openstack---keystone
Posted wangyp
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了openstack---keystone相关的知识，希望对你有一定的参考价值。
keystone 作用： 1）用户管理 记录用户以及他们的权限 2）服务目录 提供一个可用服务的目录 以及访问他们的调用端点（endpoint） 基础软件包的安装 安装openstack仓库 [[email protected] yum.repos.d]# yum install -y centos-release-openstack-mitaka 安装openstack客户端 [[email protected] yum.repos.d]# yum install -y python-openstackclient 安装openstack SElinux管理包 [[email protected] yum.repos.d]# yum install -y openstack-selinux mysql数据库部署 #状态数据存放于mysql [[email protected] yum.repos.d]# yum install -y mariadb mariadb-server python2-PyMysql #消息代理rabbitmq [[email protected] yum.repos.d]# yum install -y rabbitmq-server # Openstack验证服务keystone 其中openstack-keystone是基础包 httpd是web服务器 wsgi是Python的网关接口 memcached存放token的缓存 Python-memcached是Python连接memcached的包 [[email protected] yum.repos.d]# yum install -y openstack-keystone httpd mod_wsgi memcached python-memcached 数据库操作： 0）[[email protected] my.cnf.d]# mysql_secure_installation #设置密码，删除测试库等 1）创建以下文件并导入数据库 [[email protected] ~]# more /tmp/mysql.sql drop database keystone; create database keystone; grant all on keystone.* to ‘keystone‘@‘localhost‘ identified by ‘keystone‘; grant all on keystone.* to ‘keystone‘@‘%‘ identified by ‘keystone‘; drop database glance; create database glance; grant all on glance.* to ‘glance‘@‘localhost‘ identified by ‘glance‘; grant all on glance.* to ‘glance‘@‘%‘ identified by ‘glance‘; drop database glance; create database nova; grant all on nova.* to ‘nova‘@‘localhost‘ identified by ‘nova‘; grant all on nova.* to ‘nova‘@‘%‘ identified by ‘nova‘; create database nova_api; grant all on nova_api.* to ‘nova‘@‘localhost‘ identified by ‘nova‘; grant all on nova_api.* to ‘nova‘@‘%‘ identified by ‘nova‘; create database neutron; grant all on neutron.* to ‘neutron‘@‘localhost‘ identified by ‘neutron‘; grant all on neutron.* to ‘neutron‘@‘%‘ identified by ‘neutron‘; 消息中间件操作 ##端口是5672 yum install -y rabbitmq-server #安装 systemctl enable rabbitmq-server.service #开机自启 systemctl start rabbitmq-server.service #启动 rabbitmqctl add_user openstack openstack #新建用户并赋予权限 rabbitmqctl set_permissions openstack ".*" ".*" ".*" [[email protected] mnesia]# rabbitmq-plugins list [[email protected] mnesia]# rabbitmq-plugins enable rabbitmq_management #开启rabbitmq的web管理界面 [[email protected] mnesia]# grep ‘^[a-z]‘ /etc/keystone/keystone.conf admin_token = a4ec1d2a4abe99f4ae66 connection = mysql+pymysql://keystone:[email protected]/keystone servers = 192.168.142.166:11211 provider = fernet driver = memcache #初始化身份认证服务的数据库： [[email protected] mnesia]# su -s /bin/sh -c "keystone-manage db_sync" keystone #初始化Fernet keys keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone 配置Apache服务器 [[email protected] ~]# grep ServerName /etc/httpd/conf/httpd.conf # ServerName gives the name and port that the server uses to identify itself. ServerName 192.168.142.166:80 [[email protected] ~]# more /etc/httpd/conf.d/wsgi-keystone.conf Listen 5000 Listen 35357 <VirtualHost *:5000> WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP} WSGIProcessGroup keystone-public WSGIScriptAlias / /usr/bin/keystone-wsgi-public WSGIApplicationGroup %{GLOBAL} WSGIPassAuthorization On ErrorLogFormat "%{cu}t %M" ErrorLog /var/log/httpd/keystone-error.log CustomLog /var/log/httpd/keystone-access.log combined <Directory /usr/bin> Require all granted </Directory> </VirtualHost> <VirtualHost *:35357> WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP} WSGIProcessGroup keystone-admin WSGIScriptAlias / /usr/bin/keystone-wsgi-admin WSGIApplicationGroup %{GLOBAL} WSGIPassAuthorization On ErrorLogFormat "%{cu}t %M" ErrorLog /var/log/httpd/keystone-error.log CustomLog /var/log/httpd/keystone-access.log combined <Directory /usr/bin> Require all granted </Directory> </VirtualHost> # systemctl enable httpd.service # systemctl start httpd.service 利用token来登陆keystone export OS_TOKEN=040a9b2b6fd46cc54910 export OS_URL=http://192.168.142.166:35357/v3 export OS_IDENTITY_API_VERSION=3 #创建一个域default，类似机房的概念 openstack domain create --description "Default Domain" default #创建一个project 指定域和名称 openstack project create --domain default --description "Admin Project" admin #创建一个用户 指定域和名称 openstack user create --domain default --password-prompt admin #创建一个角色 openstack role create admin #把admin用户添加到admin项目 并授权admin的角色 openstack role add --project admin --user admin admin #创建一个demo的项目 一个demo用户 创建角色user（配置文件定义好的） openstack project create --domain default --description "Demo Project" demo openstack user create --domain default --password-prompt demo openstack role create user openstack role add --project demo --user demo user #创建service项目 openstack project create --domain default --description "Service Project" service openstack user create --domain default --password-prompt glance openstack role add --project service --user glance admin openstack user create --domain default --password-prompt nova openstack role add --project service --user nova admin openstack user create --domain default --password-prompt neutron openstack role add --project service --user neutron admin #服务注册 openstack service create --name keystone --description "OpenStack Identity" identity openstack endpoint create --region RegionOne identity public http://192.168.142.166:5000/v3 openstack endpoint create --region RegionOne identity internal http://192.168.142.166:5000/v3 openstack endpoint create --region RegionOne identity admin http://192.168.142.166:35357/v3 openstack --os-auth-url http://192.168.142.166:35357/v3 --os-project-domain-name default --os-user-domain-name default --os-project-name admin --os-username admin token issue openstack --os-auth-url http://192.168.142.166:5000/v3 --os-project-domain-name default --os-user-domain-name default --os-project-name demo --os-username demo token issue 创建脚本： #admin export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=admin export OS_USERNAME=admin export OS_PASSWORD=ADMIN_PASS export OS_AUTH_URL=http://controller:35357/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 #demo export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=demo export OS_USERNAME=demo export OS_PASSWORD=DEMO_PASS export OS_AUTH_URL=http://controller:5000/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 验证 #写一堆环境变量 . admin.sh #环境变量设置成功 [[email protected] ~]# echo $OS_USERNAME admin [[email protected] openstack token issue +------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires | 2017-07-09T03:32:21.000000Z | | id | gAAAAABZYZW2x-HD15z2mjnu6JGTZVJosa90ZUFAD0LkbLh3Eya9og2XKICxuZ6p1hvFzdKGzB2Y8bZI7BboOi_Oj- | | | 66q_fvxNTSJth7zuoQT9OM5dNeMSgfmvwudqz6f5qnJHRaPjckqyIugwU0cPg9c4NLtm7nN1nVndCZhgDQVL6IoAyvgcs | | project_id | 3e83baa0b3d64188b036ce423002aac7 | | user_id | 2614b525036b47e6a9a5b51ff385a06d | +------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+
以上是关于openstack---keystone的主要内容，如果未能解决你的问题，请参考以下文章