4.4. Configure the Object Storage Service

Procedure 4.3. Creating Identity Records for the Object Storage Service

1. Set up the shell to access keystone as the administrative user:

   # source ~/keystonerc_admin

   Copy to Clipboard Toggle word wrap
2. Create the swift user:

   [(keystone_admin)]# keystone user-create --name swift --pass PASSWORD
   +----------+----------------------------------+
   | Property |              Value               |
   +----------+----------------------------------+
   |  email   |                                  |
   | enabled  |               True               |
   |    id    | e1765f70da1b4432b54ced060139b46a |
   |   name   |              swift               |
   | username |              swift               |
   +----------+----------------------------------+
   

   Copy to Clipboard Toggle word wrap
   Replace PASSWORD with a secure password that will be used by the Object Storage service when authenticating with the Identity service.
3. Link the swift user and the admin role together within the context of the services tenant:

   [(keystone_admin)]# keystone user-role-add --user swift --role admin --tenant services

   Copy to Clipboard Toggle word wrap
4. Create the swift Object Storage service entry:

   [(keystone_admin)]# keystone service-create --name swift --type object-store \
       --description "Swift Storage Service"
   +-------------+----------------------------------+
   |   Property  |              Value               |
   +-------------+----------------------------------+
   | description |      Swift Storage Service       |
   |   enabled   |               True               |
   |      id     | 9e0156e9965241e7a7d9c839884f9c01 |
   |     name    |              swift               |
   |     type    |           object-store           |
   +-------------+----------------------------------+
   

   Copy to Clipboard Toggle word wrap
5. Create the swift endpoint entry:

   [(keystone_admin)]# keystone endpoint-create \
       --service swift \
       --publicurl 'http://IP:8080/v1/AUTH_%(tenant_id)s' \
       --adminurl 'http://IP:8080/v1' \
       --internalurl 'http://IP:8080/v1/AUTH_%(tenant_id)s' \
      --region 'RegionOne'

   Copy to Clipboard Toggle word wrap
   Replace IP with the IP address or fully qualified domain name of the server hosting the Object Storage Proxy service.

Procedure 4.4. Configuring the Object Storage Service Storage Nodes

1. Format your devices using the ext4 or XFS filesystem. Ensure that xattrs are enabled.
2. Add your devices to the /etc/fstab file to ensure that they are mounted under /srv/node/ at boot time. Use the blkid command to find your device's unique ID, and mount the device using its unique ID.

   Note

   If using ext4, ensure that extended attributes are enabled by mounting the filesystem with the user_xattr option. (In XFS, extended attributes are enabled by default.)
3. Configure the firewall to open the TCP ports used by each service running on each node. By default, the account service uses port 6202, the container service uses port 6201, and the object service uses port 6200.
   1. Open the /etc/sysconfig/iptables file in a text editor.
   2. Add an INPUT rule allowing TCP traffic on the ports used by the account, container, and object service. The new rule must appear before any reject-with icmp-host-prohibited rule:

      -A INPUT -p tcp -m multiport --dports 6200,6201,6202,873 -j ACCEPT

      Copy to Clipboard Toggle word wrap
   3. Save the changes to the /etc/sysconfig/iptables file.
   4. Restart the iptables service for the firewall changes to take effect:

      # systemctl restart iptables.service

      Copy to Clipboard Toggle word wrap
4. Change the owner of the contents of /srv/node/ to swift:swift:

   # chown -R swift:swift /srv/node/

   Copy to Clipboard Toggle word wrap
5. Set the SELinux context correctly for all directories under /srv/node/:

   # restorecon -R /srv

   Copy to Clipboard Toggle word wrap
6. Add a hash prefix to the /etc/swift/swift.conf file:

   # openstack-config --set /etc/swift/swift.conf swift-hash swift_hash_path_prefix \
      $(openssl rand -hex 10)

   Copy to Clipboard Toggle word wrap
7. Add a hash suffix to the /etc/swift/swift.conf file:

   # openstack-config --set /etc/swift/swift.conf swift-hash swift_hash_path_suffix \
      $(openssl rand -hex 10)

   Copy to Clipboard Toggle word wrap
8. Set the IP address that the storage services will listen on. Run the following commands for every service on every node in your Object Storage cluster:

   # openstack-config --set /etc/swift/object-server.conf \
      DEFAULT bind_ip NODE_IP_ADDRESS
   # openstack-config --set /etc/swift/account-server.conf \
      DEFAULT bind_ip NODE_IP_ADDRESS
   # openstack-config --set /etc/swift/container-server.conf \
      DEFAULT bind_ip NODE_IP_ADDRESS

   Copy to Clipboard Toggle word wrap
   Replace NODE_IP_ADDRESS with the IP address of the node you are configuring.
9. Copy /etc/swift/swift.conf from the node you are currently configuring to all of your Object Storage service nodes.

