"Fossies" - the Fresh Open Source Software Archive

Member "keystone-18.0.0/doc/source/install/keystone-install-rdo.rst" (14 Oct 2020, 5704 Bytes) of package /linux/misc/openstack/keystone-18.0.0.tar.gz:

As a special service "Fossies" has tried to format the requested source page into HTML format (assuming markdown format). Alternatively you can here view or download the uninterpreted source code file. A member file download can also be achieved by clicking within a package contents listing on the according byte size field. See also the latest Fossies "Diffs" side-by-side code changes report for "keystone-install-rdo.rst": 17.0.0_vs_18.0.0.

Install and configure

This section describes how to install and configure the OpenStack Identity service, code-named keystone, on the controller node. For scalability purposes, this configuration deploys Fernet tokens and the Apache HTTP server to handle requests.


Ensure that you have completed the prerequisite installation steps in the Openstack Install Guide before proceeding.


Before you install and configure the Identity service, you must create a database.

  1. Use the database access client to connect to the database server as the root user:

    $ mysql -u root -p
  2. Create the keystone database:

    MariaDB [(none)]> CREATE DATABASE keystone;
  3. Grant proper access to the keystone database:

    MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \
    MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \

    Replace KEYSTONE_DBPASS with a suitable password.

  4. Exit the database access client.

Install and configure components


Default configuration files vary by distribution. You might need to add these sections and options rather than modifying existing sections and options. Also, an ellipsis (...) in the configuration snippets indicates potential default configuration options that you should retain.

  1. Run the following command to install the packages:

    # yum install openstack-keystone httpd mod_wsgi


    For RHEL8/Centos8 and above install package python3-mod_wsgi.

  2. Edit the /etc/keystone/keystone.conf file and complete the following actions:

  3. Populate the Identity service database:

    # su -s /bin/sh -c "keystone-manage db_sync" keystone
  4. Initialize Fernet key repositories:


    The --keystone-user and --keystone-group flags are used to specify the operating system's user/group that will be used to run keystone. These are provided to allow running keystone under another operating system user/group. In the example below, we call the user & group keystone.

    # keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
    # keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
  5. Bootstrap the Identity service:


    Before the Queens release, keystone needed to be run on two separate ports to accommodate the Identity v2 API which ran a separate admin-only service commonly on port 35357. With the removal of the v2 API, keystone can be run on the same port for all interfaces.

    # keystone-manage bootstrap --bootstrap-password ADMIN_PASS \
      --bootstrap-admin-url http://controller:5000/v3/ \
      --bootstrap-internal-url http://controller:5000/v3/ \
      --bootstrap-public-url http://controller:5000/v3/ \
      --bootstrap-region-id RegionOne

    Replace ADMIN_PASS with a suitable password for an administrative user.

Configure the Apache HTTP server

  1. Edit the /etc/httpd/conf/httpd.conf file and configure the ServerName option to reference the controller node:

    ServerName controller

    The ServerName entry will need to be added if it does not already exist.

  2. Create a link to the /usr/share/keystone/wsgi-keystone.conf file:

    # ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/


A secure deployment should have the web server configured to use SSL or running behind an SSL terminator.

Finalize the installation

  1. Start the Apache HTTP service and configure it to start when the system boots:

    # systemctl enable httpd.service
    # systemctl start httpd.service
  2. Configure the administrative account by setting the proper environmental variables:

    $ export OS_USERNAME=admin
    $ export OS_PROJECT_NAME=admin
    $ export OS_USER_DOMAIN_NAME=Default
    $ export OS_PROJECT_DOMAIN_NAME=Default
    $ export OS_AUTH_URL=http://controller:5000/v3

    These values shown here are the default ones created from keystone-manage bootstrap.

    Replace ADMIN_PASS with the password used in the keystone-manage bootstrap command in keystone-install-configure-rdo.