Book Image

OpenStack Orchestration

By : Adnan Ahmed Siddiqui
Book Image

OpenStack Orchestration

By: Adnan Ahmed Siddiqui

Overview of this book

This book is focused on setting up and using one of the most important services in OpenStack orchestration, Heat. First, the book introduces you to the orchestration service for OpenStack to help you understand the uses of the templating mechanism, complex control groups of cloud resources, and huge-potential and multiple-use cases. We then move on to the topology and orchestration specification for cloud applications and standards, before introducing the most popular IaaS cloud framework, Heat. You will get to grips with the standards used in Heat, overview and roadmap, architecture and CLI, heat API, heat engine, CloudWatch API, scaling principles, JeOS and installation and configuration of Heat. We wrap up by giving you some insights into troubleshooting for OpenStack. With easy-to-follow, step-by-step instructions and supporting images, you will be able to manage OpenStack operations by implementing the orchestration services of Heat.
Table of Contents (14 chapters)
OpenStack Orchestration
About the Author
About the Reviewers
Stack Group of Connected Cloud Resources

Stack domain users

The Heat stack domain user is used to authorize a user to carry out certain operations inside a virtual machine.

Agents running inside virtual machine instances are provided with metadata. These agents repot and share the performance statistics of the VM on which they are running.

They use this metadata to apply any changes or some sort of configuration expressed in the metadata.

A signal is passed to the Heat engine when an event is completed successfully or with the failed status. A typical example can be to generate an alert when the installation of an application is completed on a specific virtual machine after its first reboot.

Heat provides features for encapsulating all the stack-defined users into a separate domain. This domain is usually created to store the information related to the Heat service. A domain admin is created, which is used by Heat for the management of the stack-domain users.

Configuring stack domain users

The following procedure is used to configure stack domain users:

  1. A new domain is created using keystone (OpenStack Identity service). Usually, the domain name is set to Heat. This ID is configured in the heat.conf file against the parameter stack_user_domain.

  2. A new user is created using keystone with permissions to create and delete projects and users. This newly defined user must belong to the domain created in step 1.

  3. The user created in step 2 (along with the password) is configured in heat.conf against the parameters: stack_domain_admin and stack_domain_admin_password.

This user is used to maintain the stack domain users on behalf of stack owners. As the heat_domain_admin user is only allowed access to the Heat domain, the risk of unwanted access to other domains is limited.

The following are the commands and the steps necessary to set up domain users:

  1. A domain is created using the following command:

    $ openstack --os-identity-api-version=3  --os-auth-url\
    --os-username admin --os-password ADMIN --os-project-name admin domain create heat \
    --description "Domain For HEAT Projects and Users"

    Here $OS_TOKEN refers to a token that must be a valid token.

    This will return a domain ID that will be referred to as $HEAT_DOMAIN_ID in the next step.

  2. Next, a user will be created within the domain created in step 1:

    $ openstack  user create heat_domain_admin \
    --os-identity-api-version=3  \
    --os-auth-url \
    --os-username=admin --os-password=ADMIN \
    --os-project-name=admin \
    --domain heat \
    --description "Admin for HEAT domain"\

    This will return a domain admin ID, which will be used in the next step.

  3. Next, the newly created user in step 2 is assigned the role of domain admin:

    $ openstack role add admin \
    --user heat_domain_admin \
    --os-identity-api-version=3  \
    --os-auth-url \
    --os-username=admin \
    --os-password=ADMIN \
    --os-project-name=admin \
    --domain heat

    We'll get the output shown in the following screenshot for this command:

The information such as domain ID, username, and password is needed to be configured against the relevant parameters in heat.conf.

Creating a stack

The following are the steps needed to create a sample stack:

  1. If the stack contains any resources that require creation of a "stack domain user", then a new "stack domain project" in the "Heat" domain is created.

  2. A new user is created under "stack domain project" by Heat if it is required. From an authentication perspective, this user is completely separate and also unrelated to the "stack owner's project."

While processing API requests, an internal lookup is made by Heat Orchestration to grant the required privileges to the user for both the stack owner's project as well as the stack domain project. These privileges are controlled by the policy.json file.