openstack 之~keystone部署

時間 2019-11-16

標籤 openstack keystone 部署简体版

原文原文鏈接

第一：版本信息

官網http://docs.openstack.org/newton/install-guide-rdo/keystone.htmlphp

咱們按照Newton這個版原本部署，openstack基本保持每6個月更新一個版本，面對如此快的版本更新，咱們其實瞅準了一個版本深刻研究下去就好，爭取爲社區提交代碼。html

第二：部署keystone

參考部署官網：http://docs.openstack.org/newton/install-guide-rdo/python

查看系統信息：mysql

[root@localhost ~]# cat /etc/redhat-release 
CentOS Linux release 7.0.1406 (Core) 
[root@localhost ~]# uname -a
Linux localhost.localdomain 3.10.0-123.el7.x86_64 #1 SMP Mon Jun 30 12:09:22 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

準備階段：

yum -y install centos-release-openstack-newton #安裝官方yum源
yum -y upgrade                        #更新
yum -y install python-openstackclient #安裝工具
yum -y install openstack-selinux      #安裝openstack-selinux包自動管理openstack組件的安全策略

額外補充：linux

[root@localhost ~]# more /etc/yum.conf 
[main]
cachedir=/newton 新建該目錄
keepcache=1  把這個本來是0的改成1，是把yum緩存到本地
debuglevel=2
logfile=/var/log/yum.log
exactarch=1
obsoletes=1
gpgcheck=1
plugins=1
installonly_limit=5
bugtracker_url=http://bugs.centos.org/set_project.php?project_id=23&ref=http://bugs.centos.org/bug_report_page.php?category=yum
distroverpkg=centos-release

mkdir /newtonweb

部署數據庫sql

keystone支持ldap和mysql做爲後端Driver,用來存放用戶相關信息，catalog等，這裏咱們選用mariadb

yum -y install mariadb mariadb-server python2-PyMySQL

配置數據庫

配置文件：/etc/my.cnf.d/openstack.cnf

[mysqld]
bind-address = 192.168.1.120 #本機管理網絡ip

default-storage-engine = innodb  #mysql的存儲引擎
innodb_file_per_table    #獨立表空間
max_connections = 4096 #最大連接數
collation-server = utf8_general_ci  #默認排序規則
character-set-server = utf8 #字符集

啓動服務並設置開機自啓動且檢查狀態apache

[root@localhost ~]# systemctl start mariadb.service
[root@localhost ~]# systemctl enable mariadb.service
Created symlink from /etc/systemd/system/multi-user.target.wants/mariadb.service to /usr/lib/systemd/system/mariadb.service.
[root@localhost ~]# systemctl status mariadb.service
● mariadb.service - MariaDB 10.1 database server
   Loaded: loaded (/usr/lib/systemd/system/mariadb.service; enabled; vendor preset: disabled)
   Active: active (running) since Mon 2017-02-06 09:25:17 EST; 16s ago
 Main PID: 43433 (mysqld)
   Status: "Taking your SQL requests now..."
   CGroup: /system.slice/mariadb.service
           └─43433 /usr/libexec/mysqld --basedir=/usr

Feb 06 09:25:16 localhost.localdomain mysql-prepare-db-dir[43275]: Please report any problems at http://mariadb.org/jira
Feb 06 09:25:16 localhost.localdomain mysql-prepare-db-dir[43275]: The latest information about MariaDB is available at http://mariadb.org/.
Feb 06 09:25:16 localhost.localdomain mysql-prepare-db-dir[43275]: You can find additional information about the MySQL part at:
Feb 06 09:25:16 localhost.localdomain mysql-prepare-db-dir[43275]: http://dev.mysql.com
Feb 06 09:25:16 localhost.localdomain mysql-prepare-db-dir[43275]: Support MariaDB development by buying support/new features from MariaDB
Feb 06 09:25:16 localhost.localdomain mysql-prepare-db-dir[43275]: Corporation Ab. You can contact us about this at sales@mariadb.com.
Feb 06 09:25:16 localhost.localdomain mysql-prepare-db-dir[43275]: Alternatively consider joining our community based development effort:
Feb 06 09:25:16 localhost.localdomain mysql-prepare-db-dir[43275]: http://mariadb.com/kb/en/contributing-to-the-mariadb-project/
Feb 06 09:25:16 localhost.localdomain mysqld[43433]: 2017-02-06  9:25:16 140101128218816 [Note] /usr/libexec/mysqld (mysqld 10.1.18-MariaD...433 ...
Feb 06 09:25:17 localhost.localdomain systemd[1]: Started MariaDB 10.1 database server.
Hint: Some lines were ellipsized, use -l to show in full.

