Moon installation and configuration instruction¶
1. Introduction¶
The Moon platform is composed of 3 components : * keystone-moon * keystonemiddleware-moon * python-moonclient
2. keystone-moon¶
This component replaces the Keystone component of the OpenStack platform. All basic functions of the original component were maintained but we add some new functions (specially authorization functions)
3. keystonemiddleware-moon¶
This component replaces the KeystoneMiddleware component of the OpenStack platform. The main function added was to intercept all actions from Nova and Swift in order to retrieve an authorization token from the Keystone-moon component.
4. python-moonclient¶
The MoonClient is an interactive script to drive the Keystone-Moon component through the network.
4.1. Packages creation¶
Packages can be found on https://github.com/dthom/moon-bin
5. keystone-moon package¶
The Keystone-Moon can be package into 2 forms. The first form is in traditional Python package :
cd moon_repo/keystone-moon
python setup.py sdist
ls dist
We develop a script to build a Debian package, this script is located in moon_repo/debian/keystone-moon
cd moon_repo/debian/keystone-moon
python create_deb.py
6. keystonemiddleware-moon package¶
The KeystoneMiddleware-Moon can be package into 2 forms. The first form is in traditional Python package :
cd moon_repo/keystonemiddleware-moon
python setup.py sdist
ls dist
We develop a script to build a Debian package, this script is located in moon_repo/debian/keystonemiddleware-moon
cd moon_repo/debian/keystonemiddleware-moon
python create_deb.py
7. python-moonclient package¶
There is only one type of package for the Moon client:
cd moon_repo/moonclient
python setup.py sdist
ls dist
7.1. Installation¶
This installation procedure only describe the installation of a standalone Moon platform.
8. Pre-requisite¶
To install the Moon platform, you will need a working Linux server box. The platform is tested on an up-to-date Ubuntu 16.04 box.
You can build your own packages or you can download stable ones on https://github.com/dthom/moon-bin
9. Installation¶
First of all, you must install dependencies for the Keystone-moon package, then you can download pre-built packages or create them by yourself. Endly, you can install Keystone-Moon and MoonClient packages:
cd /tmp
wget https://github.com/dthom/moon-bin/archive/master.zip
unzip master.zip
PKGS = $(python3 /tmp/moon-bin-master/tools/get_deb_depends.py /tmp/moon-bin-master/*.deb)
sudo apt-get install $PKGS
sudo dpkg -i /tmp/moon-bin-master/keystone_latest-moon_all.deb
sudo pip install --upgrade /tmp/moon-bin-master/python-moonclient-latest.tar.gz
At this point, the Nova and Swift components must be installed on the same box or on an other box. See http://docs.openstack.org/ for more explanation.
Nova and Swift components automatically installed the python-keystonemiddleware package. We have to replace it with the dedicated Moon one:
cd /tmp
sudo dpkg -i /tmp/moon-bin-master/python3-keystonemiddleware_latest-moon_all.deb
sudo dpkg -i /tmp/moon-bin-master/python-keystonemiddleware_latest-moon_all.deb
Note: if you installed Nova and Swift in 2 different nodes, you must install python-keystonemiddleware in those 2 nodes.
10. Configuration¶
For Keystone, the following files must be configured, some modifications may be needed, specially passwords:
/etc/keystone/keystone-paste.ini
sudo cp /etc/keystone/keystone-paste.ini /etc/keystone/keystone-paste.ini.bak
sudo sed "3i[pipeline:moon_pipeline]\npipeline = sizelimit url_normalize request_id build_auth_context token_auth admin_token_auth json_body ec2_extension_v3 s3_extension moon_service\n\n[app:moon_service]\nuse = egg:keystone#moon_service\n" /etc/keystone/keystone-paste.ini > /tmp/keystone-paste.ini
sudo cp /tmp/keystone-paste.ini /etc/keystone/keystone-paste.ini
sudo sed "s/use = egg:Paste#urlmap/use = egg:Paste#urlmap\n\/moon = moon_pipeline/" /etc/keystone/keystone-paste.ini > /tmp/keystone-paste.ini
sudo cp /tmp/keystone-paste.ini /etc/keystone/keystone-paste.ini
/etc/keystone/keystone.conf
cat << EOF | sudo tee -a /etc/keystone/keystone.conf
[moon]
# Configuration backend driver
configuration_driver = keystone.contrib.moon.backends.memory.ConfigurationConnector
# Tenant backend driver
tenant_driver = keystone.contrib.moon.backends.sql.TenantConnector
# Authorisation backend driver
authz_driver = keystone.contrib.moon.backends.flat.SuperExtensionConnector
# IntraExtension backend driver
intraextension_driver = keystone.contrib.moon.backends.sql.IntraExtensionConnector
