Fix installation of keystone in debian and ubuntu
Following the separation of the Debconf install guide, this patch updates the installation procedure for Keystone in both Debian and Ubuntu. Both distros aren't providing startup files anymore, as upstream removed support for eventlet: both Debian and Ubuntu are now providing a directly useable keystone Apache2 configuration, though only Debian goes the extra mile and activates wgsi + keystone automatically in the postinst script. Change-Id: I9a2c973a28801b61e7617a889961bcbf66307482
This commit is contained in:
Thomas Goirand
parent
5ba05882d1
commit
1f60595fde
@ -8,55 +8,53 @@ Identity service, code-named keystone, on the controller node. For
|
|||||||
performance, this configuration deploys Fernet tokens and the Apache
|
performance, this configuration deploys Fernet tokens and the Apache
|
||||||
HTTP server to handle requests.
|
HTTP server to handle requests.
|
||||||
|
|
||||||
.. only:: obs or rdo or ubuntu
|
Prerequisites
|
||||||
|
-------------
|
||||||
|
|
||||||
Prerequisites
|
Before you configure the OpenStack Identity service, you must create a
|
||||||
-------------
|
database and an administration token.
|
||||||
|
|
||||||
Before you configure the OpenStack Identity service, you must create a
|
#. To create the database, complete the following actions:
|
||||||
database and an administration token.
|
|
||||||
|
|
||||||
#. To create the database, complete the following actions:
|
* Use the database access client to connect to the database server as the
|
||||||
|
``root`` user:
|
||||||
|
|
||||||
* Use the database access client to connect to the database server as the
|
.. code-block:: console
|
||||||
``root`` user:
|
|
||||||
|
|
||||||
.. code-block:: console
|
$ mysql -u root -p
|
||||||
|
|
||||||
$ mysql -u root -p
|
* Create the ``keystone`` database:
|
||||||
|
|
||||||
* Create the ``keystone`` database:
|
.. code-block:: console
|
||||||
|
|
||||||
.. code-block:: console
|
CREATE DATABASE keystone;
|
||||||
|
|
||||||
CREATE DATABASE keystone;
|
* Grant proper access to the ``keystone`` database:
|
||||||
|
|
||||||
* Grant proper access to the ``keystone`` database:
|
.. code-block:: console
|
||||||
|
|
||||||
.. code-block:: console
|
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \
|
||||||
|
IDENTIFIED BY 'KEYSTONE_DBPASS';
|
||||||
|
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \
|
||||||
|
IDENTIFIED BY 'KEYSTONE_DBPASS';
|
||||||
|
|
||||||
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \
|
Replace ``KEYSTONE_DBPASS`` with a suitable password.
|
||||||
IDENTIFIED BY 'KEYSTONE_DBPASS';
|
|
||||||
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \
|
|
||||||
IDENTIFIED BY 'KEYSTONE_DBPASS';
|
|
||||||
|
|
||||||
Replace ``KEYSTONE_DBPASS`` with a suitable password.
|
* Exit the database access client.
|
||||||
|
|
||||||
* Exit the database access client.
|
#. Generate a random value to use as the administration token during
|
||||||
|
initial configuration:
|
||||||
|
|
||||||
#. Generate a random value to use as the administration token during
|
.. code-block:: console
|
||||||
initial configuration:
|
|
||||||
|
|
||||||
.. code-block:: console
|
$ openssl rand -hex 10
|
||||||
|
|
||||||
$ openssl rand -hex 10
|
Install and configure components
|
||||||
|
--------------------------------
|
||||||
|
|
||||||
.. only:: obs or rdo or ubuntu
|
.. include:: shared/note_configuration_vary_by_distribution.rst
|
||||||
|
|
||||||
Install and configure components
|
.. only:: obs or rdo
|
||||||
--------------------------------
|
|
||||||
|
|
||||||
.. include:: shared/note_configuration_vary_by_distribution.rst
|
|
||||||
|
|
||||||
.. note::
|
.. note::
|
||||||
|
|
||||||
@ -65,96 +63,15 @@ HTTP server to handle requests.
|
|||||||
keystone service still listens on these ports. Therefore, this guide
|
keystone service still listens on these ports. Therefore, this guide
|
||||||
manually disables the keystone service.
|
manually disables the keystone service.
|
||||||
|
|
||||||
.. only:: ubuntu
|
.. only:: ubuntu or debian
|
||||||
|
|
||||||
#. Disable the keystone service from starting automatically after
|
.. note::
|
||||||
installation:
|
|
||||||
|
|
||||||
.. code-block:: console
|
This guide uses the Apache HTTP server with ``mod_wsgi`` to serve
|
||||||
|
Identity service requests on ports 5000 and 35357. By default, the
|
||||||
# echo "manual" > /etc/init/keystone.override
|
keystone service still listens on these ports. The package handles
|
||||||
|
all of the Apache configuration for you (including the activation of
|
||||||
#. Run the following command to install the packages:
|
the ``mod_wsgi`` apache2 module and keystone configuration in Apache).
