OpenStack--Keystone组件部署

Posted 还行少年

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了OpenStack--Keystone组件部署相关的知识,希望对你有一定的参考价值。

Keyston身份服务简介

1、主要功能

  • 身份认证:对用户进行身份认证,并对应权限范围
  • 用户授权(令牌管理权限):以token令牌的方式标识用户对应拥有的权限范围
  • 用户管理(寻址功能):提供用户访问资源的寻址功能(URL)
  • 服务目录:所有服务的交互/调用,均需要keyston进行认证

2、管理对象

  • User:指使用Openstack service的用户,nova glance(跑在OpenStack里面,是需要一个用户进行管理的)
  • Project(Tenant):可以理解为一个人或服务所拥有的资源集合
  • Role:用于划分权限,通过给User指定Role, 使User获得Role对应操作权限
  • Authentication:确定用户身份的过程
  • Token:是一个字符串表示,作为访问资源的令牌。Token包含了在指定范围和有效时间内可以被访问的资源
  • Credentials:用于确认用户身份的凭证,用户的用户名和密码,或者是用户名和API密钥,或者身份管理服务提供的认证令牌。
  • Service Openstack service, 即Openstack中运行的组件服务。如nova、swift、glance、 neutron、 cinder等
  • Endpoint:一个可以通过网络来访问和定位某个Openstack service的地址,通常是一个URL(即apache的api (位置点))

3、keystone认证过程

  • user 登陆(keystone 认证)
  • user 进入控制台/命令行界面(位置点)
  • user 发起创建虚拟的请求(向keystone认证指引位置点)
  • 请求到达nova组件(向keystone认证 )
  • nova会开始执行请求,并且调用创建实例所需要的glance、neutron等资源(向keystone
    认证,指引对应服务的位置点)
  • glance和neutron 服务收到请求后(向keystone认证)才会给与nova对应的资源
  • nova 拿到资源后,调用对应资源,创建实例,最后将创建结果返回给用户

一、创建数据库实例和数据库用户

[root@ct ~]# mysql -uroot -p123456   //登录到数据库,生产环境最好不要直接将密码直接输出
Welcome to the MariaDB monitor.  Commands end with ; or \\g.
Your MariaDB connection id is 10
Server version: 10.3.20-MariaDB MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.

MariaDB [(none)]> show databases;   //查看所有库
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
+--------------------+
3 rows in set (0.002 sec)

MariaDB [(none)]> create database keystone;    //创建keystone库
Query OK, 1 row affected (0.001 sec)

MariaDB [(none)]> grant all privileges on keystone.* to 'keystone'@'localhost' identified by 'KEYSTONE_DBPASS';                //给keystone用户提权(keystone库的所有权限)
Query OK, 0 rows affected (0.001 sec)

MariaDB [(none)]> grant all privileges on keystone.* to 'keystone'@'%' identified by 'KEYSTONE_DBPASS';
Query OK, 0 rows affected (0.001 sec)

MariaDB [(none)]> flush privileges;           //刷新权限表,立即生效
Query OK, 0 rows affected (0.001 sec)

MariaDB [(none)]> show grants for keystone;    //查看keystone用户的权限
+---------------------------------------------------------------------------------------------------------+
| Grants for keystone@%                                                                                   |
+---------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO 'keystone'@'%' IDENTIFIED BY PASSWORD '*442DFE587A8B6BE1E9538855E8187C1EFB863A73' |
| GRANT ALL PRIVILEGES ON `keystone`.* TO 'keystone'@'%'                                                  |
+---------------------------------------------------------------------------------------------------------+
2 rows in set (0.000 sec)

