{"id":20111431,"url":"https://github.com/openstack/charm-keystone","last_synced_at":"2025-05-06T10:33:34.540Z","repository":{"id":66174668,"uuid":"52858767","full_name":"openstack/charm-keystone","owner":"openstack","description":"Juju Charm - Keystone. Mirror of code maintained at opendev.org.","archived":false,"fork":false,"pushed_at":"2025-03-14T20:54:55.000Z","size":3873,"stargazers_count":16,"open_issues_count":0,"forks_count":25,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-04-09T11:52:46.099Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://opendev.org/openstack/charm-keystone","language":"Python","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/openstack.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-03-01T07:54:49.000Z","updated_at":"2025-04-09T10:10:55.000Z","dependencies_parsed_at":"2023-02-20T23:15:54.064Z","dependency_job_id":"23a61278-c57d-4861-a9f3-390cb65dae88","html_url":"https://github.com/openstack/charm-keystone","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fcharm-keystone","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fcharm-keystone/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fcharm-keystone/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fcharm-keystone/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/openstack","download_url":"https://codeload.github.com/openstack/charm-keystone/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252666368,"owners_count":21785247,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-13T18:16:02.339Z","updated_at":"2025-05-06T10:33:34.071Z","avatar_url":"https://github.com/openstack.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Overview\n\nThe keystone charm deploys [Keystone][upstream-keystone], the core OpenStack\nservice that provides API client authentication, service discovery, and\ndistributed multi-tenant authorization. The charm works alongside other\nJuju-deployed OpenStack services.\n\n# Usage\n\n## Configuration\n\nThis section covers common and/or important configuration options. See file\n`config.yaml` for the full list of options, along with their descriptions and\ndefault values. See the [Juju documentation][juju-docs-config-apps] for details\non configuring applications.\n\n#### `openstack-origin`\n\nThe `openstack-origin` option states the software sources. A common value is an\nOpenStack UCA release (e.g. 'cloud:bionic-ussuri' or 'cloud:focal-victoria').\nSee [Ubuntu Cloud Archive][wiki-uca]. The underlying host's existing apt\nsources will be used if this option is not specified (this behaviour can be\nexplicitly chosen by using the value of 'distro').\n\n## Deployment\n\nKeystone is often containerised. Here a single unit is deployed to a new\ncontainer on machine '1':\n\n    juju deploy --to lxd:1 keystone\n\nNow connect the keystone application to an existing cloud database. The\ndatabase application is determined by the series. Prior to focal\n[percona-cluster][percona-cluster-charm] is used, otherwise it is\n[mysql-innodb-cluster][mysql-innodb-cluster-charm]. In the example deployment\nbelow mysql-innodb-cluster has been chosen.\n\n    juju deploy mysql-router keystone-mysql-router\n    juju add-relation keystone-mysql-router:db-router mysql-innodb-cluster:db-router\n    juju add-relation keystone-mysql-router:shared-db keystone:shared-db\n\n## Credentials\n\nThe `keystone:shared-db` relation added at deployment time stores the Keystone\nadmin password in the cloud database. By default this password is generated\nrandomly but, for testing purposes, can be set via the `admin-password`\nconfiguration option. This option can also be used to view and change the\npassword post-deployment.\n\n## Actions\n\nThis section covers Juju [actions][juju-docs-actions] supported by the charm.\nActions allow specific operations to be performed on a per-unit basis. To\ndisplay action descriptions run `juju actions keystone`. If the charm is not\ndeployed then see file `actions.yaml`.\n\n* `openstack-upgrade`\n* `pause`\n* `resume`\n* `security-checklist`\n* `get-admin-password`\n* `rotate-admin-password`\n* `rotate-service-user-password`\n* `list-service-usernames`\n\n## High availability\n\nWhen more than one unit is deployed with the [hacluster][hacluster-charm]\napplication the charm will bring up an HA active/active cluster.