OpenShift Origin (OKD) 3.11 : Keystone Authentication2018/11/20

The OpenShift installation example on this tutorial showed to configure HTPasswd for Authentication provider, however it's possible to select some Authentication provider except HTPasswd.

On here, Configure Openstack Keystone for Authentication provider.

This example is based on the environment like follows.

-----------+--------------+-------------+----------------------------+------------
           |10.0.0.25     |             |10.0.0.51                   |10.0.0.52
+----------+-----------+  |  +----------+-----------+     +----------+-----------+
|  [ ctrl.srv.world ]  |  |  | [ node01.srv.world ] |     | [ node02.srv.world ] |
|     (Master Node)    |  |  |    (Compute Node)    |     |    (Compute Node)    |
|     (Infra Node)     |  |  |                      |     |                      |
|     (Compute Node)   |  |  |                      |     |                      |
+----------------------+  |  +----------------------+     +----------------------+
-----------+--------------+
           |10.0.0.30
+----------+-----------+
| [keystone.srv.world ]|
|  Openstack Keystone  |
|                      |
|                      |
+----------------------+

[1]	Configure Openstack Keystone, refer to here.
[2]	Login as root or Cluster admin user and change authentication settings.

[origin@ctrl ~]$

sudo vi /etc/origin/master/master-config.yaml

# line 146: change like follows

  identityProviders:
  - challenge: true
    login: true
    mappingMethod: claim
    # any name you like
    name: keystone_auth
    provider:
      apiVersion: v1
      kind: KeystonePasswordIdentityProvider
      # keystone domain name (Openstack's default is just the [default])
      domainName: default
      # keystone auth URL
      url: http://10.0.0.30:5000

.....
.....

[origin@ctrl ~]$

sudo /usr/local/bin/master-restart api

[origin@ctrl ~]$

sudo /usr/local/bin/master-restart controllers

[3]	Add any user for Openshift Cluster on Keystone Server.

[root@keystone ~(keystone)]#

openstack user create --domain default --password mypassword redhat

+---------------------+----------------------------------+
| Field               | Value                            |
+---------------------+----------------------------------+
| domain_id           | default                          |
| enabled             | True                             |
| id                  | 7b4ed77c957942e0899a5ca80823aef9 |
| name                | redhat                           |
| options             | {}                               |
| password_expires_at | None                             |
+---------------------+----------------------------------+

[4]	Make sure it's possible to login to Openshift Cluster with the user above.

[cent@ctrl ~]$

oc login

Authentication required for https://ctrl.srv.world:8443 (openshift)
Username: redhat
Password:
Login successful.

You don't have any projects. You can try to create a new project, by running

    oc new-project <projectname>

[cent@ctrl ~]$

oc whoami

redhat

[cent@ctrl ~]$

oc new-project myproject

Now using project "myproject" on server "https://ctrl.srv.world:8443".

You can add applications to this project with the 'new-app' command. For example, try:

    oc new-app centos/ruby-25-centos7~https://github.com/sclorg/ruby-ex.git

to build a new example application in Ruby.
.....
.....

Matched Content