此内容没有您所选择的语言版本。

Chapter 3. Integrate with IdM using novajoin

Novajoin allows you to enroll your nodes with Red Hat Identity Manager (IdM) as part of the deployment process. As a result, you can integrate IdM features with your OpenStack deployment, including identities, kerberos credentials, and access controls.

Note

IdM enrollment through novajoin is currently only available for the undercloud and overcloud nodes. Novajoin integration for overcloud instances is expected to be supported in a later release.

3.1. Install and configure novajoin in the undercloud
复制链接

3.1.1. Add the undercloud to the CA
复制链接

Before deploying the overcloud, you must add the undercloud to the Certificate Authority (CA):

On the undercloud node, install the python3-novajoin package:
```
sudo dnf install python3-novajoin
```
```
$ sudo dnf install python3-novajoin
```
Copy to Clipboard Toggle word wrap

On the undercloud node, run the novajoin-ipa-setup script, adjusting the values to suit your deployment:

sudo /usr/libexec/novajoin-ipa-setup \
    --principal admin \
    --password <IdM admin password> \
    --server <IdM server hostname> \
    --realm <overcloud cloud domain (in upper case)> \
    --domain <overcloud cloud domain> \
    --hostname <undercloud hostname> \
    --precreate

$ sudo /usr/libexec/novajoin-ipa-setup \
    --principal admin \
    --password <IdM admin password> \
    --server <IdM server hostname> \
    --realm <overcloud cloud domain (in upper case)> \
    --domain <overcloud cloud domain> \
    --hostname <undercloud hostname> \
    --precreate

Copy to Clipboard

Toggle word wrap

In the following section, you will use the resulting One-Time Password (OTP) to enroll the undercloud.

3.1.2. Add the undercloud to IdM
复制链接

This procedure registers the undercloud with IdM and configures novajoin. Configure the following settings in undercloud.conf (within the [DEFAULT] section):

The novajoin service is disabled by default. To enable it:
```
[DEFAULT]
enable_novajoin = true
```
```
[DEFAULT]
enable_novajoin = true
```
Copy to Clipboard Toggle word wrap
You need set a One-Time Password (OTP) to register the undercloud node with IdM:
```
ipa_otp = <otp>
```
```
ipa_otp = <otp>
```
Copy to Clipboard Toggle word wrap
Set the overcloud’s domain name to be served by neutron’s DHCP server:
```
overcloud_domain_name = <domain>
```
```
overcloud_domain_name = <domain>
```
Copy to Clipboard Toggle word wrap
Set the appropriate hostname for the undercloud:
```
undercloud_hostname = <undercloud FQDN>
```
```
undercloud_hostname = <undercloud FQDN>
```
Copy to Clipboard Toggle word wrap
Set IdM as the nameserver for the undercloud:
```
undercloud_nameservers = <IdM IP>
```
```
undercloud_nameservers = <IdM IP>
```
Copy to Clipboard Toggle word wrap
For larger environments, you will need to review the novajoin connection timeout values. In undercloud.conf, add a reference to a new file called undercloud-timeout.yaml:
```
hieradata_override = /home/stack/undercloud-timeout.yaml
```
```
hieradata_override = /home/stack/undercloud-timeout.yaml
```
Copy to Clipboard Toggle word wrap
Add the following options to undercloud-timeout.yaml. You can specify the timeout value in seconds, for example, 5:
```
nova::api::vendordata_dynamic_connect_timeout: <timeout value>
nova::api::vendordata_dynamic_read_timeout: <timeout value>
```
```
nova::api::vendordata_dynamic_connect_timeout: <timeout value>
nova::api::vendordata_dynamic_read_timeout: <timeout value>
```
Copy to Clipboard Toggle word wrap
Save the undercloud.conf file.
Run the undercloud deployment command to apply the changes to your existing undercloud:
```
openstack undercloud install
```
```
$ openstack undercloud install
```
Copy to Clipboard Toggle word wrap

Verification

Check the keytab files for a key entry for the undercloud:

klist -kt

 [root@undercloud-0 ~]# klist -kt
 Keytab name: FILE:/etc/krb5.keytab
 KVNO Timestamp           Principal
 ---- ------------------- ------------------------------------------------------
    1 04/28/2020 12:22:06 host/undercloud-0.redhat.local@REDHAT.LOCAL
    1 04/28/2020 12:22:06 host/undercloud-0.redhat.local@REDHAT.LOCAL