|
||||||
|
|
||||||
.. only:: ubuntu
|
|
||||||
|
|
||||||
.. code-block:: console
|
|
||||||
|
|
||||||
# apt-get install keystone apache2 libapache2-mod-wsgi
|
|
||||||
|
|
||||||
.. only:: obs or rdo
|
|
||||||
|
|
||||||
#. Run the following command to install the packages:
|
|
||||||
|
|
||||||
.. only:: rdo
|
|
||||||
|
|
||||||
.. code-block:: console
|
|
||||||
|
|
||||||
# yum install openstack-keystone httpd mod_wsgi
|
|
||||||
|
|
||||||
.. only:: obs
|
|
||||||
|
|
||||||
.. code-block:: console
|
|
||||||
|
|
||||||
# zypper install openstack-keystone apache2-mod_wsgi
|
|
||||||
|
|
||||||
.. only:: obs or rdo or ubuntu
|
|
||||||
|
|
||||||
3. Edit the ``/etc/keystone/keystone.conf`` file and complete the following
|
|
||||||
actions:
|
|
||||||
|
|
||||||
* In the ``[DEFAULT]`` section, define the value of the initial
|
|
||||||
administration token:
|
|
||||||
|
|
||||||
.. code-block:: ini
|
|
||||||
|
|
||||||
[DEFAULT]
|
|
||||||
...
|
|
||||||
admin_token = ADMIN_TOKEN
|
|
||||||
|
|
||||||
Replace ``ADMIN_TOKEN`` with the random value that you generated in a
|
|
||||||
previous step.
|
|
||||||
|
|
||||||
* In the ``[database]`` section, configure database access:
|
|
||||||
|
|
||||||
.. code-block:: ini
|
|
||||||
|
|
||||||
[database]
|
|
||||||
...
|
|
||||||
connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone
|
|
||||||
|
|
||||||
Replace ``KEYSTONE_DBPASS`` with the password you chose for the database.
|
|
||||||
|
|
||||||
* In the ``[token]`` section, configure the Fernet token provider:
|
|
||||||
|
|
||||||
.. code-block:: ini
|
|
||||||
|
|
||||||
[token]
|
|
||||||
...
|
|
||||||
provider = fernet
|
|
||||||
|
|
||||||
.. only:: rdo or ubuntu or obs
|
|
||||||
|
|
||||||
4. Populate the Identity service database:
|
|
||||||
|
|
||||||
.. code-block:: console
|
|
||||||
|
|
||||||
# su -s /bin/sh -c "keystone-manage db_sync" keystone
|
|
||||||
|
|
||||||
.. note::
|
|
||||||
|
|
||||||
Ignore any deprecation messages in this output.
|
|
||||||
|
|
||||||
5. Initialize Fernet keys:
|
|
||||||
|
|
||||||
.. code-block:: console
|
|
||||||
|
|
||||||
# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
|
|
||||||
|
|
||||||
.. only:: debian
|
|
||||||
|
|
||||||
Install and configure the components
|
|
||||||
------------------------------------
|
|
||||||
|
|
||||||
#. Run the following command to install the packages:
|
#. Run the following command to install the packages:
|
||||||
|
|
||||||
@ -162,150 +79,70 @@ HTTP server to handle requests.
|
|||||||
|
|
||||||
# apt-get install keystone
|
# apt-get install keystone
|
||||||
|
|
||||||
#. Respond to prompts for debconf,
|
.. only:: obs or rdo
|
||||||
which will fill the below database access directive.
|
|
||||||
|
|
||||||
.. :doc:`debconf/debconf-dbconfig-common`,
|
#. Run the following command to install the packages:
|
||||||
which will fill the below database access directive.
|
|
||||||
|
|
||||||
.. code-block:: ini
|
.. only:: rdo
|
||||||
|
|
||||||
[database]
|
.. code-block:: console
|
||||||
...
|
|
||||||
connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone
|
|
||||||
|
|
||||||
If you decide to not use ``dbconfig-common``, then you have to
|
# yum install openstack-keystone httpd mod_wsgi
|
||||||
create the database and manage its access rights yourself, and run the
|
|
||||||
following by hand.
|
|
||||||
|
|
||||||
.. code-block:: console
|
.. only:: obs
|
||||||
|
|
||||||
# keystone-manage db_sync
|
.. code-block:: console
|
||||||
|
|
||||||
#. Generate a random value to use as the administration token during
|
# zypper install openstack-keystone apache2-mod_wsgi
|
||||||
initial configuration:
|
|
||||||
|
|
||||||
.. code-block:: console
|
2. Edit the ``/etc/keystone/keystone.conf`` file and complete the following
|
||||||
|
actions:
|
||||||
|
|
||||||
$ openssl rand -hex 10
|
* In the ``[DEFAULT]`` section, define the value of the initial
|
||||||
|
administration token:
|
||||||
|
|
||||||
#. Configure the initial administration token:
|
.. code-block:: ini
|
||||||
|
|
||||||
.. image:: figures/debconf-screenshots/keystone_1_admin_token.png
|
[DEFAULT]
|
||||||
:scale: 50
|
...
