As part of the docs consolidation effort, move the SSL recommendation to the installation guides for each distro. This also corrects the wording: "running in a web server" is not necessarily secure on its own, the web server must be configured to use SSL. Change-Id: If0b547680cbbea4c7f29d82de3f4fe96bd14b4ec
6.2 KiB
Install and configure
This section describes how to install and configure the OpenStack Identity service, code-named keystone, on the controller node. For scalability purposes, this configuration deploys Fernet tokens and the Apache HTTP server to handle requests.
Note
Ensure that you have completed the prerequisite installation steps in the Openstack Install Guide before proceeding.
Prerequisites
Before you install and configure the Identity service, you must create a database.
Note
Before you begin, ensure you have the most recent version of
python-pyasn1
installed.
Use the database access client to connect to the database server as the
root
user:$ mysql -u root -p
Create the
keystone
database:MariaDB [(none)]> CREATE DATABASE keystone;
Grant proper access to the
keystone
database:MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \ IDENTIFIED BY 'KEYSTONE_DBPASS'; MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \ IDENTIFIED BY 'KEYSTONE_DBPASS';
Replace
KEYSTONE_DBPASS
with a suitable password.Exit the database access client.
Install and configure components
Note
Starting with the Newton release, SUSE OpenStack packages are
shipping with the upstream default configuration files. For example
/etc/keystone/keystone.conf
, with customizations in
/etc/keystone/keystone.conf.d/010-keystone.conf
. While the
following instructions modify the default configuration file, adding a
new file in /etc/keystone/keystone.conf.d
achieves the same
result.
Run the following command to install the packages:
# zypper install openstack-keystone apache2 apache2-mod_wsgi
Edit the
/etc/keystone/keystone.conf
file and complete the following actions:In the
[database]
section, configure database access:[database] # ... connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone
Replace
KEYSTONE_DBPASS
with the password you chose for the database.Note
Comment out or remove any other
connection
options in the[database]
section.In the
[token]
section, configure the Fernet token provider:[token] # ... provider = fernet
Populate the Identity service database:
# su -s /bin/sh -c "keystone-manage db_sync" keystone
Initialize Fernet key repositories:
# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone # keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
Bootstrap the Identity service:
Note
Before the Queens release, keystone needed to be run on two separate ports to accommodate the Identity v2 API which ran a separate admin-only service commonly on port 35357. With the removal of the v2 API, keystone can be run on the same port for all interfaces.
# keystone-manage bootstrap --bootstrap-password ADMIN_PASS \ --bootstrap-admin-url http://controller:5000/v3/ \ --bootstrap-internal-url http://controller:5000/v3/ \ --bootstrap-public-url http://controller:5000/v3/ \ --bootstrap-region-id RegionOne
Replace
ADMIN_PASS
with a suitable password for an administrative user.
Configure the Apache HTTP server
Edit the
/etc/sysconfig/apache2
file and configure theAPACHE_SERVERNAME
option to reference the controller node:APACHE_SERVERNAME="controller"
Create the
/etc/apache2/conf.d/wsgi-keystone.conf
file with the following content:5000 Listen <VirtualHost *:5000> =keystone group=keystone display-name=%{GROUP} WSGIDaemonProcess keystone-public processes=5 threads=1 user WSGIProcessGroup keystone-public WSGIScriptAlias / /usr/bin/keystone-wsgi-public WSGIApplicationGroup %{GLOBAL} WSGIPassAuthorization On ErrorLogFormat "%{cu}t %M" /var/log/apache2/keystone.log ErrorLog /var/log/apache2/keystone_access.log combined CustomLog <Directory /usr/bin> all granted Require</Directory> </VirtualHost>
Recursively change the ownership of the
/etc/keystone
directory:# chown -R keystone:keystone /etc/keystone
SSL
A secure deployment should have the web server configured to use SSL or running behind an SSL terminator.
Finalize the installation
Start the Apache HTTP service and configure it to start when the system boots:
# systemctl enable apache2.service # systemctl start apache2.service
Configure the administrative account
$ export OS_USERNAME=admin $ export OS_PASSWORD=ADMIN_PASS $ export OS_PROJECT_NAME=admin $ export OS_USER_DOMAIN_NAME=Default $ export OS_PROJECT_DOMAIN_NAME=Default $ export OS_AUTH_URL=http://controller:5000/v3 $ export OS_IDENTITY_API_VERSION=3
Replace
ADMIN_PASS
with the password used in thekeystone-manage bootstrap
command in keystone-install-configure-obs.