openstack/openstack-manuals
Code Issues Proposed changes
6388b918c7
openstack-manuals/doc/install-guide-debconf/source/keystone-install.rst
Andreas Jaeger 2d44b2b36d Prepare for Sphinx 1.5 
The new sphinx version introduces some changes that break build:

* Warns if code cannot be parsed for highlighting. Fix the code so
  that it can be parsed, this includes uncommenting "..." lines.
  Note that not every config file is an ini-file.
  Also, the parser seems to have bugs and cannot parse all files.
  Fix mysql ini file and enable the parameter, see
http://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_file_per_table
* :option: works only with declared options, replace useage with
  simple ``.

This change only handles a few files, more to come later.

Change-Id: I7c7335e514581622dd562ee355f62d6ae1beaa18
2017-01-11 20:37:55 +01:00

5.0 KiB
Raw Blame History

Install and configure

This section describes how to install and configure the OpenStack Identity service, code-named keystone, on the controller node. For performance, this configuration deploys Fernet tokens and the Apache HTTP server to handle requests.

Install and configure the components

  1. Run the following command to install the packages:

    # apt-get install keystone

  2. Respond to prompts for debconf/debconf-dbconfig-common, which will fill the below database access directive.

    [database]
# ...
connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone

    If you decide to not use dbconfig-common, then you have to create the database and manage its access rights yourself, and run the following by hand.

    # keystone-manage db_sync

  3. Generate a random value to use as the administration token during initial configuration:

    $ openssl rand -hex 10

  4. Configure the initial administration token:

    image

    Use the random value that you generated in a previous step. If you install using non-interactive mode or you do not specify this token, the configuration tool generates a random value.

    Later on, the package will configure the below directive with the value you entered:

    [DEFAULT]
# ...
admin_token = ADMIN_TOKEN

  5. Create the admin project and user:

    During the final stage of the package installation, it is possible to automatically create an admin and service project, and an admin user. This can later be used for other OpenStack services to contact the Identity service. This is the equivalent of running the below commands:

    # export OS_BOOTSTRAP_USERNAME=${ADMIN_USER_NAME}

# export OS_BOOTSTRAP_PROJECT_NAME=${ADMIN_TENANT_NAME}

# export OS_BOOTSTRAP_PASSWORD=${ADMIN_USER_PW}

# keystone-manage bootstrap

# export OS_PROJECT_DOMAIN_ID=default

# export OS_USER_DOMAIN_ID=default

# export OS_USERNAME=admin

# export OS_PASSWORD=${ADMIN_USER_PW}

# export OS_TENANT_NAME=${ADMIN_TENANT_NAME}

# export OS_PROJECT_NAME=${ADMIN_TENANT_NAME}

# export OS_AUTH_URL=http://127.0.0.1:35357/v3/

# export OS_IDENTITY_API_VERSION=3

# export OS_AUTH_VERSION=3

# export OS_PROJECT_DOMAIN_ID=default

# export OS_USER_DOMAIN_ID=default

# export OS_NO_CACHE=1

# openstack project set \
  --description "Default Debian admin project" \
  $ADMIN_TENANT_NAME

# openstack project create --or-show service \
  --description "Default Debian service project"

# openstack user set \
  --description "Default Debian admin user" \
  --email ${ADMIN_USER_EMAIL} \
  --enable $ADMIN_USER_NAME

    The Keystone package will then create roles for admin, KeystoneAdmin, KeystoneServiceAdmin, heat_stack_owner, Member and ResellerAdmin, and will add them to the admin project. For each of these, it is equivalent to:

    # openstack role create --or-show FOO

# openstack role add --project admin \
  --user admin FOO

    image

    image

    image

    image

    image

  6. Register the keystone endpoint

    In Debian, the Keystone package offers automatic registration of Keystone in the service catalogue. This is equivalent of running the below commands:

    # OS_TOKEN=`openstack token issue -c id -f value` \
  openstack service create \
  --os-url=http://127.0.0.1:35357/v3/ \
  --name keystone \
  --description "OpenStack Identity" \
  identity

# OS_TOKEN=`openstack token issue -c id -f value`
  openstack endpoint create \
  --os-url=http://127.0.0.1:35357/v3/ \
  keystone public http://controller:5000/v2.0

# OS_TOKEN=`openstack token issue -c id -f value`
  openstack endpoint create \
  --os-url=http://127.0.0.1:5000/v3/ \
  keystone internal http://controller:5000/v2.0

# OS_TOKEN=`openstack token issue -c id -f value`
  openstack endpoint create \
  --os-url=http://127.0.0.1:35357/v3/ \
  keystone admin http://controller:35357/v2.0

    image