\n\nThere are two mutually exclusive high availability options: using virtual IP(s)\nor DNS. In both cases the hacluster subordinate charm is used to provide the\nCorosync and Pacemaker backend HA functionality.\n\nSee [OpenStack high availability][cdg-ha-apps] in the [OpenStack Charms\nDeployment Guide][cdg] for details.\n\n## TLS\n\nCommunication between Keystone and cloud services (as well as the OpenStack\nclient) can be encrypted with TLS. Keystone also publishes API endpoints for\nthe cloud (e.g. cinder, glance, keystone, neutron, nova, and placement), which\nmay be TLS-based.\n\nThere are two methods for managing TLS keys and certificates:\n\n1. with Vault\n1. manually (via charm options)\n\nVault can set up private keys and server certificates for an application. It\ncan also store a central CA certificate for the cloud. See the\n[vault][vault-charm] charm for more information.\n\nVault is the recommended method and is what will be covered here.\n\nThe private key and server certificate (and its signing) are enabled via a\nrelation made to the vault application:\n\n    juju add-relation keystone:certificates vault:certificates\n\n### Other applications\n\nWhen Keystone is TLS-enabled every application that talks to Keystone (i.e.\nthere exists a relation between the two) must be in possession of the signing\nCA cert. This is achieved by adding a relation between the application and\nVault. Doing so will also encrypt the application's own endpoint. For example,\nthe Placement API:\n\n    juju add-relation placement:certificates vault:certificates\n\nVault will issue certificates to the application and Keystone will update the\ncorresponding API endpoint from HTTP to HTTPS.\n\n\u003e **Note**: API endpoints can be listed with `openstack catalog list`.\n\n## Spaces\n\nThis charm supports the use of Juju Network Spaces, allowing the charm to be\nbound to network space configurations managed directly by Juju. This is only\nsupported with Juju 2.0 and above.\n\nAPI endpoints can be bound to distinct network spaces supporting the network\nseparation of public, internal and admin endpoints.\n\nAccess to the underlying MySQL instance can also be bound to a specific space\nusing the shared-db relation.\n\nTo use this feature, use the --bind option when deploying the charm:\n\n    juju deploy keystone --bind \\\n       \"public=public-space \\\n        internal=internal-space \\\n        admin=admin-space \\\n        shared-db=internal-space\"\n\nAlternatively, these can also be provided as part of a Juju native bundle\nconfiguration:\n\n```yaml\n    keystone:\n      charm: cs:xenial/keystone\n      num_units: 1\n      bindings:\n        public: public-space\n        admin: admin-space\n        internal: internal-space\n        shared-db: internal-space\n```\n\n\u003e **Note**: Spaces must be configured in the underlying provider prior to\n  attempting to use them (see [MAAS spaces][maas-docs-spaces]).\n\n\u003e **Note**: Existing deployments using `os\\-\\*-network` configuration options\n  will continue to function; these options are preferred over any network space\n  binding provided if set.\n\n## Policy overrides\n\nPolicy overrides is an advanced feature that allows an operator to override the\ndefault policy of an OpenStack service. The policies that the service supports,\nthe defaults it implements in its code, and the defaults that a charm may\ninclude should all be clearly understood before proceeding.\n\n\u003e **Caution**: It is possible to break the system (for tenants and other\n  services) if policies are incorrectly applied to the service.\n\nPolicy statements are placed in a YAML file. This file (or files) is then (ZIP)\ncompressed into a single file and used as an application resource. The override\nis then enabled via a Boolean charm option.\n\nHere are the essential commands (filenames are arbitrary):\n\n    zip overrides.zip override-file.yaml\n    juju attach-resource keystone policyd-override=overrides.zip\n    juju config keystone use-policyd-override=true\n\nSee [Policy overrides][cdg-policy-overrides] in the [OpenStack Charms\nDeployment Guide][cdg] for a thorough treatment of this feature.\n\n## Relations\n\nThe charm supports the following relations. They are primarily of use to\ndevelopers:\n\n* `identity-admin`: Used by charms to obtain the credentials for the admin\n  user. This is intended for charms that automatically provision users,\n  tenants, etc.