Fix installation of keystone in debian and ubuntu
Following the separation of the Debconf install guide, this patch updates the installation procedure for Keystone in both Debian and Ubuntu. Both distros aren't providing startup files anymore, as upstream removed support for eventlet: both Debian and Ubuntu are now providing a directly useable keystone Apache2 configuration, though only Debian goes the extra mile and activates wgsi + keystone automatically in the postinst script. Change-Id: I9a2c973a28801b61e7617a889961bcbf66307482
This commit is contained in:
Thomas Goirand
parent
5ba05882d1
commit
1f60595fde
@ -8,8 +8,6 @@ Identity service, code-named keystone, on the controller node. For
|
|||||||
performance, this configuration deploys Fernet tokens and the Apache
|
performance, this configuration deploys Fernet tokens and the Apache
|
||||||
HTTP server to handle requests.
|
HTTP server to handle requests.
|
||||||
|
|
||||||
.. only:: obs or rdo or ubuntu
|
|
||||||
|
|
||||||
Prerequisites
|
Prerequisites
|
||||||
-------------
|
-------------
|
||||||
|
|
||||||
@ -51,13 +49,13 @@ HTTP server to handle requests.
|
|||||||
|
|
||||||
$ openssl rand -hex 10
|
$ openssl rand -hex 10
|
||||||
|
|
||||||
.. only:: obs or rdo or ubuntu
|
|
||||||
|
|
||||||
Install and configure components
|
Install and configure components
|
||||||
--------------------------------
|
--------------------------------
|
||||||
|
|
||||||
.. include:: shared/note_configuration_vary_by_distribution.rst
|
.. include:: shared/note_configuration_vary_by_distribution.rst
|
||||||
|
|
||||||
|
.. only:: obs or rdo
|
||||||
|
|
||||||
.. note::
|
.. note::
|
||||||
|
|
||||||
This guide uses the Apache HTTP server with ``mod_wsgi`` to serve
|
This guide uses the Apache HTTP server with ``mod_wsgi`` to serve
|
||||||
@ -65,22 +63,21 @@ HTTP server to handle requests.
|
|||||||
keystone service still listens on these ports. Therefore, this guide
|
keystone service still listens on these ports. Therefore, this guide
|
||||||
manually disables the keystone service.
|
manually disables the keystone service.
|
||||||
|
|
||||||
.. only:: ubuntu
|
.. only:: ubuntu or debian
|
||||||
|
|
||||||
#. Disable the keystone service from starting automatically after
|
.. note::
|
||||||
installation:
|
|
||||||
|
|
||||||
.. code-block:: console
|
This guide uses the Apache HTTP server with ``mod_wsgi`` to serve
|
||||||
|
Identity service requests on ports 5000 and 35357. By default, the
|
||||||
# echo "manual" > /etc/init/keystone.override
|
keystone service still listens on these ports. The package handles
|
||||||
|
all of the Apache configuration for you (including the activation of
|
||||||
|
the ``mod_wsgi`` apache2 module and keystone configuration in Apache).
|
||||||
|
|
||||||
#. Run the following command to install the packages:
|
#. Run the following command to install the packages:
|
||||||
|
|
||||||
.. only:: ubuntu
|
|
||||||
|
|
||||||
.. code-block:: console
|
.. code-block:: console
|
||||||
|
|
||||||
# apt-get install keystone apache2 libapache2-mod-wsgi
|
# apt-get install keystone
|
||||||
|
|
||||||
.. only:: obs or rdo
|
.. only:: obs or rdo
|
||||||
|
|
||||||
@ -98,9 +95,7 @@ HTTP server to handle requests.
|
|||||||
|
|
||||||
# zypper install openstack-keystone apache2-mod_wsgi
|
# zypper install openstack-keystone apache2-mod_wsgi
|
||||||
|
|
||||||
.. only:: obs or rdo or ubuntu
|
2. Edit the ``/etc/keystone/keystone.conf`` file and complete the following
|
||||||
|
|
||||||
3. Edit the ``/etc/keystone/keystone.conf`` file and complete the following
|
|
||||||
actions:
|
actions:
|
||||||
|
|
||||||
* In the ``[DEFAULT]`` section, define the value of the initial
|
* In the ``[DEFAULT]`` section, define the value of the initial
|
||||||
@ -133,9 +128,7 @@ HTTP server to handle requests.
|
|||||||
...
|
...
|
||||||
provider = fernet
|
provider = fernet
|
||||||
|
|
||||||
.. only:: rdo or ubuntu or obs
|
3. Populate the Identity service database:
|
||||||
|
|
||||||
4. Populate the Identity service database:
|
|
||||||
|
|
||||||
.. code-block:: console
|
.. code-block:: console
|
||||||
|
|
||||||
@ -145,168 +138,12 @@ HTTP server to handle requests.
|
|||||||
|
|
||||||
Ignore any deprecation messages in this output.
|
Ignore any deprecation messages in this output.
