3 Openstack-Ussuri-Keystone部署-ubuntu1804

Keystone 的主要功能如下：
1 管理用户及其权限；
2 维护 OpenStack 服务的 Endpoint；
3 Authentication（认证）和 Authorization（鉴权）。

3.1 配置Keystone数据库

#使用root登陆数据库：

mysql -u root -p

#创建keystone数据库:

CREATE DATABASE keystone;

#授予对keystone数据库的访问权限，刷新退出数据库:

GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'keystone.123';
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone.123';
flush privileges;
exit

3.2 安装配置Keystone

#安装对应组件包

apt install keystone -y

#备份Keystone配置文件

cp /etc/keystone/keystone.conf /etc/keystone/keystone.conf.bak
egrep -v "^$|^#" /etc/keystone/keystone.conf.bak >/etc/keystone/keystone.conf

#配置Keystone配置文件，在对应项底下增加以下字段
#vim /etc/keystone/keystone.conf

[database]
connection = mysql+pymysql://keystone:keystone.123@controller160/keystone
[token]
provider = fernet

#填充Keystone数据库，并初始化Fernet，无报错即为成功

su -s /bin/sh -c "keystone-manage db_sync" keystone
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

#验证keystone数据库是否正常写入：

mysql -h controller160 -ukeystone -pkeystone.123 -e "use keystone;show tables;"

#引导Identity service，这里将admin的密码设置为admin.123

keystone-manage bootstrap --bootstrap-password admin.123 \
  --bootstrap-admin-url http://controller160:5000/v3/ \
  --bootstrap-internal-url http://controller160:5000/v3/ \
  --bootstrap-public-url http://controller160:5000/v3/ \
  --bootstrap-region-id RegionOne

3.3 配置Http Server

#修改servername为主机名，如果不存在则添加在文末：
#vim /etc/apache2/apache2.conf

ServerName controller160

#启动Apache HTTP服务，并配置开机启动:

systemctl enable apache2.service
systemctl start apache2.service
systemctl status apache2.service

3.4 配置环境变量

#配置环境变量文件，这里使用的admin为上面引导创建的密码
#vim adminrc.sh

export OS_USERNAME=admin
export OS_PASSWORD=admin.123
export OS_PROJECT_NAME=admin
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default
export OS_AUTH_URL=http://controller160:5000/v3
export OS_IDENTITY_API_VERSION=3

#取消环境变量配置
#vim unsetadminrc.sh

unset OS_USERNAME
unset OS_PASSWORD
unset OS_PROJECT_NAME
unset OS_USER_DOMAIN_NAME
unset OS_PROJECT_DOMAIN_NAME
unset OS_AUTH_URL
unset OS_IDENTITY_API_VERSION

#查看是否设置成功

env |grep OS

3.5 创建域、项目、用户和角色

身份服务为每个OpenStack服务提供身份验证服务，其中包括服务使用域、项目、用户和角色的组合。

#keystone-manage引导步骤中，“默认”域已经存在，创建新域的方法是:

openstack domain create --description "An Example Domain" example

#执行完成后的正常提示

+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | An Example Domain                |
| enabled     | True                             |
| id          | 5916bd1699e749148d5df127662a3b47 |
| name        | example                          |
| options     | {}                               |
| tags        | []                               |
+-------------+----------------------------------+

#创建服务项目:

openstack project create --domain default --description "Service Project" service

#执行结果：

+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Service Project                  |
| domain_id   | default                          |
| enabled     | True                             |
| id          | 108d49a7bd5840ddb4cb7eae4e673b10 |
| is_domain   | False                            |
| name        | service                          |
| options     | {}                               |
| parent_id   | default                          |
| tags        | []                               |
+-------------+----------------------------------+

#创建user角色

openstack role create user

#输出

+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | None                             |
| domain_id   | None                             |
| id          | 0cd495c936f546b69731aaead35bf899 |
| name        | user                             |
| options     | {}                               |
+-------------+----------------------------------+

#查看角色

openstack role list

#输出

+----------------------------------+--------+
| ID                               | Name   |
+----------------------------------+--------+
| 0cd495c936f546b69731aaead35bf899 | user   |
| 250873c84a6c44f49b731cae406fb547 | reader |
| 629b9f90f7694f25a627dcb251b8fc76 | member |
| 9404d69aaf3c4751b3a424c54722324b | admin  |
+----------------------------------+--------+

至此，Keystone已部署完毕，如有问题请联系我改正，感激不尽！

3.x 部署过程遇到的问题汇总

eg.1: