openstack
/
openstack-manuals
Code Issues Proposed changes
openstack-manuals/doc/install-guide-debconf/source/keystone-install.rst

5.0 KiB
Raw Blame History

Install and configure

This section describes how to install and configure the OpenStack Identity service, code-named keystone, on the controller node. For performance, this configuration deploys Fernet tokens and the Apache HTTP server to handle requests.

Install and configure the components

  1. Run the following command to install the packages:

    # apt-get install keystone

  2. Respond to prompts for debconf/debconf-dbconfig-common, which will fill the below database access directive.

    [database]
...
connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone

    If you decide to not use dbconfig-common, then you have to create the database and manage its access rights yourself, and run the following by hand.

    # keystone-manage db_sync

  3. Generate a random value to use as the administration token during initial configuration:

    $ openssl rand -hex 10

  4. Configure the initial administration token:

    image

    Use the random value that you generated in a previous step. If you install using non-interactive mode or you do not specify this token, the configuration tool generates a random value.

    Later on, the package will configure the below directive with the value you entered:

    [DEFAULT]
...
admin_token = ADMIN_TOKEN

  5. Create the admin project and user:

    During the final stage of the package installation, it is possible to automatically create an admin and service project, and an admin user. This can later be used for other OpenStack services to contact the Identity service. This is the equivalent of running the below commands:

    # openstack --os-token ${AUTH_TOKEN} \
  --os-url=http://127.0.0.1:35357/v3/ \
  --os-domain-name default \
  --os-identity-api-version=3 \
  project create --or-show \
  admin --domain default \
  --description "Default Debian admin project"

# openstack --os-token ${AUTH_TOKEN} \
  --os-url=http://127.0.0.1:35357/v3/ \
  --os-domain-name default \
  --os-identity-api-version=3 \
  project create --or-show \
  service --domain default \
  --description "Default Debian admin project"

# openstack --os-token ${AUTH_TOKEN} \
  --os-url=http://127.0.0.1:35357/v3/ \
  --os-domain-name default \
  --os-identity-api-version=3 \
  user create --or-show \
  --password ADMIN_PASS \
  --project admin \
  --email root@localhost \
  --enable \
  admin \
  --domain default \
  --description "Default Debian admin user"

# openstack --os-token ${AUTH_TOKEN} \
  --os-url=http://127.0.0.1:35357/v3/ \
  --os-domain-name default \
  --os-identity-api-version=3 \
  role create --or-show admin

# openstack  --os-token ${AUTH_TOKEN} \
  --os-url=http://127.0.0.1:35357/v3/ \
  --os-domain-name default \
  --os-identity-api-version=3 \
  role add --project admin --user admin admin

    image

    image

    image

    image

    image

    In Debian, the Keystone package offers automatic registration of Keystone in the service catalogue. This is equivalent of running the below commands:

    # openstack --os-token ${AUTH_TOKEN} \
  --os-url=http://127.0.0.1:35357/v3/ \
  --os-domain-name default \
  --os-identity-api-version=3 \
  service create \
  --name keystone \
  --description "OpenStack Identity" \
  identity

# openstack --os-token ${AUTH_TOKEN} \
  --os-url=http://127.0.0.1:35357/v3/ \
  --os-domain-name default \
  --os-identity-api-version=3 \
  keystone public http://controller:5000/v2.0

# openstack --os-token ${AUTH_TOKEN} \
  --os-url=http://127.0.0.1:35357/v3/ \
  --os-domain-name default \
  --os-identity-api-version=3 \
  keystone internal http://controller:5000/v2.0

# openstack --os-token ${AUTH_TOKEN} \
  --os-url=http://127.0.0.1:35357/v3/ \
  --os-domain-name default \
  --os-identity-api-version=3 \
  keystone admin http://controller:35357/v2.0

    image