OpenStack Cloud Computing Cookbook

Tag Archives: ubuntu

Installing and Configuring OpenLDAP

In order to operate OpenStack Identity service with an external authentication source, it is necessary that one have an external authentication service available. In the OpenStack Cloud Computing Cookbook, we used OpenLDAP. As installing and configuring OpenLDAP is beyond the scope of the book, that information is provided here.

Getting ready

We will be performing an installation and configuration of OpenLDAP on it’s own Ubuntu 14.04 server.

How to do it…

We will break this into two steps: installing OpenLDAP, and configuring it for use with OpenStack.

Installing OpenLDAP

Once you are logged in, to your Ubuntu 14.04 node, run the following commands to install OpenLDAP:
We set the Ubuntu installer to non-interactive, as we will be providing the configuration values for OpenLDAP prior to installation:

export DEBIAN_FRONTEND=noninteractive

Next we provide an admin password so OpenLDAP will install:

echo -e " \
slapd slapd/internal/generated_adminpw password openstack
slapd slapd/password2 password openstack
slapd slapd/internal/adminpw password openstack
slapd slapd/password1 password openstack
" | sudo debconf-set-selections

Finally, we install OpenLDAP via slapd package:

sudo apt-get install -y slapd ldap-utils


OpenStack has a few requirements regarding which attribute types are used for user information. To accomodate this in our OpenLDAP we need to add these values to the new-attributes schema file:

sudo echo "
 attributetype ( 1.2.840.113556.1.4.8 NAME 'userAccountControl'
 SYNTAX '' )
objectclass ( 1.2.840.113556.1.5.9 NAME 'user'
 DESC 'a user'
 MUST ( cn )
 MAY ( userPassword $ memberOf $ userAccountControl ) )
" >> /etc/ldap/schema/new-attributes.schema

Finally, restart OpenLDAP:

sudo service slapd restart

How it works…

What we have done here is install OpenLDAP on Ubuntu 14.04. Additionally we created an LDAP schema, configuring the userAccountControl property, and configuring a ‘user’ object to provide login authorization.

OpenStack clients installation on Ubuntu for the OpenStack Cloud Computing Cookbook

Throughout the OpenStack Cloud Computing Cookbook we expect the reader to have access to the client tools required to operate an OpenStack environment. If these are not installed, they can be installed by following this simple guide.

This guide will cover installation of

  • Nova Client
  • Keystone Client
  • Neutron Client
  • Glance Client
  • Cinder Client
  • Swift Client
  • Heat Client

Getting ready

To use the tools and this guide, you are expected to have access to a Ubuntu (preferably 14.04 LTS) server or PC that has access to the network where you are installing OpenStack.

How to do it…

To install the clients, simply execute the following commands

sudo apt-get update
sudo apt-get install python-novaclient python-neutronclient python-glanceclient \
    python-cinderclient python-swiftclient python-heatclient

Once these are installed, we can configure our CLI shell environment with the appropriate environment variables to allow us to communicate with the OpenStack endpoints.

A typical set of environment variables are as follows and is used extensively throughout the book when operating OpenStack as a user of the services:

export OS_TENANT_NAME=cookbook
export OS_USERNAME=admin
export OS_PASSWORD=openstack
export OS_AUTH_URL=
export OS_NO_CACHE=1
export OS_KEY=/vagrant/cakey.pem
export OS_CACERT=/vagrant/ca.pem

Typically these export lines are written to a file, for example called ‘$home/openrc’ that allows a user to simply execute the following command to source in these to use with OpenStack

source openrc

(or in Bash: . openrc)

Configuring Keystone for the first time

To initially configure Keystone, we utilize the SERVICE_TOKEN and SERVICE_ENDPOINT environment variables. The SERVICE_TOKEN is found in /etc/keystone/keystone.conf and should only be used for bootstrapping Keystone. Set the environment up as follows

export ENDPOINT=
export SERVICE_ENDPOINT=https://${ENDPOINT}:35357/v2.0
export OS_KEY=/vagrant/cakey.pem
export OS_CACERT=/vagrant/ca.pem

This bypasses the usual authentication process to allow services and users to be configured in Keystone before the users and passwords exist.

How it works…

The OpenStack command line tools utilize environment variables to know how to interact with OpenStack. The environment variables are easy to understand in terms of their function. A user is able to control multiple environments by simply changing the relevant environment variables.

To initially install the users and services, a SERVICE_TOKEN must be used as at this first stage there are no users in the Keystone database to assign administrative privileges to. Once the initial users and services has been set up, the SERVICE_TOKEN should not be used unless maintenance and troubleshooting calls for it.

Configuring Ubuntu Cloud Archive for OpenStack

Ubuntu 14.04 LTS, the release used throughout this book, provides two repositories for installing OpenStack. The standard repository ships with the Icehouse release of OpenStack. Whereas a further supported repository, called the Ubuntu Cloud Archive, provides access to the latest release (at time of writing), Juno. We will be performing an installation and configuration of OpenStack Identity service (as well as the rest of the OpenStack services) with packages from the Ubuntu Cloud Archive to provide us with the Juno release of software.

Getting ready

Ensure you have a suitable server available for installation of the OpenStack Identity service components. If you are using the accompanying Vagrant environment as described in the Preface this will be the controller node that we will be using.

Ensure you are logged onto the controller node and that it has Internet access to allow us to install the required packages in our environment for running Keystone. If you created this node with Vagrant, you can execute the following command:

vagrant ssh controller

How to do it…

Carry out the following steps to configure Ubuntu 14.04 LTS to use the Ubuntu Cloud Archive:

  1. To access the Ubuntu Cloud Archive repository, we first install the Ubuntu Cloud Archive Keyring and enable Personal Package Archives within Ubuntu as follows:
    sudo apt-get update
    sudo apt-get install -y software-properties-common ubuntu-cloud-keyring
  2. Next we enable the Ubuntu Cloud Archive for OpenStack Juno. We do this as follows:
    sudo add-apt-repository -y cloud-archive:juno 
    sudo apt-get update

How it works…

What we’re doing here is adding an extra repository to our system that provides us with a tested set of packages of OpenStack that is fully supported on Ubuntu 14.04 LTS release. The packages in here will then be ones that will be used when we perform installation of OpenStack on our system.

There’s more…

More information about the Ubuntu Cloud Archive can be found by visiting the following address: This explains the release process and the ability to use latest releases of OpenStack—where new versions are released every 6 months—on a long term supported release of Ubuntu that gets released every 2 years.

Using an alternative release

If you wish to optionally deviate from stable releases, it is appropriate when you are helping to develop or debug OpenStack, or require functionality that is not available in the current release.

To use a particular release of PPA, for example, the next OpenStack release Kilo, we issue the following command:

sudo add-apt-repository cloud-archive:kilo