   Important

   The /etc/swift/swift.conf file must be identical on all of your Object Storage service nodes.
10. Start the services that will run on the node:

    # systemctl start openstack-swift-account.service
    # systemctl start openstack-swift-container.service
    # systemctl start openstack-swift-object.service

    Copy to Clipboard Toggle word wrap
11. Configure the services to start at boot time:

    # systemctl enable openstack-swift-account.service
    # systemctl enable openstack-swift-container.service
    # systemctl enable openstack-swift-object.service

    Copy to Clipboard Toggle word wrap

Procedure 4.5. Configuring the Object Storage Service Proxy Service

1. Update the configuration file for the proxy server with the correct authentication details for the appropriate service user:

   # openstack-config --set /etc/swift/proxy-server.conf \
         filter:authtoken auth_host IP
   # openstack-config --set /etc/swift/proxy-server.conf \
         filter:authtoken admin_tenant_name services
   # openstack-config --set /etc/swift/proxy-server.conf \
         filter:authtoken admin_user swift
   # openstack-config --set /etc/swift/proxy-server.conf \
         filter:authtoken admin_password PASSWORD

   Copy to Clipboard Toggle word wrap
   Replace the following values:

   • Replace IP with the IP address or host name of the Identity server.
   • Replace services with the name of the tenant that was created for the Object Storage service (previous examples set this to services).
   • Replace swift with the name of the service user that was created for the Object Storage service (previous examples set this to swift).
   • Replace PASSWORD with the password associated with the service user.
2. Start the memcached and openstack-swift-proxy services:

   # systemctl start memcached.service
   # systemctl start openstack-swift-proxy.service

   Copy to Clipboard Toggle word wrap
3. Configure the memcached and openstack-swift-proxy services to start at boot time:

   # systemctl enable memcached.service
   # systemctl enable openstack-swift-proxy.service

   Copy to Clipboard Toggle word wrap
4. Allow incoming connections to the server hosting the Object Storage proxy service. Open the /etc/sysconfig/iptables file in a text editor, and Add an INPUT rule allowing TCP traffic on port 8080. The new rule must appear before any INPUT rules that REJECT traffic: :

   -A INPUT -p tcp -m multiport --dports 8080 -j ACCEPT

   Copy to Clipboard Toggle word wrap

   Important

   This rule allows communication from all remote hosts to the system hosting the Swift proxy on port 8080. For information regarding the creation of more restrictive firewall rules, see the Red Hat Enterprise Linux Security Guide:

   https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/
5. Restart the iptables service to ensure that the change takes effect:

   # systemctl restart iptables.service

   Copy to Clipboard Toggle word wrap

Procedure 4.6. Building Object Storage Service Ring Files

1. Build one ring for each service. Provide a builder file, a partition power, a replica count, and the minimum hours between partition reassignment:

   # swift-ring-builder /etc/swift/object.builder create part_power replica_count min_part_hours
   # swift-ring-builder /etc/swift/container.builder create part_power replica_count min_part_hours
   # swift-ring-builder /etc/swift/account.builder create part_power replica_count min_part_hours

   Copy to Clipboard Toggle word wrap
2. When the rings are created, add devices to the account ring:

   # swift-ring-builder /etc/swift/account.builder add zX-SERVICE_IP:6202/dev_mountpt part_count

   Copy to Clipboard Toggle word wrap
   Replace the following values:
   • Replace X with the corresponding integer of a specified zone (for example, z1 would correspond to Zone One).
   • Replace SERVICE_IP with the IP on which the account, container, and object services should listen. This IP should match the bind_ip value set during the configuration of the Object Storage service storage nodes.
   • Replace dev_mountpt with the /srv/node subdirectory under which your device is mounted.
   • Replace part_count with the partition count you used to calculate your partition power.

   Note

   Repeat this step for each device (on each node in the cluster) you want added to the ring.
3. Add each device to both the container and object rings:

   # swift-ring-builder /etc/swift/container.builder add zX-SERVICE_IP:6201/dev_mountpt part_count
   # swift-ring-builder /etc/swift/object.builder add zX-SERVICE_IP:6200/dev_mountpt part_count

   Copy to Clipboard Toggle word wrap
   Replace the variables with the same ones used in the previous step.

   Note

   Repeat these commands for each device (on each node in the cluster) you want added to the ring.
4. Distribute the partitions across the devices in the ring:

   # swift-ring-builder /etc/swift/account.builder rebalance
   # swift-ring-builder /etc/swift/container.builder rebalance
   # swift-ring-builder /etc/swift/object.builder rebalance

   Copy to Clipboard Toggle word wrap
5. Check to see that you now have three ring files in the directory /etc/swift:

   # ls /etc/swift/*gz 

   Copy to Clipboard Toggle word wrap
   The files should be listed as follows:

   /etc/swift/account.ring.gz  /etc/swift/container.ring.gz  /etc/swift/object.ring.gz
   

   Copy to Clipboard Toggle word wrap
6. Restart the openstack-swift-proxy service:

   # systemctl restart openstack-swift-proxy.service

   Copy to Clipboard Toggle word wrap
7. Ensure that all files in the /etc/swift/ directory, including those that you have just created, are owned by the root user and the swift group:

   Important

   All mount points must be owned by root; all roots of mounted file systems must be owned by swift. Before running the following command, ensure that all devices are already mounted and owned by root.

   # chown -R root:swift /etc/swift

   Copy to Clipboard Toggle word wrap
8. Copy each ring builder file to each node in the cluster, storing them under /etc/swift/.