This guide covers manual configuration of the Bare Metal service in the standalone mode. Alternatively, Bifrost can be used for automatic configuration.
It is possible to use the Bare Metal service without other OpenStack services.
You should make the following changes to
Choose an authentication strategy which supports standalone, one option is
Another option is
http_basicwhere the credentials are stored in an Apache htpasswd format file:
[DEFAULT] auth_strategy=http_basic http_basic_auth_user_file=/etc/ironic/htpasswd
bcryptformat is supported, and the Apache htpasswd utility can be used to populate the file with entries, for example:
htpasswd -nbB myName myPassword >> /etc/ironic/htpasswd
If you want to disable the Networking service, you should have your network pre-configured to serve DHCP and TFTP for machines that you’re deploying. To disable it, change the following lines:
If you disabled the Networking service and the driver that you use is supported by at most one conductor, PXE boot will still work for your nodes without any manual config editing. This is because you know all the DHCP options that will be used for deployment and can set up your DHCP server appropriately.
If you have multiple conductors per driver, it would be better to use Networking since it will do all the dynamically changing configurations for you.
If you want to disable using a messaging broker between conductor and API processes, switch to JSON RPC instead:
[DEFAULT] rpc_transport = json-rpc
JSON RPC also has its own authentication strategy. If it is not specified then the stategy defaults to
auth_strategy. The following will set JSON RPC to
[json_rpc] auth_strategy = noauth
http_basicthe conductor server needs a credentials file to validate requests:
[json_rpc] auth_strategy = http_basic http_basic_auth_user_file = /etc/ironic/htpasswd-json-rpc
The API server also needs client-side credentials to be specified:
[json_rpc] auth_type = http_basic username = myName password = myPassword
Starting with the Yoga release series, you can use a combined API+conductor service and completely disable the RPC. Set
[DEFAULT] rpc_transport = none
and use the
ironicexecutable to start the combined service.
The combined service also works with RPC enabled, which can be useful for some deployments, but may not be advisable for all security models.
To use the
set up these environment variables. If the
noauth authentication strategy is
being used, the value
none must be set for OS_AUTH_TYPE. OS_ENDPOINT is
the URL of the ironic-api process.
http_basic authentication strategy is being used, the value
http_basic must be set for OS_AUTH_TYPE. For example: