openstack---keystone

我爱小虾

keystone
作用：
1）用户管理 记录用户以及他们的权限
2）服务目录 提供一个可用服务的目录 以及访问他们的调用端点（endpoint）

------更新于20170802------
作用：
1）authentication 验证

2）authorization  授权
3）用户管理
基础软件包的安装
安装openstack仓库
[iyunv@master1 yum.repos.d]# yum install -y centos-release-openstack-mitaka
安装openstack客户端
[iyunv@master1 yum.repos.d]# yum install -y python-openstackclient
安装openstack SElinux管理包
[iyunv@master1 yum.repos.d]# yum install -y openstack-selinux
Mysql数据库部署
#状态数据存放于mysql
[iyunv@master1 yum.repos.d]# yum install -y mariadb mariadb-server python2-PyMysql
#消息代理rabbitmq
[iyunv@master1 yum.repos.d]# yum install -y rabbitmq-server

# Openstack验证服务keystone 其中openstack-keystone是基础包 httpd是web服务器 wsgi是Python的网关接口 memcached存放token的缓存 Python-memcached是Python连接memcached的包
[iyunv@master1 yum.repos.d]# yum install -y openstack-keystone httpd mod_wsgi memcached python-memcached

数据库操作：
0）[iyunv@master1 my.cnf.d]# mysql_secure_installation #设置密码，删除测试库等
1）创建以下文件并导入数据库
[iyunv@master1 ~]# more /tmp/mysql.sql
drop database keystone;
create database keystone;
grant all on keystone.* to 'keystone'@'localhost' identified by 'keystone';
grant all on keystone.* to 'keystone'@'%' identified by 'keystone';
drop database glance;
create database glance;
grant all on glance.* to 'glance'@'localhost' identified by 'glance';
grant all on glance.* to 'glance'@'%' identified by 'glance';
drop database glance;
create database nova;
grant all on nova.* to 'nova'@'localhost' identified by 'nova';
grant all on nova.* to 'nova'@'%' identified by 'nova';

create database nova_api;
grant all on nova_api.* to 'nova'@'localhost' identified by 'nova';
grant all on nova_api.* to 'nova'@'%' identified by 'nova';
create database neutron;
grant all on neutron.* to 'neutron'@'localhost' identified by 'neutron';
grant all on neutron.* to 'neutron'@'%' identified by 'neutron';

消息中间件操作 ##端口是5672
yum install -y rabbitmq-server  #安装
systemctl enable rabbitmq-server.service #开机自启
systemctl start rabbitmq-server.service  #启动
rabbitmqctl add_user openstack openstack  #新建用户并赋予权限
rabbitmqctl set_permissions openstack ".*" ".*" ".*"
[iyunv@master1 mnesia]# rabbitmq-plugins list
[iyunv@master1 mnesia]# rabbitmq-plugins enable rabbitmq_management #开启rabbitmq的web管理界面
[iyunv@master1 mnesia]# grep '^[a-z]' /etc/keystone/keystone.conf
admin_token = a4ec1d2a4abe99f4ae66
connection = mysql+pymysql://keystone:keystone@192.168.142.166/keystone
servers = 192.168.142.166:11211
provider = fernet
driver = memcache
#初始化身份认证服务的数据库：
[iyunv@master1 mnesia]# su -s /bin/sh -c "keystone-manage db_sync" keystone
#初始化Fernet keys
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

配置Apache服务器
[iyunv@master1 ~]# grep ServerName /etc/httpd/conf/httpd.conf
# ServerName gives the name and port that the server uses to identify itself.
ServerName 192.168.142.166:80

[iyunv@master1 ~]# more /etc/httpd/conf.d/wsgi-keystone.conf
Listen 5000
Listen 35357
<VirtualHost *:5000>
WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-public
WSGIScriptAlias / /usr/bin/keystone-wsgi-public
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
ErrorLogFormat "%{cu}t %M"
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
Require all granted
</Directory>
</VirtualHost>
<VirtualHost *:35357>
WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-admin
WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
ErrorLogFormat "%{cu}t %M"
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
Require all granted
</Directory>
</VirtualHost>
# systemctl enable httpd.service
# systemctl start httpd.service
利用token来登陆keystone
export OS_TOKEN=040a9b2b6fd46cc54910
export OS_URL=http://192.168.142.166:35357/v3
export OS_IDENTITY_API_VERSION=3
#创建一个域default，类似机房的概念
openstack domain create --description "Default Domain" default
#创建一个project  指定域和名称
openstack project create --domain default   --description "Admin Project" admin
#创建一个用户 指定域和名称
openstack user create --domain default   --password-prompt admin
#创建一个角色
openstack role create admin
#把admin用户添加到admin项目 并授权admin的角色
openstack role add --project admin --user admin admin

#创建一个demo的项目  一个demo用户 创建角色user（配置文件定义好的）  
openstack project create --domain default   --description "Demo Project" demo
openstack user create --domain default   --password-prompt demo
openstack role create user
openstack role add --project demo --user demo user
#创建service项目
openstack project create --domain default  --description "Service Project" service
openstack user create --domain default --password-prompt glance
openstack role add --project service --user glance admin
openstack user create --domain default --password-prompt nova
openstack role add --project service --user nova admin
openstack user create --domain default --password-prompt neutron
openstack role add --project service --user neutron admin
#服务注册
openstack service create   --name keystone --description "OpenStack Identity" identity
openstack endpoint create --region RegionOne   identity public http://192.168.142.166:5000/v3
openstack endpoint create --region RegionOne   identity internal http://192.168.142.166:5000/v3
openstack endpoint create --region RegionOne   identity admin http://192.168.142.166:35357/v3
#unsettle variable
unset OS_TOKEN OS_URL
openstack --os-auth-url http://192.168.142.166:35357/v3 --os-project-domain-name default --os-user-domain-name default  --os-project-name admin --os-username admin token issue
openstack --os-auth-url http://192.168.142.166:5000/v3 --os-project-domain-name default --os-user-domain-name default --os-project-name demo --os-username demo token issue
创建脚本：
#admin.sh
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=ADMIN_PASS
export OS_AUTH_URL=http://controller:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
#demo.sh
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=DEMO_PASS
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
验证
#写一堆环境变量
.  admin.sh
#验证环境变量设置成功
[iyunv@master1 ~]# echo $OS_USERNAME
admin
[iyunv@master1 openstack token issue
+------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field      | Value                                                                                                                                                    |
+------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires    | 2017-07-09T03:32:21.000000Z                                                                                                                              |
| id         | gAAAAABZYZW2x-HD15z2mjnu6JGTZVJosa90ZUFAD0LkbLh3Eya9og2XKICxuZ6p1hvFzdKGzB2Y8bZI7BboOi_Oj-                                                               |
|            | 66q_fvxNTSJth7zuoQT9OM5dNeMSgfmvwudqz6f5qnJHRaPjckqyIugwU0cPg9c4NLtm7nN1nVndCZhgDQVL6IoAyvgcs                                                            |
| project_id | 3e83baa0b3d64188b036ce423002aac7                                                                                                                         |
| user_id    | 2614b525036b47e6a9a5b51ff385a06d                                                                                                                         |
+------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+