Openstack（二）：keystone認證服務(wù)

首先說明安裝Opnstack服務(wù)安裝的一些基本套路：

1、數(shù)據(jù)庫創(chuàng)建

2、安裝對應(yīng)服務(wù)的軟件包并修改配置文件

3、創(chuàng)建相應(yīng)的服務(wù)并注冊api

一、數(shù)據(jù)庫

官方文檔https://docs.openstack.org/keystone/stein/install/keystone-install-rdo.html

????1、 創(chuàng)建數(shù)據(jù)庫和keystone用戶

mysql?-uroot?-p123456
MariaDB?[(none)]>?CREATE?DATABASE?keystone;
GRANT?ALL?PRIVILEGES?ON?keystone.*?TO?'keystone'@'%'?IDENTIFIED?BY?'keystone123';

????2、在控制端測試能否連接

mysql?-ukeystone?-pkeystone123?-hopenstack-mysql.heng.net

二、安裝對應(yīng)服務(wù)的軟件包并修改配置文件

?1、在控制端操作安裝keystone軟件包

yum?install?openstack-keystone?httpd?mod_wsgi
?#???mod_wsgi用于httpd調(diào)用python服務(wù)

2、修改keystone配置文件

vi /etc/keystone/keystone.conf

[database]???搜索數(shù)據(jù)庫部分
connection?=?mysql+pymysql://keystone:keystone123@openstack-mysql.heng.net/keystone
[token]
#?...
provider?=?fernet???去掉注釋

3、生成keystone數(shù)據(jù)庫的表

su?-s?/bin/sh?-c?"keystone-manage?db_sync"?keystone

4、生成fernet驗證文件

keystone-manage?fernet_setup?--keystone-user?keystone?--keystone-group?keystone
keystone-manage?credential_setup?--keystone-user?keystone?--keystone-group?keystone

5、編輯apache配置文件

vi /etc/httpd/conf/httpd.conf

ServerName?192.168.12.17:80

6、創(chuàng)建/usr/share/keystone/wsgi-keystone.conf 的軟連接，這個是apache調(diào)用python的配置文件，監(jiān)聽了5000端口

ln?-s?/usr/share/keystone/wsgi-keystone.conf?/etc/httpd/conf.d/
?systemctl?start?httpd.service
systemctl?enable?httpd.service

三、創(chuàng)建相應(yīng)的服務(wù)并注冊api

1、Openstack由于現(xiàn)在沒有賬號和密碼，keystone無法提供認證服務(wù)，通過認證服務(wù)就是為了獲取一個token，所以可以直接先定義一個token，繞過認證

openssl?rand?-hex?10
3fdcd4af381781fda580

vi /etc/keystone/keystone.conf

admin_token?=?3fdcd4af381781fda580

修改之后再次同步數(shù)據(jù)庫，寫到數(shù)據(jù)庫

su?-s?/bin/sh?-c?"keystone-manage?db_sync"?keystone

2、查看日志是否有報錯

keystone 日志文件：

ll?/var/log/keystone/keystone.log

3、定義環(huán)境變量

export?OS_TOKEN=3fdcd4af381781fda580
export?OS_URL=http://192.168.12.17:5000/v3
export?OS_IDENTITY_API_VERSION=3

echo $OS_TOKEN? 確認是否設(shè)置成功

4、創(chuàng)建默認域

openstack?domain?create?--description?"Default?Domain"?default

5、創(chuàng)建一個admin項目

openstack?project?create?--domain?default?--description?"Admin?Project"?admin

6、創(chuàng)建 admin 用戶并設(shè)置密碼為 admin：

[root@controller1?~]#openstack?user?create?--domain?default?--password-prompt?admin
User?Password:
Repeat?User?Password:

7、創(chuàng)建admin角色并給amdin用戶授權(quán)

openstack?role?create?admin
openstack?role?add?--project?admin?--user?admin?admin

8、創(chuàng)建demo項目和用戶

openstack?project?create?--domain?default?--description?"Demo?Project"?demo
openstack?user?create?--domain?default?--password-prompt?demo
User?Password:
Repeat?User?Password:
openstack?role?create?user
openstack?role?add?--project?demo?--user?demo?user

9、創(chuàng)建 service 項目

openstack?project?create?--domain?default?--description?"Service?Project"?service

10、創(chuàng)建認證服務(wù)

openstack?service?create?--name?keystone?--description?"OpenStack?Identity"?identity
[root@controller1?~]#openstack?service?list??#查看當前的服務(wù)

11、注冊api到認證服務(wù)

openstack?endpoint?create?--region?RegionOne?identity?admin?http://openstack-vip.heng.net:5000/v3
openstack?endpoint?create?--region?RegionOne?identity?public?http://openstack-vip.heng.net:5000/v3
openstack?endpoint?create?--region?RegionOne?identity?internal?http://openstack-vip.heng.net:5000/v3

12、測試 keystone 是否可以做用戶驗證打開一個新終端

[root@controller1?~]#export?OS_IDENTITY_API_VERSION=3
[root@controller1?~]#openstack?--os-auth-url?http://openstack-vip.heng.net:5000/v3?--os-project-domain-name?Default?--os-user-domain-name?Default?--os-project-name?admin?--os-username?admin?token?issue

#輸入這條命令不用輸入密碼即可顯示結(jié)果，則表示成功

13、已經(jīng)可以做用戶認證后就不需要手動指定token來管理了，文件中的token已經(jīng)用不到了，刪除

vi /etc/keystone/keystone.conf? ?

?

14、定義二個環(huán)境變量的腳本，通過這兩個腳本定義變量，調(diào)用對應(yīng)api

vi scripts/admin-stein.sh

export?OS_PROJECT_DOMAIN_NAME=Default
export?OS_USER_DOMAIN_NAME=Default
export?OS_PROJECT_NAME=admin
export?OS_USERNAME=admin
export?OS_PASSWORD=admin
export?OS_AUTH_URL=http://openstack-vip.heng.net:5000/v3
export?OS_IDENTITY_API_VERSION=3
export?OS_IMAGE_API_VERSION=2

?

vi scripts/demo-stein.sh

export?OS_PROJECT_DOMAIN_NAME=Default
export?OS_USER_DOMAIN_NAME=Default
export?OS_PROJECT_NAME=demo
export?OS_USERNAME=demo
export?OS_PASSWORD=demo
export?OS_AUTH_URL=http://openstack-vip.heng.net:5000/v3
export?OS_IDENTITY_API_VERSION=3
export?OS_IMAGE_API_VERSION=2

15、腳本使用，出現(xiàn)這個結(jié)果表示keystone服務(wù)安裝成功

source?demo-stein.sh
openstack?token?issue