OpenStack 02 安装认证服务--keystone

准备环境

选择虚拟机类型
主7.6   节点7.2  安装者请自行分配ip到控制端，节点和数据库。
最小化安装，直接启用自带的yum源，
更改主机名
[root@linux-host1 ~]# cat /etc/hostname
linux-host1.exmaple.com

修改hosts文件
[root@linux-host1 ~]# cat /etc/hosts
192.168.10.201 linux-host1.exmaple.com linux-host1

关闭防火墙和selinux
[root@linux-host1 ~]# systemctl disable firewalld.
[root@linux-host1 ~]# systemctl disable NetworkManager
[root@linux-host1 ~]# vim /etc/selinux/config
SELINUX=disabled

同步时间
[root@linux-host1 ~]#rm -rf /etc/localtime    #删除错误的时间
[root@linux-host1 ~]#ln -sv /usr/share/zoneinfo/Asia/Shanghai /etc/localtime   #创建连接到上海时间
[root@linux-host1 ~]#ntpdate time1.aliyun.com
[root@linux-host1 ~]#hwclock -w 
[root@linux-host1 ~]#crontab -e 
*/5 * * * * /sbin/ntpdate time1.aliyun.com && hwclock -w 

安装认证服务–keystone

1.不同主机的操作
1.查看所有openstack版本，我们选择的是stein版本
[root@controller1 ~]# yum list centos-release-openstack*    
centos-release-openstack-ocata.noarch                     1-2.el7                           extras
centos-release-openstack-pike.x86_64                      1-1.el7                           extras
centos-release-openstack-queens.noarch                    1-2.el7.centos                    extras
centos-release-openstack-rocky.noarch                     1-1.el7.centos                    extras
centos-release-openstack-stein.noarch                     1-1.el7.centos                    extras


2.控制机器和节点机都要安装,这是openstack源
[root@controller1 ~]# yum install  centos-release-openstack-stein.noarch
[root@node1 ~]# yum install  centos-release-openstack-stein.noarch
[root@vmysql ~]# yum install  centos-release-openstack-stein.noarch -y


3.安装组件，controller和node安装
[root@controller1 ~]# yum install python-openstackclient openstack-selinux -y
[root@node1 ~]# yum install python-openstackclient openstack-selinux -y


4.安装数据库
因为我们是拆分的所以要分开装，node装mariadb
# yum install mariadb mariadb-server python2-PyMySQL

[root@vmysql ~]# yum install mariadb mariadb-server -y

[root@vmysql ~]# vim /etc/my.cnf.d/openstack.cnf 
[mysqld]
bind-address = 0.0.0.0

default-storage-engine = innodb
innodb_file_per_table = on
max_connections = 4096
collation-server = utf8_general_ci
character-set-server = utf8

[root@vmysql ~]# systemctl start mariadb.service
[root@vmysql ~]# systemctl enable mariadb.service
[root@vmysql ~]# mysql_secure_installation     #初始化数据库，密码是123456 其余全是y


5.安装消息队列 message queue
[root@vmysql ~]# yum install rabbitmq-server
[root@vmysql ~]# systemctl enable rabbitmq-server.service
[root@vmysql ~]# systemctl start rabbitmq-server.service
[root@vmysql ~]# rabbitmqctl add_user openstack openstack123    #设置openstack123 为密码
[root@vmysql ~]# rabbitmqctl set_permissions openstack ".*" ".*" ".*"    #设置权限
#可以启动[root@vmysql ~]# rabbitmq-plugins enable rabbitmq_management
http://192.168.41.111:15672/#/   guest guest

6.安装memcached
[root@controller1 ~]# yum install memcached python-memcached python2-PyMySQL    #pymysql是因为控制和node分开所以单独装
[root@vmysql ~]# yum install memcached    #数据库端安装
[root@vmysql ~]# vim  /etc/sysconfig/memcached
PORT="11211"
USER="memcached"    #账号
MAXCONN="1024"    #最大连接数
CACHESIZE="1024"    #最大大小
OPTIONS="-l 0.0.0.0,::1"
[root@vmysql ~]#systemctl restart memcached
[root@vmysql ~]#systemctl enable memcached


7.安装服务
#数据库服务
[root@vmysql ~]# mysql -uroot -p123456 -h127.0.0.1
MariaDB [(none)]> create database keystone;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%'  IDENTIFIED BY 'keystone123';

[root@controller1 ~]#yum install mysql -y     #创建数据库测试连接
[root@controller1 ~]# mysql -ukeystone -pkeystone123 -h 192.168.41.115
MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| keystone           |
+--------------------+



#http服务
[root@controller1 ~]#  yum install openstack-keystone httpd mod_wsgi  -y
[root@controller1 ~]# vim /etc/keystone/keystone.conf
[database]    #可以通过\[database] 精确找到
connection = mysql+pymysql://keystone:keystone123@openstack-vip.magedu.net/keystone    #此处把地址换成域名了。
[token]
provider = fernet

