9.2. Configure the Orchestration Service

Procedure 9.1. Configuring the Orchestration Service Database

1. Connect to the database service:

   # mysql -u root -p

   Copy to Clipboard Toggle word wrap
2. Create the heat database:

   mysql> CREATE DATABASE heat;

   Copy to Clipboard Toggle word wrap
3. Create a database user named heat and grant the user access to the heat database:

   mysql> GRANT ALL ON heat.* TO 'heat'@'%' IDENTIFIED BY 'PASSWORD';
   mysql> GRANT ALL ON heat.* TO 'heat'@'localhost' IDENTIFIED BY 'PASSWORD';

   Copy to Clipboard Toggle word wrap
   Replace PASSWORD with a secure password that will be user to authenticate with the database server as this user.
4. Flush the database privileges to ensure that they take effect immediately:

   mysql> FLUSH PRIVILEGES;

   Copy to Clipboard Toggle word wrap
5. Exit the mysql client:

   mysql> quit

   Copy to Clipboard Toggle word wrap
6. Set the value of the sql_connection configuration key:

   # openstack-config --set /etc/heat/heat.conf \
      DEFAULT sql_connection mysql://heat:PASSWORD@IP/heat

   Copy to Clipboard Toggle word wrap
   Replace the following values:
   • Replace PASSWORD with the password of the heat database user.
   • Replace IP with the IP address or host name of the database server.
7. As the heat user, sync the database:

   # runuser -s /bin/sh heat -c "heat-manage db_sync"

   Copy to Clipboard Toggle word wrap

Procedure 9.2. Creating Identity Records for the Orchestration Service

1. Set up the shell to access Keystone as the administrative user:

   # source ~/keystonerc_admin

   Copy to Clipboard Toggle word wrap
2. Create the heat user:

   [(keystone_admin)]# keystone user-create --name heat --pass PASSWORD
   +----------+----------------------------------+
   | Property |              Value               |
   +----------+----------------------------------+
   |  email   |                                  |
   | enabled  |               True               |
   |    id    | 96cd855e5bfe471ce4066794bbafb615 |
   |   name   |               heat               |
   | username |               heat               |
   +----------+----------------------------------+

   Copy to Clipboard Toggle word wrap
   Replace PASSWORD with a password that will be used by the Orchestration service when authenticating with the Identity service.
3. Link the heat user and the admin role together within the context of the services tenant:

   [(keystone_admin)]# keystone user-role-add --user heat --role admin --tenant services

   Copy to Clipboard Toggle word wrap
4. Create the heat and heat-cfn service entries:

   [(keystone_admin)]# keystone service-create --name heat \
      --type orchestration
   # keystone service-create --name heat-cfn \
      --type cloudformation

   Copy to Clipboard Toggle word wrap
5. Create endpoint entries for the heat service and the heat-cfn service:

   [(keystone_admin)]# keystone endpoint-create \
      --service heat-cfn \
      --publicurl 'HEAT_CFN_IP:8000/v1' \
      --adminurl 'HEAT_CFN_IP:8000/v1' \
      --internalurl 'HEAT_CFN_IP:8000/v1' \
      --region 'RegionOne'
   [(keystone_admin)]# keystone endpoint-create \
      --service heat \
      --publicurl 'HEAT_IP:8004/v1/%(tenant_id)s' \
      --adminurl 'HEAT_IP:8004/v1/%(tenant_id)s' \
      --internalurl 'HEAT_IP:8004/v1/%(tenant_id)s' \
      --region 'RegionOne'

   Copy to Clipboard Toggle word wrap
   Replace the following values:
   • Replace HEAT_CFN_IP with the IP or host name of the system hosting the heat-cfn service.
   • Replace HEAT_IP with the IP or host name of the system hosting the heat service.

   Important

   Include the http:// prefix for HEAT_CFN_IP and HEAT_IP values.

Procedure 9.4. Configuring the Orchestration Service to Authenticate Through the Identity Service

1. Set the Orchestration services to authenticate as the correct tenant:

   # openstack-config --set /etc/heat/heat.conf \
      keystone_authtoken admin_tenant_name services

   Copy to Clipboard Toggle word wrap
   Replace services is the name of the tenant created for the use of the Orchestration service. Examples in this guide use services.
2. Set the Orchestration services to authenticate using the heat administrative user account:

   # openstack-config --set /etc/heat/heat.conf \
      keystone_authtoken admin_user heat

   Copy to Clipboard Toggle word wrap
3. Set the Orchestration services to use the correct heat administrative user account password:

   # openstack-config --set /etc/heat/heat.conf \
      keystone_authtoken admin_password PASSWORD

   Copy to Clipboard Toggle word wrap
   Replace PASSWORD with the password set when the heat user was created.
4. Set the Identity service host that the Orchestration services must use:

