We will be performing an installation and configuration of the OpenStack Identity service, known as Keystone, using the Ubuntu Cloud Archive. Once configured, connecting to our OpenStack cloud environment will be performed through our new OpenStack Identity service.
The backend datastore for our OpenStack Identity service will be a MariaDB database. The environment we will be installing is shown in the following figure. In this chapter, we will be concentrating on the Controller host.
To ensure that we're running the Ubuntu Cloud Archive, we must first configure our Ubuntu 14.04 installation to use this service. For more information, visit http://bit.ly/OpenStackCookbookCloudArchive.
All of the steps can be found at http://www.openstackcookbook.com/.
We will configure Keystone to use MariaDB as the database backend, so this needs to be installed prior to installing Keystone.
If MariaDB is not installed, visit http://bit.ly/OpenStackCookbookPreReqs for instructions on how to do this.
Ensure that you have a suitable server available for installation of the OpenStack Identity service components. If you are using the accompanying Vagrant environment, as described in the Preface, this will be the
Make sure that you are logged in to the
controller node and ensure that it has Internet access to allow us to install the required packages in our environment for running Keystone. If you created this node with Vagrant, you can execute the following command:
vagrant ssh controller
The instructions here assume that the
controller node has two IP addresses. It will have a front-facing IP address, 192.168.100.200, and a backside IP address, 172.16.0.200, (which is also the address of the MariaDB server). The reason it has two addresses is that internal data will communicate over the backside IP address (for example, database traffic), and any Keystone traffic will traverse the front.
Carry out the following instructions to install the OpenStack Identity service:
Installation of the OpenStack Identity service is done by specifying the Keystone package in Ubuntu, and we do this as follows:
sudo apt-get update sudo apt-get install ntp keystone python-keyring
Once installed, we need to configure the backend database store, so we first create the
keystonedatabase in MariaDB. We do this as follows (here, we have a user in MariaDB called
rootwith the password
openstack, which can create databases):
MYSQL_ROOT_PASS=openstack mysql -uroot -p$MYSQL_ROOT_PASS -e "CREATE DATABASE \ keystone;"
It is good practice to create a user that is specific to our OpenStack Identity service, so we create a Keystone user in the database as follows:
MYSQL_KEYSTONE_PASS=openstack mysql -uroot -p$MYSQL_ROOT_PASS -e "GRANT ALL PRIVILEGES ON \keystone.* TO 'keystone'@'localhost' IDENTIFIED BY \'$MYSQL_KEYSTONE_PASS';" mysql -uroot -p$MYSQL_ROOT_PASS -e "GRANT ALL PRIVILEGES ON \keystone.* TO 'keystone'@'%' IDENTIFIED BY \'$MYSQL_KEYSTONE_PASS';"
[DEFAULT] admin_token = ADMIN log_dir=/var/log/keystone [database] connection = mysql://keystone:[email protected]/keystone [extra_headers] Distribution = Ubuntu use_syslog = True syslog_log_facility = LOG_LOCAL0
We can now restart the
keystoneservice to pick up these changes:
sudo stop keystone sudo start keystone
keystonestarted, we can now populate the
keystonedatabase with the required tables by issuing the following command:
sudo keystone-manage db_sync
Congratulations! We have now installed the OpenStack Identity service and it is ready for use in our OpenStack environment.
A convenient way to install the OpenStack Identity service in our OpenStack environment is by using the Ubuntu packages. Once installed, we configure our MariaDB database server with a
keystone database and set up the
keystone.conf configuration file with the corresponding values. After starting the Keystone service, running the
keystone-manage db_sync command populates the
keystone database with the appropriate tables ready for us to add in the required users, roles, and tenants required in our OpenStack environment.