The proxy server takes each request and looks up locations for the account, container, or object and routes the requests correctly. The proxy server also handles API requests. You enable account management by configuring it in the proxy-server.conf file. Swift processes run under a separate user and group, set by configuration options, and referred to as swift:swiftopenstack-swift:openstack-swift. The default user is swift, which may not exist on your system.openstack-swift. Install swift-proxy service: # apt-get install swift-proxy memcached python-keystoneclient python-swiftclient python-webob # yum install openstack-swift-proxy memcached openstack-utils python-swiftclient python-keystone-auth-token # zypper install openstack-swift-proxy memcached openstack-utils python-swiftclient python-keystoneclient Create self-signed cert for SSL: # cd /etc/swift # openssl req -new -x509 -nodes -out cert.crt -keyout cert.key Modify memcached to listen on the default interfaces. Preferably this should be on a local, non-public network. Edit the following line in /etc/memcached.conf, changing: -l 127.0.0.1 to -l <PROXY_LOCAL_NET_IP> Restart the memcached server: # service memcached restart RHEL/CentOS/Fedora only: To set up Object Storage to authenticate tokens we need to set the keystone Admin token in the swift proxy file with the openstack-config command. # openstack-config --set /etc/swift/proxy-server.conf filter:authtoken admin_token $ADMIN_TOKEN # sudo openstack-config --set /etc/swift/proxy-server.conf filter:authtoken auth_token $ADMIN_TOKEN Create /etc/swift/proxy-server.conf: If you run multiple memcache servers, put the multiple IP:port listings in the [filter:cache] section of the proxy-server.conf file like: 10.1.2.3:11211,10.1.2.4:11211 Only the proxy server uses memcache. Create the signing_dir and set its permissions accordingly.# mkdir -p /home/swift/keystone-signing # chown -R swift:swift /home/swift/keystone-signing # mkdir -p /home/swift/keystone-signing # chown -R openstack-swift:openstack-swift /home/swift/keystone-signing Create the account, container and object rings. The builder command is basically creating a builder file with a few parameters. The parameter with the value of 18 represents 2 ^ 18th, the value that the partition will be sized to. Set this “partition power” value based on the total amount of storage you expect your entire ring to use. The value of 3 represents the number of replicas of each object, with the last value being the number of hours to restrict moving a partition more than once. # cd /etc/swift # swift-ring-builder account.builder create 18 3 1 # swift-ring-builder container.builder create 18 3 1 # swift-ring-builder object.builder create 18 3 1 For every storage device on each node add entries to each ring: # swift-ring-builder account.builder add z<ZONE>-<STORAGE_LOCAL_NET_IP>:6002[R<STORAGE_REPLICATION_NET_IP>:6005]/<DEVICE> 100 # swift-ring-builder container.builder add z<ZONE>-<STORAGE_LOCAL_NET_IP_1>:6001[R<STORAGE_REPLICATION_NET_IP>:6004]/<DEVICE> 100 # swift-ring-builder object.builder add z<ZONE>-<STORAGE_LOCAL_NET_IP_1>:6000[R<STORAGE_REPLICATION_NET_IP>:6003]/<DEVICE> 100 STORAGE_REPLICATION_NET_IP is an optional parameter which must be omitted if you do not want to use dedicated network for replication For example, if you were setting up a storage node with a partition in Zone 1 on IP 10.0.0.1. Storage node has address 10.0.1.1 from replication network. The mount point of this partition is /srv/node/sdb1, and the path in rsyncd.conf is /srv/node/, the DEVICE would be sdb1 and the commands would look like: # swift-ring-builder account.builder add z1-10.0.0.1:6002R10.0.1.1:6005/sdb1 100 # swift-ring-builder container.builder add z1-10.0.0.1:6001R10.0.1.1:6005/sdb1 100 # swift-ring-builder object.builder add z1-10.0.0.1:6000R10.0.1.1:6005/sdb1 100 Assuming there are 5 zones with 1 node per zone, ZONE should start at 1 and increment by one for each additional node. Verify the ring contents for each ring: # swift-ring-builder account.builder # swift-ring-builder container.builder # swift-ring-builder object.builder Rebalance the rings: # swift-ring-builder account.builder rebalance # swift-ring-builder container.builder rebalance # swift-ring-builder object.builder rebalance Rebalancing rings can take some time. Copy the account.ring.gz, container.ring.gz, and object.ring.gz files to each of the Proxy and Storage nodes in /etc/swift. Make sure all the config files are owned by the swift user: # chown -R swift:swift /etc/swift # chown -R openstack-swift:openstack-swift /etc/swift Start Proxy services: # service proxy-server start