Stack domain users

The Heat stack domain user is used to authorize a user to carry out certain operations inside a virtual machine.

Agents running inside virtual machine instances are provided with metadata. These agents repot and share the performance statistics of the VM on which they are running.

They use this metadata to apply any changes or some sort of configuration expressed in the metadata.

A signal is passed to the Heat engine when an event is completed successfully or with the failed status. A typical example can be to generate an alert when the installation of an application is completed on a specific virtual machine after its first reboot.

Heat provides features for encapsulating all the stack-defined users into a separate domain. This domain is usually created to store the information related to the Heat service. A domain admin is created, which is used by Heat for the management of the stack-domain users.

Configuring stack domain users

The following procedure is used to configure stack domain users:

1. A new domain is created using keystone (OpenStack Identity service). Usually, the domain name is set to Heat. This ID is configured in the heat.conf file against the parameter stack_user_domain.
2. A new user is created using keystone with permissions to create and delete projects and users. This newly defined user must belong to the domain created in step 1.
3. The user created in step 2 (along with the password) is configured in heat.conf against the parameters: stack_domain_admin and stack_domain_admin_password.

This user is used to maintain the stack domain users on behalf of stack owners. As the heat_domain_admin user is only allowed access to the Heat domain, the risk of unwanted access to other domains is limited.

The following are the commands and the steps necessary to set up domain users:

1. A domain is created using the following command:

   $ openstack --os-identity-api-version=3  --os-auth-url  http://192.168.5.38:35357/v3\
   --os-username admin --os-password ADMIN --os-project-name admin domain create heat \
   --description "Domain For HEAT Projects and Users"
   

   Here $OS_TOKEN refers to a token that must be a valid token.

   This will return a domain ID that will be referred to as $HEAT_DOMAIN_ID in the next step.

   
2. Next, a user will be created within the domain created in step 1:

   $ openstack  user create heat_domain_admin \
   --os-identity-api-version=3  \
   --os-auth-url  http://192.168.5.38:35357/v3 \
   --os-username=admin --os-password=ADMIN \
   --os-project-name=admin \
   --domain heat \
   --description "Admin for HEAT domain"\
   

   This will return a domain admin ID, which will be used in the next step.

   
3. Next, the newly created user in step 2 is assigned the role of domain admin:

   $ openstack role add admin \
   --user heat_domain_admin \
   --os-identity-api-version=3  \
   --os-auth-url  http://192.168.5.38:35357/v3 \
   --os-username=admin \
   --os-password=ADMIN \
   --os-project-name=admin \
   --domain heat
   

   We'll get the output shown in the following screenshot for this command:

   

The information such as domain ID, username, and password is needed to be configured against the relevant parameters in heat.conf.

Creating a stack

The following are the steps needed to create a sample stack:

1. If the stack contains any resources that require creation of a "stack domain user", then a new "stack domain project" in the "Heat" domain is created.
2. A new user is created under "stack domain project" by Heat if it is required. From an authentication perspective, this user is completely separate and also unrelated to the "stack owner's project."

While processing API requests, an internal lookup is made by Heat Orchestration to grant the required privileges to the user for both the stack owner's project as well as the stack domain project. These privileges are controlled by the policy.json file.