 [root@undercloud-0 ~]# klist -kt /etc/novajoin/krb5.keytab
 Keytab name: FILE:/etc/novajoin/krb5.keytab
 KVNO Timestamp           Principal
 ---- ------------------- ------------------------------------------------------
    1 04/28/2020 12:22:26 nova/undercloud-0.redhat.local@REDHAT.LOCAL
    1 04/28/2020 12:22:26 nova/undercloud-0.redhat.local@REDHAT.LOCAL

Copy to Clipboard

Toggle word wrap

Test the system /etc/krb.keytab file with the host principle:

kinit -k

 [root@undercloud-0 ~]# kinit -k
 [root@undercloud-0 ~]# klist
 Ticket cache: KEYRING:persistent:0:0
 Default principal: host/undercloud-0.redhat.local@REDHAT.LOCAL

 Valid starting       Expires              Service principal
 05/04/2020 10:34:30  05/05/2020 10:34:30  krbtgt/REDHAT.LOCAL@REDHAT.LOCAL

 [root@undercloud-0 ~]# kdestroy
 Other credential caches present, use -A to destroy all

Copy to Clipboard

Toggle word wrap

Test the novajoin /etc/novajoin/krb.keytab file with the nova principle:

kinit -kt /etc/novajoin/krb5.keytab 'nova/undercloud-0.redhat.local@REDHAT.LOCAL'

 [root@undercloud-0 ~]# kinit -kt /etc/novajoin/krb5.keytab 'nova/undercloud-0.redhat.local@REDHAT.LOCAL'
 [root@undercloud-0 ~]# klist
 Ticket cache: KEYRING:persistent:0:0
 Default principal: nova/undercloud-0.redhat.local@REDHAT.LOCAL

 Valid starting       Expires              Service principal
 05/04/2020 10:39:14  05/05/2020 10:39:14  krbtgt/REDHAT.LOCAL@REDHAT.LOCAL

Copy to Clipboard

Toggle word wrap

3.2. Install and configure novajoin in the overcloud
复制链接

These sections describe how to register an overcloud node with IdM.

3.2.1. Configure overcloud DNS
复制链接

For automatic detection of your IdM environment, and easier enrollment, consider using IdM as your DNS server:

Connect to your undercloud:
```
source ~/stackrc
```
```
$ source ~/stackrc
```
Copy to Clipboard Toggle word wrap

Configure the control plane subnet to use IdM as the DNS name server:

openstack subnet set ctlplane-subnet --dns-nameserver  <idm_server_address>

$ openstack subnet set ctlplane-subnet --dns-nameserver  <idm_server_address>

Copy to Clipboard

Toggle word wrap

Set the DnsServers parameter in an environment file to use your IdM server:
```
parameter_defaults:
  DnsServers: ["<idm_server_address>"]
```
```
parameter_defaults:
  DnsServers: ["<idm_server_address>"]
```
Copy to Clipboard Toggle word wrap
This parameter is usually defined in a custom network-environment.yaml file.

3.2.2. Configure overcloud to use novajoin
复制链接

To enable IdM integration, create a copy of the /usr/share/openstack-tripleo-heat-templates/environments/predictable-placement/custom-domain.yaml environment file:

cp /usr/share/openstack-tripleo-heat-templates/environments/predictable-placement/custom-domain.yaml \
  /home/stack/templates/custom-domain.yaml

$ cp /usr/share/openstack-tripleo-heat-templates/environments/predictable-placement/custom-domain.yaml \
  /home/stack/templates/custom-domain.yaml

Copy to Clipboard

Toggle word wrap

Edit the /home/stack/templates/custom-domain.yaml environment file and set the CloudDomain and CloudName* values to suit your deployment. For example:

parameter_defaults:
  CloudDomain: lab.local
  CloudName: overcloud.lab.local
  CloudNameInternal: overcloud.internalapi.lab.local
  CloudNameStorage: overcloud.storage.lab.local
  CloudNameStorageManagement: overcloud.storagemgmt.lab.local
  CloudNameCtlplane: overcloud.ctlplane.lab.local

parameter_defaults:
  CloudDomain: lab.local
  CloudName: overcloud.lab.local
  CloudNameInternal: overcloud.internalapi.lab.local
  CloudNameStorage: overcloud.storage.lab.local
  CloudNameStorageManagement: overcloud.storagemgmt.lab.local
  CloudNameCtlplane: overcloud.ctlplane.lab.local

Copy to Clipboard

Toggle word wrap

Include the following environment files in the overcloud deployment process:

/usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml
/usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-everywhere-endpoints-dns.yaml

/home/stack/templates/custom-domain.yaml

For example:

openstack overcloud deploy \
  --templates \
   -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml \
   -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-everywhere-endpoints-dns.yaml \
   -e /home/stack/templates/custom-domain.yaml \

openstack overcloud deploy \
  --templates \
   -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml \
   -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-everywhere-endpoints-dns.yaml \
   -e /home/stack/templates/custom-domain.yaml \

Copy to Clipboard

Toggle word wrap

As a result, the deployed overcloud nodes will be automatically enrolled with IdM.

