Installation with Keystone

Bifrost can now install and make use of keystone. In order to enable this as part of the installation, the enable_keystone variable must be set to true, either in playbooks/inventory/group_vars/target or on the command line during installation. Note that enable_keystone and noauth_mode are mutually exclusive so they should have an opposite value of oneanother. Example:

ansible-playbook -vvvv -i inventory/target install.yaml -e enable_keystone=true -e noauth_mode=false

However, prior to installation, overriding credentials should be set in order to customize the deployment to meet your needs. At the very least, the following parameters should be changed for a production environment:

admin_password

Password for the bootstrap user (called admin by default).

default_password

Password for the regular user (called bifrost_user by default).

service_password

Password for communication between services (never exposed to end users).

If any of these values is not set, a random password is generated during the initial installation and stored on the controller in an accordingly named file in the ~/.config/bifrost directory (override using password_dir).

See the following files for more settings that can be overridden:

  • playbooks/roles/bifrost-ironic-install/defaults/main.yml

  • playbooks/roles/bifrost-keystone-install/defaults/main.yml

TLS notes

There are two important limitations to keep in mind when using Keystone with TLS:

  • It’s not possible to enable TLS on upgrade from Bifrost < 9.0 (Ussuri and early Victoria). First do an upgrade to Bifrost >= 9.0, then enable TLS in a separate step.

  • Automatically updating from a TLS environment to a non-TLS one may not be possible if using custom TLS certificates in a non-standard location (/etc/bifrost/bifrost.crt). You need to manually change identity endpoints in the catalog from https to http directly before an update. The public endpoint must be updated last or you may lock yourself out of keystone.

Using an existing Keystone

If you choose to install bifrost using an existing keystone, this should be possible, however it has not been tested. In this case you will need to set the appropriate defaults, via playbooks/roles/bifrost-ironic-install/defaults/main.yml which would be a good source for the role level defaults. Ideally, when setting new defaults, they should be set in the playbooks/inventory/group_vars/target file.

Creation of clouds.yaml

By default, during bifrost installation, a file will be written to the user’s home directory that is executing the installation. That file can be located at ~/.config/openstack/clouds.yaml. The clouds that are written to that file are named bifrost (for regular users) and bifrost-admin (for administrators).

Creation of openrc

Also by default, after bifrost installation and again, when keystone is enabled, a file will be written to the user’s home directory that you can use to set the appropriate environment variables in your current shell to be able to use OpenStack utilities:

. ~/openrc bifrost
openstack baremetal driver list