部署keystone

部署keystone

完成基础环境配置后，应先部署keystone组件，只需在controller节点上部署。
1、创建数据库实例和数据库用户
在MySQL中创建数据库keystone，同时创建数据库用户，并授权权限。
[root@controller ~]# mysql -u root -p000000
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 15
Server version: 10.3.20-MariaDB MariaDB Server

Copyright © 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the current input statement.

MariaDB [(none)]> CREATE DATABASE keystone;
Query OK, 1 row affected (0.001 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone. TO ‘keystone’@‘localhost’ IDENTIFIED BY ‘keystone’;*
Query OK, 0 rows affected (0.000 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone. TO ‘keystone’@‘controller’ IDENTIFIED BY ‘keystonee’;*
Query OK, 0 rows affected (0.000 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone. TO ‘keystone’@’%’ IDENTIFIED BY ‘keystone’;*
Query OK, 0 rows affected (0.000 sec)

MariaDB [(none)]> exit
Bye
2、安装keystone软件包
[root@controller ~]# yum install -y openstack-keystone httpd mod_wsgi
3、配置keystone
[root@controller ~]# vim /etc/keystone/keystone.conf
[database]
connection=mysql+pymysql://keystone:keystone@controller/keystone //添加此行命令
[token]
provider=fernet//添加此行命令
4、初始化认证服务数据库
[root@controller ~]# su -s /bin/sh -c “keystone-manage db_sync” keystone
验证数据库是否同步成功
[root@controller ~]# mysql -h 192.168.16.128 -u keystone -pkeystone -e “USE keystone; SHOW TABLES;”
±-----------------------------------+
| Tables_in_keystone |
±-----------------------------------+
| access_rule |
| access_token |
| application_credential |
| application_credential_access_rule |
| application_credential_role |
| assignment |
| config_register |
| consumer |
| credential |
| endpoint |
| endpoint_group |
| federated_user |
| federation_protocol |
| group |
| id_mapping |
| identity_provider |
| idp_remote_ids |
| implied_role |
| limit |
| local_user |
| mapping |
| migrate_version |
| nonlocal_user |
| password |
| policy |
| policy_association |
| project |
| project_endpoint |
| project_endpoint_group |
| project_option |
| project_tag |
| region |
| registered_limit |
| request_token |
| revocation_event |
| role |
| role_option |
| sensitive_config |
| service |
| service_provider |
| system_assignment |
| token |
| trust |
| trust_role |
| user |
| user_group_membership |
| user_option |
| whitelisted_config |
±-----------------------------------+
5、初始化Fernet keys
Fernet keys是用于API令牌的安全信息格式
[root@controller ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
[root@controller ~]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
6、配置bootstrap身份认证服务
[root@controller ~]# keystone-manage bootstrap --bootstrap-password 000000 --bootstrap-admin-url http://controller:35357/v3/ --bootstrap-internal-url http://controller:5000/v3/ --bootstrap-public-url http://controller:5000/v3/ --bootstrap-region-id RegionOne
7、配置Apache HTTP服务器
（1）修改服务器主机名
[root@controller ~]# vim /etc/httpd/conf/httpd.conf
修改前#ServerName www.example.com:80
修改后ServerName controller
保存退出
（2）创建配置文件
[root@controller ~]# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/
（3）启动服务并设置开机自启
[root@controller ~]# systemctl start httpd.service
[root@controller ~]# systemctl enable httpd.service
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
8、配置管理员账户的环境变量
[root@controller ~]# export OS_USERNAME=admin
[root@controller ~]# export OS_PASSWORD=000000
[root@controller ~]# export OS_PROJECT_NAME=admin
[root@controller ~]# export OS_USER_DOMAIN_NAME=Default
[root@controller ~]# export OS_PROJECT_DOMAIN_NAME=Default
[root@controller ~]# export OS_AUTH_URL=http://controller:5000/v3
[root@controller ~]# export OS_IDENTITY_API_VERSION=3
9、创建OpenStack域、项目、用户、角色
[root@controller ~]# openstack project create --domain default --description “Service Project” service //创建service项目
±------------±---------------------------------+
| Field | Value |
±------------±---------------------------------+
| description | Service Project |
| domain_id | default |
| enabled | True |
| id | 034564ee72e6440ebe7f32e7e6156aa2 |
| is_domain | False |
| name | service |
| options | {} |
| parent_id | default |
| tags | [] |
±------------±---------------------------------+
[root@controller ~]# openstack project create --domain default --description “Demo Project” demo //创建demo项目
±------------±---------------------------------+
| Field | Value |
±------------±---------------------------------+
