Openstack_O版(otaka)部署_认证服务keystone部署
安装和配置服务
1. 建keystone库建用户
在控制节点执行
mysql -uroot -p123456 CREATE DATABASE keystone; GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY ''; GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY ''; flush privileges;
2.软件安装
yum install openstack-keystone httpd mod_wsgi -y
3. 编辑配置文件
vim /etc/keystone/keystone.conf [DEFAULT] admin_token = b4164396208d7fe6d48b # 建议用命令制作 token:openssl rand -hex 10 [database] connection = mysql+pymysql://keystone:123456@controller01/keystone [token] provider = fernet
4. 同步修改到数据库
su -s /bin/sh -c "keystone-manage db_sync" keystone
5. 初始化fernet keys
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
6. 配置apache服务
vim /etc/httpd/conf/httpd.conf ServerName controller01
vim /etc/httpd/conf.d/wsgi-keystone.conf Listen 5000 Listen 35357 <VirtualHost *:5000> WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP} WSGIProcessGroup keystone-public WSGIScriptAlias / /usr/bin/keystone-wsgi-public WSGIApplicationGroup %{GLOBAL} WSGIPassAuthorization On ErrorLogFormat "%{cu}t %M" ErrorLog /var/log/httpd/keystone-error.log CustomLog /var/log/httpd/keystone-access.log combined <Directory /usr/bin> Require all granted </Directory> </VirtualHost> <VirtualHost *:35357> WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP} WSGIProcessGroup keystone-admin WSGIScriptAlias / /usr/bin/keystone-wsgi-admin WSGIApplicationGroup %{GLOBAL} WSGIPassAuthorization On ErrorLogFormat "%{cu}t %M" ErrorLog /var/log/httpd/keystone-error.log CustomLog /var/log/httpd/keystone-access.log combined <Directory /usr/bin> Require all granted </Directory> </VirtualHost>
7. 启动Web服务
systemctl enable httpd.service
systemctl restart httpd.service
创建服务实体和访问端点
1. 实现配置管理员环境变量,用于获取后面创建的权限
export OS_TOKEN=b4164396208d7fe6d48b export OS_URL=http://controller01:35357/v3 export OS_IDENTITY_API_VERSION=3
2. 基于上一步给的权限,创建认证服务实体(目录服务)
openstack service create --name keystone --description "OpenStack Identity" identity +-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Identity |
| enabled | True |
| id | aa47cd781e53430dad37b0c9944b688b |
| name | keystone |
| type | identity |
+-------------+----------------------------------+
3. 基于上一步建立的服务实体,创建访问该实体的三个api端点
openstack endpoint create --region RegionOne identity public http://controller01:5000/v3 +--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 41fee09de7cc4e9b8d08c0b73e9f39d3 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | aa47cd781e53430dad37b0c9944b688b |
| service_name | keystone |
| service_type | identity |
| url | http://controller01:5000/v3 |
+--------------+----------------------------------+ openstack endpoint create --region RegionOne identity internal http://controller01:5000/v3 +--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | d5dcf1954a414131913f7fa4ea5182ee |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | aa47cd781e53430dad37b0c9944b688b |
| service_name | keystone |
| service_type | identity |
| url | http://controller01:5000/v3 |
+--------------+----------------------------------+ openstack endpoint create --region RegionOne identity admin http://controller01:35357/v3 +--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 93fe3d113327455f9c973d3b42579268 |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | aa47cd781e53430dad37b0c9944b688b |
| service_name | keystone |
| service_type | identity |
| url | http://controller01:35357/v3 |
+--------------+----------------------------------+
创建域,租户,用户,角色,把四个元素关联到一起
1. 建立一个公共的域名
openstack domain create --description "Default Domain" default +-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Default Domain |
| enabled | True |
| id | 135e691ebbb74fefb5086970eac74706 |
| name | default |
+-------------+----------------------------------+
2. 建立一个管理员
openstack project create --domain default --description "Admin Project" admin +-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Admin Project |
| domain_id | 135e691ebbb74fefb5086970eac74706 |
