Skip to content

Commit fe169cb

Browse files
committed
fix: re-add keystone rxt auth to the default deployment
The keystone image we're using wasn't pointed at the rackerlabs image which broke our auth plugin. This change updates the image reference to our new 2024.1 image type and uncomments the auth section. Adds documentation on getting started with the CLI. Depends-On: rackerlabs/keystone-rxt#6 Signed-off-by: Kevin Carter <[email protected]>
1 parent c7c2840 commit fe169cb

8 files changed

+179
-61
lines changed

docs/openstack-deploy-cli.md

+37-20
Original file line numberDiff line numberDiff line change
@@ -2,49 +2,66 @@
22

33
Before we can get started we need to install a few things.
44

5-
#### Installing Python
5+
## Installing Python
66

7-
Installed by default on Mac OS X.
7+
While most operating systems have some form of Python already installed, you will need to ensure you have python available on your system to use the standard command line utilities. If you need to install python, consult your operating system documentation or the upstream python [documentation](https://www.python.org/downloads) to get started.
88

9-
Many Linux distributions provide packages to make setuptools easy to install. Search your package manager for setuptools to find an installation package. If you cannot find one, download the setuptools package directly from https://pip.pypa.io/en/stable/installation.
9+
### Installing `pip`
1010

11-
The recommended way to install setuptools on Microsoft Windows is to follow the documentation provided on the setuptools website (https://pypi.python.org/pypi/setuptools).
11+
Pip is the python package manager and can make installing libraries very simple; however, some build tools may be required. For more information on installing `pip`, consult the [upstream documentation](https://pip.pypa.io/en/stable/installation).
1212

13-
#### Installing pip
14-
15-
MacOS
16-
17-
!!! note
18-
19-
Users may want to use a Virtual Environment so that they do not have any risk of hurting their default Python environment. For more information on seting up a venv please visit (https://docs.python.org/3/library/venv.html).
13+
#### MacOS
2014

2115
``` shell
22-
easy_install pip
16+
python -m ensurepip --upgrade
2317
```
2418

25-
Microsoft Windows
19+
#### Microsoft Windows
2620

2721
Ensure that the C:\Python27\Scripts directory is defined in the PATH environment variable, and use the easy_install command from the setuptools package:
2822

2923
``` shell
30-
C:\>easy_install pip
24+
C:> py -m ensurepip --upgrade
3125
```
3226

33-
Ubuntu or Debian
27+
#### Linux
3428

3529
``` shell
36-
apt-get install python-dev python-pip
30+
python -m ensurepip --upgrade
3731
```
3832

39-
#### Installing the Openstack Client Using Pip
33+
### Installing the Openstack Client Using `pip`
34+
35+
Assuming you have `pip` installed, it can be used to install the openstack client utilities.
36+
37+
!!! tip
38+
39+
Users may want to use a Virtual Environment so that they do not have any risk of hurting their default Python environment. For more information on seting up a venv please visit the python [documentation](https://packaging.python.org/en/latest/tutorials/installing-packages/#creating-and-using-virtual-environments) on working with virtual environments.
4040

4141
``` shell
4242
pip install python-openstackclient
4343
```
4444

45-
!!! note
45+
For further information on Openstack Command Line and Authentication please visit the [upstream docs](https://docs.openstack.org/python-openstackclient/latest/cli/man/openstack.html).
4646

47-
You may want to set the PATH to you opesntack to more easily use the commands.
47+
### Installing the OpenStack Client with packages
4848

49+
Package based client install is a great way to simplify the installation process, however, it does come with a greater possibility to lag behind a given release and may not be as featurefull.
4950

50-
For further information on Openstack Command Line and Authentication please visit the [upstream docs](https://docs.openstack.org/python-openstackclient/latest/cli/man/openstack.html).
51+
#### MacOS
52+
53+
``` shell
54+
brew install openstackclient
55+
```
56+
57+
#### Ubuntu or Debian
58+
59+
``` shell
60+
apt install python3-openstackclient
61+
```
62+
63+
#### Enterprise Linux
64+
65+
``` shell
66+
dnf install python3-openstackclient
67+
```

