Installation with Keystone¶
Bifrost can now install and make use of keystone. In order to enable
this as part of the installation, the enable_keystone
variable
must be set to true
, either in playbooks/inventory/group_vars/target
or on the command line during installation. Note that enable_keystone and
noauth_mode are mutually exclusive so they should have an opposite value of
oneanother. Example:
ansible-playbook -vvvv -i inventory/target install.yaml -e enable_keystone=true -e noauth_mode=false
However, prior to installation, overriding credentials should be set in order to customize the deployment to meet your needs. At the very least, the following parameters should be changed for a production environment:
admin_password
Password for the bootstrap user (called
admin
by default).default_password
Password for the regular user (called
bifrost_user
by default).service_password
Password for communication between services (never exposed to end users).
If any of these values is not set, a random password is generated during the
initial installation and stored on the controller in an accordingly named file
in the ~/.config/bifrost
directory (override using password_dir
).
See the following files for more settings that can be overridden:
playbooks/roles/bifrost-ironic-install/defaults/main.yml
playbooks/roles/bifrost-keystone-install/defaults/main.yml
TLS notes¶
There are two important limitations to keep in mind when using Keystone with TLS:
It’s not possible to enable TLS on upgrade from Bifrost < 9.0 (Ussuri and early Victoria). First do an upgrade to Bifrost >= 9.0, then enable TLS in a separate step.
Automatically updating from a TLS environment to a non-TLS one may not be possible if using custom TLS certificates in a non-standard location (
/etc/bifrost/bifrost.crt
). You need to manually change identity endpoints in the catalog fromhttps
tohttp
directly before an update. Thepublic
endpoint must be updated last or you may lock yourself out of keystone.
Using an existing Keystone¶
If you choose to install bifrost using an existing keystone, this
should be possible, however it has not been tested. In this case you
will need to set the appropriate defaults, via
playbooks/roles/bifrost-ironic-install/defaults/main.yml
which would be a good source for the role level defaults.
Ideally, when setting new defaults, they should be set in the
playbooks/inventory/group_vars/target
file.
Creation of clouds.yaml¶
By default, during bifrost installation, a file will be written to the user’s
home directory that is executing the installation. That file can be located at
~/.config/openstack/clouds.yaml
. The clouds that are written
to that file are named bifrost
(for regular users) and bifrost-admin
(for administrators).
Creation of openrc¶
Also by default, after bifrost installation and again, when keystone is enabled, a file will be written to the user’s home directory that you can use to set the appropriate environment variables in your current shell to be able to use OpenStack utilities:
. ~/openrc bifrost
openstack baremetal driver list