This document provides an overview and introduction to the Keystone identity service in OpenStack. It defines key concepts in Keystone including users, tenants, roles, tokens, services, and endpoints. It also provides examples of using the keystone CLI to list and get information about users, tenants, services, and endpoints. The document concludes by assigning homework of setting up additional roles, endpoints, and services in Keystone to enable the Glance image service, and installing Glance in preparation for the next session.

1. Identity - Keystone
Couch To OpenStack

2. - Subscribe & Recordings: http://bit.ly/BrownbagPodcast
- Sign up for the rest of the series:
http://openstack.prov12n.com/about-couch-to-openstack/
Some Logistics

3. On Twitter: #vBrownBag
Also: @cody_bunch
Join the conversation

4. - New Edition: http://www.packtpub.com/openstack-cloud-
computing-cookbook-second-edition/book
- Old Edition: http://amzn.to/12eI6rX
Buy the Book

5. 7/2/2013 – Intro to OpenStack < Recording here: http://buff.ly/1cQZ3xC
7/9/2013 – Vagrant Primer < Recording here: http://bit.ly/149FnWt
7/16/2013 – Identity services (Keystone) << We Are Here
7/23/2013 – Image services (Glance)
7/30/2013 – Compute Services (Nova)
8/6/2013 – Block Storage / Volume Services (Cinder)
8/13/2013 – Networking Services (Quantum)
8/20/2013 - Monitoring & Troubleshooting
8/27/2013 - HA OpenStack
9/3/2013 – DevOps Deployments
Note: Dates are subject to change depending on how far we get in each lesson.
The Rest of the Series

6. Y’all did the homework right?
Remember we have a G+ Support group here:
https://plus.google.com/communities/1016630525883821
71429
Homework Review

7. - git clone
https://github.com/bunchc/Couch_to_OpenStack.git
- cd Couch_to_OpenStack
- vagrant up
Build Time!

8. - Adds the Grizzly packages for Ubuntu
- Set’s a bunch of variables
- Installs MySQL
- Creates a DB
- Creates a User
- Assigns User to DB
- Installs keystone
- Configs keystone
- Creates a user / tenant / endpoint, etc
Build – What’s it doing?

9. - Identity Management Service
- Provides centralized Authentication and Authorization
for OpenStack Services
- … Let’s take a look:
Keystone Intro

10. Keystone Intro

11. - Users
- A User or Service
- Set of credentials
- User / Pass
- User / API Key
- User / RSA Token
- etc
Concepts - Users

12. - Tenant
- A collection of resources
- Instances in Nova
- Networks in Neutron
- Images in Glance
- aka “projects”
Concepts - Tenants

13. - Role
- Binds a user to a tenant
- Privileges or Rights on a set of resources
- For example
- Access to networks
- Ability to upload images
- Access to consoles
Concepts - Roles

14. - Token
- Arbitrary bit of text
- Provides context & scope for authorization
- PKI Tokens in Grizzly
- keystone.token.providers.pki.Provider
- Additional providers in the future
Concepts – Token

15. - Service
- An OpenStack Service
- Keystone
- Cinder
- Nova
- etc
- Provides “endpoints”, or URLs users can use to
operate the services
Concepts – Service

16. - Endpoint
- Network Address / URL for a service
- Admin
- Internal
- Public
Concepts – Endpoint

17. - http://docs.openstack.org/trunk/openstack-
identity/admin/content/Identity-Service-Concepts-
e1362.html
- http://www.slideshare.net/kamesh001/openstack-
keystone
- http://docs.openstack.org/developer/keystone/configur
ation.html
Concepts – Reference

18. - vagrant ssh controller
- sudo su -
- cat .stackrc
- export OS_TENANT_NAME=cookbook
- export OS_USERNAME=admin
- export OS_PASSWORD=openstack
- export OS_AUTH_URL=http://${MY_IP}:5000/v2.0/
- source .stackrc
Using Keystone!

