Chapter 1. Introduction to the Identity Service (keystone)
As a cloud administrator, you can manage projects, users, and roles.
Projects are organizational units containing a collection of resources. You can assign users to roles within projects. Roles define the actions that those users can perform on the resources within a given project. Users can be assigned roles in multiple projects.
Each Red Hat OpenStack (RHOSP) deployment must include at least one user assigned to a role within a project. As a cloud administrator, you can:
- Add, update, and delete projects and users.
- Assign users to one or more roles, and change or remove these assignments.
- Manage projects and users independently from each other.
You can also configure user authentication with the Identity service (keystone)to control access to services and endpoints. The Identity service provides token-based authentication and can integrate with LDAP and Active Directory, so you can manage users and identities externally and synchronize the user data with the Identity service.
1.1. Resource credential files
When you install Red Hat OpenStack Platform director, a resource credentials (RC) file is automatically generated:
# Clear any old environment that may conflict. for key in $( set | awk -F= '/^OS_/ {print $1}' ); do unset "${key}" ; done export OS_CLOUD=undercloud # Add OS_CLOUDNAME to PS1 if [ -z "${CLOUDPROMPT_ENABLED:-}" ]; then export PS1=${PS1:-""} export PS1=\${OS_CLOUD:+"(\$OS_CLOUD)"}\ $PS1 export CLOUDPROMPT_ENABLED=1 fi export PYTHONWARNINGS="ignore:Certificate has no, ignore:A true SSLContext object is not available"
Source the stackrc
file to export authentication details into your shell environment. This allows you to run commands against the local Red Hat OpenStack Platform director API.
The name of the RC file generated during the installation of the overcloud is the name of the deployed stack suffixed with 'rc'. If you do not provide a custom name for your stack, then the stack is labeled overcloud
. An RC file is created called overcloudrc
:
# Clear any old environment that may conflict. for key in $( set | awk '{FS="="} /^OS_/ {print $1}' ); do unset $key ; done export OS_USERNAME=admin export OS_PROJECT_NAME=admin export OS_USER_DOMAIN_NAME=Default export OS_PROJECT_DOMAIN_NAME=Default export OS_NO_CACHE=True export OS_CLOUDNAME=overcloud export no_proxy=10.0.0.145,192.168.24.27 export PYTHONWARNINGS='ignore:Certificate has no, ignore:A true SSLContext object is not available' export OS_AUTH_TYPE=password export OS_PASSWORD=mpWt4y0Qhc9oTdACisp4wgo7F export OS_AUTH_URL=http://10.0.0.145:5000 export OS_IDENTITY_API_VERSION=3 export OS_COMPUTE_API_VERSION=2.latest export OS_IMAGE_API_VERSION=2 export OS_VOLUME_API_VERSION=3 export OS_REGION_NAME=regionOne # Add OS_CLOUDNAME to PS1 if [ -z "${CLOUDPROMPT_ENABLED:-}" ]; then export PS1=${PS1:-""} export PS1=\${OS_CLOUDNAME:+"(\$OS_CLOUDNAME)"}\ $PS1 export CLOUDPROMPT_ENABLED=1 fi
The overcloud RC file is referred to as overcloudrc
in the documentation, regardless of the actual name of your stack. Source the overcloudrc
file to export authentication details into your shell environment. This allows you to run commands against the control plane API of your overcloud cluster. The automatically generated overcloudrc
file will authenticate you as the admin
user to the admin
project. This authentication is valuable for domain administrative tasks, such as creating provider networks or projects.
1.2. OpenStack regions
A region is a division of an OpenStack deployment. Each region has its own full OpenStack deployment, including its own API endpoints, networks and compute resources. Different regions share one set of Identity service (keystone) and Dashboard service (horizon) services to provide access control and a web interface. Red Hat OpenStack Platform is deployed with a single region. By default, your overcloud region is named regionOne
. You can change the default region name in Red Hat OpenStack Platform.
Procedure
Under
parameter_defaults
, define theKeystoneRegion
parameter:parameter_defaults: KeystoneRegion: '<sample_region>'
Replace
<sample_region>
with a region name of your choice.NoteYou cannot modify the region name after you deploy the overcloud.