[root@controller1 ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
[root@controller1 ~]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
[root@controller1 ~]# vim /etc/httpd/conf/httpd.conf
ServerName 192.168.41.111:80
[root@controller1 ~]# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/
[root@controller1 ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone    #初始化数据库，此时可以到115去查看生成的表的数据。
[root@controller1 ~]# vim /etc/keystone/keystone.conf
[DEFAULT]
admin_token = d2f60b7ec753e9bfc799    #这串代码是openssl rand -hex 10 生成
[root@controller1 ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone    #重新初始化



8.创建域，用户，项目，角色
[root@controller1 ~]# export OS_TOKEN=d2f60b7ec753e9bfc799    #重新打开一个窗口2，代码是上面生成的
[root@controller1 ~]# export OS_URL=http://192.168.41.111:5000/v3
[root@controller1 ~]# export OS_IDENTITY_API_VERSION=3
[root@controller1 ~]# systemctl start httpd         &&  systemctl enable httpd  
[root@controller1 ~]# openstack domain create --description "Default Domain" default
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Default Domain                   |
| enabled     | True                             |
| id          | edf2085ad5c7434e84beb3c3d6dec573 |
| name        | default                          |
| tags        | []                               |
+-------------+----------------------------------+
[root@controller1 ~]# openstack project create --domain default --description "Admin Project" Admin    #要在刚才的启动环境变量的窗口2进行
[root@controller1 ~]# openstack project list
[root@controller1 ~]# openstack project --help     #可以进行项目的操作。
[root@controller1 ~]# openstack user create --domain default --password-prompt admin    #创建角色账号密码为admin
[root@controller1 ~]# openstack role create admin    #创建角色
[root@controller1 ~]# openstack role list    #查看创建的角色
[root@controller1 ~]# openstack role add --project Admin --user admin admin    #加入到项目里面
[root@controller1 ~]# openstack project create --domain default --description "Demo Project" demo    #创建demo的演示项目
[root@controller1 ~]# openstack user create --domain default --password-prompt demo    #密码设置为demo
[root@controller1 ~]# openstack role create user    #创建user角色，权限较小。
[root@controller1 ~]# openstack role add --project demo --user demo user    #demo用户添加到demo项目。
[root@controller1 ~]# openstack project create --domain default --description "Service Project" service    #创建service项目
[root@controller1 ~]# openstack service create --name keystone --description "OpenStack Identity" identity    #创建类型为identity的文件。
[root@controller1 ~]# openstack service list    #查看创建的service
[root@controller1 ~]#openstack endpoint create --region RegionOne identity public http://openstack-vip.magedu.net:5000/v3     #公共点
[root@controller1 ~]#openstack endpoint create --region RegionOne identity admin http://openstack-vip.magedu.net:5000/v3     #管理点
[root@controller1 ~]#openstack endpoint create --region RegionOne identity internal http://openstack-vip.magedu.net:5000/v3    #私有点
[root@controller1 ~]# openstack endpoint list     #确认下是否制作成功，保证端口号是5000
#[root@controller1 ~]#openstack endpoint delete  id号码    #如果错误了进行删除，防止出错最好全删除了。
#测试keystone是否可以做验证
[root@controller1 ~]# export OS_IDENTITY_API_VERSION=3    #新打开一个窗口，声明 环境变量仅对本窗口有效
#运行完下面指令后产生一个user_id 相当于openstack user  list  的id同理project也一样
[root@controller1 ~]# openstack --os-auth-url http://openstack-vip.magedu.net:5000/v3 \
--os-project-domain-name Default --os-user-domain-name Default \
--os-project-name admin --os-username admin token issue

[root@controller1 ~]# mkdir /root/scripts    #创建两个脚本的文件夹
[root@controller1 ~]# vim scripts/admin-stein.sh    #创建admin的脚本
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=Admin
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_AUTH_URL=http://openstack-vip.magedu.net:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

[root@controller1 ~]# vim scripts/demo-stein.sh    #创建demo的脚本
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo
export OS_AUTH_URL=http://openstack-vip.magedu.net:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

#新打开一个窗口检测生效性
[root@controller1 ~]# source scripts/admin-stein.sh 
[root@controller1 ~]# cat  scripts/admin-stein.sh 
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=Admin
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_AUTH_URL=http://openstack-vip.magedu.net:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
[root@controller1 ~]# echo $OS_AUTH_URL
http://openstack-vip.magedu.net:5000/v3

[root@controller1 ~]#  openstack token issue


#如果报错设置监听，安装haproxy
[root@controller1 ~]# vim /etc/haproxy/haproxy.conf
listen  mysql
        bind 192.168.41.111:3306    #本地
        mode tcp
        log global
        server mysql  192.168.41.115:3306 check    #数据库
        
listen  memcached
        bind 192.168.41.111:11211
        mode tcp
        log global
        server mysql  192.168.41.115:11211 check