/keystone

name: openstack-keystone
description: "OpenStack Keystone identity service skill for deploying, configuring, operating, and troubleshooting the authentication and authorization backbone of an OpenStack cloud. Covers identity management, token lifecycle (Fernet provider with rotation), service catalog registration, RBAC policy customization, domain/project/user hierarchy, federation basics (SAML/OIDC), credential encryption, and endpoint management. Use when deploying Keystone via Kolla-Ansible, managing users and projects, debugging 401 errors, rotating Fernet keys, configuring RBAC policies, or integrating services through the service catalog."
user-invocable: true
allowed-tools: Read Grep Glob
metadata:
  extensions:
    gsd-skill-creator:
      version: 1
      createdAt: "2026-02-22"
      triggers:
        intents:
          - "keystone"
          - "identity"
          - "authentication"
          - "service catalog"
          - "RBAC"
          - "token"
          - "federation"
          - "policy.json"
          - "endpoint"
        contexts:
          - "deploying openstack"
          - "configuring identity"
          - "troubleshooting authentication"
          - "managing users and projects"

OpenStack Keystone Identity Service

Keystone is the identity service for OpenStack. Every API call to every OpenStack service passes through Keystone for authentication and authorization. It is the first service deployed and the last decommissioned. If Keystone is down, the entire cloud is down.

Keystone provides five core functions: **identity** (users, groups), **resources** (projects, domains), **assignment** (roles mapped to users on projects), **token** (authentication proof with configurable lifetime), and **catalog** (service endpoint registry). Understanding Keystone means understanding how every OpenStack service discovers and trusts every other service.

Deploy

Kolla-Ansible Configuration

**globals.yml settings:**

# Required -- set strong passwords
keystone_admin_password: "{{ vault_keystone_admin_password }}"
keystone_database_password: "{{ vault_keystone_database_password }}"

# TLS (recommended for production)
kolla_enable_tls_internal: "yes"
kolla_enable_tls_external: "yes"
kolla_copy_ca_into_containers: "yes"

# Token provider (Fernet is default and recommended)
keystone_token_provider: "fernet"

# Optional tuning
keystone_token_expiration: 3600  # seconds, default 1 hour

**Deployment sequence:**

# 1. Bootstrap -- creates databases, service users, initial endpoints
kolla-ansible -i inventory bootstrap-servers

# 2. Deploy Keystone (runs as part of full deploy or targeted)
kolla-ansible -i inventory deploy --tags keystone

# 3. Post-deploy -- creates admin credentials file
kolla-ansible -i inventory post-deploy

**Container verification:**

# Verify Keystone containers are running
docker ps --filter "name=keystone" --format "table {{.Names}}\t{{.Status}}"
# Expected: keystone_api, keystone_fernet (both Up)

# Verify service responds
source /etc/kolla/admin-openrc.sh
openstack token issue  # Must return a valid token table

**Service catalog registration:**

Kolla-Ansible auto-registers Keystone in the service catalog. Verify:

openstack service list  # Should show "identity" service
openstack endpoint list --service keystone
# Expected: 3 endpoints (public, internal, admin) per region

**Initial admin setup:**

# admin-openrc.sh is generated by post-deploy
source /etc/kolla/admin-openrc.sh

# Verify admin project and user exist
openstack project show admin
openstack user show admin
openstack role assignment list --user admin --project admin
# admin should have "admin" role on "admin" project

Configure

Fernet Token Provider

Fernet tokens are cryptographic tokens validated without database lookup. They require synchronized key repositories across Keystone nodes.

**Key repository:** `/etc/kolla/keystone/fernet-keys/` (inside container)

**Key types:**

• **Staging key (index 0):** Used for decryption only; becomes primary on rotation
• **Primary key (highest index):** Used for encryption; tokens it created remain valid
• **Secondary keys (middle indices):** Decrypt only; pruned after max_active_keys exceeded

**Rotation procedure:**

# Rotate Fernet keys (Kolla-Ansible managed)
kolla-ansible -i inventory keystone_fernet_rotate

# Manual rotation (if needed)
docker exec keystone_api keystone-manage fernet_rotate \
  --keystone-user keystone --keystone-group keystone

**Configuration:** `keystone.conf [fernet_tokens]`

• `max_active_keys`: Default 3. Set to (token_expiration / rotation_interval) + 2

Domain, Project, and User Hierarchy

Domain (organizational boundary)
  +-- Project (resource container, formerly "tenant")
       +-- User (identity with credentials)
       +-- Group (collection of users)
       +-- Role Assignment (user/group + role on this project)

**Best practices:**

• Create a domain per organization or department
• Use the "default" domain for service accounts
• Never modify the "admin" project; create separate operator projects
• Assign roles to groups, not individual users, for scalability

RBAC Policies

**Policy files:** `/etc/kolla/keystone/policy.yaml` (override defaults)

# Example: restrict user creation to domain-scoped admins
"identity:create_user": "rule:admin_required and domain_id:%(target.user.domain_id)s"

# Example: allow project members to list users in their project
"identity:list_users": "role:member and project_id:%(scope.project.id)s"

**Policy evaluation order:** 1. Check explicit rule match in policy.yaml 2. Fall back to code default (oslo.policy) 3. Deny if no rule matches

**Verify policy changes:**

# Test a specific policy rule
openstack --os-auth-url http://keystone:5000/v3 \
  --os-username testuser --os-password testpass \
  --os-project-name testproject --os-user-domain-name default \
  -