MariaDB已經啓動json

初始化數據庫

mysql_secure_installation

部署keystone

keystone關於數據庫的操做

[root@localhost ~]# mysql -u root -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 8
Server version: 10.1.18-MariaDB MariaDB Server

Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> CREATE DATABASE keystone;#新建數據庫
Query OK, 1 row affected (0.00 sec) 

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \
    ->   IDENTIFIED BY '123';    #新建本地訪問keystone帳號
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \
    ->   IDENTIFIED BY '123';   #新建遠程訪問keystone帳號
Query OK, 0 rows affected (0.00 sec)

安裝包：

#keystone軟件包名openstack-keystone
#安裝httpd和mod_wsgi的緣由是，社區主推apache+keystone
#openstack-keystone本質就是一款基於wsgi協議的web app,而httpd本質就是一個兼容wsgi協議的web server，因此咱們須要爲httpd安裝mod_wsgi模塊
yum -y install openstack-keystone httpd mod_wsgi

配置：/etc/keystone/keystone.conf

#讓openstack-keystone可以知道如何鏈接到後端的數據庫keystone
#mysql+pymysql：pymysql是一個python庫，使用python能夠操做mysql原生sql
[database]
connection = mysql+pymysql://keystone:123@192.168.31.57/keystone #注意123沒有引號哈
[token]
provider = fernet #fernet爲生成token的方式

初始化數據庫keystone

#初始化是由於python的orm對象關係映射，須要初始化來生成數據庫表結構
su -s /bin/sh -c "keystone-manage db_sync" keystone

初始化Fernet key倉庫

keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

結合apache整合keystone

首先修改主機名

hostnamectl set-hostname controller

設置/etc/hosts

192.168.1.120 controller

配置/etc/httpd/conf/httpd.conf

ServerName controller

爲mod_wsgi模塊添加配置文件

ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/
注：直接複製也能夠

啓動apache，設置開機自啓動

systemctl start httpd.service
systemctl enable httpd.service

第三：keystone操做

一：建立keystone的catalog

配置/etc/keystone/keystone.conf

[DEFAULT]
admin_token = 123

設置環境變量

#OS_TOKEN=配置文件中的admin_token
#會在filter過濾過程當中被admin_token_auth中間間設置is_admin=True
#誰有這個admin_token誰就是管理員了。

export OS_TOKEN=123 #等於keystone.conf中admin_token的值
export OS_URL=http://192.168.1.120:35357/v3
export OS_IDENTITY_API_VERSION=3

爲keystone建立catalog

#根據上一步給的權限，建立認證服務實體

二：建立域，項目，用戶，角色，把四個元素關聯到一塊兒

首先創建一個公共的域名：

建立管理員各項信息：

#建立admin項目

#建立admin角色

三者關聯（項目、用戶、角色）
[root@localhost ~]# openstack role add --project admin --user admin admin

三：使用Bootstrap完成一和二的工做

#爲keystone建立catalog
keystone-manage bootstrap --bootstrap-password 123 \
  --bootstrap-admin-url http://192.168.1.120:35357/v3/ \
  --bootstrap-internal-url http://192.168.1.120:35357/v3/ \
  --bootstrap-public-url http://192.168.1.120:5000/v3/ \
  --bootstrap-region-id RegionOne

設置環境變量（is_admin不會被設置成True，admin用戶會得到一個Token）
export OS_USERNAME=admin
export OS_PASSWORD=123 #就是keystone-manage中設定的--bootstrap-password
export OS_PROJECT_NAME=admin
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default
export OS_AUTH_URL=http://192.168.1.120:35357/v3
export OS_IDENTITY_API_VERSION=3

四：建立的項目，普通用戶，項目，角色，創建關聯

#建立project名爲demo
[root@localhost ~]# openstack project create --domain default \
>   --description "Demo Project" demo
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Demo Project                     |
| domain_id   | 9526862455314cefbf4ad7faa4580582 |
| enabled     | True                             |
| id          | 1d57f06fda06450298d5cf72777be63d |
| is_domain   | False                            |
| name        | demo                             |
| parent_id   | 9526862455314cefbf4ad7faa4580582 |
+-------------+----------------------------------+
#建立普通用戶demo
[root@localhost ~]# openstack user create --domain default \
>   --password-prompt demo
User Password:
Repeat User Password:
+---------------------+----------------------------------+
| Field               | Value                            |
+---------------------+----------------------------------+
| domain_id           | 9526862455314cefbf4ad7faa4580582 |
| enabled             | True                             |
| id                  | 8e28f8c353db487eb17477953e34452c |
| name                | demo                             |
| password_expires_at | None                             |
+---------------------+----------------------------------+
#建立普通用戶的角色即user
[root@localhost ~]# openstack role create user
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | None                             |
| id        | d0094c83800043529c37401a28815497 |
| name      | user                             |
+-----------+----------------------------------+
#創建三者關聯

[root@localhost ~]# openstack role add --project demo --user demo user

五：爲後續的服務建立統一租戶service

#後面全部的服務公用一個項目service，都是管理員角色admin
#因此實際上後續的服務安裝關於keysotne的操做只剩2，4
[root@localhost ~]# openstack project create --domain default \
>   --description "Service Project" service
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Service Project                  |
| domain_id   | 9526862455314cefbf4ad7faa4580582 |
| enabled     | True                             |
| id          | 75026d89c408438086f2314c003fdc8f |
| is_domain   | False                            |
| name        | service                          |
| parent_id   | 9526862455314cefbf4ad7faa4580582 |
+-------------+----------------------------------+