| description | Demo Project |
| domain_id | default |
| enabled | True |
| id | 5350cda310b9484680c28fcfc92587e9 |
| is_domain | False |
| name | demo |
| options | {} |
| parent_id | default |
| tags | [] |
±------------±---------------------------------+
[root@controller ~]# openstack user create --domain default --password-prompt demo //创建demo用户
User Password:000000
Repeat User Password:000000
±--------------------±---------------------------------+
| Field | Value |
±--------------------±---------------------------------+
| domain_id | default |
| enabled | True |
| id | d34d1f0450c24546b157f624b2adb33f |
| name | demo |
| options | {} |
| password_expires_at | None |
±--------------------±---------------------------------+
[root@controller ~]# openstack role create user //创建user用户
±------------±---------------------------------+
| Field | Value |
±------------±---------------------------------+
| description | None |
| domain_id | None |
| id | 1f43962ba43244058f25dad2b7150129 |
| name | user |
| options | {} |
±------------±---------------------------------+
[root@controller ~]# openstack role add --project demo --user demo user //添加demo用户到demo项目和user角色
10、验证认证服务
（1）鉴于安全因素，出去临时的令牌认证授权机制
编辑/etc/keystone/keystone-paste.ini配置文件，将[pipeline:public_api]、[pipeline:admin_api]、[pipeline:api_v3]中的admin_token值删除
（2）取消临时环境变量
[root@controller ~]# unset OS_AUTH_URL OS_PASSWORD
（3）以admin用户身份请求令牌
[root@controller ~]# openstack --os-auth-url http://controller:5000/v3
–os-project-domain-name default --os-user-domain-name default
–os-project-name admin --os-username admin token issue
Password: 000000
Password: 000000
±-----------±----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
±-----------±----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires | 2020-05-08T13:56:14+0000 |
| id | gAAAAABetVbuwnOJRVKoaPPfHOmowVHRwgGzzhL0trOrLnUdSgAHlVX_QWpnNdnVAX_nsfqpPvVYyH7y9nvXMdCsCubfY0ElgAaiUVSxrZ3BndNfoM9jZOpOmzMU-9k0Dlixt5CaymMgXDba4yNXsUAUv-Wb2UgYZrmH3ukVznio-aENViOeQx8 |
| project_id | fa7f256af0d447f1977ec4a781502e38 |
| user_id | 6e3faf98b03a480e862c340753855ae4 |
±-----------±----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
（4）以demo用户身份请求令牌
[root@controller ~]# openstack --os-auth-url http://controller:5000/v3
–os-project-domain-name default --os-user-domain-name default
–os-project-name demo --os-username demo token issue
Password: 000000
Password: 000000
±-----------±----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
±-----------±----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires | 2020-05-08T13:58:17+0000 |
| id | gAAAAABetVdpGLwJsqGWyustkFtb5elYYJnErdPbSBoVBVA8k1FUkMvRVYkdUOvEdUzxklTVJS7Qvst-kKOSRo_gL0U8-gmKaRDUUcwTlosEntMw_2KMjeB1wx-BT-j-aT82oHYOM-dH_IhJo2okvm1YzY_HABew0XBHO65LM7ve_yUUj2539xw |
| project_id | 5350cda310b9484680c28fcfc92587e9 |
| user_id | d34d1f0450c24546b157f624b2adb33f |
±-----------±----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
（5）创建环境脚本，命令如下
①创建admin用户环境脚本
[root@controller ~]# vim admin-openrc
[root@controller ~]# cat admin-openrc
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=000000
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
②创建demo用户环境脚本，命令如下：
[root@controller ~]# vim demo-openrc
[root@controller ~]# cat demo-openrc
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=000000
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
③给环境脚本增加可执行权限，命令如下：
[root@controller ~]# chmod +x admin-openrc
[root@controller ~]# chmod +x demo-openrc
（6）验证管理员admin环境脚本
①执行管理员admin的环境脚本
[root@controller ~]# ./admin-openrc
②给予脚本中的环境变量，直接请求令牌
[root@controller ~]# openstack token issue
Missing value auth-url required for auth plugin password
解决办法：
在admin-openrc目录下执行
[root@controller ~]# source admin-openrc
[root@controller ~]# openstack token issue
±-----------±----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
±-----------±----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires | 2020-05-08T14:09:19+0000 |
| id | gAAAAABetVn_XtdknvviCFdNnESEBM7CZcQBrf-mCSoUKq-LVkwP2ajb9B65BwXWGKMMd8-aR2M6nVX3mNsXviG42OaE8_mjaaDpvTZv-6TpqqTbxbawUVbOUqm3qw8M13_hH-E3cOlKiDXtiVGvcs418nU1pXJQuCyfWKF8rNCTy8HkbydDZxE |
| project_id | fa7f256af0d447f1977ec4a781502e38 |
| user_id | 6e3faf98b03a480e862c340753855ae4 |
±-----------±----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
至此，部署Keystone完成。