN_ROLE}',\
+             'email':'${ADMIN_USER_EMAIL}',\
+            }
+    d.setVarFlags("USERCREATE_PARAM_%s-setup" % d.getVar('SRCNAME',True), flags)
+}
+SERVICECREATE_PARAM_${SRCNAME}-setup = "name type description region publicurl adminurl internalurl"
+python () {
+    flags = {'type':'identity',\
+             'description':'OpenStack Identity',\
+             'publicurl':"'http://${KEYSTONE_HOST}:5000/v2.0'",\
+             'adminurl':"'http://${KEYSTONE_HOST}:35357/v2.0'",\
+             'internalurl':"'http://${KEYSTONE_HOST}:5000/v2.0'"}
+    d.setVarFlags("SERVICECREATE_PARAM_%s-setup" % d.getVar('SRCNAME',True), flags)
+}
+
 do_install_append() {
 
     KEYSTONE_CONF_DIR=${D}${sysconfdir}/keystone
@@ -41,7 +68,7 @@ do_install_append() {
     install -d ${D}${localstatedir}/log/${SRCNAME}
 
     install -m 600 ${WORKDIR}/keystone.conf ${KEYSTONE_CONF_DIR}/
-    install -m 600 ${WORKDIR}/identity.sh ${KEYSTONE_CONF_DIR}/
+    install -m 755 ${WORKDIR}/identity.sh ${KEYSTONE_CONF_DIR}/
     install -m 600 ${WORKDIR}/openrc ${KEYSTONE_CONF_DIR}/
     install -m 600 ${S}/etc/logging.conf.sample ${KEYSTONE_CONF_DIR}/logging.conf
     install -m 600 ${S}/etc/policy.json ${KEYSTONE_CONF_DIR}/policy.json
@@ -124,20 +151,15 @@ pkg_postinst_${SRCNAME}-setup () {
         sleep 2
     fi
 
-    sudo -u postgres createdb keystone
-    keystone-manage db_sync
-    keystone-manage pki_setup --keystone-user=root --keystone-group=root
+    # This is to make sure keystone is configured and running
+    PIDFILE="/var/run/keystone-all.pid"
+    if [ -z `cat $PIDFILE 2>/dev/null` ]; then
+       sudo -u postgres createdb keystone
+       keystone-manage db_sync
+       keystone-manage pki_setup --keystone-user=root --keystone-group=root
 
-    # Create users, services and endpoints
-    /etc/init.d/keystone start
-    sleep 2
-
-    ADMIN_PASSWORD=${ADMIN_PASSWORD} \
-    SERVICE_PASSWORD=${SERVICE_PASSWORD} \
-    SERVICE_TENANT_NAME=${SERVICE_TENANT_NAME} \
-             bash /etc/keystone/identity.sh
-
-    # end python-keystone postinst
+       /etc/init.d/keystone start
+    fi
 }
 
 # By default tokens are expired after 1 day so by default we can set
diff --git a/meta-openstack/recipes-devtools/python/python-neutron_git.bb b/meta-openstack/recipes-devtools/python/python-neutron_git.bb
index c1c67d5..f59d111 100644
--- a/meta-openstack/recipes-devtools/python/python-neutron_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-neutron_git.bb
@@ -26,6 +26,25 @@ S = "${WORKDIR}/git"
 
 inherit setuptools update-rc.d identity hosts default_configs
 
+SERVICECREATE_PACKAGES = "${SRCNAME}-setup"
+KEYSTONE_HOST="${CONTROLLER_IP}"
+
+# USERCREATE_PARAM and SERVICECREATE_PARAM contain the list of parameters to be set.
+# If the flag for a parameter in the list is not set here, the default value will be given to that parameter.
+# Parameters not in the list will be set to empty.
+
+USERCREATE_PARAM_${SRCNAME}-setup = "name pass tenant role email"
+SERVICECREATE_PARAM_${SRCNAME}-setup = "name type description region publicurl adminurl internalurl"
+python () {
+    flags = {'type':'network',\
+             'description':'OpenStack Networking service',\
+             'publicurl':"'http://${KEYSTONE_HOST}:9696/'",\
+             'adminurl':"'http://${KEYSTONE_HOST}:9696/'",\
+             'internalurl':"'http://${KEYSTONE_HOST}:9696/'"}
+
+    d.setVarFlags("SERVICECREATE_PARAM_%s-setup" % d.getVar('SRCNAME',True), flags)
+}
+
 do_install_append() {
     TEMPLATE_CONF_DIR=${S}${sysconfdir}/
     NEUTRON_CONF_DIR=${D}${sysconfdir}/neutron
diff --git a/meta-openstack/recipes-devtools/python/python-nova_git.bb b/meta-openstack/recipes-devtools/python/python-nova_git.bb
index 7b390d3..e3174fb 100644
--- a/meta-openstack/recipes-devtools/python/python-nova_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-nova_git.bb
@@ -35,6 +35,36 @@ inherit update-rc.d setuptools identity hosts useradd default_configs
 
 LIBVIRT_IMAGES_TYPE ?= "default"
 
+SERVICECREATE_PACKAGES = "${SRCNAME}-setup ${SRCNAME}-ec2"
+KEYSTONE_HOST="${CONTROLLER_IP}"
+
+# USERCREATE_PARAM and SERVICECREATE_PARAM contain the list of parameters to be set.
+# If the flag for a parameter in the list is not set here, the default value will be given to that parameter.
+# Parameters not in the list will be set to empty.
+
+USERCREATE_PARAM_${SRCNAME}-setup = "name pass tenant role email"
+SERVICECREATE_PARAM_${SRCNAME}-setup = "name type description region publicurl adminurl internalurl"
+python () {
+    flags = {'type':'compute',\
+             'description':'OpenStack Compute Service',\
+             'publicurl':"'http://${KEYSTONE_HOST}:8774/v2/\$(tenant_id)s'",\
+             'adminurl':"'http://${KEYSTONE_HOST}:8774/v2/\$(tenant_id)s'",\
+             'internalurl':"'http://${KEYSTONE_HOST}:8774/v2/\$(tenant_id)s'"}
+    d.setVarFlags("SERVICECREATE_PARAM_%s-setup" % d.getVar('SRCNAME',True), flags)
+}
+
+# ec2 is provided by nova-api
+SERVICECREATE_PARAM_${SRCNAME}-ec2 = "name type description region publicurl adminurl internalurl"
+python () {
+    flags = {'name':'ec2',\
+             'type':'ec2',\
+             'description':'OpenStack EC2 Service',\
+             'publicurl':"'http://${KEYSTONE_HOST}:8773/services/Cloud'",\
+             'adminurl':"'http://${KEYSTONE_HOST}:8773/services/Admin'",\
+             'internalurl':"'http://${KEYSTONE_HOST}:8773/services/Cloud'"}
+    d.setVarFlags("SERVICECREATE_PARAM_%s-ec2" % d.getVar('SRCNAME',True), flags)
+}
+
 do_install_append() {
     if [ ! -f "${WORKDIR}/nova.conf" ]; then
         return
@@ -172,6 +202,7 @@ PACKAGES += " ${SRCNAME}-scheduler"
 PACKAGES += " ${SRCNAME}-cert"
 PACKAGES += " ${SRCNAME}-conductor"
 PACKAGES += " ${SRCNAME}-api"
+PACKAGES += " ${SRCNAME}-ec2"
 
 PACKAGECONFIG ?= "bash-completion"
 PACKAGECONFIG[bash-completion] = ",,bash-completion,bash-completion python-nova-bash-completion"
@@ -181,6 +212,7 @@ FILES_${BPN}-bash-completion = "${sysconfdir}/bash_completion.d/*"
 
