Install and configure¶
This section describes how to install and configure the OpenStack Identity service, code-named keystone, on the controller node. For scalability purposes, this configuration deploys Fernet tokens and the Apache HTTP server to handle requests.
Prerequisites¶
Before you install and configure the Identity service, you must create a database.
Use the database access client to connect to the database server as the
root
user:# mysql
Create the
keystone
database:MariaDB [(none)]> CREATE DATABASE keystone;
Grant proper access to the
keystone
database:MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \ IDENTIFIED BY 'KEYSTONE_DBPASS'; MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \ IDENTIFIED BY 'KEYSTONE_DBPASS';
Replace
KEYSTONE_DBPASS
with a suitable password.Exit the database access client.
Install and configure components¶
Note
Default configuration files vary by distribution. You might need
to add these sections and options rather than modifying existing
sections and options. Also, an ellipsis (...
) in the configuration
snippets indicates potential default configuration options that you
should retain.
Note
This guide uses the Apache HTTP server with mod_wsgi
to serve
Identity service requests on ports 5000 and 35357. By default, the
keystone service still listens on these ports. The package handles
all of the Apache configuration for you (including the activation of
the mod_wsgi
apache2 module and keystone configuration in Apache).
Run the following command to install the packages:
# apt install keystone
Edit the
/etc/keystone/keystone.conf
file and complete the following actions:In the
[database]
section, configure database access:[database] # ... connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone
Replace
KEYSTONE_DBPASS
with the password you chose for the database.Note
Comment out or remove any other
connection
options in the[database]
section.In the
[token]
section, configure the Fernet token provider:[token] # ... provider = fernet
Populate the Identity service database:
# su -s /bin/sh -c "keystone-manage db_sync" keystone
Initialize Fernet key repositories:
# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone # keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
Bootstrap the Identity service:
# keystone-manage bootstrap --bootstrap-password ADMIN_PASS \ --bootstrap-admin-url http://controller:35357/v3/ \ --bootstrap-internal-url http://controller:5000/v3/ \ --bootstrap-public-url http://controller:5000/v3/ \ --bootstrap-region-id RegionOne
Replace
ADMIN_PASS
with a suitable password for an administrative user.
Configure the Apache HTTP server¶
Edit the
/etc/apache2/apache2.conf
file and configure theServerName
option to reference the controller node:ServerName controller
Finalize the installation¶
Restart the Apache service:
# service apache2 restart
Configure the administrative account
$ export OS_USERNAME=admin $ export OS_PASSWORD=ADMIN_PASS $ export OS_PROJECT_NAME=admin $ export OS_USER_DOMAIN_NAME=Default $ export OS_PROJECT_DOMAIN_NAME=Default $ export OS_AUTH_URL=http://controller:35357/v3 $ export OS_IDENTITY_API_VERSION=3
Replace
ADMIN_PASS
with the password used in thekeystone-manage bootstrap
command in keystone-install-configure-ubuntu.