:_mod-docs-content-type: PROCEDURE
[id="adopting-the-identity-service_{context}"]

= Adopting the {identity_service}

To adopt the {identity_service_first_ref}, you patch an existing `OpenStackControlPlane` custom resource (CR) where the {identity_service} is disabled. The patch starts the service with the configuration parameters that are provided by the {rhos_prev_long} ({OpenStackShort}) environment.

.Prerequisites

* Create the keystone secret that includes the Fernet keys that were copied from the {OpenStackShort} environment:
+
----
$ oc apply -f - <<EOF
apiVersion: v1
data:
  CredentialKeys0: $($CONTROLLER1_SSH sudo cat /var/lib/config-data/puppet-generated/keystone/etc/keystone/credential-keys/0 | base64 -w 0)
  CredentialKeys1: $($CONTROLLER1_SSH sudo cat /var/lib/config-data/puppet-generated/keystone/etc/keystone/credential-keys/1 | base64 -w 0)
  FernetKeys0: $($CONTROLLER1_SSH sudo cat /var/lib/config-data/puppet-generated/keystone/etc/keystone/fernet-keys/0 | base64 -w 0)
  FernetKeys1: $($CONTROLLER1_SSH sudo cat /var/lib/config-data/puppet-generated/keystone/etc/keystone/fernet-keys/1 | base64 -w 0)
kind: Secret
metadata:
  name: keystone
type: Opaque
EOF
----

.Procedure

. Patch the `OpenStackControlPlane` CR to deploy the {identity_service}:
+
----
$ oc patch openstackcontrolplane openstack --type=merge --patch '
spec:
  keystone:
    enabled: true
    apiOverride:
      route: {}
    template:
      override:
        service:
          internal:
            metadata:
              annotations:
                metallb.universe.tf/address-pool: internalapi
                metallb.universe.tf/allow-shared-ip: internalapi
                metallb.universe.tf/loadBalancerIPs: 172.17.0.80 <1>
            spec:
              type: LoadBalancer
      databaseInstance: openstack
      secret: osp-secret
'
----
+
<1> If you use IPv6, change the load balancer IP to the load balancer IP in your environment, for example, `metallb.universe.tf/loadBalancerIPs: fd00:bbbb::80`.

. Create an alias to use the `openstack` command in the {rhos_long} deployment:
+
----
$ alias openstack="oc exec -t openstackclient -- openstack"
----

. Remove services and endpoints that still point to the {OpenStackShort}
control plane, excluding the {identity_service} and its endpoints:
+
----
$ openstack endpoint list | grep keystone | awk '/admin/{ print $2; }' | xargs ${BASH_ALIASES[openstack]} endpoint delete || true

for service in aodh heat heat-cfn barbican cinderv3 glance gnocchi manila manilav2 neutron nova placement swift ironic-inspector ironic octavia; do
  openstack service list | awk "/ $service /{ print \$2; }" | xargs -r ${BASH_ALIASES[openstack]} service delete || true
done
----

.Verification

. Verify that you can access the `OpenStackClient` pod. For more information, see link:{defaultURL}/maintaining_the_red_hat_openstack_services_on_openshift_deployment/assembly_accessing-the-rhoso-cloud#proc_accessing-the-OpenStackClient-pod_cloud-access-admin[Accessing the OpenStackClient pod] in _Maintaining the {rhos_long_noacro} deployment_.

. Confirm that the {identity_service} endpoints are defined and are pointing to the control plane FQDNs:
+
----
$ openstack endpoint list | grep keystone
----

. Wait for the `OpenStackControlPlane` resource to become `Ready`:
+
----
$ oc wait --for=condition=Ready --timeout=1m OpenStackControlPlane openstack
----