 
 ALLOW_EMPTY_${SRCNAME}-setup = "1"
+ALLOW_EMPTY_${SRCNAME}-ec2 = "1"
 
 FILES_${PN} = "${libdir}/*"
 
@@ -273,6 +305,7 @@ RDEPENDS_${SRCNAME}-common = "${PN} openssl openssl-misc libxml2 libxslt \
                               iptables curl dnsmasq sudo procps"
 
 RDEPENDS_${SRCNAME}-controller = "${PN} ${SRCNAME}-common \
+                                  ${SRCNAME}-ec2 \
                                   ${SRCNAME}-consoleauth \
                                   ${SRCNAME}-novncproxy \
                                   ${SRCNAME}-spicehtml5proxy \
@@ -286,6 +319,7 @@ RDEPENDS_${SRCNAME}-controller = "${PN} ${SRCNAME}-common \
 RDEPENDS_${SRCNAME}-compute = "${PN} ${SRCNAME}-common \
                                qemu libvirt libvirt-libvirtd libvirt-python libvirt-virsh"
 RDEPENDS_${SRCNAME}-setup = "postgresql sudo ${SRCNAME}-common"
+RDEPENDS_${SRCNAME}-ec2 = "postgresql sudo ${SRCNAME}-common"
 
 RDEPENDS_${SRCNAME}-tests = " \
                             python-coverage \
diff --git a/meta-openstack/recipes-devtools/python/python-swift_git.bb b/meta-openstack/recipes-devtools/python/python-swift_git.bb
index 19c056f..43ba8dd 100644
--- a/meta-openstack/recipes-devtools/python/python-swift_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-swift_git.bb
@@ -30,6 +30,25 @@ inherit setuptools python-dir update-rc.d hosts identity
 # filesystem of must support xattrs. e.g ext4
 SWIFT_BACKING_FILE_SIZE ?= "2G"
 
+SERVICECREATE_PACKAGES = "${SRCNAME}-setup"
+KEYSTONE_HOST="${CONTROLLER_IP}"
+
+# USERCREATE_PARAM and SERVICECREATE_PARAM contain the list of parameters to be set.
+# If the flag for a parameter in the list is not set here, the default value will be given to that parameter.
+# Parameters not in the list will be set to empty.
+
+USERCREATE_PARAM_${SRCNAME}-setup = "name pass tenant role email"
+SERVICECREATE_PARAM_${SRCNAME}-setup = "name type description region publicurl adminurl internalurl"
+python () {
+    flags = {'type':'object-store',\
+             'description':'OpenStack object-store',\
+             'publicurl':"'http://${KEYSTONE_HOST}:8888/v1/AUTH_\$(tenant_id)s'",\
+             'adminurl':"'http://${KEYSTONE_HOST}:8888/v1'",\
+             'internalurl':"'http://${KEYSTONE_HOST}:8888/v1/AUTH_\$(tenant_id)s'"}
+
+    d.setVarFlags("SERVICECREATE_PARAM_%s-setup" % d.getVar('SRCNAME',True), flags)
+}
+
 do_install_append() {
     SWIFT_CONF_DIR=${D}${sysconfdir}/swift
 
diff --git a/meta-openstack/recipes-extended/images/openstack-image-controller.bb b/meta-openstack/recipes-extended/images/openstack-image-controller.bb
index 36b5b7a..d2cc90f 100644
--- a/meta-openstack/recipes-extended/images/openstack-image-controller.bb
+++ b/meta-openstack/recipes-extended/images/openstack-image-controller.bb
@@ -16,9 +16,11 @@ IMAGE_INSTALL = "\
     "
 
