@@ -19,8 +19,49 @@ Configuration
1919OpenStack Configuration
2020=======================
2121
22- Publishing benchmark information
23- --------------------------------
22+ Apart from configuring cASO, several actions need to be performed in your
23+ OpenStack installation in order to be able to extract accounting records.
24+
25+ User credentials (required)
26+ ---------------------------
27+
28+ In the next section you will configure an OpenStack Keystone credentials in
29+ order to extract the records. The cASO user has to be a member of each of the
30+ projects (another option is to convert that user in an administrator, but the
31+ former option is a safer approach) for which it is extracting the accounting.
32+ Otherwise, ``cASO `` will not be able to get the usages and will fail.
33+
34+ In order to do so, we are going to setup a new role ``accounting `` a new user
35+ ``accounting ``, adding it to each of the projects with that role::
36+
37+ openstack role create accounting
38+ openstack user create --password <password> accounting
39+ # For each of the projects, add the user with the accounting role
40+ openstack role add --user accounting --project <project> accounting
41+
42+ Moreover, this user needs access to Keystone so as to extract the users
43+ information. In this case, we can can grant the user just the rights for
44+ listing the users adding the appropriate rules in your
45+ ``/etc/keystone/policy.json `` as follows. Replace the line::
46+
47+ "identity:list_users": "rule:admin_required",
48+
49+ with::
50+
51+ "identity:list_users": "rule:admin_required or role:accounting",
52+
53+ Recent Keystone versions leverage a ``/etc/keystone/policy-yaml `` file, if this
54+ is your case, substitute the line::
55+
56+ "identity:list_users": "rule:admin_required"
57+
58+ with::
59+
60+ "identity:list_users": "rule:admin_required or role:accounting"
61+
62+
63+ Publishing benchmark information for OpenStack flavors (optional)
64+ -----------------------------------------------------------------
2465
2566Starting with the V0.4 of the accounting record it is possible to publish
2667benchmark information. In order to do so, you need to add this information to
@@ -30,13 +71,13 @@ are two different values that need to be added to the flavor:
3071* The benchmark name, indicated with the ``accounting:benchmark_name `` flavor property.
3172* The benchmark value, indicated with the ``accounting:benchmark_value `` flavor property.
3273
33- So , if you are using HEPSPEC06 and the benchmark value is ``99 `` for the flavor
34- ``m1.foo `` you should set this as follows::
74+ For example , if you are using HEPSPEC06 and the benchmark value is ``99 `` for
75+ the flavor ``m1.foo ``, the benchmark information is configured as follows::
3576
36- openstack flavor set --property benchmark_name="HEPSPEC06" --property accounting:benchmark_value=99 m1.foo
77+ openstack flavor set --property accounting: benchmark_name="HEPSPEC06" --property accounting:benchmark_value=99 m1.foo
3778
38- Using different keys
39- ~~~~~~~~~~~~~~~~~~~~
79+ Using different keys to specify bechmark information
80+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4081
4182If you do not want to use cASO's default flavor properties ``accounting:benchmark_name `` and
4283``accounting:benchmark_value `` (for example because you are using different benchmark types
@@ -52,48 +93,12 @@ the ``benchmark_name_key`` ``benchkark_value_key`` in the configuration file.
5293 properties in cASO's configuration file, please include the complete name
5394 (i.e. ``scope:property ``).
5495
55-
56- User credentials
57- ----------------
58-
59- The user configured in the previous section has to be a member of each of the
60- project (another option is to convert that user in an administrator, but the
61- former option is a safer approach) for which it is extracting the accounting.
62- Otherwise, ``cASO `` will not be able to get the usages and will fail::
63-
64- openstack role create accounting
65- openstack user create --password <password> accounting
66- # For each of the projects, add the user with the accounting role
67- openstack role add --user accounting --project <project> accounting
68-
69- Also, this user needs access to Keystone so as to extract the users
70- information.
71-
72- * If you are using the V2 identity API, you have to give admin rights to the
73- ``accounting `` user, editing the ``/etc/keystone/policy.json `` file and
74- replacing the line::
75-
76- "admin_required": "role:admin or is_admin:1 or",
77-
78- with::
79-
80- "admin_required": "role:admin or is_admin:1 or role:accounting",
81-
82- * If you are using the V3 identity API you can grant the user just the rights
83- for listing the users adding the appropriate rules in the
84- ``/etc/keystone/policy.json `` as follows. Replace the line::
85-
86- "identity:list_users": "rule:admin_required",
87-
88- with::
89-
90- "identity:list_users": "rule:admin_required or role:accounting",
91-
9296cASO configuration
9397==================
9498
9599``cASO `` uses a config file (default at ``/etc/caso/caso.conf ``) with several
96- sections. A sample file is available at ``etc/caso/caso.conf.sample ``.
100+ sections. A sample file is available at
101+ :download: `etc/caso/caso.conf.sample <static/caso.conf.sample >`.
97102
98103``[DEFAULT] `` section
99104---------------------
@@ -114,19 +119,23 @@ of every option. You should check at least the following options:
114119* ``messengers `` (list, default: ``noop ``). List of the messengers to publish
115120 data to. Records will be pushed to all these messengers, in order. Valid
116121 messengers shipped with cASO are:
117- * ``ssm `` for publishing APEL V0.4 records.
118- * ``logstash `` for publishing to Logstash.
119- * ``noop `` do nothing at all.
122+
123+ * ``ssm `` for publishing APEL V0.4 records.
124+ * ``logstash `` for publishing to Logstash.
125+ * ``noop `` do nothing at all.
126+
120127 Note that there might be other messengers available in the system if they are
121128 registered into the ``caso.messenger `` entry point namespace.
122129* ``mapping_file `` (default: ``/etc/caso/voms.json ``). File containing the
123130 mapping from VOs to local projects as configured in Keystone-VOMS, in the
124131 form::
132+
125133 {
126134 "VO": {
127135 "projects": ["foo", "bar"],
128136 }
129137 }
138+
130139* ``benchmark_name_key `` and ``benchmark_value_key ``. These two configuration
131140 options are used by ``cASO `` to retrieve the benchmark information form the
132141 OpenStack flavors.
@@ -141,7 +150,6 @@ authentication, so that it is possible to use any authentication plugin that is
141150available there (so starting on version 1.0 of cASO it is possible to use the
142151Keystone V3 API).
143152
144-
145153.. important ::
146154 You need to specify the ``auth_type `` that you want to use (normally
147155 ``v3password `` is a good choice.
@@ -168,3 +176,16 @@ messenger. Available options:
168176
169177* ``host `` (default: ``localhost ``), host of Logstash server.
170178* ``port `` (default: ``5000 ``), Logstash server port.
179+
180+ Other cASO configuration options
181+ --------------------------------
182+
183+ For an exhaustive list of the defined options, please check the following page:
184+
185+ .. toctree ::
186+ :maxdepth: 1
187+ :titlesonly:
188+
189+ configuration-file
190+
191+
0 commit comments