一,keyston 介绍
1.Keystone是OpenStack的组件之一, 用于为OpenStack家族中的其它组件成员提供统的认证服务,包括身份验证、令牌的发放和校验、服务列表、用户权限的定义等。
2. 基本概念
1). User
User可简单的理解为用户,用户携带信物(token)能够访问openstack各个服务和资源。
2). Tenant
Tenant即租户,早期版本又称为project,它是各个服务中的一些可以访问的资源集合。比如通过nova创建虚拟机时要指定到某个租户中,在cinder创建卷也要指定到某个租户中。用户访问租户的资源前,必须与该租户关联,并且指定该用户在该租户下的角色。
3). Role
Role即角色,可以理解为VIP等级,用户的Role越高,在openstack中能访问的服务和资源就更多。
4). Service
Service即服 务,如Nova、Glance、Swift、heat、ceilometer等。Nova提供云计算的服务,Glance提供镜像管理服务,Swift提 供对象存储服务,heat提供资源编排服务,ceilometer则是提供告警计费服务,cinder提供块存储服务。
5). Endpoint
Service的显得 太抽象笼统。Endpoint则具体化Service。Endpoint翻译为“端点”,我们可以理解它是一个服务暴露出来的访问点,如果需要访问一个服 务,则必须知道他的endpoint,而endpoint一般为url,我们知道了服务的url,我们就可以访问它。Endpoint 的url具有public、private和admin这三种权限。public url可以被全局访问,private url只能被局域网访问,admin url被从常规的访问中分离。
6). Token
Token即是信物、令牌,用户通过用户名和密码获取在某个租户下的token,通过token,可以实现单点登录。
7) Credentials
该术语可以简单的理解为用户和密码。
- 例子
二,部署
1.创建数据库实例和数据库用户
[root@ct ~]# mysql -u root -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 8
Server version: 10.3.20-MariaDB MariaDB Server
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> create database keystone;
Query OK, 1 row affected (0.001 sec)
MariaDB [(none)]> grant all privileges on keystone.* to 'keystone'@'localhost'identified by 'keystone_dbpass';
Query OK, 0 rows affected (0.001 sec)
MariaDB [(none)]> grant all privileges on keystone.* to 'keystone'@'%' identified by 'keystone_dbpass';
Query OK, 0 rows affected (0.000 sec)
MariaDB [(none)]> flush privileges;
Query OK, 0 rows affected (0.001 sec)
MariaDB [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| keystone |
| mysql |
| performance_schema |
+--------------------+
4 rows in set (0.041 sec)
MariaDB [(none)]> exit
Bye
2安装、配置keystone、数据库、Apache
2.1、安装keystone、httpd、mod_wsgi
[root@ct ~]# yum -y install openstack-keystone httpd mod_wsgi
已加载插件:fastestmirror
Loading mirror speeds from cached hostfile
* base: mirrors.163.com
* centos-ceph-nautilus: mirrors.163.com
* centos-nfs-ganesha28: mirrors.163.com
* centos-openstack-train: mirrors.163.com
* centos-qemu-ev: mirrors.163.com
* extras: mirrors.163.com
* updates: mirrors.163.com
软件包 1:openstack-keystone-16.0.2-1.el7.noarch 已安装并且是最新版本
软件包 httpd-2.4.6-97.el7.centos.x86_64 已安装并且是最新版本
软件包 mod_wsgi-3.4-18.el7.x86_64 已安装并且是最新版本
无须任何处理
[root@ct ~]# cd /etc/keystone/
[root@ct keystone]# cp -a keystone.conf{,.bak}
[root@ct keystone]# grep -Ev "^$|#" keystone.conf.bak > keystone.conf #通过pymysql模块访问mysql,指定用户名密码、数据库的域名、数据库名;
[root@ct keystone]# openstack-config --set /etc/keystone/keystone.conf database connection mysql+pymysql://keystone:keystone_dbpass@ct/keystone ##指定token的提供者;提供者就是keystone自己本身
[root@ct keystone]# openstack-config --set /etc/keystone/keystone.conf token provider fernet #一种安全的消息传递格式
2.2, 初始化数据库
[root@ct keystone]# su -s /bin/sh -c "keystone-manage db_sync" keystone #使用keystone的身份切换环境来执行操作
[root@ct keystone]# mysql -uroot -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 18
Server version: 10.3.20-MariaDB MariaDB Server
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> use keystone;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
MariaDB [keystone]> show tables;
+------------------------------------+
| Tables_in_keystone |
+------------------------------------+
| access_rule |
| access_token |
| application_credential |
| application_credential_access_rule |
| application_credential_role |
| assignment |
| config_register |
| consumer |
| credential |
| endpoint |
| endpoint_group |
| federated_user |
| federation_protocol |
| group |
| id_mapping |
| identity_provider |
| idp_remote_ids |
| implied_role |
| limit |
| local_user |
| mapping |
| migrate_version |
| nonlocal_user |
| password |
| policy |
| policy_association |
| project |
| project_endpoint |
| project_endpoint_group |
| project_option |
| project_tag |
| region |
| registered_limit |
| request_token |
| revocation_event |
| role |
| role_option |
| sensitive_config |
| service |
| service_provider |
| system_assignment |
| token |
| trust |
| trust_role |
| user |
| user_group_membership |
| user_option |
| whitelisted_config |
+------------------------------------+
48 rows in set (0.000 sec)
————————————————
初始化fernet 密钥存储库(以下命令会生成两个密钥,生成的密钥放于/etc/keystone/目录下,用于加密数据)
[root@ct keystone]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
[root@ct keystone]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
3.配置bootstrap身份认证服务
[root@ct ~]# keystone-manage bootstrap --bootstrap-password ADMIN_PASS \
--bootstrap-admin-url http://ct:5000/v3/ \
--bootstrap-internal-url http://ct:5000/v3/ \
--bootstrap-public-url http://ct:5000/v3/ \
--bootstrap-region-id RegionOne #指定一个区域名称
4.配置Apache服务器
[root@ct ~]# echo "ServerName controller" >> /etc/httpd/conf/httpd.conf
[root@ct ~]# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/ #让apache调用wsgi
[root@ct ~]# systemctl enable httpd #开机自启
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
[root@ct ~]# systemctl start httpd
5.配置管理员账号的环境变量
[root@ct ~]# cat >> ~/.bashrc << EOF
> export OS_USERNAME=admin
> export OS_PASSWORD=ADMIN_PASS
> export OS_PROJECT_NAME=admin
> export OS_USER_DOMAIN_NAME=Default
> export OS_PROJECT_DOMAIN_NAME=Default
> export OS_AUTH_URL=http://ct:5000/v3
> export OS_IDENTITY_API_VERSION=3
> export OS_IMAGE_API_VERSION=2
> EOF
[root@ct ~]# source .bashrc
6.查看当前所有用户列表
[root@ct ~]# openstack user list
+----------------------------------+-------+
| ID | Name |
+----------------------------------+-------+
| e40d635d87de46d28bc0962c8ed1dbd4 | admin |
+----------------------------------+-------+
7.创建OpenStack 域、项目、用户和角色
7.1、创建项目
创建在指定的domain (域) 中,指定描述信息,project名称为service
7.2查看指定域
创建角色(可使用openstack role list查看)
[root@ct ~]# openstack role create user
查看openstack 角色列表
[root@ct ~]# openstack role list
查看是否可以不指定密码就可以获取到token信息(验证认证服务)
[root@ct ~]# openstack token issue