keystone-manage administration command
keystone-manage performs administrative operations using the configured
database, admin interface, key repositories, or distributed-storage endpoint.
keystone-manage --config /etc/keystone/keystone.conf <command>
| Command | Purpose |
|---|---|
bootstrap | Create or update the initial domain, project, user, roles, assignments, and optional catalog endpoints. |
catalog service | Create, list, show, update, or delete catalog services. |
catalog endpoint | Create, list, show, update, or delete catalog endpoints. |
| `credential setup | migrate |
| `db sync | up |
oauth2 ensure-signing-key | Provision a missing domain signing key. |
| `oauth2 rotate-signing-key | confirm-rotate-signing-key` |
| `oauth2 list-local-emergency-candidates | reconcile-local-emergency-key` |
| `storage init | join |
| `storage backup | restore |
| `storage rotate-dek | confirm-rotate-dek` |
| `storage list-dek-local-emergency-candidates | reconcile-dek-local-emergency` |
| `token setup | rotate` |
Use <command> --help before execution. Follow the linked administrator runbook
for Fernet tokens,
OAuth2/OIDC, or
distributed storage; command help describes
syntax, while the runbook describes ordering and safety constraints.