{{tag>Brouillon OpenStack}} # Notes OpenStack Keystone Voir : * https://docs.openstack.org/newton/install-guide-ubuntu/keystone-install.html * https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/10/html/manual_installation_procedures/sect-prerequisite_message_broker * https://books.google.fr/books?id=TMhsDwAAQBAJ&pg=PA43&lpg=PA43&dq=keystone+bootstrap-admin-url+5000+35357&source=bl&ots=PonObAz5-9&sig=ACfU3U1EZw0lO_-FottWlAHUd3-OWGoS7A&hl=fr&sa=X&ved=2ahUKEwjNxJDO0JXhAhX4AWMBHcoLBqUQ6AEwCHoECAkQAQ#v=onepage&q=keystone%20bootstrap-admin-url%205000%2035357&f=false ## Install Prérequis : * NTP ### RedHat ~~~bash yum install centos-release-openstack-rocky.noarch yum install openstack-keystone-doc python-keystoneclient-doc yum install openstack-keystone httpd mod_wsgi yum install python-openstackclient # yum install python-PROJETclient # yum install python-keystoneclient # MySQL / MariaDB yum install MySQL-python # Postgress #yum install postgresql #yum install postgresql-server yum install @postgresql yum install python-sqlalchemy python-psycopg2 # RabbitMQ yum install rabbitmq-server ~~~ ~~~bash sudo postgresql-setup initdb systemctl start postgresql.service systemctl enable postgresql.service ~~~ Configurer `/var/lib/pgsql/data/pg_hba.conf` ~~~ #host all all 127.0.0.1/32 ident host all all 127.0.0.1/32 md5 ~~~ ~~~bash su - postgres psql ~~~ ~~~sql CREATE ROLE keystoneUser WITH LOGIN PASSWORD 'toor'; CREATE DATABASE keystone OWNER keystoneuser ; ~~~ `/etc/keystone/keystone.conf` ~~~ini [DEFAULT] #verbose = True debug = true [database] #connection = mysql://keystoneUser:toor@127.0.0.1/keystone #connection = mysql+pymysql://keystoneUser:toor@127.0.0.1/keystone?charset=utf8 connection = postgresql://keystoneuser:toor@127.0.0.1/keystone [token] provider = fernet ~~~ ~~~bash systemctl restart httpd su keystone -s /bin/sh -c "keystone-manage db_sync" ~~~ Les logs sont ici `/var/log/keystone/keystone.log` ou ~~~bash journalctl -f -u devstack@keystone.service ~~~ ## Configuration ### Renommer un endpoint Kestone a été initié avec les paramètres suivants ~~~bash keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone keystone-manage credential_setup --keystone-user keystone --keystone-group keystone ~~~ ~~~bash keystone-manage bootstrap --bootstrap-password toor \ --bootstrap-admin-url http://srv-openstack-controller:35357/v3/ \ --bootstrap-internal-url http://srv-openstack-controller:5000/v3/ \ --bootstrap-public-url http://srv-openstack-controller:5000/v3/ \ --bootstrap-region-id RegionOne ~~~ Solution : faire un update en base. ~~~sql update endpoint set url='http://srv-openstack-controller:5000/v3/' where interface='admin'; ~~~ Puis rédemarrer le service Apache ou le service SystemD ~~~bash systemctl restart httpd # ou systemctl restart devstack@keystone.service ~~~ Test `openrc` ~~~bash export OS_USERNAME=admin export OS_PASSWORD=toor export OS_PROJECT_NAME=admin export OS_USER_DOMAIN_NAME=Default export OS_PROJECT_DOMAIN_NAME=Default export OS_AUTH_URL=http://srv-openstack-controller:5000/v3 export OS_IDENTITY_API_VERSION=3 ~~~ ~~~bash source openrc openstack token issue --debug openstack service list openstack user list ~~~ ### Configuration d'un domaine AD/LDAP Exemple de conf `/etc/keystone/domains/keystone.domain.conf` ~~~ini [identity] domain_configurations_from_database = False driver = ldap [ldap] query_scope = sub group_name_attribute = sAMAccountName group_objectclass = group user_mail_attribute = mail user_enabled_attribute = userAccountControl group_tree_dn = CN=Openstack,OU=Groupes,DC=acme,DC=local chase_referrals = false user_id_attribute = sAMAccountName group_members_are_ids = true group_member_attribute = memberUid page_size = 500 use_tls = false url = ldaps://ldap.acme.local:636 user_name_attribute = sAMAccountName user = Admin user_objectclass = organizationalPerson group_id_attribute = cn user_filter = (memberOf=CN=Openstack,OU=Groupes,DC=acme,DC=local) group_desc_attribute = description user_tree_dn = DC=acme,DC=local user_pass_attribute = userPassword password = UEBzc3cwcmQhISEK ~~~ ## Pb ### Pb utilisateur manquant L’utilisateur n'apparait pas ~~~bash openstack user list | grep jean ~~~ Mais il apparait bien avec ~~~bash openstack user show jean ~~~ #### Solution Augmenter le `page_size` `/etc/keystone/domains/keystone.acme.conf` ~~~ini [ldap] page_size = 500 ~~~ Puis restart d'Apache ou du service keystone. ## Autres Note : ** iptables est remplacé maintenant par [[nftables_un_remplacant_d_iptables|nftables]] ** ~~~bash iptables -I INPUT -p tcp --dport 5000 -j ACCEPT ~~~