OpenStack安装与部署:keystone认证服务2
创建库和授权
#mysql -uroot -popenstack
show databases;
create database keystone;
show databases;
grant all privileges on keystone.* to ‘keystone’@’localhost’ identified by ‘KEYSTONE_DBPASS’;
grant all privileges on keystone.* to ‘keystone’@’%’ identified by ‘KEYSTONE_DBPASS’;
exit
#mysql -uroot -popenstack
SELECT User, Host, Password FROM mysql.user;
exit
验证数据库是否创建成功
#mysql -ukeystone -pKEYSTONE_DBPASS
Keystone的安装和配置
安装软件包
#yum install -y openstack-keystone python-keystoneclient openstack-utils
生成token
#export ADMIN_TOKEN=$(openstack rand -hex 10)
#echo $ADMIN_TOKEN
#openstack-config --set /etc/keystone/keystone.conf DEFAULT admin_token ID
此处输入的id号,根据个人查出来的为准
查看是否配置成功
#cat /etc/keystone/keystone.conf | grep admin_
配置数据库连接
#vi /etc/hosts
将第一行127.0.0.1后面的第一个localhost改为controller0
改完必须重启(reboot)
#openstack-config --set /etc/keystone/keystone.conf database connection mysql://keystone:KEYSTONE_DBPASS@controller0/keystone
查看是否修改成功
#cat /etc/keystone/keystone.conf | grep connection=
如果没有修改成功就需要手动修改
#openstack-config --set /etc/keystone/keystone.conf token provider keystone.token.providers.uuid.Provider
#cat /etc/keystone/keystone.conf | grep provider
#openstack-config --set /etc/keystone/keystone.conf revoke driver keystone.contrib.revoke.backends.sql.Revoke
#cat /etc/keystone/keystone.conf | grep revoke
#openstack-config --set /etc/keystone/keystone.conf DEFAULT verbose True
#cat /var/log/keystone/keystone.log
此时还没有执行操作没有记录信息,未生成日志文件
生成PKI认证所需的证书文件
#keystone-manage pki_setup --keystone-user keystone --keystone-group keystone
#ll -d /etc/keystone/ssl/
#chown -R keystone:keystone /etc/keystone/ssl/
#chmod 750 /etc/keystone/ssl/
#chown -R keystone:keystone /etc/keystone/
同步keystone数据库,生成keystone所需的表
#su -s /bin/sh -c “keystone-manage db_sync” keystone
#mysql -ukeystone -pKEYSTONE_DBPASS -e “show tables from keystone”
启动keystone服务和校验服务状态
#chkconfig openstack-keystone on
#service openstack-keystone start
#service openstack-keystone status
创建一个cron任务,配置定期清理过期的token(默认存在DB,防止影响性能)
#(crontab -l -u keystone 2>&1 |grep -q token_flush) || echo ‘@hourly /usr/bin/keystone-manage token_flush > /var/log/keystone/keystone-tokenflush.log 2>&1’ >> /var/spool/cron/keystone
#crontab -l -u keystone
Keystone创建user、tenant、role、和endpoint
该项操作只在controller0主机上进行
#export ADMIN_TOKEN=id
#echo KaTeX parse error: Expected 'EOF', got '#' at position 13: ADMIN_TOKEN #̲export OS_SERVI…(ADMIN_TOKEN)
#export OS_SERVICE_ENDPOINT=http://controller0:35357/v2.0
#echo $OS_SERVICE_TOKEN
#echo $OS_SERVICE_ENDPOINT
如果重启虚拟机主机,要重新执行一次,所以可以直接将环境变量写进配置文件中(/etc/profile)
#vi /etc/profile
创建用户、租户和权限
#keystone tenant-create --name admin --description “Admin Tenant”
#keystone tenant-get id
#keystone tenant-list
#keystone user-create --name admin --pass ADMIN_PASS --email admin@example.com
#keystone user-get id
#keystone user-list
#keystone role-create --name admin
#keystone role-get id
#keystone role-list
将用户admin赋予admin角色和admin project内
#keystone user-role-add --user admin --role admin --tenant admin
#keystone user-role-list --user admin --tenant admin
创建用户并将admin用户加入该角色中
#keystone OS_TENANT_NAME=admin
#keystone OS_USERNAME=admin
#keystone OS_password=ADMIN_PASS
#keystone 0S_AUTH_URL=http://controller0:35357/v2.0
#keystone role-create --name member
#keysont user-role-add —user admin --role member --tenant admin
#keystone user-role-list --user admin --tenant admin
#keystone user-create --name demo --pass=DEMO_PASS --email=demo@example.com --enable=True
#keystone user-get id
#keystone user-list
创建租户
#keystone tenant-create --name demo --descrption “Demo Tenant” --enable True
#keystone tenant-get id
#keystone tenant-list
#keystone user-role-add --user demo --role member
#keystone user-role-list --user demo --tenant demo
#keystone tenant-create --name service --description “Service Tenant”
#keystone tenant-get id
#keystone tenant-list
创建keystone自身的服务和端点endpoint
#keystone service-create --name keystone --type identity --description “OpenStack Identity”
#keystone service-get id
#keystone service-list
将keystone服务端口注册到service中,从而通过service访问keystone
#keystone endpoint-create --service-id=$(keystone service-list | awk ‘/identity / {print $2}’) --publicurl http://controller0:5000/v2.0 --internalurl http://controller0:500key0/v2.0 --adminurl http://controller0:35357/v2.0 --region regionOne
#keystone endpoint-list
校验keystone的配置
#unset OS_SERVICE_TOKEN
#unset OS_SERVICE_ENDPOINT 取消刚才设置的两个环境变量
校验admin用户获取token是否正常
#keystone --os-username admin --os-tenant admin --os-password ADMIN_PASS --os-auth-url http://controller0:35357/v2.0 token-get
校验admin是否有管理权限,如用户、角色、租户、端点、服务等
#keystone --os-username admin --os-tenant admin --os-password ADMIN_PASS --os-auth-url http://controller0:35357/v2.0 user-list
#keystone --os-username admin --os-tenant admin --os-password ADMIN_PASS --os-auth-url http://controller0:35357/v2.0 service-list
校验demo是否有权限
#keystone --os-username demo --os-tenant demo --os-password DEMO_PASS --os-auth-url http://controller0:35357/v2.0 user-list
#keystone --os-username demo --os-tenant demo --os-password DEMO_PASS --os-auth-url http://controller0:35357/v2.0 endpoint-list
#tail -f /var/log/keystone.log
日志中有警告提示需要admin权限
设置用户环境变量文件
配置admin用户的环境变量
#vi /root/admin-openrc.sh
#source /root/admin-openrc.sh
#set | grep OS_
#keystone tonken-get
#keystone user-list
配置demo账号的环境变量
#vi /root/demo-openrc.sh
#source /root/admin-openrc.sh
#keystone tonken-get
#keystone user-list
没有任何输出因为没有权限