 IMAGE_FEATURES += " ssh-server-openssh"
+POST_KEYSTONE_SETUP_COMMAND = "/etc/keystone/hybrid-backend-setup"
 
 inherit core-image
 inherit openstack-base
+inherit identity
 
 # Ensure extra space for guest images, and rabbit MQ has a hard coded
 # check for 2G of free space, so we use 5G as a starting point.
diff --git a/meta-openstack/recipes-extended/tempest/tempest_git.bb b/meta-openstack/recipes-extended/tempest/tempest_git.bb
index ae388d9..3667635 100644
--- a/meta-openstack/recipes-extended/tempest/tempest_git.bb
+++ b/meta-openstack/recipes-extended/tempest/tempest_git.bb
@@ -21,6 +21,49 @@ SRCREV="6273339e2da725b01560b6a2db11a3bf7a6659d7"
 PV="2013.2+git${SRCPV}"
 S = "${WORKDIR}/git"
 
+SERVICECREATE_PACKAGES = "${SRCNAME}-setup ${SRCNAME}-setup-altdemo ${SRCNAME}-setup-admin"
+KEYSTONE_HOST="${CONTROLLER_IP}"
+
+# USERCREATE_PARAM and SERVICECREATE_PARAM contain the list of parameters to be set.
+# If the flag for a parameter in the list is not set here, the default value will be given to that parameter.
+# Parameters not in the list will be set to empty.
+
+# create demo user
+USERCREATE_PARAM_${SRCNAME}-setup = "name pass tenant role email"
+python () {
+    flags = {'name':'demo',\
+             'pass':'password',\
+             'tenant':'demo',\
+             'role':'${MEMBER_ROLE}',\
+             'email':'demo@domain.com',\
+            }
+    d.setVarFlags("USERCREATE_PARAM_%s-setup" % d.getVar('SRCNAME',True), flags)
+}
+
+# create alt-demo user
+USERCREATE_PARAM_${SRCNAME}-setup-altdemo = "name pass tenant role email"
+python () {
+    flags = {'name':'alt_demo',\
+             'pass':'password',\
+             'tenant':'alt_demo',\
+             'role':'${MEMBER_ROLE}',\
+             'email':'alt_demo@domain.com',\
+            }
+    d.setVarFlags("USERCREATE_PARAM_%s-setup-altdemo" % d.getVar('SRCNAME',True), flags)
+}
+
+# add admin user to demo tenant as admin role
+USERCREATE_PARAM_${SRCNAME}-setup-admin = "name pass tenant role email"
+python () {
+    flags = {'name':'${ADMIN_USER}',\
+             'pass':'${ADMIN_PASSWORD}',\
+             'tenant':'demo',\
+             'role':'${ADMIN_ROLE}',\
+             'email':'${ADMIN_USER_EMAIL}',\
+            }
+    d.setVarFlags("USERCREATE_PARAM_%s-setup-admin" % d.getVar('SRCNAME',True), flags)
+}
+
 do_install_append() {
     TEMPLATE_CONF_DIR=${S}${sysconfdir}/
     TEMPEST_CONF_DIR=${D}${sysconfdir}/${SRCNAME}
@@ -60,15 +103,27 @@ do_install_append() {
     cp -r tools ${TEMPEST_CONF_DIR}
 }
 
-PACKAGES =+ "${SRCNAME}-tests"
+PACKAGES =+ "${SRCNAME}-tests \
+             ${SRCNAME}-setup \
+             ${SRCNAME}-setup-altdemo \
+             ${SRCNAME}-setup-admin \
+             "
 
 FILES_${SRCNAME}-tests = "${sysconfdir}/${SRCNAME}/tests/*"
 
 FILES_${PN} = "${libdir}/* \
                ${sysconfdir}/* \
 "
+
+ALLOW_EMPTY_${SRCNAME}-setup = "1"
+ALLOW_EMPTY_${SRCNAME}-setup-altdemo = "1"
+ALLOW_EMPTY_${SRCNAME}-setup-admin = "1"
+
 RDEPENDS_${PN} += " \
         ${SRCNAME}-tests \
+        ${SRCNAME}-setup \
+        ${SRCNAME}-setup-altdemo \
+        ${SRCNAME}-setup-admin \
         python-mox \
         python-mock \
         python-hp3parclient \