| enabled | True |
| id | a3f24ce750034504876c0132c427306e |
| is_domain | False |
| name | admin |
| parent_id | 135e691ebbb74fefb5086970eac74706 |
+-------------+----------------------------------+ openstack user create --domain default --password-prompt admin +---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | 135e691ebbb74fefb5086970eac74706 |
| enabled | True |
| id | 1a1f6cf671474f45b81bf4150d8f6a67 |
| name | admin |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
3. 建立一个角色:admin
openstack role create admin +-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | None |
| id | a442951d5ed044b78c80c223aef2bf3a |
| name | admin |
+-----------+----------------------------------+ openstack role add --project admin --user admin admin
4. 建立一个普通用户
openstack project create --domain default --description "Demo Project" demo +-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Demo Project |
| domain_id | 135e691ebbb74fefb5086970eac74706 |
| enabled | True |
| id | 890abe6826374c4d94b371d035f3f6ee |
| is_domain | False |
| name | demo |
| parent_id | 135e691ebbb74fefb5086970eac74706 |
+-------------+----------------------------------+ openstack user create --domain default --password-prompt demo +---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | 135e691ebbb74fefb5086970eac74706 |
| enabled | True |
| id | 8f26fad523ed4b6e9c30fbfa21cc8544 |
| name | demo |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
5. 建立一个普通角色
openstack role create user +-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | None |
| id | 3065224e5e32425a8d84775fe0fadbbc |
| name | user |
+-----------+----------------------------------+ openstack role add --project demo --user demo user
6. 为后续的服务创建统一租户service
# 解释:后面每搭建一个新的服务都需要在keystone中执行四种操作:1.建租户 2.建用户 3.建角色 4.做关联 # 后面所有的服务公用一个租户service,都是管理员角色admin,所以实际上后续的服务安装关于keysotne的操作只剩2,4 openstack project create --domain default --description "Service Project" service +-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Service Project |
| domain_id | 135e691ebbb74fefb5086970eac74706 |
| enabled | True |
| id | 38fce9de65f2455088be6196678e2090 |
| is_domain | False |
| name | service |
| parent_id | 135e691ebbb74fefb5086970eac74706 |
+-------------+----------------------------------+
验证操作
vim /etc/keystone/keystone-paste.ini 在[pipeline:public_api], [pipeline:admin_api], and [pipeline:api_v3] 三个地方 移走:admin_token_auth unset OS_TOKEN OS_URL openstack --os-auth-url http://controller01:35357/v3 --os-project-domain-name default --os-user-domain-name default --os-project-name admin --os-username admin token issue +------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
+------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires | 2018-02-02T02:45:24+0000 |
| id | gAAAAABac8K0yoQzaByOrSYlzDGUAASjSuz-4mcyk6neOMNoCh_pkqXZH20wW3n6RXOQ4fk2IZQyM1yt0MMghtYakyurzghBFsuVYBw- |
| | 76mA2yQRGDTtL_3XTcg8AHD2Oaw0_UTZ59ROda_l6deP_BFGnyxIvO80pcUXBqp6HN7xzgP5ssnnXkQ |
| project_id | a3f24ce750034504876c0132c427306e |
| user_id | 1a1f6cf671474f45b81bf4150d8f6a67 |
+------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
新建客户端脚本文件
管理员:admin-openrc
vim admin-openrc
export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=admin export OS_USERNAME=admin export OS_PASSWORD=123456 export OS_AUTH_URL=http://controller01:35357/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2
普通用户demo:demo-openrc
vim demo-openrc
export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=demo export OS_USERNAME=demo export OS_PASSWORD=che001 export OS_AUTH_URL=http://controller01:5000/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2
效果:
source admin-openrc openstack token issue
Openstack_O版(otaka)部署_认证服务keystone部署的更多相关文章
- Openstack_O版(otaka)部署_准备环境和依赖软件
架构介绍 本次案列为基本的三节点部署 一:网络: 1.管理网络:192.168.198.0/24 2.数据网络:10.0.0.0/24 二:操作系统: CentOS Linux release 7.3 ...
- Openstack_O版(otaka)部署_镜像服务glance部署
安装和配置服务 1. 建库建用户 mysql -u root -p CREATE DATABASE glance; GRANT ALL PRIVILEGES ON glance.* TO '; GRA ...