This only sets TLS for the internal endpoints. For the external endpoints you can use the normal means of adding TLS with the /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-tls.yaml environment file (which must be modified to add your custom certificate and key). Consequently, your openstack deploy command would be similar to this:

openstack overcloud deploy \
  --templates \
  -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml \
  -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-everywhere-endpoints-dns.yaml \
  -e /home/stack/templates/custom-domain.yaml \
  -e /home/stack/templates/enable-tls.yaml

openstack overcloud deploy \
  --templates \
  -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml \
  -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-everywhere-endpoints-dns.yaml \
  -e /home/stack/templates/custom-domain.yaml \
  -e /home/stack/templates/enable-tls.yaml

Copy to Clipboard

Toggle word wrap

Alternatively, you can also use IdM to issue your public certificates. In that case, you need to use the /usr/share/openstack-tripleo-heat-templates/environments/services/haproxy-public-tls-certmonger.yaml environment file. For example:

openstack overcloud deploy \
  --templates \
   -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml \
   -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-everywhere-endpoints-dns.yaml \
   -e /home/stack/templates/custom-domain.yaml \
   -e /usr/share/openstack-tripleo-heat-templates/environments/services/haproxy-public-tls-certmonger.yaml

openstack overcloud deploy \
  --templates \
   -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml \
   -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-everywhere-endpoints-dns.yaml \
   -e /home/stack/templates/custom-domain.yaml \
   -e /usr/share/openstack-tripleo-heat-templates/environments/services/haproxy-public-tls-certmonger.yaml

Copy to Clipboard

Toggle word wrap

3.3. Validate a node in IdM
复制链接

Locate an overcloud node in IdM and confirm that the host entry includes Keytab:True:

ipa host-show overcloud-node-01

$ ipa host-show overcloud-node-01
  Host name: overcloud-node-01.lab.local
  Principal name: host/overcloud-node-01.lab.local@LAB.LOCAL
  Principal alias: host/overcloud-node-01.lab.local@LAB.LOCAL
  SSH public key fingerprint: <snip>
  Password: False
  Keytab: True
  Managed by: overcloud-node-01.lab.local

Copy to Clipboard

Toggle word wrap

SSH to the node and confirm that sssd can query IdM users. For example, to query an IdM user named susan:
```
getent passwd susan
```
```
$ getent passwd susan
uid=1108400007(susan) gid=1108400007(bob) groups=1108400007(susan)
```
Copy to Clipboard Toggle word wrap

3.4. Configure DNS entries for Novajoin
复制链接

If you use the haproxy-public-tls-certmonger.yaml template to issue public certificates for endpoints, then you will need to manually create DNS entries for the VIP endpoints used by Novajoin:

Identify the overcloud networks. You can expect to locate these in /home/stack/virt/network/network-environment.yaml:

parameter_defaults:
    ControlPlaneDefaultRoute: 192.168.24.1
    ExternalAllocationPools:
    -   end: 10.0.0.149
        start: 10.0.0.101
    InternalApiAllocationPools:
    -   end: 172.17.1.149
        start: 172.17.1.10
    StorageAllocationPools:
    -   end: 172.17.3.149
        start: 172.17.3.10
    StorageMgmtAllocationPools:
    -   end: 172.17.4.149
        start: 172.17.4.10

parameter_defaults:
    ControlPlaneDefaultRoute: 192.168.24.1
    ExternalAllocationPools:
    -   end: 10.0.0.149
        start: 10.0.0.101
    InternalApiAllocationPools:
    -   end: 172.17.1.149
        start: 172.17.1.10
    StorageAllocationPools:
    -   end: 172.17.3.149
        start: 172.17.3.10
    StorageMgmtAllocationPools:
    -   end: 172.17.4.149
        start: 172.17.4.10