MariaDB [(none)]> 

二、安装、配置keystone、数据库、Apache

1.安装keystone、apache

[root@ct ~]#  yum -y install openstack-keystone httpd mod_wsgi
已加载插件:fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirrors.cn99.com
 * centos-ceph-nautilus: mirrors.cn99.com
 * centos-nfs-ganesha28: mirrors.aliyun.com
 * centos-openstack-train: mirrors.huaweicloud.com
 * centos-qemu-ev: mirrors.aliyun.com
 * extras: mirrors.cn99.com
 * updates: mirrors.aliyun.com
软件包 1:openstack-keystone-16.0.2-1.el7.noarch 已安装并且是最新版本        
软件包 httpd-2.4.6-97.el7.centos.x86_64 已安装并且是最新版本
软件包 mod_wsgi-3.4-18.el7.x86_64 已安装并且是最新版本          //让apache能够代理python程序的组件
无须任何处理
[root@ct ~]# 

2.配置keystone

[root@ct ~]# cp -a /etc/keystone/keystone.conf{,.bak}   //将配置文件备份
[root@ct ~]# grep -Ev "^$|#" /etc/keystone/keystone.conf.bak > /etc/keystone/keystone.conf    //过滤出不以$或#开头的行并覆盖配置文件文件
[root@ct ~]# openstack-config --set /etc/keystone/keystone.conf database connection   mysql+pymysql://keystone:KEYSTONE_DBPASS@ct/keystone    //通过pymysql模块连接mysql。指定用户名密码、数据库的域名、数据库名
[root@ct ~]# cat /etc/keystone/keystone.conf
[database]
connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@ct/keystone

[root@ct ~]# openstack-config --set /etc/keystone/keystone.conf token provider fernet  //指定token传递者的消息传递模式
[root@ct ~]# cat /etc/keystone/keystone.conf

3.初始化数据库

[root@ct ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone   //使用keystone的身份切换环境来执行操作
[root@ct ~]# mysql -uroot -p123456
Welcome to the MariaDB monitor.  Commands end with ; or \\g.
Your MariaDB connection id is 12
Server version: 10.3.20-MariaDB MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.

MariaDB [(none)]> use keystone
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [keystone]> show tables;
+------------------------------------+
| Tables_in_keystone                 |
+------------------------------------+
| access_rule                        |
| access_token                       |
| application_credential             |
| application_credential_access_rule |
| application_credential_role        |
| assignment                         |
| config_register                    |
| consumer                           |
| credential                         |
| endpoint                           |
| endpoint_group                     |
| federated_user                     |
| federation_protocol                |
| group                              |
| id_mapping                         |
| identity_provider                  |
| idp_remote_ids                     |
| implied_role                       |
| limit                              |
| local_user                         |
| mapping                            |
| migrate_version                    |
| nonlocal_user                      |
| password                           |
| policy                             |
| policy_association                 |
| project                            |
| project_endpoint                   |
| project_endpoint_group             |
| project_option                     |
| project_tag                        |
| region                             |
| registered_limit                   |
| request_token                      |
| revocation_event                   |
| role                               |
| role_option                        |
| sensitive_config                   |
| service                            |
| service_provider                   |
| system_assignment                  |
| token                              |
| trust                              |
| trust_role                         |
| user                               |
| user_group_membership              |
| user_option                        |
| whitelisted_config                 |
+------------------------------------+
48 rows in set (0.000 sec)

4.初始化fernet密钥存储库

[root@ct ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone   //生成密钥文件
[root@ct ~]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone    //生成凭证文件
[root@ct ~]# ls /etc/keystone/
credential-keys            fernet-keys    keystone.conf.bak  policy.json
default_catalog.templates  keystone.conf  logging.conf       sso_callback_template.html
[root@ct ~]# 

5.配置bootstrap身份认证服务

初始化openstack,会把openstack的admin用户的信息写入到mysql的user表中,以及url等其他信息写入到mysql的相关表中

[root@ct ~]# keystone-manage bootstrap --bootstrap-password ADMIN_PASS \\
> --bootstrap-admin-url http://ct:5000/v3/ \\
> --bootstrap-internal-url http://ct:5000/v3/ \\
> --bootstrap-public-url http://ct:5000/v3/ \\
> --bootstrap-region-id RegionOne

