Chapter 5. Configuring LDAP on RHOSO

Procedure

1. Create an OpenStack domain:

   $ openstack domain create <name>

   where:

   <name>

   Specifies the name of your OpenStack domain.

2. Create a keystone-domains secret called keystone-domains.yaml. This secret is mounted into the /etc/keystone/domains configuration directory:

   apiVersion: v1
   kind: Secret
   metadata:
     name: keystone-domains
     namespace: openstack
   type: Opaque
   stringData:
       keystone.<domain_name>.conf: |
           [identity]
           driver = ldap
           [ldap]
           url = ldaps://localhost
           user = =openstack,ou=Users,dc=director,dc=example,dc=com
           password = RedactedComplexPassword
           suffix = dc=domain,dc=example,dc=com
           user_tree_dn = ou=Users,dc=domain,dc=example,dc=com
           user_objectclass = person
           group_tree_dn = ou=Groups,dc=example,dc=org
           group_objectclass = groupOfNames
           use_tls = True

3. Create the secret:

   $ oc apply -f keystone-domain-name.yaml

4. Open your OpenStackCustomResource custom resource (CR) file and add the secret by using the extraMounts field:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   metadata:
     name: openstack
   spec:
     keystone:
       template:
         customServiceConfig: |
           [identity]
           domain_specific_drivers_enabled = True
         extraMounts:
         - name: v1
           region: r1
             extraVol:
               - propagation:
                 - Keystone
                 extraVolType: Conf
                 volumes:
                 - name: keystone-domains
                   secret:
                     secretName: keystone-domains
                 mounts:
                 - name: keystone-domains
                   mountPath: "/etc/keystone/domains"
                   readOnly: true

5. Apply the changes to your OpenStack control plane CR:

   $ oc apply -f openstack_control_plane.yaml