OpenStack安装与部署：keystone认证服务2

OpenStack安装与部署：keystone认证服务2

创建库和授权
#mysql -uroot -popenstack

show databases;
create database keystone;
show databases;

grant all privileges on keystone.* to ‘keystone’@’localhost’ identified by ‘KEYSTONE_DBPASS’;
grant all privileges on keystone.* to ‘keystone’@’%’ identified by ‘KEYSTONE_DBPASS’;
exit

#mysql -uroot -popenstack

SELECT User, Host, Password FROM mysql.user;

exit
验证数据库是否创建成功
#mysql -ukeystone -pKEYSTONE_DBPASS

Keystone的安装和配置
安装软件包
#yum install -y openstack-keystone python-keystoneclient openstack-utils

生成token
#export ADMIN_TOKEN=$(openstack rand -hex 10)
#echo $ADMIN_TOKEN
#openstack-config --set /etc/keystone/keystone.conf DEFAULT admin_token ID
此处输入的id号，根据个人查出来的为准
查看是否配置成功
#cat /etc/keystone/keystone.conf | grep admin_

配置数据库连接
#vi /etc/hosts
将第一行127.0.0.1后面的第一个localhost改为controller0

改完必须重启（reboot）
#openstack-config --set /etc/keystone/keystone.conf database connection mysql://keystone:KEYSTONE_DBPASS@controller0/keystone
查看是否修改成功
#cat /etc/keystone/keystone.conf | grep connection=
如果没有修改成功就需要手动修改

#openstack-config --set /etc/keystone/keystone.conf token provider keystone.token.providers.uuid.Provider
#cat /etc/keystone/keystone.conf | grep provider

#openstack-config --set /etc/keystone/keystone.conf revoke driver keystone.contrib.revoke.backends.sql.Revoke
#cat /etc/keystone/keystone.conf | grep revoke

#openstack-config --set /etc/keystone/keystone.conf DEFAULT verbose True
#cat /var/log/keystone/keystone.log
此时还没有执行操作没有记录信息，未生成日志文件

生成PKI认证所需的证书文件
#keystone-manage pki_setup --keystone-user keystone --keystone-group keystone

#ll -d /etc/keystone/ssl/
#chown -R keystone:keystone /etc/keystone/ssl/
#chmod 750 /etc/keystone/ssl/
#chown -R keystone:keystone /etc/keystone/

同步keystone数据库，生成keystone所需的表
#su -s /bin/sh -c “keystone-manage db_sync” keystone
#mysql -ukeystone -pKEYSTONE_DBPASS -e “show tables from keystone”

启动keystone服务和校验服务状态
#chkconfig openstack-keystone on
#service openstack-keystone start
#service openstack-keystone status

创建一个cron任务，配置定期清理过期的token（默认存在DB,防止影响性能）
#（crontab -l -u keystone 2>&1 |grep -q token_flush） || echo ‘@hourly /usr/bin/keystone-manage token_flush > /var/log/keystone/keystone-tokenflush.log 2>&1’ >> /var/spool/cron/keystone
#crontab -l -u keystone

Keystone创建user、tenant、role、和endpoint
该项操作只在controller0主机上进行
#export ADMIN_TOKEN=id
#echo KaTeX parse error: Expected 'EOF', got '#' at position 13: ADMIN_TOKEN #̲export OS_SERVI…(ADMIN_TOKEN)
#export OS_SERVICE_ENDPOINT=http://controller0:35357/v2.0
#echo $OS_SERVICE_TOKEN
#echo $OS_SERVICE_ENDPOINT
如果重启虚拟机主机，要重新执行一次，所以可以直接将环境变量写进配置文件中（/etc/profile）

#vi /etc/profile

创建用户、租户和权限
#keystone tenant-create --name admin --description “Admin Tenant”
#keystone tenant-get id
#keystone tenant-list

#keystone user-create --name admin --pass ADMIN_PASS --email admin@example.com
#keystone user-get id
#keystone user-list

#keystone role-create --name admin
#keystone role-get id
#keystone role-list

将用户admin赋予admin角色和admin project内
#keystone user-role-add --user admin --role admin --tenant admin
#keystone user-role-list --user admin --tenant admin

创建用户并将admin用户加入该角色中
#keystone OS_TENANT_NAME=admin
#keystone OS_USERNAME=admin
#keystone OS_password=ADMIN_PASS
#keystone 0S_AUTH_URL=http://controller0:35357/v2.0
#keystone role-create --name member
#keysont user-role-add —user admin --role member --tenant admin
#keystone user-role-list --user admin --tenant admin

#keystone user-create --name demo --pass=DEMO_PASS --email=demo@example.com --enable=True
#keystone user-get id
#keystone user-list

创建租户
#keystone tenant-create --name demo --descrption “Demo Tenant” --enable True
#keystone tenant-get id
#keystone tenant-list

#keystone user-role-add --user demo --role member
#keystone user-role-list --user demo --tenant demo

#keystone tenant-create --name service --description “Service Tenant”
#keystone tenant-get id
#keystone tenant-list

创建keystone自身的服务和端点endpoint
#keystone service-create --name keystone --type identity --description “OpenStack Identity”
#keystone service-get id
#keystone service-list

将keystone服务端口注册到service中，从而通过service访问keystone
#keystone endpoint-create --service-id=$(keystone service-list | awk ‘/identity / {print $2}’) --publicurl http://controller0:5000/v2.0 --internalurl http://controller0:500key0/v2.0 --adminurl http://controller0:35357/v2.0 --region regionOne
#keystone endpoint-list

校验keystone的配置
#unset OS_SERVICE_TOKEN
#unset OS_SERVICE_ENDPOINT 取消刚才设置的两个环境变量
校验admin用户获取token是否正常
#keystone --os-username admin --os-tenant admin --os-password ADMIN_PASS --os-auth-url http://controller0:35357/v2.0 token-get

校验admin是否有管理权限，如用户、角色、租户、端点、服务等
#keystone --os-username admin --os-tenant admin --os-password ADMIN_PASS --os-auth-url http://controller0:35357/v2.0 user-list

#keystone --os-username admin --os-tenant admin --os-password ADMIN_PASS --os-auth-url http://controller0:35357/v2.0 service-list
校验demo是否有权限
#keystone --os-username demo --os-tenant demo --os-password DEMO_PASS --os-auth-url http://controller0:35357/v2.0 user-list

#keystone --os-username demo --os-tenant demo --os-password DEMO_PASS --os-auth-url http://controller0:35357/v2.0 endpoint-list
#tail -f /var/log/keystone.log

日志中有警告提示需要admin权限
设置用户环境变量文件
配置admin用户的环境变量
#vi /root/admin-openrc.sh

#source /root/admin-openrc.sh
#set | grep OS_
#keystone tonken-get
#keystone user-list

配置demo账号的环境变量
#vi /root/demo-openrc.sh

#source /root/admin-openrc.sh
#keystone tonken-get
#keystone user-list

没有任何输出因为没有权限