6.配置apache服务器

[root@ct ~]# echo "ServerName controller" >> /etc/httpd/conf/httpd.conf  
[root@ct ~]#  ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/  //让apache调用wsgi
[root@ct ~]# systemctl enable httpd   //开机启动
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
[root@ct ~]# systemctl start httpd     //启动httpd

7.配置管理员账户的环境变量

[root@ct ~]# cat >> ~/.bashrc << EOF
> export OS_USERNAME=admin
> export OS_PASSWORD=ADMIN_PASS
> export OS_PROJECT_NAME=admin
> export OS_USER_DOMAIN_NAME=Default
> export OS_PROJECT_DOMAIN_NAME=Default
> export OS_AUTH_URL=http://ct:5000/v3
> export OS_IDENTITY_API_VERSION=3
> export OS_IMAGE_API_VERSION=2
> EOF
[root@ct ~]# source .bashrc 


8.查看当前所有用户列表

[root@ct ~]# openstack user list
+----------------------------------+-------+
| ID                               | Name  |
+----------------------------------+-------+
| 3ca7f7442b954e028c6b46152dccfc46 | admin |
+----------------------------------+-------+
[root@ct ~]# 

三、创建OpenStack 域、项目、用户和角色

1.创建一个项目

[root@ct ~]# openstack project create --domain default --description "Service Project" service   //创建在指定的domain(域)中,指定描述信息,project名称为service
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Service Project                  |
| domain_id   | default                          |
| enabled     | True                             |
| id          | 784ed99e838e4375aa8f092941908b53 |
| is_domain   | False                            |
| name        | service                          |
| options     | {}                               |
| parent_id   | default                          |
| tags        | []                               |
+-------------+----------------------------------+
[root@ct ~]# openstack domain list    //查看指定域
+---------+---------+---------+--------------------+
| ID      | Name    | Enabled | Description        |
+---------+---------+---------+--------------------+
| default | Default | True    | The default domain |
+---------+---------+---------+--------------------+
[root@ct ~]# 

2.创建角色

[root@ct ~]# openstack role create user   
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | None                             |
| domain_id   | None                             |
| id          | 42ef7ca8401c415d8dfa3e3ae469c7eb |
| name        | user                             |
| options     | {}                               |
+-------------+----------------------------------+
[root@ct ~]# openstack role list   //查看角色列表
+----------------------------------+--------+
| ID                               | Name   |
+----------------------------------+--------+
| 42ef7ca8401c415d8dfa3e3ae469c7eb | user   |   //用户
| 556b53c2942d4901840b28233c48d3c7 | admin  |   //管理员
| 65f0dd93c4b24825a16a059de8e63874 | member |   //租户
| d446535751c5421890fed29161280e65 | reader |   
+----------------------------------+--------+
[root@ct ~]# 

3.验证认证服务

[root@ct ~]# openstack token issue
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field      | Value                                                                                                                                                                                   |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires    | 2021-08-23T11:41:57+0000                                                                                                                                                                |
| id         | gAAAAABhI3t1u3wY06pqe-gz7o9MUqN_uIRd0WsXFaFb6x_SKwRLT2IZcFObuGEHD2VW_ZmsYWE4PU9JygMuWgYOwbXAMvAMqRyU-onTbKiO-7vOjKJbxsmLU3IHMvJ2roKG6UQ3XlqZaBuh0eG3tlCGLmU1Y2Ph3cfbZHo8CsuiwXJ5W_cTwso |
| project_id | cdf2831522724a8b91c8b7e57bd84516                                                                                                                                                        |
| user_id    | 3ca7f7442b954e028c6b46152dccfc46                                                                                                                                                        |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
[root@ct ~]# 

以上是关于OpenStack--Keystone组件部署的主要内容,如果未能解决你的问题,请参考以下文章

OpenStack--Keystone组件部署

OpenStack——Keystone组件

OpenStack——Keystone组件

OpenStack——Keystone组件

Openstack keystone组件详解

有关Openstack keystone组件的理解