We thought it would be a good idea to have a “Meet the Red Hat Open Stack Team” series of blog post. This is me.
Continue reading
Category Archives: Openstack
Using Puppet to setup PostgreSQL for Keystone on Fedora
Using Puppet to manage software configuration makes sense. Setting up PostgreSQL support for Keystone development and testing has been my excuse to learn it.
sudo yum install puppet sudo puppet module install puppetlabs/postgresql
Then create a file /etc/puppet/site.pp
Put this line in it:
class { 'postgresql::server': } postgresql::db{ 'keystone': user => 'keystone', password => 'keystone', grant => 'all', }
sudo puppet apply --verbose /etc/puppet/site.pp
Confirm that postgresql is running:
systemctl status postgresql.service
Should get you
postgresql.service - PostgreSQL database server Loaded: loaded (/usr/lib/systemd/system/postgresql.service; disabled) Active: active (running) since Thu, 03 Jan 2013 13:26:46 -0500; 43min ago Process: 17529 ExecStop=/usr/bin/pg_ctl stop -D ${PGDATA} -s -m fast (code=exited, status=0/SUCCESS) Process: 17553 ExecStart=/usr/bin/pg_ctl start -D ${PGDATA} -s -o -p ${PGPORT} -w -t 300 (code=exited, status=0/SUCCESS) Process: 17545 ExecStartPre=/usr/bin/postgresql-check-db-dir ${PGDATA} (code=exited, status=0/SUCCESS) Main PID: 17556 (postgres) CGroup: name=systemd:/system/postgresql.service ├ 17556 /usr/bin/postgres -D /var/lib/pgsql/data -p 5432 ├ 17557 postgres: logger process ├ 17559 postgres: writer process ├ 17560 postgres: wal writer process ├ 17561 postgres: autovacuum launcher process └ 17562 postgres: stats collector process
Test we can connect to the PostgreSQL command line tool:
psql -h localhost -U keystone keystone Password for user keystone: psql (9.1.7) Type "help" for help. keystone=> \d
To run the Keystone unit test test against the database, alter the file /opt/stack/keystone/tests/backend_sql.conf. Comment out the sqlite connection line, and uncomment the postgresql line.
[sql] #connection = sqlite:// #To Test MySQL: #connection = mysql://root:keystone@localhost/keystone?charset=utf8 #To Test PostgreSQL: connection = postgresql://keystone:keystone@localhost/keystone?client_encoding=utf8 idle_timeout = 200
Then you can run the unit tests with
./run_tests.sh -N test_sql_upgrade
If the tests fail (and they will), they will leave the database in an unusable state. You can drop the database and recreate with puppet:
sudo su postgres -c "dropdb keystone" sudo puppet apply --verbose /etc/puppet/site.pp
A SQL upgrade script in Keystone
The SQL migration mechanism in Keystone is interesting enough to warrant some attention. If you need to modify the SQL database in any of the Open Stack projects, you are going to use a similar approach. Here is a step by step I have recorded of a SQL upgrade script I am writing for a feature in Keystone.
Continue reading
Reviewing Code
Code reviews are vital to the success of any software project. In Open Stack, code must be reviewed to be accepted. If there are not enough people doing code reviews, the reviews get stagnant, and the project can’t move forward.
Right now, there are only three active core contributors focused on Keystone. There are a couple people that are core on multiple projects the pay attention to Keystone from time to time, but mostly it is just three of us.
Keystone and Eclipse PyDev
“Step through your code” –some of the best advice I ever got, from Code Complete.
I am a fan of Eclipse. Although I am conversant in VI and Fluent in emacs, I tend to write code in Eclipse. While the Python source code browsing is only mediocre when compared with the Java support, the integrated debugging is very powerful. Here is how I have set things up to work for Keystone.
What changed in that latest patch?
Gerrit is great, but one thing it does not do well is tell you the differences in an update to a review request. Here’s how I found I could focus review requests to just the deltas between submissions.
Continue reading
Multifactor Auth and Keystone
Something you have. Something you are. Something You Know. Pick Two. This is the conventional wisdom for the basis of secure authentication.
PKI tokens and Horizon
With PKI, tokens have gone from 40 byte to a varying size more than 3000 bytes long. This plus additional payload in Horizon means that they no longer fit inside an HTTP cookie. How do we deal with this?
Preauthorization in Keystone
“I’ll gladly pay you Tuesday for a Hamburger Today” –Wimpy, from the Popeye Cartoon.
Sometimes you need to authorize a service to perform an action on your behalf. Often, that action takes place long after any authentication token you can provide would have expired. Currently, the only mechanism in Keystone that people can use is to share credentials. We can do better.
Testing PKI Tokens in pre-release Folsom
There have been a few questions regarding PKI tokens and their testing in the Openstack code base. Here are the steps: