Skip to content

Instantly share code, notes, and snippets.

Created March 15, 2024 15:50
Show Gist options
  • Save markus-hentsch/b0f7315a9ad6f5dc8621727056df275e to your computer and use it in GitHub Desktop.
Save markus-hentsch/b0f7315a9ad6f5dc8621727056df275e to your computer and use it in GitHub Desktop.
Minimal DevStack in a VirtualBox VM for Keystone

Minimal DevStack VirtualBox setup

This is a very concise quickstart guide to setup an OpenStack DevStack limited to Keystone in a VirtualBox VM using Ubuntu Server LTS as the guest operating system. By limiting the DevStack to primarily deploy Keystone only, installation is quick and the machine does not take up much resources.

As the time of writing it uses up about 11 GB of disk space and 1 GB of RAM running Keystone.

This is meant for testing authentication and IDM-related things with OpenStack Keystone while disregarding other components. It can easily be extended by further components by adjusting the local.conf accordingly.

VirtualBox VM

Create a VirtualBox VM for Ubuntu Server LTS that has two interfaces:

  1. NAT for internet access
  2. Host-only for OpenStack API

Later on, it should look like this in the guest OS:


      dhcp4: true
      dhcp4: true
  version: 2

DevStack setup (within the VM)

Full guide:


sudo useradd -s /bin/bash -d /opt/stack -m stack
sudo chmod +x /opt/stack
echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
sudo -u stack -i
git clone
cd devstack
cp samples/local.conf local.conf

Now edit local.conf as instructed below:

# Use the IP address of the Host-only adapter here:

# Only deploy wanted services
ENABLED_SERVICES=key,mysql,tempest # see devstack/stackrc

The above *_SERVICES settings will trim down the DevStack to Keystone, Tempest, mysqld and memcached.

Note: configuring *_SERVICES can be tricky. Look into devstack/stackrc and the source code for reference. Sometimes full service names are interpreted ("keystone"), sometimes only shorthands ("g-api").

Now, deploy the DevStack.

Deploying and tearing down the DevStack

First, enter the DevStack environment:

sudo -u stack -i
cd devstack/





Using the DevStack

From within the VM

sudo -u stack -i
cd devstack/

source openrc  # user: demo, project: demo
openstack image list  # example command

source openrc admin admin  # user: admin, project: admin
openstack project list  # example command

From the host (outside of the VM)

virtualenv .openstack-venv
source .openstack-venv/bin/activate
pip install openstackclient

For the next step, log into the VM and extract the client settings like so:

NOTE: To extract the client settings for the admin user instead, use source openrc admin admin in the steps below.

sudo -u stack -i
cd devstack
source openrc
printenv | grep OS_

Now leave the VM again and return to the host. Copy the returned OS_* variables and save them in a local file (e.g. as ~/openrc) on your workstation outside of the VM. Prepend "export " to each of them, e.g.

export OS_REGION_NAME=RegionOne
export OS_PROJECT_DOMAIN_ID=default
export OS_CACERT=

Outside of the VM, enter the virtualenv again (if you left it) and then load that file:

source .openstack-venv/bin/activate
source ~/openrc

openstack image list  # example command

NOTE: Make sure that OS_AUTH_URL in the variables file is set to the IP address of the Host-only adapter of the running DevStack VM reachable from the host.

Tips & Tricks

Making changes to configuration or source code

Upstream guide:

  • you can find the .conf files in the VM guest directly under the corresponding /etc/ trees
    • e.g. /etc/keystone/keystone.conf
  • there are systemd services for all OpenStack components
    • you can list them with systemctl list-units | grep devstack
    • note that many services have abbreviated names: c-* for Cinder, g-* for Glance, n-* for Neutron and so on
  • source code of the main components can be edited directly under /opt/stack/<component>/
    • changes will take effect once the corresponding service(s) is/are restarted
      • e.g. systemctl restart devstack@g-api
  • to change library source code you have to edit it in the common VirtualEnv located at /opt/stack/data/venv/
    • e.g. /opt/stack/data/venv/lib/python3.10/site-packages/keystoneauth1/ for the keystoneauth library

Enabling the new RBAC defaults (enforce_scope)


To use this new option, adjustments are necessary both server-side (DevStack) and client-side (OSC, Tempest).

NOTE: The enforce_scope-related settings need to be in sync between both sides at all times. If you revert this configuration, make sure to revert both sides.



enforce_new_defaults = true
enforce_scope = true
sudo systemctl restart devstack@keystone


export OS_SYSTEM_SCOPE=all



# IMPORTANT: comment out admin_project_name and admin_domain_name when you
# enable enforce_scope! Otherwise auth won't work.
#admin_project_name = admin
#admin_domain_name = Default
admin_system = all

enforce_scope = true

# Does the compute/identity/network/... service API policies enforce scope and
# new defaults? Should be enabled when
# nova.conf: oslo_policy.enforce_new_defaults and oslo_policy.enforce_scope are
# enabled.
keystone = true

enforce_scope = true

Adding Barbican

Barbican is not deployed per default and needs to be added explicitly via the following addition to local.conf followed by a redeployment:

# Barbican plugin
enable_plugin barbican
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment