OpenStack之四： keystone验证服务（端口5000）

Posted 2022-09-11 maxuebin

#官网地址：https://docs.openstack.org/keystone/stein/install/keystone-install-rdo.html

#：创建库，并授权

MariaDB [(none)]> CREATE DATABASE keystone;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO ‘keystone‘@‘%‘  IDENTIFIED BY ‘keystone123‘;

#： 在控制端安装keystone服务

[root@localhost ~]# yum install openstack-keystone httpd mod_wsgi -y

#： 配置keystone

[root@localhost ~]# vim /etc/keystone/keystone.conf
[database]
connection=mysql+pymysql://keystone:[e-mail]/keystone

[token]
provider = fernet

#: 解析域名

[root@localhost ~]# vim /etc/hosts
192.168.7.101 www.magedu.net

#： 安装haproxy

[root@localhost ~]# yum install haproxy -y

#: 配置haproxy

[root@localhost ~]# vim /etc/haproxy/haproxy.cfg
listen mysqlserver
bind 192.168.7.101:3306
mode tcp
server mysql 192.168.7.105:3306 check inter 2s fall 3 rise 5

#：配置sysctl

[root@localhost ~]# vim /etc/sysctl.conf
net.ipv4.ip_nonlocal_bind = 1
[root@localhost ~]# sysctl -p

#: 启动haproxy

[root@localhost ~]# systemctl start haproxy
[root@localhost ~]# systemctl enable haproxy


#：初始化数据库

[root@localhost ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone

#： 提供两个认证文件

[root@localhost ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
[root@localhost ~]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

#：修改http 的配置

[root@localhost ~]# vim  /etc/httpd/conf/httpd.conf
ServerName 192.168.7.101:80

#：做一个软连接

[root@localhost ~]# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/


#：绕过keystone用命令生成token

  [root@node1 ~]# openssl rand -hex 10
   de844334c3e60d1ae559                #随便找一台机子生成字符串

  [root@controller1 ~]# vim /etc/keystone/keystone.conf

   admin_token = de844334c3e60d1ae559

 

 #：再次做一次初始化

 

  [root@localhost ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone

 

 #：新打开一个窗口导入环境变量

 

 [root@localhost ~]# export  OS_TOKEN=de844334c3e60d1ae559
 [root@localhost ~]# export OS_URL=http://192.168.7.101:5000/v3
 [root@localhost ~]# export OS_IDENTITY_API_VERSION=3

 

 #： 启动httpd服务

 

 [root@localhost ~]# systemctl start httpd
 [root@localhost ~]# systemctl enable httpd

 

 

#： 创建一个default域

 

[root@controller1 ~]# openstack domain create --description "Default Domain" default

 

#：在default域中创建一个admin项目

 

[root@controller1 ~]# openstack project create --domain default --description "Admin Project" admin

 

#：在default域中创建一个admin的用户（密码是admin）

 

[root@controller1 ~]# openstack user create --domain default --password-prompt admin

 

#：创建一个admin角色,一个项目里面可以有多个角色

 

[root@controller1 ~]# openstack role create admin

 

#：给admin项目添加一个用户叫admin，并将其添加至admin角色中

 

[root@controller1 ~]# openstack role add --project admin --user admin admin

 

#：再在default域中创建一个demo项目

 

[root@controller1 ~]# openstack project create --domain default --description "Demo Project" demo

 

#：在default域中创建一个demo用户（密码是demo）

 

[root@controller1 ~]#  openstack user create --domain default --password-prompt demo

 

#：创建一个user角色

 

[root@controller1 ~]# openstack role create user

 

#：给demo项目添加一个用户叫demo，并将其添加至user角色中

 

[root@controller1 ~]# openstack role add --project demo --user demo user

 

#：创建一个service项目

 

[root@controller1 ~]# openstack project create --domain default   --description "Service Project" service

 

#：创建一个类型为identity的service

 

[root@controller1 ~]# openstack service create  --name keystone --description "OpenStack Identity" identity

 

#：注册API

 

[root@localhost ~]# openstack endpoint create --region RegionOne identity public http://www.magedu.net:5000/v3

[root@localhost ~]# openstack endpoint create --region RegionOne identity internal http://www.magedu.net:5000/v3

[root@localhost ~]# openstack endpoint create --region RegionOne identity admin http://www.magedu.net:5000/v3

 

#：新打开一个窗口，测试

 

[root@localhost ~]# export OS_IDENTITY_API_VERSION=3
[root@localhost ~]# openstack --os-auth-url http://www.magedu.net:5000/v3 --os-project-domain-name default --os-user-domain-name default  --os-project-name admin  --os-username admin token issue

 

#： 创建脚本

 

[root@localhost ~]# mkdir scripts
[root@localhost ~]# cd scripts/

[root@localhost scripts]# vim admin-stein.sh

export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_AUTH_URL=http://www.magedu.net:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

 

[root@localhost scripts]# vim demo-stein.sh

export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo
export OS_AUTH_URL=http://www.magedu.net:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

 

#：测试

 

[root@localhost ~]# source scripts/admin-stein.sh
[root@localhost ~]# openstack token issue
[root@localhost ~]# source scripts/demo-stein.sh
[root@localhost ~]# openstack token issue