docs/openstack-getting-started-cli.md

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# OpenStack Getting Started with CLI
2+
3+
After you have installed the OpenStack command-line tools, you can proceed with initializing your account. This guide will show you how to run a command with an unscoped and scoped token to set up your account.
4+
5+
!!! note
6+
7+
This document makes the assumption that your account has the `OPENSTACK_FLEX` role assigned to it. If you do not have the `OPENSTACK_FLEX` role, you may not be permitted access to the environment.
8+
9+
## Prerequisites
10+
11+
1. Ensure you have the OpenStack command-line tools installed. If not, follow the instructions in the [Openstack Deploying the Command Line Tools](openstack-deploy-cli.md) documentation.
12+
2. Obtain your OpenStack credentials: **username**, **password**, and **domain**.
13+
3. Obtain the authentication URL.
14+
15+
## Authenticating with OpenStack
16+
17+
Before you can run OpenStack commands, you need to authenticate using your OpenStack credentials. This involves obtaining an unscoped token and then using it to get a scoped token.
18+
19+
### Step 1: Obtain your projects
20+
21+
To obtain a list of our available projects, we'll need to run a command with an unscoped token. Unscoped tokens are used to identify a user but does not define an association with a project.
22+
23+
!!! note
24+
25+
This step authenticates you with the OpenStack Identity service (Keystone) and is required for first time access to the environment.
26+
27+
Run the following command, replacing the placeholders with your actual OpenStack credentials:
28+
29+
``` shell
30+
openstack project list --os-auth-url ${AUTH_URL} \
31+
--os-username ${USERNAME} \
32+
--os-password ${PASSWORD} \
33+
--os-user-domain-name ${DOMAIN_NAME}
34+
```
35+
36+
> Replace the placeholders with your actual credentials and project name.
37+
38+
This command returns a list of your available projects, the returned information will be used to in later commands
39+
40+
### Step 2: Obtain a Scoped Token
41+
42+
A scoped token is associated with a specific project and is used to perform actions within that project.
43+
44+
Run the following command to obtain a scoped token:
45+
46+
``` shell
47+
openstack token issue --os-auth-url ${AUTH_URL} \
48+
--os-username ${USERNAME} \
49+
--os-password ${PASSWORD} \
50+
--os-user-domain-name ${DOMAIN_NAME} \
51+
--os-project-domain-name ${DOMAIN_NAME} \
52+
--os-project-name ${PROJECT_NAME}
53+
```
54+
55+
This command returns a scoped token that you will use for subsequent OpenStack commands.
56+
57+
## Running an OpenStack Command
58+
59+
With your scoped token, you can now run OpenStack commands. For example, to list the available flavors, use:
60+
61+
``` shell
62+
openstack flavor list --os-auth-url ${AUTH_URL} \
63+
--os-username ${USERNAME} \
64+
--os-password ${PASSWORD} \
65+
--os-user-domain-name ${DOMAIN_NAME} \
66+
--os-project-domain-name ${DOMAIN_NAME} \
67+
--os-project-name ${PROJECT_NAME}
68+
```
69+
70+
This command lists all flavors available to your project.
71+
72+
## Further Reading
73+
74+
For more detailed information on OpenStack command-line interface and authentication, refer to the [our documentation](openstack-clouds.md) for creating your `clouds.yaml`.
75+
76+
By following these steps, you should be able to initialize your account and start using the OpenStack CLI.

docs/openstack-keystone-federation.md

+11-1
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,21 @@ You're also welcome to generate your own mapping to suit your needs; however, if
2727
Now register the mapping within Keystone.
2828

2929
``` shell
30-
openstack --os-cloud default mapping create --rules /tmp/mapping.json rackspace_mapping
30+
openstack --os-cloud default mapping create --rules /tmp/mapping.json --schema-version 2.0 rackspace_mapping
3131
```
3232

3333
## Create the federation protocol
3434

3535
``` shell
3636
openstack --os-cloud default federation protocol create rackspace --mapping rackspace_mapping --identity-provider rackspace
3737
```
38+
39+
## Rackspace Configuration Options
40+
41+
The `[rackspace]` section can also be used in your `keystone.conf` to allow you to configure how to anchor on
42+
roles.
43+
44+
| key | value | default |
45+
| --- | ----- | ------- |
46+
| `role_attribute` | A string option used as an anchor to discover roles attributed to a given user | **os_flex** |
47+
| `role_attribute_enforcement` | When set `true` will limit a users project to only the discovered GUID for the defined `role_attribute` | **false** |

etc/keystone/mapping.json

+8-2
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,19 @@
44
{
55
"user": {
66
"name": "{0}",
7-
"email": "{1}"
7+
"email": "{1}",
8+
"domain": {
9+
"name": "rackspace_cloud_domain"
10+
}
811
}
912
},
1013
{
1114
"projects": [
1215
{
13-
"name": "{2}_Flex",
16+
"name": "{2}",
17+
"domain": {
18+
"name": "rackspace_cloud_domain"
19+
},
1420
"roles": [
1521
{
1622
"name": "member"