小結：後面每搭建一個新的服務都須要在keystone中執行四種操做：1.建項目 2.建用戶 3.建角色 4.作關聯

第四：驗證

準備工做

出於安全考慮，須要關閉臨時令牌認證機制（配置文件中的admin_token和keystone-manage的--bootstrap-password都是基於該機制）

該機制會將用戶的請求設置is_admin=True，源碼分析中會介紹，先暫且理解到這裏


編輯/etc/keystone/keystone-paste.ini
這三個

[pipeline:public_api]
[pipeline:admin_api]
[pipeline:api_v3] 
中的admin_token_auth都去掉

取消一切設置的環境變量，如

unset OS_AUTH_URL OS_PASSWORD

開始驗證：用admin用戶

報錯了，這個錯誤的中文意思是：只有認證的用戶才能夠申請token，我也申請過了，這是什麼緣由？

緣由有兩個：第一：主機名/etc/hosts,配置不正確

第二：主機名修改後沒有進行從新登陸

最好這個第一步就作了，

驗證成功

舒適提示：必定要加上--os-identity-api-version 3 我們用的是v3

用demo用戶驗證：

驗證方法二：

[root@controller ~]# curl -i \
> -H "Content-Type: application/json" \
> -d '
> {
>     "auth": {
>         "identity": {
>             "methods": [
>                 "password"
>             ],
>             "password": {
>                 "user": {
>                     "domain":{
>                         "name": "default"
>                      },
>                     "name": "admin",
>                     "password": "123"
>                 }
>             }
>          },
>          "scope": {
>             "project": {
>                 "domain": {
>                         "name":"default"
>                 },
>                "name": "admin"
>             }
>          }
>      }
> }' \
> http://127.0.0.1:5000/v3/auth/tokens
HTTP/1.1 201 Created
Date: Mon, 06 Feb 2017 15:32:25 GMT
Server: Apache/2.4.6 (CentOS) mod_wsgi/3.4 Python/2.7.5
X-Subject-Token: gAAAAABYmJcyCNVmoREAng1Q_KKedkdp3SVMnJdZeH1edN-lQk5OLM0_Nfqar-YeObaVn2Go90jFVCMbRk5UE-rRhDPqW33mlccjD2aTrf0U3cHNAj_dqSJJaXNfCPjpwSH2bopieKeOMaY87NtiUhZunTvvPRORsGUrrSR2KGBxRmM0dNpIX-A
Vary: X-Auth-Token
x-openstack-request-id: req-5ec4e24e-dc11-4d89-99f9-e9dabbe3a948
Content-Length: 1124
Content-Type: application/json

{"token": {"is_domain": false, "methods": ["password"], "roles": [{"id": "81fcdb131f3d4a0d8b4fa3bc95cf7f46", "name": "admin"}], "expires_at": "2017-02-06T16:33:00.000000Z", "project": {"domain": {"id": "9526862455314cefbf4ad7faa4580582", "name": "default"}, "id": "d2cac6cd998a4463abc5e83ec06f8996", "name": "admin"}, "catalog": [{"endpoints": [{"region_id": "RegionOne", "url": "http://192.168.1.120:5000/v3", "region": "RegionOne", "interface": "public", "id": "37d4397231f74a5b98c48fd1220d7cd0"}, {"region_id": "RegionOne", "url": "http://192.168.1.120:5000/v3", "region": "RegionOne", "interface": "internal", "id": "72b8b7a700124e3f8876c6e74fd7b0c5"}, {"region_id": "RegionOne", "url": "http://192.168.1.120:35357/v3", "region": "RegionOne", "interface": "admin", "id": "b63e63c081b74dc3829cb9ae045f02f7"}], "type": "identity", "id": "7ed3a973acd3460883efdc187225ef80", "name": "keystone"}], "user": {"domain": {"id": "9526862455314cefbf4ad7faa4580582", "name": "default"}, "id": "97ecd026af9f46349b76c57af5f7f84c", "name": "admin"}, "audit_ids": ["Jw80h1bURZ6u6vYzcRA3xg"], "issued_at": "2017-02-06T15:33:06.000000Z"}}

View Code

第五：查看信息

查看catalog信息，admin，internal，public

查看endpoint信息

查看服務列表

查看域列表

查看項目，角色，用戶，以及他們的管理信息

第六：編寫腳本

admin-openrc

export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=123
export OS_AUTH_URL=http://192.168.1.120:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

demo-openrc,針對不一樣的用戶應該有不一樣的用戶信息

export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=123
export OS_AUTH_URL=http://192.168.1.120:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

小結：咱們能夠針對不一樣的用戶，都定義成腳本

咱們的申請token操做爲：

source admin-openrc
openstack token issue

相關標籤/搜索

每日一句

每一个你不满意的现在，都有一个你没有努力的曾经。