   # openstack-config --set /etc/heat/heat.conf \
      keystone_authtoken service_host KEYSTONE_HOST
   # openstack-config --set /etc/heat/heat.conf \
      keystone_authtoken auth_host KEYSTONE_HOST 
   # openstack-config --set /etc/heat/heat.conf \	
      keystone_authtoken auth_uri http://KEYSTONE_HOST:35357/v2.0
   # openstack-config --set /etc/heat/heat.conf \	
      keystone_authtoken keystone_ec2_uri http://KEYSTONE_HOST:35357/v2.0

   Copy to Clipboard Toggle word wrap
   Replace KEYSTONE_HOST with the IP address or host name of the server hosting the Identity service. If the Identity service is hosted on the same system, use 127.0.0.1.
5. Configure the heat-api-cfn and heat-api-cloudwatch service host names to which virtual machine instances will connect:

   # openstack-config --set /etc/heat/heat.conf \
      DEFAULT heat_metadata_server_url HEAT_CFN_HOST:8000
   # openstack-config --set /etc/heat/heat.conf \	
      DEFAULT heat_waitcondition_server_url HEAT_CFN_HOST:8000/v1/waitcondition
   # openstack-config --set /etc/heat/heat.conf \	
      DEFAULT heat_watch_server_url HEAT_CLOUDWATCH_HOST:8003

   Copy to Clipboard Toggle word wrap
   Replace the following values:
   • Replace HEAT_CFN_HOST with the IP address or host name of the server hosting the heat-api-cfn service.
   • Replace HEAT_CLOUDWATCH_HOST with the IP address or host name of the server hosting the heat-api-cloudwatch service.

   Important

   Even if all services are hosted on the same system, do not use 127.0.0.1 for either service host name. This IP address refers to the local host of each instance, and would therefore prevent the instance from reaching the actual service.
6. Application templates use wait conditions and signaling for orchestration. Define the Identity role for users that should receive progress data. By default, this role is heat_stack_user:

   # openstack-config --set /etc/heat/heat.conf \
      DEFAULT heat_stack_user_role heat_stack_user

   Copy to Clipboard Toggle word wrap

Procedure 9.5. Configuring the Orchestration Service to use the RabbitMQ Message Broker

1. Set RabbitMQ as the RPC back end:

   # openstack-config --set /etc/heat/heat.conf \
      DEFAULT rpc_backend heat.openstack.common.rpc.impl_kombu

   Copy to Clipboard Toggle word wrap
2. Set the Orchestration service to connect to the RabbitMQ host:

   # openstack-config --set /etc/heat/heat.conf \
      DEFAULT rabbit_host RABBITMQ_HOST

   Copy to Clipboard Toggle word wrap
   Replace RABBITMQ_HOST with the IP address or host name of the message broker.
3. Set the message broker port to 5672:

   # openstack-config --set /etc/heat/heat.conf \
      DEFAULT rabbit_port 5672

   Copy to Clipboard Toggle word wrap
4. Set the RabbitMQ user name and password created for the Orchestration service when RabbitMQ was configured:

   # openstack-config --set /etc/heat/heat.conf \
      DEFAULT rabbit_userid heat
   # openstack-config --set /etc/heat/heat.conf \
      DEFAULT rabbit_password HEAT_PASS

   Copy to Clipboard Toggle word wrap
   Replace heat and HEAT_PASS with the RabbitMQ user name and password created for the Orchestration service.
5. When RabbitMQ was launched, the heat user was granted read and write permissions to all resources: specifically, through the virtual host /. Configure the Orchestration service to connect to this virtual host:

   # openstack-config --set /etc/heat/heat.conf \
      DEFAULT rabbit_virtual_host /

   Copy to Clipboard Toggle word wrap

Procedure 9.6. Enabling SSL Communication Between the Orchestration Service and the RabbitMQ Message Broker

1. Enable SSL communication with the message broker:

   # openstack-config --set /etc/heat/heat.conf \
      DEFAULT rabbit_use_ssl True
   # openstack-config --set /etc/heat/heat.conf \
      DEFAULT kombu_ssl_certfile /path/to/client.crt
   # openstack-config --set /etc/heat/heat.conf \
      DEFAULT kombu_ssl_keyfile /path/to/clientkeyfile.key

   Copy to Clipboard Toggle word wrap
   Replace the following values:
   • Replace /path/to/client.crt with the absolute path to the exported client certificate.
   • Replace /path/to/clientkeyfile.key with the absolute path to the exported client key file.
2. If your certificates were signed by a third-party Certificate Authority (CA), you must also run the following command:

   # openstack-config --set /etc/heat/heat.conf \
      DEFAULT kombu_ssl_ca_certs /path/to/ca.crt

   Copy to Clipboard Toggle word wrap
   Replace /path/to/ca.crt with the absolute path to the CA file provided by the third-party CA (see Section 2.3.4, “Enable SSL on the RabbitMQ Message Broker” for more information).