openstack M版安装 认证(keystone)服务篇
配置安装keystone 认证服务一、安装配置控制节点
1、创建数据库并添加权限
1
2
3
4
5
#mysql -u root -p
>>CREATE DATABASE keystone;
>>GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \IDENTIFIED BY 'KEYSTONE_DBPASS
>>GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \IDENTIFIED BY 'KEYSTONE_DBPASS';';
KEYSTONE_PASS改为自己想要的数据库密码，退出数据库
生产一个随机字符串作为keystone的密码
1
# openssl rand -hex 10 > /root/key
2、安装keystone
1
# yum install openstack-keystone httpd mod_wsgi
编辑keystone配置文件，由于原来的配置文件内容很多，编辑起来比较麻烦，这里所有服务我们都全部备份一下，然后手动编写配置
1
2
3
4
5
6
7
8
# mv /etc/keystone/keystone.conf /etc/keystone/keystone.conf_bak
# vim /etc/keystone/keystone.conf
admin_token = ADMIN_TOKEN#ADMIN_TOKEN是上一步生产的/root/key的值
connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone #替换KEYSTONE_DBPASS
provider = fernet
同步数据库
1
# su -s /bin/sh -c "keystone-manage db_sync" keystone
忽略所有输出
初始化Fernet keys
1
# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
配置apacheweb服务，使用wsgi启动keystone服务
编辑/etc/httpd/conf/httpd.conf
1
ServerName controller
新建配置文件
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
#vim /etc/httpd/conf.d/wsgi-keystone.conf
Listen 5000
Listen 35357
<VirtualHost *:5000>
WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-public
WSGIScriptAlias / /usr/bin/keystone-wsgi-public
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
ErrorLogFormat "%{cu}t %M"
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
Require all granted
</Directory>
</VirtualHost>
<VirtualHost *:35357>
WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-admin
WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
ErrorLogFormat "%{cu}t %M"
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
Require all granted
</Directory>
</VirtualHost>
启动apache，并加入开机启动
1
2
# systemctl enable httpd.service
# systemctl start httpd.service
3、创建服务实体和api接口
设置环境变量
1
2
3
# export OS_TOKEN=`cat /root/key`
# export OS_URL=
# export OS_IDENTITY_API_VERSION=3
创建服务实体和api接口
1
2
3
4
# openstack service create --name keystone --description "OpenStack Identity" identity
# openstack endpoint create --region RegionOne identity public http://controller:5000/v3
# openstack endpoint create --region RegionOne identity internal http://controller:5000/v3
# openstack endpoint create --region RegionOne identity admin http://controller:35357/v3
创建domain，projects，users，roles
1
2
3
4
5
6
7
8
9
10
# openstack domain create --description "Default Domain" default
# openstack project create --domain default--description "Admin Project" admin
# openstack user create --domain default--password-prompt admin#提示数据admin密码
# openstack role create admin
#openstack role add --project admin --user admin admin
#openstack project create --domain default--description "Service Project" service
#openstack project create --domain default--description "Demo Project" demo
#openstack user create --domain default--password-prompt demo#提示数据demo用户密码
#openstack role create user
#openstack role add --project demo --user demo user
4、验证
a、编辑/etc/keystone/keystone-paste.ini 文件 从, , 和 三节中 的admin_token_auth 去掉
b、unset环境变量
1
# unset OS_TOKEN OS_URL
c、使用admin和demo用户 ，用刚才创建的密码，来获取admin和demo的token
1
2
3
4
5
6
7
8
9
10
11
# openstack --os-auth-url http://controller:35357/v3--os-project-domain-name default --os-user-domain-name default --os-project-name admin --os-username admin token issue
Password:
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires | 2016-06-16T11:45:07.490509Z |
| id | gAAAAABXYoMzoRksV6N766GIOfaKj74qiiXEcjLhpN5RpNPqP4TvJ3ln-17Fqx1G-Oz2-BA_c2a0hIxmFozpr5enc7veoBIfKV32_dAppdn2cOKzR0zyW1eP1eQ-a8MU9ikKy5OVFKKEBM8l2uzLZJNcoB6Y7VKDg3Rmc3R5UdHwdoXDhot1LVk |
| project_id | 00a82ac5055d4ddd934d14eaed7c76ac |
| user_id | ce8866883361430d834dc0b5a65a368f |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
# openstack --os-auth-url http://controller:5000/v3--os-project-domain-name default --os-user-domain-name default --os-project-name demo --os-username demo token issue
5、创建openstack client 环境配置脚本
在controller节点
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
# vim /root/admin-openrc.sh
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin #改为自己密码
export OS_AUTH_URL=http://controller:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
# vim /root/demo-openrc.sh
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo #改为自己密码
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
测试，使用admin环境变量
1
2
# source /root/admin-openrc.sh
# openstack token issue #获取admin用户的token
没有错误表示成功！
页:
[1]