<html><body><p>... re-adding the operators mailing list.<br><br>sounds like we should document how to do this, with the assertion that it is not tested with our CI.<br><br>with that said, we should try to have a job that sets up keystone with nginx that is run periodically (similar to our eventlet job at the moment).<br><br>stevemar<br><br><img width="16" height="16" src="cid:1__=8FBBF587DFEC1B4C8f9e8a93df938690918c8FB@" border="0" alt="Inactive hide details for Brant Knudson ---2015/12/07 05:52:20 PM---On Tue, Dec 1, 2015 at 12:57 AM, Steve Martinelli <stevemar"><font color="#424282">Brant Knudson ---2015/12/07 05:52:20 PM---On Tue, Dec 1, 2015 at 12:57 AM, Steve Martinelli <stevemar@ca.ibm.com> wrote:</font><br><br><font size="2" color="#5F5F5F">From: </font><font size="2">Brant Knudson <blk@acm.org></font><br><font size="2" color="#5F5F5F">To: </font><font size="2">"OpenStack Development Mailing List (not for usage questions)" <openstack-dev@lists.openstack.org></font><br><font size="2" color="#5F5F5F">Date: </font><font size="2">2015/12/07 05:52 PM</font><br><font size="2" color="#5F5F5F">Subject: </font><font size="2">Re: [openstack-dev] [Openstack-operators] [keystone] Removing functionality that was deprecated in Kilo and upcoming deprecated functionality in Mitaka</font><br><hr width="100%" size="2" align="left" noshade style="color:#8091A5; "><br><br><br><br><br><font size="4">On Tue, Dec 1, 2015 at 12:57 AM, Steve Martinelli <</font><a href="mailto:stevemar@ca.ibm.com" target="_blank"><u><font size="4" color="#0000FF">stevemar@ca.ibm.com</font></u></a><font size="4">> wrote:</font><ul><font size="4">Trying to summarize here... <br><br>- There isn't much interest in keeping eventlet around.<br>- Folks are OK with running keystone in a WSGI server, but feel they are constrained by Apache.<br>- uWSGI could help to support multiple web servers.<br><br>My opinion:<br><br>- Adding support for uWSGI definitely sounds like it's worth investigating, but not achievable in this release (unless someone already has something cooked up).</font></ul><br><br><font size="4">What needs to change to support uWSGI? You can already run keystone in python uwsgi and then front it with nginx:<br><br> $ uwsgi --socket </font><a href="http://127.0.0.1:5001/"><u><font size="4" color="#0000FF">127.0.0.1:5001</font></u></a><font size="4"> --wsgi-file $(which keystone-wsgi-public) --honour-stdin --enable-threads --workers 6<br> $ uwsgi --socket </font><a href="http://127.0.0.1:35358/"><u><font size="4" color="#0000FF">127.0.0.1:35358</font></u></a><font size="4"> --wsgi-file $(which keystone-wsgi-admin) --honour-stdin --enable-threads --workers 6<br><br> $ sudo vi /etc/nginx/sites-available/keystone<br><br>server {<br> listen 5000 default_server;<br> server_name localhost;<br> location / {<br> include uwsgi_params;<br> uwsgi_pass </font><a href="http://127.0.0.1:5001/"><u><font size="4" color="#0000FF">127.0.0.1:5001</font></u></a><font size="4">;<br> uwsgi_param SCRIPT_NAME /;<br> }<br>}<br>server {<br> listen 35357 default_server;<br> server_name localhost;<br> location / {<br> include uwsgi_params;<br> uwsgi_pass </font><a href="http://127.0.0.1:35358/"><u><font size="4" color="#0000FF">127.0.0.1:35358</font></u></a><font size="4">;<br> uwsgi_param SCRIPT_NAME /;<br> }<br>}<br></font><br><font size="4"> $ sudo ln -x /etc/nginx/sites-available/keystone /etc/nginx/sites-enabled/</font><br><br><font size="4"> $ sudo nginx<br></font><br><font size="4">and then you can make your regular curl calls.</font><br><br><font size="4">Also, you can run keystone with regular http in python uwsgi (uwsgi --http) and then just do normal reverse proxy (from Apache or nginx or whatever), which I think would be adequate for keystone.</font><br><br><font size="4">We don't do anything in keystone to stop deployments in web servers other than Apache. Keystone is just a regular wsgi app. We document Apache since it's popular and it provides mod_shib, which is the only saml2 module for web servers that I know of. Keystone can work with other saml2 modules and in different servers, it just takes the environment variables that the module sets and runs it through some mapping code. The mapping code has been shown to work alternative authentication modules (for ldap and kerberos).</font><br><br><font size="4">- Brant<br></font><tt>__________________________________________________________________________<br>OpenStack Development Mailing List (not for usage questions)<br>Unsubscribe: OpenStack-dev-request@lists.openstack.org?subject:unsubscribe<br></tt><tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a></tt><tt><br></tt><br><br><BR>
</body></html>