helm-configs.example/aio-example-openstack-overrides.yaml

+7-7
Original file line numberDiff line numberDiff line change
@@ -37,14 +37,14 @@ images:
3737
cinder_storage_init: "docker.io/openstackhelm/ceph-config-helper:ubuntu_focal_18.2.0-1-20231013"
3838
cinder_backup: "docker.io/openstackhelm/cinder:2023.1-ubuntu_jammy"
3939
cinder_backup_storage_init: "docker.io/openstackhelm/ceph-config-helper:ubuntu_focal_18.2.0-1-20231013"
40-
keystone_api: "ghcr.io/rackerlabs/genestack/keystone-rxt:2023.1-ubuntu_jammy"
40+
keystone_api: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
4141
keystone_bootstrap: "docker.io/openstackhelm/heat:2023.1-ubuntu_jammy"
42-
keystone_credential_rotate: "ghcr.io/rackerlabs/genestack/keystone-rxt:2023.1-ubuntu_jammy"
43-
keystone_credential_setup: "ghcr.io/rackerlabs/genestack/keystone-rxt:2023.1-ubuntu_jammy"
44-
keystone_db_sync: "ghcr.io/rackerlabs/genestack/keystone-rxt:2023.1-ubuntu_jammy"
45-
keystone_domain_manage: "ghcr.io/rackerlabs/genestack/keystone-rxt:2023.1-ubuntu_jammy"
46-
keystone_fernet_rotate: "ghcr.io/rackerlabs/genestack/keystone-rxt:2023.1-ubuntu_jammy"
47-
keystone_fernet_setup: "ghcr.io/rackerlabs/genestack/keystone-rxt:2023.1-ubuntu_jammy"
42+
keystone_credential_rotate: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
43+
keystone_credential_setup: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
44+
keystone_db_sync: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
45+
keystone_domain_manage: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
46+
keystone_fernet_rotate: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
47+
keystone_fernet_setup: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
4848
keystone_credential_cleanup: "docker.io/openstackhelm/heat:2023.1-ubuntu_jammy"
4949
libvirt: docker.io/openstackhelm/libvirt:2023.2-ubuntu_jammy # We want to use jammy. 2023.2 is the latest version that supports jammy.
5050
libvirt_exporter: vexxhost/libvirtd-exporter:latest

helm-configs.example/keystone/keystone-helm-overrides.yaml

+14-11
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,14 @@ images:
2121
bootstrap: "docker.io/openstackhelm/heat:2024.1-ubuntu_jammy"
2222
db_init: "docker.io/openstackhelm/heat:2024.1-ubuntu_jammy"
2323
db_drop: "docker.io/openstackhelm/heat:2024.1-ubuntu_jammy"
24-
keystone_api: "docker.io/aedan/keystone:2024.1-ubuntu_jammy"
24+
keystone_api: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
2525
keystone_bootstrap: "docker.io/openstackhelm/heat:2024.1-ubuntu_jammy"
26-
keystone_credential_rotate: "docker.io/aedan/keystone:2024.1-ubuntu_jammy"
27-
keystone_credential_setup: "docker.io/aedan/keystone:2024.1-ubuntu_jammy"
28-
keystone_db_sync: "docker.io/aedan/keystone:2024.1-ubuntu_jammy"
29-
keystone_domain_manage: "docker.io/aedan/keystone:2024.1-ubuntu_jammy"
30-
keystone_fernet_rotate: "docker.io/aedan/keystone:2024.1-ubuntu_jammy"
31-
keystone_fernet_setup: "docker.io/aedan/keystone:2024.1-ubuntu_jammy"
26+
keystone_credential_rotate: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
27+
keystone_credential_setup: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
28+
keystone_db_sync: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
29+
keystone_domain_manage: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
30+
keystone_fernet_rotate: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
31+
keystone_fernet_setup: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
3232
ks_user: "docker.io/openstackhelm/heat:2024.1-ubuntu_jammy"
3333
test: docker.io/xrally/xrally-openstack:2.0.0
3434
rabbit_init: docker.io/rabbitmq:3.7-management
@@ -550,10 +550,13 @@ conf:
550550
# NOTE(vdrok): The following two options have effect only for SQL backend
551551
lockout_failure_attempts: 5
552552
lockout_duration: 1800
553-
# auth:
554-
# methods: password,token,application_credential,rxt
555-
# password: rxt
556-
# totp: rxt
553+
auth:
554+
methods: password,token,application_credential,totp
555+
password: rxt
556+
totp: rxt
557+
rackspace:
558+
role_attribute: os_flex
559+
role_attribute_enforcement: False # This should be set to true in production environments.
557560

