keystone连接mysql_OpenStack（1）-keystone身份服务部署

傲雪吟霜白如冰

于 2021-02-17 05:52:34 发布

阅读量231

点赞数

文章标签： keystone连接mysql

本文链接：https://blog.csdn.net/weixin_36337502/article/details/114318580

版权

本文档详细介绍了如何在OpenStack环境中配置Keystone身份服务，使其连接到MySQL数据库。步骤包括安装必要的软件如python2-PyMySQL、MySQL、rabbitmq-server和memcached，设置权限，创建数据库和用户，安装keystone，配置数据库连接，同步数据库，初始化Fernet密钥，以及配置httpd服务。最后，通过创建域、项目、用户和角色进行了验证。

摘要由CSDN通过智能技术生成

身份服务(Identity Service)：Keystone。为OpenStack其他服务提供身份验证、服务规则和服务令牌的功能，管理Domains、Projects、Users、Groups、Roles。自Essex版本集成到项目中。

我们将keystone部署到controller上；

1.我们需要连接数据库；需要安装python2-PyMySQL；

[root@sxb2 ~]# yum install python2-PyMySQL -y

2.配置一个mysql；重启服务；

[root@sxb2 ~]# vim /etc/my.cnf.d/openstack.cnf

[mysqld]

bind-address = 192.168.88.102 本机的地址

default-storage-engine =innodb

innodb_file_per_table=on

max_connections= 4096collation-server =utf8_general_ci

character-set-server = utf8

3.安装和配置组件；设置为开机自启，并当前启动；

yum install rabbitmq-server

[root@sxb2 ~]# systemctl enable rabbitmq-server.service

Created symlink from /etc/systemd/system/multi-user.target.wants/rabbitmq-server.service to /usr/lib/systemd/system/rabbitmq-server.service.

[root@sxb2 ~]# systemctl start rabbitmq-server.service

4.创建一个OpenStack用户；并进行授权；

[root@sxb2 ~]# rabbitmqctl add_user openstack 123Creating user"openstack"[root@sxb2~]# rabbitmqctl set_permissions openstack ".*" ".*" ".*"Setting permissionsfor user "openstack" in vhost "/"

5.安装memcache，配置组件；

yum install memcached python-memcached

[root@sxb2~]# vim /etc/sysconfig/memcached

PORT="11211"USER="memcached"MAXCONN="1024"CACHESIZE="64"OPTIONS="-l 127.0.0.1,::1,192.168.88.102"　　　　加上自己的IP地址

6.启动memcache，并设置成开机自启；

[root@sxb2 ~]# systemctl enable memcached.service

Created symlinkfrom /etc/systemd/system/multi-user.target.wants/memcached.service to /usr/lib/systemd/system/memcached.service.

[root@sxb2~]# systemctl start memcached.service

我们的前期准备就完成了；接下来我们开始安装一个最小化Stein版本

1.我们首先要完成用户验证服务的配置；创建mysql keystone库，并进行授权；

mysql>CREATE DATABASE keystone;

Query OK,1 row affected (0.00sec)

mysql> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY '123';

Query OK,0 rows affected, 1 warning (0.00sec)

mysql> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY '123'

->;

Query OK,0 rows affected, 1 warning (0.00 sec)

2.安装软件；配置文件；

[root@sxb2 ~]# yum install openstack-keystone httpd mod_wsgi

[root@sxb2~]# vim /etc/keystone/keystone.conf

[database]

connection= mysql+pymysql://keystone:123@192.168.88.102/keystone 这里需要改成刚才授权的mysql密码，IP

[token]

provider= fernet

3.更新数据库；

su -s /bin/sh -c "keystone-manage db_sync" keystone

4.初始化Fernet密钥存储库；

[root@sxb2 ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

[root@sxb2~]# keystone-manage credential_setup --keystone-user keystone --keystone-group

5.进行身份引导服务配置；admin、internal、public；

[root@sxb2 ~]# keystone-manage bootstrap --bootstrap-password 123 --bootstrap-admin-url http://192.168.88.102:5000/v3/ --bootstrap-internal-urlhttp://192.168.88.102:5000/v3/ --bootstrap-public-urlhttp://192.168.88.102:5000/v3/ --bootstrap-region-id RegionOne

6.配置httpd服务；

[root@sxb2 ~]# vim /etc/httpd/conf/httpd.conf

ServerName sxb2.102.com　　　　改成自己的IP

7.创建符号链接到httpd服务；

ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

8.启动，并设置成开机自启；

[root@sxb2 ~]# systemctl enable httpd.service

Created symlinkfrom /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.

