openstack 部署（Q版)-----keystone认证服务安装配置

一、新建数据库及用户

CREATE DATABASE keystone;
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY '123456';
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY '123456';

二、安装keystone

yum install -y openstack-keystone httpd mod_wsgi

修改keystone配置文件

vim /etc/keystone/keystone.conf

[database]
connection = mysql+pymysql://keystone:123456@controller01/keystone

[token]
provider = fernet

初始化数据库

su -s /bin/sh -c "keystone-manage db_sync" keystone

初始化Fernet密钥存储库

keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

引导标识服务

keystone-manage bootstrap --bootstrap-password  \
--bootstrap-admin-url http://controller01:35357/v3/ \
--bootstrap-internal-url http://controller01:5000/v3/ \
--bootstrap-public-url http://controller01:5000/v3/ \
--bootstrap-region-id RegionOne

配置apache httpd

vim /etc/httpd/conf/httpd.conf修改ServerName

ServerName controller01

ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

启动httpd

systemctl enable httpd.service
systemctl start httpd.service

查看35357和5000端口有没有被监听

netstat -anpt | grep http

配置环境变量

export OS_USERNAME=admin
export OS_PASSWORD=
export OS_PROJECT_NAME=admin
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default
export OS_AUTH_URL=http://controller01:35357/v3
export OS_IDENTITY_API_VERSION=

source /etc/profile

查看创建的Identity服务及其endpoint

openstack service list
openstack endpoint list

三、创建域、项目、用户、角色

创建一个服务项目，名称是“service”，该服务项目包含唯一用户，它是添加到环境的所有服务的用户：

openstack project create --domain default --description "Service Project" service

查看

openstack project list

注意，其中的admin项目是自动创建的，不需要手工创建。

创建demo项目

openstack project create --domain default --description "Demo Project" demo

创建“demo”用户并设置密码

openstack user create --domain default --password-prompt demo

创建“user”角色

openstack role create user

为“demo”项目的“demo”用户添加“user”角色：

openstack role add --project demo --user demo user

四、测试令牌是否正常

取消以下两个环境变量

unset OS_AUTH_URL OS_PASSWORD

尝试用admin用户请求一个令牌看是否正常

openstack --os-auth-url http://controller01:35357/v3 \
--os-project-domain-name default --os-user-domain-name default \
--os-project-name admin --os-username admin token issue

尝试用demo用户请求一个令牌看是否正常

openstack --os-auth-url http://controller01:5000/v3 \

--os-project-domain-name default --os-user-domain-name default \

--os-project-name demo --os-username demo token issue

五、为admin和demo用户创建环境变量脚本

以上过程命令长、参数多，为了简化，分别为admin/demo用户创建环境变量脚本：

admin-openrc脚本

export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=
export OS_AUTH_URL=http://controller01:35357/v3
export OS_IDENTITY_API_VERSION=
export OS_IMAGE_API_VERSION=

demo-openrc脚本

export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=
export OS_AUTH_URL=http://controller01:5000/v3
export OS_IDENTITY_API_VERSION=
export OS_IMAGE_API_VERSION=

测试脚本使用

source admin-openrc
openstack token issue              admin用户请求令牌

source demo-openrc
openstack token issue              demo用户请求令牌

六、keystone服务正常测试

从各节点访问keystone服务，验证是否正常

curl http://controller01:35357/v3

curl http://controller01:5000/v3