11.2. Configure the Data Processing Service
To configure the Data Processing service (Sahara), you must complete the following tasks:
- Configure the Data Processing service database connection.
- Configure the Data Processing API service to authenticate with the Identity service.
- Configure the firewall to allow service traffic for the Data Processing service (through port
8386).
11.2.1. Create the Data Processing Service Database
Create the database and database user used by the Data Processing API service. The database connection string used by the Data Processing service is defined in the
/etc/sahara/sahara.conf file. It must be updated to point to a valid database server before starting the Data Processing API service (openstack-sahara-api).
Procedure 11.1. Creating and Configuring a Database for the Data Processing API Service
- Connect to the database service:
#mysql -u root -p - Create the
saharadatabase:mysql>CREATE DATABASE sahara; - Create a
saharadatabase user and grant the user access to thesaharadatabase:mysql>GRANT ALL ON sahara.* TO 'sahara'@'%' IDENTIFIED BY 'PASSWORD';mysql>GRANT ALL ON sahara.* TO 'sahara'@'localhost' IDENTIFIED BY 'PASSWORD';Replace PASSWORD with a secure password that will be used to authenticate with the database server as this user. - Exit the
mysqlclient:mysql>quit - Set the value of the
sql_connectionconfiguration key:#openstack-config --set /etc/sahara/sahara.conf \database connection mysql://sahara:PASSWORD@IP/saharaReplace the following values:- Replace PASS with the password of the database user.
- Replace IP with the IP address or host name of the server hosting the database service.
- Configure the schema of the
saharadatabase:#sahara-db-manage --config-file /etc/sahara/sahara.conf upgrade head
Important
The IP address or host name specified in the connection configuration key must match the IP address or host name to which the Data Processing service database user was granted access when creating the Data Processing service database. Moreover, if the database is hosted locally and you granted permissions to 'localhost' when creating the Data Processing service database, you must enter 'localhost'.
11.2.2. Create the Data Processing Service Identity Records
Create and configure Identity service records required by the Data Processing service. These entries assist other OpenStack services attempting to locate and access the functionality provided by the Data Processing service.
This procedure assumes that you have already created an administrative user account and a
services tenant. For more information, see:
Perform this procedure on the Identity service server, or on any machine onto which you have copied the
keystonerc_admin file and on which the keystone command-line utility is installed.
Procedure 11.2. Creating Identity Records for the Data Processing Service
- Set up the shell to access keystone as the administrative user:
#source ~/keystonerc_admin - Create the
saharauser:[(keystone_admin)]#keystone user-create --name sahara --pass PASSWORDReplace PASSWORD with a password that will be used by the Data Processing service when authenticating with the Identity service. - Link the
saharauser and theadminrole together within the context of theservicestenant:[(keystone_admin)]#keystone user-role-add --user sahara --role admin --tenant services - Create the
saharaservice entry:[(keystone_admin)]#keystone service-create --name sahara \--type data-processing \--description "OpenStack Data Processing" - Create the
saharaendpoint entry:[(keystone_admin)]#keystone endpoint-create \--service sahara \--publicurl 'http://SAHARA_HOST:8386/v1.1/%(tenant_id)s' \--adminurl 'http://SAHARA_HOST:8386/v1.1/%(tenant_id)s' \--internalurl 'http://SAHARA_HOST:8386/v1.1/%(tenant_id)s' \--region 'RegionOne'Replace SAHARA_HOST with the IP address or fully qualified domain name of the server hosting the Data Processing service.Note
By default, the endpoint is created in the default region,RegionOne. This is a case-sensitive value. To specify a different region when creating an endpoint, use the--regionargument to provide it.See Section 3.6.1, “Service Regions” for more information.
11.2.3. Configure Data Processing Service Authentication
Configure the Data Processing API service (
openstack-sahara-api) to use the Identity service for authentication. All steps in this procedure must be performed on the server hosting the Data Processing API service, while logged in as the root user.
Procedure 11.3. Configuring the Data Processing API Service to Authenticate through the Identity Service
- Set the Identity service host that the Data Processing API service must use:
#openstack-config --set /etc/sahara/sahara.conf \keystone_authtoken auth_uri http://IP:5000/v2.0/#openstack-config --set /etc/sahara/sahara.conf \keystone_authtoken identity_uri http://IP:35357Replace IP with the IP address of the server hosting the Identity service. - Set the Data Processing API service to authenticate as the correct tenant:
#openstack-config --set /etc/sahara/sahara.conf \keystone_authtoken admin_tenant_name servicesReplace services with the name of the tenant created for the use of the Data Processing service. Examples in this guide useservices. - Set the Data Processing API service to authenticate using the
saharaadministrative user account:#openstack-config --set /etc/sahara/sahara.conf \keystone_authtoken admin_user sahara - Set the Data Processing API service to use the correct
saharaadministrative user account password:#openstack-config --set /etc/sahara/sahara.conf \keystone_authtoken admin_password PASSWORDReplace PASSWORD with the password set when thesaharauser was created.
11.2.4. Configure the Firewall to Allow OpenStack Data Processing Service Traffic
The Data Processing service receives connections on port
8386. The firewall on the service node must be configured to allow network traffic on this port. All steps in this procedure must be performed on the server hosting the Data Processing service, while logged in as the root user.
Procedure 11.4. Configuring the Firewall to Allow Data Processing Service Traffic
- Open the
/etc/sysconfig/iptablesfile in a text editor. - Add an INPUT rule allowing TCP traffic on port
8386. The new rule must appear before any INPUT rules that REJECT traffic:-A INPUT -p tcp -m multiport --dports 8386 -j ACCEPT
- Save the changes to the
/etc/sysconfig/iptablesfile. - Restart the
iptablesservice to ensure that the change takes effect:#systemctl restart iptables.service