19. - keystone service-list
+----------------------------------+----------+----------+---------------------------+
| id | name | type | description |
+----------------------------------+----------+----------+---------------------------+
| cd9aedf1430e48aa9d63af7c52581aa0 | cinder | volume | Cinder Volume Service |
| 9ed2fcefaf70476896b7b5dd3fff1a8c | ec2 | ec2 | EC2 Compatibility Layer |
| 830ed2c03fd742a586c5c378f6c540e0 | glance | image | Glance Image Service |
| 9103fbbc247248ea9132025e91ba7025 | keystone | identity | Keystone Identity Service |
| e75645d65beb4a95a79d1b3cabf7f256 | nova | compute | Nova Compute Service |
+----------------------------------+----------+----------+---------------------------+
- keystone service-get <UUID>
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | Keystone Identity Service |
| id | 9103fbbc247248ea9132025e91ba7025 |
| name | keystone |
| type | identity |
+-------------+----------------------------------+
List Services

20. # keystone user-list
+----------------------------------+------------+---------+-------+
| id | name | enabled | email |
+----------------------------------+------------+---------+-------+
| 390f2da1b41447aea3fa87f3feb77159 | admin | True | |
| e2d55836f1d64e7d9131eedb222803ea | cinder | True | |
| 690ba1fd20104b7db99873c02d7497a3 | glance | True | |
| 62b9f4c6924749deb80c2f3e0ed86df8 | monitoring | True | |
| 3b57d891ef9649c087d6c7259f0cdf80 | nova | True | |
+----------------------------------+------------+---------+-------+
# keystone user-get 3b57d891ef9649c087d6c7259f0cdf80
+----------+----------------------------------+
| Property | Value |
+----------+----------------------------------+
| email | |
| enabled | True |
| id | 3b57d891ef9649c087d6c7259f0cdf80 |
| name | nova |
| tenantId | 5551bace71ff4d3f891176fe22cb3016 |
+----------+----------------------------------+
List Users

21. # keystone tenant-list
+----------------------------------+---------+---------+
| id | name | enabled |
+----------------------------------+---------+---------+
| e9f36d967ce249398f223da966fac706 | admin | True |
| 5551bace71ff4d3f891176fe22cb3016 | service | True |
+----------------------------------+---------+---------+
# keystone tenant-get 5551bace71ff4d3f891176fe22cb3016
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | service Tenant |
| enabled | True |
| id | 5551bace71ff4d3f891176fe22cb3016 |
| name | service |
+-------------+----------------------------------+
List Tenants

22. # keystone endpoint-list
+----------------------------------+-----------+-------------------------------------------+---------------------------
----------------+-------------------------------------------+----------------------------------+
| id | region | publicurl | internalurl
| adminurl | service_id |
+----------------------------------+-----------+-------------------------------------------+---------------------------
----------------+-------------------------------------------+----------------------------------+
| 087c7b7b7a4c433c97414db7187d0ac1 | RegionOne | http://10.178.22.42:8773/services/Cloud |
http://10.178.22.42:8773/services/Cloud | http://10.178.22.42:8773/services/Admin | 9ed2fcefaf70476896b7b5dd3fff1a8c
|
| 520e98d49f5e4c23a93f278cf12a4b22 | RegionOne | http://10.178.22.42:5000/v2.0 |
http://10.178.22.42:5000/v2.0 | http://10.178.22.42:35357/v2.0 | 9103fbbc247248ea9132025e91ba7025 |
| 8c253aea03cb445fbe5549bf65baf430 | RegionOne | http://10.178.22.42:9292/v1 |
http://10.178.22.42:9292/v1 | http://10.178.22.42:9292/v1 | 830ed2c03fd742a586c5c378f6c540e0 |
| ec3a2237002c4dbdb4db365fbc961aa1 | RegionOne | http://10.178.22.42:8776/v1/%(tenant_id)s |
http://10.178.22.42:8776/v1/%(tenant_id)s | http://10.178.22.42:8776/v1/%(tenant_id)s |
cd9aedf1430e48aa9d63af7c52581aa0 |
| f9aa590ca08346a6a4a228b993cdcf39 | RegionOne | http://10.178.22.42:8774/v2/%(tenant_id)s |
http://10.178.22.42:8774/v2/%(tenant_id)s | http://10.178.22.42:8774/v2/%(tenant_id)s |
e75645d65beb4a95a79d1b3cabf7f256 |
+----------------------------------+-----------+-------------------------------------------+---------------------------
----------------+-------------------------------------------+----------------------------------+
# keystone endpoint-get --service identity
+--------------------+-------------------------------+
| Property | Value |
+--------------------+-------------------------------+
| identity.publicURL | http://10.178.22.42:5000/v2.0 |
+--------------------+-------------------------------+
List Endpoints

23. We’re going to need some things to make Glance work next week. Specifically, you’ll want a
role, endpoint, service, and maybe some others in keystone.
Additionally, like getting keystone up and running, let’s try to get glance installed for next
week as well.
Homework!