|
||||||
|
admin_token = ADMIN_TOKEN
|
||||||
|
|
||||||
Use the random value that you generated in a previous step. If you
|
Replace ``ADMIN_TOKEN`` with the random value that you generated in a
|
||||||
install using non-interactive mode or you do not specify this token, the
|
previous step.
|
||||||
configuration tool generates a random value.
|
|
||||||
|
|
||||||
Later on, the package will configure the below directive with the value
|
* In the ``[database]`` section, configure database access:
|
||||||
you entered:
|
|
||||||
|
|
||||||
.. code-block:: ini
|
.. code-block:: ini
|
||||||
|
|
||||||
[DEFAULT]
|
[database]
|
||||||
...
|
...
|
||||||
admin_token = ADMIN_TOKEN
|
connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone
|
||||||
|
|
||||||
#. Create the ``admin`` project and user:
|
Replace ``KEYSTONE_DBPASS`` with the password you chose for the database.
|
||||||
|
|
||||||
During the final stage of the package installation, it is possible to
|
* In the ``[token]`` section, configure the Fernet token provider:
|
||||||
automatically create an ``admin`` and ``service`` project, and an ``admin`` user.
|
|
||||||
This can later be used for other OpenStack services to contact the
|
|
||||||
Identity service. This is the equivalent of running the below commands:
|
|
||||||
|
|
||||||
.. code-block:: console
|
.. code-block:: ini
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
[token]
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
...
|
||||||
--os-domain-name default \
|
provider = fernet
|
||||||
--os-identity-api-version=3 \
|
|
||||||
project create --or-show \
|
|
||||||
admin --domain default \
|
|
||||||
--description "Default Debian admin project"
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
3. Populate the Identity service database:
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
project create --or-show \
|
|
||||||
service --domain default \
|
|
||||||
--description "Default Debian admin project"
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
.. code-block:: console
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
user create --or-show \
|
|
||||||
--password ADMIN_PASS \
|
|
||||||
--project admin \
|
|
||||||
--email root@localhost \
|
|
||||||
--enable \
|
|
||||||
admin \
|
|
||||||
--domain default \
|
|
||||||
--description "Default Debian admin user"
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
# su -s /bin/sh -c "keystone-manage db_sync" keystone
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
role create --or-show admin
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
.. note::
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
role add --project admin --user admin admin
|
|
||||||
|
|
||||||
.. image:: figures/debconf-screenshots/keystone_2_register_admin_tenant_yes_no.png
|
Ignore any deprecation messages in this output.
|
||||||
:scale: 50
|
|
||||||
|
|
||||||
.. image:: figures/debconf-screenshots/keystone_3_admin_user_name.png
|
4. Initialize Fernet keys:
|
||||||
:scale: 50
|
|
||||||
|
|
||||||
.. image:: figures/debconf-screenshots/keystone_4_admin_user_email.png
|
.. code-block:: console
|
||||||
:scale: 50
|
|
||||||
|
|
||||||
.. image:: figures/debconf-screenshots/keystone_5_admin_user_pass.png
|
# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
|
||||||
:scale: 50
|
|
||||||
|
|
||||||
.. image:: figures/debconf-screenshots/keystone_6_admin_user_pass_confirm.png
|
|
||||||
:scale: 50
|
|
||||||
|
|
||||||
In Debian, the Keystone package offers automatic registration of
|
|
||||||
Keystone in the service catalogue. This is equivalent of running the
|
|
||||||
below commands:
|
|
||||||
|
|
||||||
.. code-block:: console
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
service create \
|
|
||||||
--name keystone \
|
|
||||||
--description "OpenStack Identity" \
|
|
||||||
identity
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
keystone public http://controller:5000/v2.0
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
keystone internal http://controller:5000/v2.0
|
|
||||||
|
|
||||||
# openstack --os-token ${AUTH_TOKEN} \
|
|
||||||
--os-url=http://127.0.0.1:35357/v3/ \
|
|
||||||
--os-domain-name default \
|
|
||||||
--os-identity-api-version=3 \
|
|
||||||
keystone admin http://controller:35357/v2.0
|
|
||||||
|
|
||||||
.. image:: figures/debconf-screenshots/keystone_7_register_endpoint.png
|
|
||||||
|
|
||||||
.. only:: obs or rdo or ubuntu
|
.. only:: obs or rdo or ubuntu
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user