Juju Charm - Keystone
Go to file
David Ames 1861bfea42 [1chb1n, r=thedac] wait for unit status and turn on releases for amulet tests 2016-01-21 11:51:44 -08:00
actions Change pause/resume actions use (new) assess_status() 2016-01-13 15:13:10 +00:00
charmhelpers [corey.bryant,r=osci] Sync charm-helpers. 2016-01-11 14:22:31 +00:00
hooks [tinwood,r=thedac] Fixes Bug#1526511 change pause/resume actions use (new) assess_status() 2016-01-19 08:54:03 -08:00
scripts Sync scripts/. 2013-04-09 11:35:51 -07:00
templates [hopem,r=] 2015-12-07 15:04:38 +01:00
tests rebase 2016-01-20 04:33:10 +00:00
unit_tests [tinwood,r=thedac] Fixes Bug#1526511 change pause/resume actions use (new) assess_status() 2016-01-19 08:54:03 -08:00
.bzrignore Add tox support 2015-10-31 08:30:09 +09:00
.coveragerc Move actions to action.py 2015-08-19 09:22:21 +03:00
.project Merge ssl-everywhere branch (may break stuff) 2014-03-27 10:54:38 +00:00
.pydevproject Support https under multiple networks 2014-09-22 15:23:26 +01:00
.testr.conf Add missing files 2015-11-03 11:02:17 +00:00
Makefile Move 00-setup to prevent extra, unnecessary bootstrap in test runs. 2016-01-08 21:44:55 +00:00
README.md [corey.bryant,trivial] Update deploy from source README samples. 2015-04-30 12:09:22 +00:00
actions.yaml Action-managed upgrade support. 2015-10-07 12:20:36 -04:00
charm-helpers-hooks.yaml [corey.bryant,r=trivial] Enable sync of payload.archive 2016-01-08 02:35:15 +00:00
charm-helpers-tests.yaml Sync charm-helpers. 2015-06-24 19:17:17 +00:00
config.yaml Fix lp:1522130 Add sane haproxy timeout defaults and make them configurable. 2015-12-03 14:47:11 -08:00
copyright Add copyright 2011-12-23 17:55:37 -08:00
icon.svg Fix icon.svg. 2013-11-04 00:56:57 -08:00
metadata.yaml Update maintainer 2015-11-18 10:35:54 +00:00
requirements.txt Add missing files 2015-11-03 11:02:17 +00:00
setup.cfg Add trivial test config 2014-03-31 11:18:06 +01:00
test-requirements.txt Add missing files 2015-11-03 11:02:17 +00:00
tox.ini Add missing files 2015-11-03 11:02:17 +00:00

README.md

Overview

This charm provides Keystone, the Openstack identity service. It's target platform is (ideally) Ubuntu LTS + Openstack.

Usage

The following interfaces are provided:

- nrpe-external-master: Used to generate Nagios checks.

- identity-service: Openstack API endpoints request an entry in the 
  Keystone service catalog + endpoint template catalog. When a relation
  is established, Keystone receives: service name, region, public_url,
  admin_url and internal_url. It first checks that the requested service
  is listed as a supported service. This list should stay updated to
  support current Openstack core services. If the service is supported,
  an entry in the service catalog is created, an endpoint template is
  created and a admin token is generated. The other end of the relation
  receives the token as well as info on which ports Keystone is listening
  on.

- keystone-service: This is currently only used by Horizon/dashboard
  as its interaction with Keystone is different from other Openstack API
  services. That is, Horizon requests a Keystone role and token exists.
  During a relation, Horizon requests its configured default role and
  Keystone responds with a token and the auth + admin ports on which
  Keystone is listening.

- identity-admin: Charms use this relation to obtain the credentials
  for the admin user. This is intended for charms that automatically
  provision users, tenants, etc. or that otherwise automate using the
  Openstack cluster deployment.

- identity-notifications: Used to broadcast messages to any services
  listening on the interface.

Database

Keystone requires a database. By default, a local sqlite database is used. The charm supports relations to a shared-db via mysql-shared interface. When a new data store is configured, the charm ensures the minimum administrator credentials exist (as configured via charm configuration)

HA/Clustering

VIP is only required if you plan on multi-unit clustering (requires relating with hacluster charm). The VIP becomes a highly-available API endpoint.

SSL/HTTPS

This charm also supports SSL and HTTPS endpoints. In order to ensure SSL certificates are only created once and distributed to all units, one unit gets elected as an ssl-cert-master. One side-effect of this is that as units are scaled-out the currently elected leader needs to be running in order for nodes to sync certificates. This 'feature' is to work around the lack of native leadership election via Juju itself, a feature that is due for release some time soon but until then we have to rely on this. Also, if a keystone unit does go down, it must be removed from Juju i.e.

juju destroy-unit keystone/<unit-num>

Otherwise it will be assumed that this unit may come back at some point and therefore must be know to be in-sync with the rest before continuing.

Deploying from source

The minimum openstack-origin-git config required to deploy from source is:

openstack-origin-git: include-file://keystone-juno.yaml

keystone-juno.yaml
    repositories:
    - {name: requirements,
       repository: 'git://github.com/openstack/requirements',
       branch: stable/juno}
    - {name: keystone,
       repository: 'git://github.com/openstack/keystone',
       branch: stable/juno}

Note that there are only two 'name' values the charm knows about: 'requirements' and 'keystone'. These repositories must correspond to these 'name' values. Additionally, the requirements repository must be specified first and the keystone repository must be specified last. All other repostories are installed in the order in which they are specified.

The following is a full list of current tip repos (may not be up-to-date):

openstack-origin-git: include-file://keystone-master.yaml

keystone-master.yaml
    repositories:
    - {name: requirements,
       repository: 'git://github.com/openstack/requirements',
       branch: master}
    - {name: oslo-concurrency,
       repository: 'git://github.com/openstack/oslo.concurrency',
       branch: master}
    - {name: oslo-config,
       repository: 'git://github.com/openstack/oslo.config',
       branch: master}
    - {name: oslo-db,
       repository: 'git://github.com/openstack/oslo.db',
       branch: master}
    - {name: oslo-i18n,
       repository: 'git://github.com/openstack/oslo.i18n',
       branch: master}
    - {name: oslo-serialization,
       repository: 'git://github.com/openstack/oslo.serialization',
       branch: master}
    - {name: oslo-utils,
       repository: 'git://github.com/openstack/oslo.utils',
       branch: master}
    - {name: pbr,
       repository: 'git://github.com/openstack-dev/pbr',
       branch: master}
    - {name: python-keystoneclient,
       repository: 'git://github.com/openstack/python-keystoneclient',
       branch: master}
    - {name: sqlalchemy-migrate,
       repository: 'git://github.com/stackforge/sqlalchemy-migrate',
       branch: master}
    - {name: keystonemiddleware,
       repository: 'git://github.com/openstack/keystonemiddleware',
       branch: master}
    - {name: keystone,
       repository: 'git://github.com/openstack/keystone',
       branch: master}