Copy to Clipboard

Toggle word wrap

Create a list of virtual IP addresses (VIP) for each overcloud network. For example: /home/stack/virt/public_vip.yaml

parameter_defaults:
    ControlFixedIPs: [{'ip_address':'192.168.24.101'}]
    PublicVirtualFixedIPs: [{'ip_address':'10.0.0.101'}]
    InternalApiVirtualFixedIPs: [{'ip_address':'172.17.1.101'}]
    StorageVirtualFixedIPs: [{'ip_address':'172.17.3.101'}]
    StorageMgmtVirtualFixedIPs: [{'ip_address':'172.17.4.101'}]
    RedisVirtualFixedIPs: [{'ip_address':'172.17.1.102'}]

parameter_defaults:
    ControlFixedIPs: [{'ip_address':'192.168.24.101'}]
    PublicVirtualFixedIPs: [{'ip_address':'10.0.0.101'}]
    InternalApiVirtualFixedIPs: [{'ip_address':'172.17.1.101'}]
    StorageVirtualFixedIPs: [{'ip_address':'172.17.3.101'}]
    StorageMgmtVirtualFixedIPs: [{'ip_address':'172.17.4.101'}]
    RedisVirtualFixedIPs: [{'ip_address':'172.17.1.102'}]

Copy to Clipboard

Toggle word wrap

Add DNS entries to IdM for each of the VIPs. You may also need to create new zones. The following example demonstrates DNS record and zone creation for IdM:

ipa dnsrecord-add lab.local overcloud --a-rec 10.0.0.101
ipa dnszone-add ctlplane.lab.local
ipa dnsrecord-add ctlplane.lab.local overcloud --a-rec 192.168.24.101
ipa dnszone-add internalapi.lab.local
ipa dnsrecord-add internalapi.lab.local overcloud --a-rec 172.17.1.101
ipa dnszone-add storage.lab.local
ipa dnsrecord-add storage.lab.local overcloud --a-rec 172.17.3.101
ipa dnszone-add storagemgmt.lab.local
ipa dnsrecord-add storagemgmt.lab.local overcloud --a-rec 172.17.4.101

ipa dnsrecord-add lab.local overcloud --a-rec 10.0.0.101
ipa dnszone-add ctlplane.lab.local
ipa dnsrecord-add ctlplane.lab.local overcloud --a-rec 192.168.24.101
ipa dnszone-add internalapi.lab.local
ipa dnsrecord-add internalapi.lab.local overcloud --a-rec 172.17.1.101
ipa dnszone-add storage.lab.local
ipa dnsrecord-add storage.lab.local overcloud --a-rec 172.17.3.101
ipa dnszone-add storagemgmt.lab.local
ipa dnsrecord-add storagemgmt.lab.local overcloud --a-rec 172.17.4.101

Copy to Clipboard

Toggle word wrap

此内容没有您所选择的语言版本。

Chapter 3. Integrate with IdM using novajoin

3.1. Install and configure novajoin in the undercloud
复制链接

3.1.1. Add the undercloud to the CA
复制链接

3.1.2. Add the undercloud to IdM
复制链接

3.2. Install and configure novajoin in the overcloud
复制链接

3.2.1. Configure overcloud DNS
复制链接

3.2.2. Configure overcloud to use novajoin
复制链接

3.3. Validate a node in IdM
复制链接

3.4. Configure DNS entries for Novajoin
复制链接

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

此内容没有您所选择的语言版本。

Chapter 3. Integrate with IdM using novajoin

3.1. Install and configure novajoin in the undercloud复制链接链接已复制到粘贴板!

3.1.1. Add the undercloud to the CA复制链接链接已复制到粘贴板!

3.1.2. Add the undercloud to IdM复制链接链接已复制到粘贴板!

3.2. Install and configure novajoin in the overcloud复制链接链接已复制到粘贴板!

3.2.1. Configure overcloud DNS复制链接链接已复制到粘贴板!

3.2.2. Configure overcloud to use novajoin复制链接链接已复制到粘贴板!

3.3. Validate a node in IdM复制链接链接已复制到粘贴板!

3.4. Configure DNS entries for Novajoin复制链接链接已复制到粘贴板!

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

3.1. Install and configure novajoin in the undercloud
复制链接

3.1.1. Add the undercloud to the CA
复制链接

3.1.2. Add the undercloud to IdM
复制链接

3.2. Install and configure novajoin in the overcloud
复制链接

3.2.1. Configure overcloud DNS
复制链接

3.2.2. Configure overcloud to use novajoin
复制链接

3.3. Validate a node in IdM
复制链接

3.4. Configure DNS entries for Novajoin
复制链接