openstack M版安装 认证(keystone)服务篇

4532423

配置安装keystone 认证服务


一、安装配置控制节点
1、创建数据库并添加权限

1 2 3 4 5

[iyunv@controller ~]#mysql -u root -p >>CREATE DATABASE keystone; >>GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \  IDENTIFIED BY 'KEYSTONE_DBPASS >>GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \  IDENTIFIED BY 'KEYSTONE_DBPASS';';

KEYSTONE_PASS改为自己想要的数据库密码，退出数据库

生产一个随机字符串作为keystone的密码

1	[iyunv@controller ~]# openssl rand -hex 10 > /root/key

2、安装keystone

1	[iyunv@controller ~]# yum install openstack-keystone httpd mod_wsgi

编辑keystone配置文件，由于原来的配置文件内容很多，编辑起来比较麻烦，这里所有服务我们都全部备份一下，然后手动编写配置

1 2 3 4 5 6 7 8

[iyunv@controller ~]# mv /etc/keystone/keystone.conf /etc/keystone/keystone.conf_bak [iyunv@controller ~]# vim /etc/keystone/keystone.conf [DEFAULT] admin_token = ADMIN_TOKEN  #ADMIN_TOKEN是上一步生产的/root/key的值 [database] connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone   #替换KEYSTONE_DBPASS [token] provider = fernet

同步数据库

1	[iyunv@controller ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone

忽略所有输出
初始化Fernet keys

1	[iyunv@controller ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

配置apache  web服务，使用wsgi启动keystone服务
编辑/etc/httpd/conf/httpd.conf

1	ServerName controller

新建配置文件

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

[iyunv@controller ~]#vim /etc/httpd/conf.d/wsgi-keystone.conf Listen 5000 Listen 35357 <VirtualHost *:5000> WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP} WSGIProcessGroup keystone-public    WSGIScriptAlias / /usr/bin/keystone-wsgi-public WSGIApplicationGroup %{GLOBAL}    WSGIPassAuthorization On ErrorLogFormat "%{cu}t %M" ErrorLog /var/log/httpd/keystone-error.log CustomLog /var/log/httpd/keystone-access.log combined    <Directory /usr/bin>     Require all granted    </Directory> </VirtualHost>    <VirtualHost *:35357>     WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}        WSGIProcessGroup keystone-admin        WSGIScriptAlias / /usr/bin/keystone-wsgi-admin     WSGIApplicationGroup %{GLOBAL}        WSGIPassAuthorization On     ErrorLogFormat "%{cu}t %M"     ErrorLog /var/log/httpd/keystone-error.log     CustomLog /var/log/httpd/keystone-access.log combined        <Directory /usr/bin>         Require all granted        </Directory>   </VirtualHost>

启动apache，并加入开机启动

1 2	[iyunv@controller ~]# systemctl enable httpd.service [iyunv@controller ~]# systemctl start httpd.service

3、创建服务实体和api接口
设置环境变量

1 2 3

[iyunv@controller ~]# export OS_TOKEN=`cat /root/key` [iyunv@controller ~]# export OS_URL= [iyunv@controller ~]# export OS_IDENTITY_API_VERSION=3

创建服务实体和api接口

1 2 3 4

[iyunv@controller ~]# openstack service create --name keystone --description "OpenStack Identity" identity [iyunv@controller ~]# openstack endpoint create --region RegionOne identity public http://controller:5000/v3 [iyunv@controller ~]# openstack endpoint create --region RegionOne identity internal http://controller:5000/v3 [iyunv@controller ~]# openstack endpoint create --region RegionOne identity admin   http://controller:35357/v3

创建domain，projects，users，roles

1 2 3 4 5 6 7 8 9 10

[iyunv@controller ~]# openstack domain create --description "Default Domain" default [iyunv@controller ~]# openstack project create --domain default  --description "Admin Project" admin [iyunv@controller ~]# openstack user create --domain default  --password-prompt admin  #提示数据admin密码 [iyunv@controller ~]# openstack role create admin [iyunv@controller ~]#  openstack role add --project admin --user admin admin [iyunv@controller ~]#  openstack project create --domain default  --description "Service Project" service [iyunv@controller ~]#  openstack project create --domain default  --description "Demo Project" demo [iyunv@controller ~]#  openstack user create --domain default  --password-prompt demo  #提示数据demo用户密码 [iyunv@controller ~]#  openstack role create user [iyunv@controller ~]#  openstack role add --project demo --user demo user

4、验证
a、编辑/etc/keystone/keystone-paste.ini 文件 从[pipeline:public_api], [pipeline:admin_api], 和 [pipeline:api_v3] 三节中 的admin_token_auth 去掉
b、unset环境变量

1	[iyunv@controller ~]# unset OS_TOKEN OS_URL

c、使用admin和demo用户 ，用刚才创建的密码，来获取admin和demo的token

1 2 3 4 5 6 7 8 9 10 11

[iyunv@controller ~]# openstack --os-auth-url http://controller:35357/v3  --os-project-domain-name default --os-user-domain-name default   --os-project-name admin --os-username admin token issue Password: +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field      | Value                                                                                                                                                                                   | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires    | 2016-06-16T11:45:07.490509Z                                                                                                                                                             | | id         | gAAAAABXYoMzoRksV6N766GIOfaKj74qiiXEcjLhpN5RpNPqP4TvJ3ln-17Fqx1G-Oz2-BA_c2a0hIxmFozpr5enc7veoBIfKV32_dAppdn2cOKzR0zyW1eP1eQ-a8MU9ikKy5OVFKKEBM8l2uzLZJNcoB6Y7VKDg3Rmc3R5UdHwdoXDhot1LVk | | project_id | 00a82ac5055d4ddd934d14eaed7c76ac                                                                                                                                                        | | user_id    | ce8866883361430d834dc0b5a65a368f                                                                                                                                                        | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ [iyunv@controller ~]# openstack --os-auth-url http://controller:5000/v3  --os-project-domain-name default --os-user-domain-name default   --os-project-name demo --os-username demo token issue

5、创建openstack client 环境配置脚本
在controller节点

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

[iyunv@controller ~]# vim /root/admin-openrc.sh export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=admin export OS_USERNAME=admin export OS_PASSWORD=admin     #改为自己密码 export OS_AUTH_URL=http://controller:35357/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 [iyunv@controller ~]# vim /root/demo-openrc.sh export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=demo export OS_USERNAME=demo export OS_PASSWORD=demo    #改为自己密码 export OS_AUTH_URL=http://controller:5000/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2

测试，使用admin环境变量

1 2	[iyunv@controller ~]# source /root/admin-openrc.sh [iyunv@controller ~]# openstack token issue   #获取admin用户的token

没有错误表示成功！