\n\n* `identity-credentials`: Used by charms to obtain Keystone credentials without\n  creating a service catalogue entry. Set 'username' only on the relation and\n  Keystone will set defaults and return authentication details. Possible\n  relation settings:\n\n  * `username`: Username to be created.\n  * `project`: Project (tenant) name to be created. Defaults to service's\n               project.\n  * `requested_roles`: Comma-delimited list of roles to be created.\n  * `requested_grants`: Comma-delimited list of roles to be granted. Defaults\n                        to Admin role.\n  * `domain`: Keystone v3 domain the user will be created in. Defaults to the\n              Default domain.\n\n* `identity-notifications`: Used to broadcast messages to services listening on\n  the corresponding interface.\n\n* `identity-service`: Used by API endpoints to request an entry in the Keystone\n  service catalogue and the endpoint template catalogue.\n\n  \u003e **Note**: The `identity-service` relation is not used by Horizon (see\n    `keystone-service` instead).\n\n  When a relation is established Keystone receives the following data from the\n  requesting API endpoint:\n\n  * `service_name`\n  * `region`\n  * `public_url`\n  * `admin_url`\n  * `internal_url`\n\n  Keystone verifies that the requested service is supported (the list of\n  supported services should remain updated). The following will occur for a\n  supported service:\n\n  1. an entry in the service catalogue is created\n  1. an endpoint template is created\n  1. an admin token is generated.\n\n  The API endpoint receives the token and is informed of the ports that\n  Keystone is listening on.\n\n* `keystone-service`: Used only by Horizon. Horizon requests its configured\n  default role and Keystone responds with a token. Horizon also receives the\n  authentication and admin ports on which Keystone is listening.\n\n* `nrpe-external-master`: Used to generate Nagios checks.\n\n## Further resources\n\nThe below topics are covered in the [OpenStack Charms Deployment Guide][cdg].\n\n* [Security compliance][cdg-security-compliance]: Shows how to use the\n  `password-security-compliance` charm option to set Keystone's security\n  compliance configuration.\n\n* [Token support][cdg-token-support]: Provides a background of Keystone keys\n  and tokens. It explains key rotation, and how to use the\n  `fernet-max-active-keys` and `token-expiration` charm options.\n\n# Documentation\n\nThe OpenStack Charms project maintains two documentation guides:\n\n* [OpenStack Charm Guide][cg]: for project information, including development\n  and support notes\n* [OpenStack Charms Deployment Guide][cdg]: for charm usage information\n\n# Bugs\n\nPlease report bugs on [Launchpad][lp-bugs-charm-keystone].\n\n\u003c!-- LINKS --\u003e\n\n[hacluster-charm]: https://jaas.ai/hacluster\n[vault-charm]: https://jaas.ai/vault\n[cg]: https://docs.openstack.org/charm-guide\n[cdg]: https://docs.openstack.org/project-deploy-guide/charm-deployment-guide\n[cdg-policy-overrides]: https://docs.openstack.org/project-deploy-guide/charm-deployment-guide/latest/app-policy-overrides.html\n[lp-bugs-charm-keystone]: https://bugs.launchpad.net/charm-keystone/+filebug\n[cdg-ha-apps]: https://docs.openstack.org/project-deploy-guide/charm-deployment-guide/latest/app-ha.html#ha-applications\n[upstream-keystone]: https://docs.openstack.org/keystone/latest/\n[juju-docs-config-apps]: https://juju.is/docs/configuring-applications\n[wiki-uca]: https://wiki.ubuntu.com/OpenStack/CloudArchive\n[juju-docs-actions]: https://jaas.ai/docs/actions\n[percona-cluster-charm]: https://jaas.ai/percona-cluster\n[mysql-innodb-cluster-charm]: https://jaas.ai/mysql-innodb-cluster\n[maas-docs-spaces]: https://maas.io/docs/concepts-and-terms#heading--spaces\n[cdg-token-support]: https://docs.openstack.org/project-deploy-guide/charm-deployment-guide/latest/keystone.html#token-support\n[cdg-security-compliance]: https://docs.openstack.org/project-deploy-guide/charm-deployment-guide/latest/keystone.html#security-compliance\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenstack%2Fcharm-keystone","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fopenstack%2Fcharm-keystone","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenstack%2Fcharm-keystone/lists"}