[root@sxb2~]# systemctl start httpd.service

我们可以提前创建好两个用户

[root@sxb2 ~]# vim admin-openrc

export OS_PROJECT_DOMAIN_NAME=Default

export OS_USER_DOMAIN_NAME=Default

export OS_PROJECT_NAME=admin

export OS_USERNAME=admin

export OS_PASSWORD=123export OS_AUTH_URL=http://192.168.88.102:5000/v3

export OS_IDENTITY_API_VERSION=3export OS_IMAGE_API_VERSION=2

[root@sxb2 ~]# vim demo-openrc

export OS_PROJECT_DOMAIN_NAME=Default

export OS_USER_DOMAIN_NAME=Default

export OS_PROJECT_NAME=myproject

export OS_USERNAME=myuser

export OS_PASSWORD=123export OS_AUTH_URL=http://192.168.88.102:5000/v3

export OS_IDENTITY_API_VERSION=3export OS_IMAGE_API_VERSION=2

下一阶段我们进行域、项目、用户和角色

1.我们要创建一个新域；首先确保一定要是admin用户；

[root@sxb2 ~]# . admin-openrc

[root@sxb2~]# openstack domain create --description "An Example Domain"example+-------------+----------------------------------+

| Field | Value |

+-------------+----------------------------------+

| description | An Example Domain |

| enabled | True |

| id | 2f4f7bf3bb6545f9b4e5f6bbac653d6d |

| name | example |

| tags | [] |

+-------------+----------------------------------+

2.在域中创建一个service项目；

[root@sxb2 ~]# openstack project create --domain default --description "Service Project"service+-------------+----------------------------------+

| Field | Value |

+-------------+----------------------------------+

| description | Service Project |

| domain_id | default |

| enabled | True |

| id | d6b9b42ec4de4a1fbd0574f2b23f883f |

| is_domain | False |

| name | service |

| parent_id | default |

| tags | [] |

+-------------+----------------------------------+

3.创建一个myproject项目；

[root@sxb2 ~]# openstack project create --domain default --description "Demo Project"myproject+-------------+----------------------------------+

| Field | Value |

+-------------+----------------------------------+

| description | Demo Project |

| domain_id | default |

| enabled | True |

| id | a6dc8ef37cb543599c98083af439b8a0 |

| is_domain | False |

| name | myproject |

| parent_id | default |

| tags | [] |

+-------------+----------------------------------+

4.创建myuser用户，并设置密码；

[root@sxb2 ~]# openstack user create --domain default --password-prompt myuser

User Password:

Repeat User Password:+---------------------+----------------------------------+

| Field | Value |

+---------------------+----------------------------------+

| domain_id | default |

| enabled | True |

| id | d9128e749b944e5e86422e917d910145 |

| name | myuser |

| options | {} |

| password_expires_at | None |

+---------------------+----------------------------------+

5.创建myrole角色；

[root@sxb2 ~]# openstack role create myrole+-------------+----------------------------------+

| Field | Value |

+-------------+----------------------------------+

| description | None |

| domain_id | None |

| id | c3e9e6bb3f634807967ef128433334df |

| name | myrole |

+-------------+----------------------------------+

6.将myuser添加到myproject项目中，并以myrole的角色来管理项目；

openstack role add --project myproject --user myuser myrole

到这里我们的keystone组件就配置完成了，接下来进行验证

1.取消环境变量，admin进行身份验证；

[root@sxb2 ~]# unset OS_AUTH_URL OS_PASSWORD

[root@sxb2~]# openstack --os-auth-url http://192.168.88.102:5000/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name admin --os-username admin token issue

Password:+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

| Field | Value |

+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

| expires | 2019-08-10T13:42:33+0000 |

| id | gAAAAABdTru5XE9SIQFDp1POA_UXdgNkusBk3Sj4PFqFc7w9WBseyMI0uutM7M6WOrcYkZofJayT8Sbo0WXV7LojJmPBzJhaxtHV9bztHeS0M8rjc-8AfQoSZ9xkMng0pq4j_oA72RdfWOLTC13WY48d18W2ytUqaqCLXhrd39d3FiIV0xqt2dQ |

| project_id | 0efc3e774118464eb39800063ad7a64b |

| user_id | d17347f078034a83900df5d0b6f4a644 |

+------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

2.myuser进行身份验证；

[root@sxb2 ~]# openstack --os-auth-url http://192.168.88.102:5000/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name myproject --os-username myuser token issue

Password:

No password entered, or found via--os-password or OS_PASSWORD

[root@sxb2~]# openstack --os-auth-url http://192.168.88.102:5000/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name myproject --os-username myuser token issue

| Field | Value |

| expires | 2019-08-10T13:47:03+0000 |

| id | gAAAAABdTrzHyiYveXthqNw_rkcGCS_lqYgE4rLB9YvOkcuDzdbwDnUZMTswP9ZrZu3ORRBj9QygPfFuW2e2XLY7Ua6Buq16BVVbut_R5QUU3359bzy2gkb63ixyJLfKwAEaLGl6ViJ_0qMb4WiHAdA80_Fyg5VWCAPQZ1aDt0oalDfvHCMLtJo |

| project_id | a6dc8ef37cb543599c98083af439b8a0 |

| user_id | d9128e749b944e5e86422e917d910145 |

+------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

在下一章里我们进行glance的配置；

傲雪吟霜白如冰

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
keystone连接mysql_OpenStack（1）-keystone身份服务部署

身份服务(Identity Service)：Keystone。为OpenStack其他服务提供身份验证、服务规则和服务令牌的功能，管理Domains、Projects、Users、Groups、Roles。自Essex版本集成到项目中。我们将keystone部署到controller上；1.我们需要连接数据库；需要安装python2-PyMySQL；[root@sxb2 ~]# yum inst...
复制链接

扫一扫