|
||||||
|
|
||||||
5. Initialize Fernet keys:
|
4. Initialize Fernet keys:
|
||||||
|
|
||||||
.. code-block:: console
|
.. code-block:: console
|
||||||
|
|
||||||
# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
|
# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
|
||||||
|
|
||||||
.. only:: debian
|
|
||||||
|
|
||||||
Install and configure the components
|
|
||||||
------------------------------------
|
|
||||||
|
|
||||||
#. Run the following command to install the packages:
|
|
||||||
|
|
||||||
.. code-block:: console
|
|
||||||
|
|
||||||
# apt-get install keystone
|
|
||||||
|
|
||||||
#. Respond to prompts for debconf,
|
|
||||||
which will fill the below database access directive.
|
|
||||||
|
|
||||||
.. :doc:`debconf/debconf-dbconfig-common`,
|
|
||||||
which will fill the below database access directive.
|
|
||||||
|
|
||||||
.. code-block:: ini
|
|
||||||
|
|
||||||
[database]
|
|
||||||
...
|
|
||||||
connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone
|
|
||||||
|
|
||||||
If you decide to not use ``dbconfig-common``, then you have to
|
|
||||||
create the database and manage its access rights yourself, and run the
|
|
||||||
following by hand.
|
|
||||||
|
|
||||||
.. code-block:: console
|
|
||||||
|
|
||||||
# keystone-manage db_sync
|
|
||||||
|
|
||||||
#. Generate a random value to use as the administration token during
|
|
||||||
initial configuration:
|
|
||||||
|
|
||||||
.. code-block:: console
|
|
||||||
|
|
||||||
$ openssl rand -hex 10
|
|
||||||
|
|
||||||
#. Configure the initial administration token:
|
|
||||||
|
|
||||||
.. image:: figures/debconf-screenshots/keystone_1_admin_token.png
|
|
||||||
:scale: 50
|
|
||||||
|
|
||||||
Use the random value that you generated in a previous step. If you
|
|
||||||
install using non-interactive mode or you do not specify this token, the
|
|
||||||
configuration tool generates a random value.
|
|
||||||
|
|
||||||
Later on, the package will configure the below directive with the value
|
|
||||||
you entered:
|
|
||||||
|
|
||||||
.. code-block:: ini
|
|
||||||
|
|
||||||
[DEFAULT]
|
|
||||||
...
|
|
||||||
admin_token = ADMIN_TOKEN
|
|
||||||
|
|
||||||
#. Create the ``admin`` project and user:
|
|
||||||
|
|
||||||
During the final stage of the package installation, it is possible to
|
|
||||||
automatically create an ``admin`` and ``service`` project, and an ``admin`` user.
|
|
||||||
This can later be used for other OpenStack services to contact the
|
|
||||||
Identity service. This is the equivalent of running the below commands:
|
|
||||||
|
|
||||||
.. code-block:: console
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
project create --or-show \
|
|
||||||
admin --domain default \
|
|
||||||
--description "Default Debian admin project"
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
project create --or-show \
|
|
||||||
service --domain default \
|
|
||||||
--description "Default Debian admin project"
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
user create --or-show \
|
|
||||||
--password ADMIN_PASS \
|
|
||||||
--project admin \
|
|
||||||
--email root@localhost \
|
|
||||||
--enable \
|
|
||||||
admin \
|
|
||||||
--domain default \
|
|
||||||
--description "Default Debian admin user"
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
role create --or-show admin
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
role add --project admin --user admin admin
|
|
||||||
|
|
||||||
.. image:: figures/debconf-screenshots/keystone_2_register_admin_tenant_yes_no.png
|
|
||||||
:scale: 50
|
|
||||||
|
|
||||||
.. image:: figures/debconf-screenshots/keystone_3_admin_user_name.png
|
|
||||||
:scale: 50
|
|
||||||
|
|
||||||
.. image:: figures/debconf-screenshots/keystone_4_admin_user_email.png
|
|
||||||
:scale: 50
|
|
||||||
|
|
||||||
.. image:: figures/debconf-screenshots/keystone_5_admin_user_pass.png
|
|
||||||
:scale: 50
|
|
||||||
|
|
||||||
.. image:: figures/debconf-screenshots/keystone_6_admin_user_pass_confirm.png
|
|
||||||
:scale: 50
|
|
||||||
|
|
||||||
In Debian, the Keystone package offers automatic registration of
|
|
||||||
Keystone in the service catalogue. This is equivalent of running the
|
|
||||||
below commands:
|
|
||||||
|
|
||||||
.. code-block:: console
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
service create \
|
|
||||||
--name keystone \
|
|
||||||
--description "OpenStack Identity" \
|
|
||||||
identity
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
keystone public http://controller:5000/v2.0
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
keystone internal http://controller:5000/v2.0
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
keystone admin http://controller:35357/v2.0
|
|
||||||
|
|
||||||
.. image:: figures/debconf-screenshots/keystone_7_register_endpoint.png
|
|
||||||
|
|
||||||
.. only:: obs or rdo or ubuntu
|
.. only:: obs or rdo or ubuntu
|
||||||
|
|
||||||
Configure the Apache HTTP server
|
Configure the Apache HTTP server
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user