- Openstack_O版(otaka)部署_网络服务Neutron部署
控制节点配置 1. 建库建用户 CREATE DATABASE neutron; GRANT ALL PRIVILEGES ON neutron.* TO '; GRANT ALL PRIVILEGE ...
- Openstack_O版(otaka)部署_Nova部署
控制节点配置 1. 建库建用户 CREATE DATABASE nova_api; CREATE DATABASE nova; GRANT ALL PRIVILEGES ON nova_api.* T ...
- Openstack_O版(otaka)部署_Horizon部署
控制节点 1. 安装软件包 yum install openstack-dashboard -y 2. 修改配置文件 vim /etc/openstack-dashboard/local_settin ...
- OpenStack 认证服务 KeyStone部署(三)
Keystone 介绍 Keystone作用: 用户与认证:用户权限与用户行为跟踪: 服务目录:提供一个服务目录,包括所有服务项和相关Api的断点 SOA相关知识 Keystone主要两大功能用户认证 ...
- OpenStack 认证服务 KeyStone部署 (四)
Keystone作用: 用户与认证:用户权限与用户行为跟踪: 服务目录:提供一个服务目录,包括所有服务项和相关Api的断点 SOA相关知识 Keystone主要两大功能用户认证和服务目录(相当于一个注 ...
- openstack项目【day24】:keystone部署及操作
阅读目录 一 前言 二 版本信息 三 部署keystone 四 keystone操作 五 验证 六 创建脚本 七 keystone使用套路总结 一 前言 任何软件的部署都是没有技术含量的,任何就部署讲 ...
- keystone系列四:keystone部署及操作
一 前言 任何软件的部署都是没有技术含量的,任何就部署讲部署的人都是江湖骗子. 部署的本质就是拷贝,粘贴,回车.我们家养了条狗,它可以胜任这件事情. 我们搞技术的,一定不能迂腐:轻信或者一概不信. 轻 ...
随机推荐
- Jquery DataTable控制显示列,导出EXCEL
1.初始化 var table = $('#table').DataTable({ "data": data[0].DATA, "columns": data[ ...
- BZOJ 3456: 城市规划 [多项式求逆元 组合数学 | 生成函数 多项式求ln]
3456: 城市规划 题意:n个点组成的无向连通图个数 以前做过,今天复习一下 令\(f[n]\)为n个点的无向连通图个数 n个点的完全图个数为\(2^{\binom{n}{2}}\) 和Bell数的 ...
- ACE在windows下的编译及配置(VS2010)
ACE在windows下的编译及配置(VS2010) 分类: -[小西南]- 2013-08-06 16:17 2354人阅读 评论( ...
- Phone文件备份
一 把照片导入到本地 连接手机和PC,插上数据线后PC上会自动检测并弹出对话框,提示导入 可以指定导入的目录.确定之后点击导入即可开始执行导入操作. 二 把语音备忘录导入到本地 需要借助iTunes联 ...
- 使用CentOS7配置Squid代理
其实之前配过一个squid,只是由于太懒,网上随便搜了一个教程,用了默认端口并且没有添加用户认证.某天不幸的被爬虫扫到,被用来发了半个月的垃圾邮件..直到有一天登录邮箱,看到了一大坨警告邮件,才意识到 ...
- maven项目打包的时候,*Mapper.xml 文件会打不不进去解决办法
打包的时候,不同版本的 Eclipse 还有IDEA 会有打包打不进去Mapper.xml 文件,这个时候要加如下代码, 在<build> 标签内加入即可 <resources> ...
- solr6.6教程-基础环境搭建(二)
在上一篇文章中已经简单介绍了solr在windows的部署,今天我们来下如何新建一个自己core. 1,core理解 如果把solr理解为个数据库的话,那么core可以理解为数据库中的一张表,其实就是 ...
- aria2 加速百度网盘下载
准备工作: chrome浏览器: BaiduExporter插件(下载地址:https://github.com/acgotaku/BaiduExporter): aria2工具(下载地址:http: ...
- 让网站通过Https访问
Prerequisites Before you begin, you should have some configuration already taken care of. We will be ...
- 2018-03-03-解决win下凭据删除不干净而无法登录共项目录的问题
layout: post title: 2018-03-03-解决win下凭据删除不干净而无法登录共项目录的问题 key: 20180303 tags: GIT 版本管理 modify_date: 2 ...