# InterExtension backend driver
interextension_driver = keystone.contrib.moon.backends.sql.InterExtensionConnector
# Logs backend driver
log_driver = keystone.contrib.moon.backends.flat.LogConnector
# Local directory where all policies are stored
policy_directory = /etc/keystone/policies
# Local directory where Root IntraExtension configuration is stored
root_policy_directory = policy_root
# URL of the Moon master
master = 'http://localhost:35357/'
# Login of the Moon master
master_login = 'admin'
# Password of the Moon master
master_password = 'nomoresecrete'
EOF
The logging system must be configured :
sudo mkdir /var/log/moon/
sudo chown keystone /var/log/moon/
sudo addgroup moonlog
sudo chgrp moonlog /var/log/moon/
sudo touch /var/log/moon/keystonemiddleware.log
sudo touch /var/log/moon/system.log
sudo chgrp moonlog /var/log/moon/keystonemiddleware.log
sudo chgrp moonlog /var/log/moon/system.log
sudo chmod g+rw /var/log/moon
sudo chmod g+rw /var/log/moon/keystonemiddleware.log
sudo chmod g+rw /var/log/moon/system.log
sudo adduser keystone moonlog
sudo adduser swift moonlog
sudo adduser nova moonlog
The Keystone database must be updated:
sudo /usr/bin/keystone-manage db_sync
sudo /usr/bin/keystone-manage db_sync --extension moon
And, Apache must be restarted:
sudo systemctl restart apache.service
In order to Nova to be able to communicate with Keystone-Moon, you must update the Nova KeystoneMiddleware configuration file. To achieve this, a new filter must be added in /etc/nova/api-paste.ini and this filter must be added to the composite data. The filter is:
[filter:moon]
paste.filter_factory = keystonemiddleware.moon_agent:filter_factory
authz_login=admin
authz_password=password
logfile=/var/log/moon/keystonemiddleware.log
Here is some bash lines to insert this into the Nova configuration file:
sudo cp /etc/nova/api-paste.ini /etc/nova/api-paste.ini.bak2
sudo sed "/^keystone = / s/keystonecontext/keystonecontext moon/" /etc/nova/api-paste.ini > /tmp/api-paste.ini
sudo cp /tmp/api-paste.ini /etc/nova/api-paste.ini
echo -e "\n[filter:moon]\npaste.filter_factory = keystonemiddleware.moon_agent:filter_factory\nauthz_login=admin\nauthz_password=password\nlogfile=/var/log/moon/keystonemiddleware.log\n" | sudo tee -a /etc/nova/api-paste.ini
Nova can then be restarted:
for service in nova-compute nova-api nova-cert nova-conductor nova-consoleauth nova-scheduler ; do
sudo service ${service} restart
done
In order to Swift to be able to communicate with Keystone-Moon, you must update the Swift KeystoneMiddleware configuration file. To achieve this, a new filter must be added in /etc/swift/proxy-server.conf and this filter must be added to the composite data. The filter is (exactly the same as Nova):
[filter:moon]
paste.filter_factory = keystonemiddleware.moon_agent:filter_factory
authz_login=admin
authz_password=password
logfile=/var/log/moon/keystonemiddleware.log
Here is some bash lines to insert this into the Nova configuration file:
sudo cp /etc/swift/proxy-server.conf /etc/swift/proxy-server.conf.bak2
sudo sed "/^pipeline = / s/proxy-server/moon proxy-server/" /etc/swift/proxy-server.conf > /tmp/proxy-server.conf
sudo cp /tmp/proxy-server.conf /etc/swift/proxy-server.conf
echo -e "\n[filter:moon]\npaste.filter_factory = keystonemiddleware.moon_agent:filter_factory\nauthz_login=admin\nauthz_password=password\nlogfile=/var/log/moon/keystonemiddleware.log\n" | sudo tee -a /etc/swift/proxy-server.conf
Swift can then be restarted:
for service in swift-account swift-account-replicator \
swift-container-replicator swift-object swift-object-updater \
swift-account-auditor swift-container swift-container-sync \
swift-object-auditor swift-proxy swift-account-reaper swift-container-auditor \
swift-container-updater swift-object-replicator ; do
sudo service ${service} status
done
11. Running tests¶
After a successful installation of the Moon platform, you can execute some tests to see if the platform is up and running. Be patient, the latest test takes time (5 to 20 minutes).
export OS_USERNAME=admin
export OS_PASSWORD=password
export OS_REGION_NAME=What_ever_you_want
export OS_TENANT_NAME=admin
export OS_AUTH_URL=http://localhost:5000/v2.0
# See if Nova is up and running:
nova list
# See if Swift is up and running:
swift stat
# See if Keystone-Moon is up and running
moon intraextension list
# you must see one extension (named root)
moon test --self
Revision:
Build date: October 20, 2016
