OpenStack Havana - Configure Keystone#1
2013/10/22 |
Install and Configure OpenStack Identity Service (Keystone).
|
|
[1] | Install Keystone |
# install from EPEL OpenStack, EPEL [root@dlp ~]# yum --enablerepo=openstack-havana,epel -y install openstack-keystone openstack-utils
|
[2] | Configure Keystone |
# set database ( set any password you like for "password" section ) [root@dlp ~]# openstack-db --init --service keystone --password password Please enter the password for the 'root' MySQL user: # MySQL root password Verified connectivity to MySQL. Creating 'keystone' database. Updating 'keystone' database password in /etc/keystone/keystone.conf Initializing the keystone database, please wait... Complete!
[root@dlp ~]#
vi /etc/keystone/keystone.conf # line 3 : uncomment and change admin_token = admintoken
# line 6 : uncomment bind_host = 0.0.0.0 # line 9 : uncomment public_port = 5000 # line 12 : uncomment admin_port = 35357 # line 20 : uncomment compute_port = 8774 # line 310 : uncomment and add token_format = PKI
# line 312 : uncomment all and chnage to your locations like below certfile = /etc/keystone/pki/certs/signing_cert.pem keyfile = /etc/keystone/pki/private/signing_key.pem ca_certs = /etc/keystone/pki/certs/cacert.pem ca_key = /etc/keystone/pki/private/cakey.pem key_size = 2048 valid_days = 3650 cert_subject = /C=JP/ST=Hiroshima/L=Hiroshima/O=Server_World/CN=dlp.srv.world
keystone-manage pki_setup --keystone-user keystone --keystone-group keystone 2013-10-22 19:30:28.215 2276 INFO keystone.common.openssl [-] openssl req -key /etc/keystone/pki/private/signing_key.pem -new -out /etc/keystone/pki/certs/req.pem -config /etc/keystone/pki/certs/openssl.conf -subj /C=JP/ST=Hiroshima/L=Hiroshima/O=Server_World/CN=dlp.srv.world 2013-10-22 19:30:28.229 2276 INFO keystone.common.openssl [-] openssl ca -batch -out /etc/keystone/pki/certs/signing_cert.pem -config /etc/keystone/pki/certs/openssl.conf -days 3650d -cert /etc/keystone/pki/certs/cacert.pem -keyfile /etc/keystone/pki/private/cakey.pem -infiles /etc/keystone/pki/certs/req.pem Using configuration from /etc/keystone/pki/certs/openssl.conf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'JP' stateOrProvinceName :ASN.1 12:'Hiroshima' localityName :ASN.1 12:'Hiroshima' organizationName :ASN.1 12:'Server_World' commonName :ASN.1 12:'dlp.srv.world' Certificate is to be certified until Oct 20 10:30:28 2023 GMT (3650 days) Write out database with 1 new entries Data Base Updated[root@dlp ~]# /etc/rc.d/init.d/openstack-keystone start Starting keystone: [ OK ] [root@dlp ~]# chkconfig openstack-keystone on |