<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Nov 22, 2016 at 3:28 AM, Hong Gang Liu <span dir="ltr"><<a href="mailto:shhgliu@cn.ibm.com" target="_blank">shhgliu@cn.ibm.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2">
<p style="margin:0in;font-family:"microsoft yahei";font-size:11pt" lang="en-US"><font size="2">Hi folks,</font></p><font size="2">
</font><p style="margin:0in;font-family:"microsoft yahei";font-size:11pt" lang="en-US"><font size="2"> </font></p><font size="2">
</font><p style="margin:0in;font-size:11pt" lang="en-US"><font size="2"><span style="font-family:"microsoft yahei"">I'm working on setting up keystone(identity API) high
available function with Newton release on CentOS 7.2 . According to document </span><a href="http://docs.openstack.org/ha-guide/controller-ha-identity.html" target="_blank"><span style="font-family:calibri">http://docs.openstack.org/ha-<wbr>guide/controller-ha-identity.<wbr>html</span></a><span style="font-family:calibri"> , I use pacemaker to achieve it. </span></font></p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US"> </p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">Unfortunately,
the document is out-of-date, such as:</p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">1. the
doc suggest to add "systemd:openstack-keystone" resource to
pacemaker. However, as a separate service, openstack-keystone has already been
deprecated/dropped in Newton release. It's integrated into httpd service as
well as horizon. </p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">2. modify
conf file of keystone and other services, the parameter most are changed too. </p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US"> </p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">After
investigation, I made some progress by following steps:</p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US"> </p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">1. use
ocf instead of systemd: download keystone ocf file from <a href="https://git.openstack.org/cgit/openstack/openstack-resource-agents/plain/ocf/keystone" target="_blank">https://git.openstack.org/<wbr>cgit/openstack/openstack-<wbr>resource-agents/plain/ocf/<wbr>keystone</a>, then add rx to it. Besides this, I also did more modification on ocf because
some keystone commands used in it are deprecated/dropped too: such as change
"keystone-all" to "keystone-manage", remove
"keystone" etc.</p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">2. after
step 1# action, pcs can list out the openstack-keystone as ocf resource, then
add it successfully. </p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">3. add
virtual IP resource to pcs successfully. </p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">4. modify
'admin_bind_host/publid_bind_<wbr>host" in keystone.conf to vip.</p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">5. update
3 keystone endpoint values to vip in database.</p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">6. modify
auth_url/auth_uri in other OpenStack services conf files to vip. </p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">7. modify
the keystonerc_admin OS_AUTH_URL to vip.</p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">8.
restart all services. </p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">But it
doesn't work, the symptom is I can use curl commands to get the endpoints lists
from vip url, but all openstack command line failed<span> </span>with error message 404 while getting tokens.</p></font></blockquote><div><br></div><div>Propose a patch to update the manual :)</div><div> <span style="font-family:calibri;font-size:11pt"> </span></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2">
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">So want
to know your points on the following questions:</p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">1. is
there any new document for keystone high available function on newton?</p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">2. for
Newton release, keystone is not a separate system service any more, it's
integrated into httpd as sub-service,<span>
</span>does pacemaker and OpenStack still support keystone HA function?</p>
<p style="margin:0in;font-family:calibri;font-size:11pt" lang="en-US">3. Does
anyone setup keystone HA on newton release successfully?</p></font></blockquote><div><br></div><div>There was a mailing list thread about this a few months ago: <a href="http://lists.openstack.org/pipermail/openstack/2016-September/017611.html">http://lists.openstack.org/pipermail/openstack/2016-September/017611.html</a> Theres a lot of good information on that (there were many replies)</div></div></div></div>