558561
# NOTE(lamt) We can leverage multiple domains with different
559562
# configurations as outlined in

helm-configs.example/prod-example-openstack-overrides.yaml

+7-7
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,14 @@ images:
3636
cinder_storage_init: "docker.io/openstackhelm/ceph-config-helper:ubuntu_focal_18.2.0-1-20231013"
3737
cinder_backup: "docker.io/openstackhelm/cinder:2023.1-ubuntu_jammy"
3838
cinder_backup_storage_init: "docker.io/openstackhelm/ceph-config-helper:ubuntu_focal_18.2.0-1-20231013"
39-
keystone_api: "ghcr.io/rackerlabs/genestack/keystone-rxt:2023.1-ubuntu_jammy"
39+
keystone_api: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
4040
keystone_bootstrap: "docker.io/openstackhelm/heat:2023.1-ubuntu_jammy"
41-
keystone_credential_rotate: "ghcr.io/rackerlabs/genestack/keystone-rxt:2023.1-ubuntu_jammy"
42-
keystone_credential_setup: "ghcr.io/rackerlabs/genestack/keystone-rxt:2023.1-ubuntu_jammy"
43-
keystone_db_sync: "ghcr.io/rackerlabs/genestack/keystone-rxt:2023.1-ubuntu_jammy"
44-
keystone_domain_manage: "ghcr.io/rackerlabs/genestack/keystone-rxt:2023.1-ubuntu_jammy"
45-
keystone_fernet_rotate: "ghcr.io/rackerlabs/genestack/keystone-rxt:2023.1-ubuntu_jammy"
46-
keystone_fernet_setup: "ghcr.io/rackerlabs/genestack/keystone-rxt:2023.1-ubuntu_jammy"
41+
keystone_credential_rotate: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
42+
keystone_credential_setup: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
43+
keystone_db_sync: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
44+
keystone_domain_manage: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
45+
keystone_fernet_rotate: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
46+
keystone_fernet_setup: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1720466623"
4747
keystone_credential_cleanup: "docker.io/openstackhelm/heat:2023.1-ubuntu_jammy"
4848
libvirt: docker.io/openstackhelm/libvirt:2023.2-ubuntu_jammy # We want to use jammy. 2023.2 is the latest version that supports jammy.
4949
libvirt_exporter: vexxhost/libvirtd-exporter:latest

mkdocs.yml

+19-13
Original file line numberDiff line numberDiff line change
@@ -214,23 +214,29 @@ nav:
214214
- OVN traffic flow introduction: ovn-traffic-flow-intro.md
215215
- OVN Database Backup: infrastructure-ovn-db-backup.md
216216
- MariaDB Operations: infrastructure-mariadb-ops.md
217-
- OpenStack:
218-
- Generating Clouds YAML: openstack-clouds.md
219-
- Keystone Federation to Rackspace: openstack-keystone-federation.md
220-
- Keystone Readonly Users: openstack-keystone-readonly.md
221-
- Nova Flavor Creation: openstack-flavors.md
222-
- Nova CPU Allocation Ratio: openstack-cpu-allocation-ratio.md
223-
- Nova PCI Passthrough: openstack-pci-passthrough.md
224-
- Service Overrides: openstack-service-overrides.md
225-
- Creating Networks: openstack-neutron-networks.md
226-
- Glance Images Creation: openstack-glance-images.md
227-
- Building Local Images: build-local-images.md
228-
- Working Locallly With Docs: mkdocs-howto.md
217+
- Building Local Images: build-local-images.md
229218
- Third Party Tools:
230219
- OSIE: extra-osie.md
220+
- OpenStack:
221+
- CLI Access:
222+
- Generating Clouds YAML: openstack-clouds.md
223+
- Compute:
224+
- Nova Flavor Creation: openstack-flavors.md
225+
- Nova CPU Allocation Ratio: openstack-cpu-allocation-ratio.md
226+
- Nova PCI Passthrough: openstack-pci-passthrough.md
227+
- Images:
228+
- Glance Images Creation: openstack-glance-images.md
229+
- Identity:
230+
- Keystone Federation to Rackspace: openstack-keystone-federation.md
231+
- Keystone Readonly Users: openstack-keystone-readonly.md
232+
- Networking:
233+
- Creating Networks: openstack-neutron-networks.md
234+
- Service Overrides: openstack-service-overrides.md
235+
- Working locally With Docs: mkdocs-howto.md
231236
- Cloud Onboarding:
232237
- Cloud Onboarding Welcome: cloud-onboarding-welcome.md
233-
- Openstack Deploying CLI Tools: openstack-deploy-cli.md
238+
- Openstack Installing CLI Tools: openstack-deploy-cli.md
239+
- OpenStack Getting Started: openstack-getting-started-cli.md
234240
- Openstack Security Groups: openstack-security-groups.md
235241
- Openstack Floating Ips: openstack-floating-ips.md
236242
- Openstack Keypairs: openstack-keypairs.md

0 commit comments

Comments
 (0)