身份服务(Identity Service):Keystone。为OpenStack其他服务提供身份验证、服务规则和服务令牌的功能,管理Domains、Projects、Users、Groups、Roles。自Essex版本集成到项目中。
我们将keystone部署到controller上;
1.我们需要连接数据库;需要安装python2-PyMySQL;
[root@sxb2 ~]# yum install python2-PyMySQL -y
2.配置一个mysql;重启服务;
[root@sxb2 ~]# vim /etc/my.cnf.d/openstack.cnf
[mysqld]
bind-address = 192.168.88.102 本机的地址
default-storage-engine =innodb
innodb_file_per_table=on
max_connections= 4096collation-server =utf8_general_ci
character-set-server = utf8
3.安装和配置组件;设置为开机自启,并当前启动;
yum install rabbitmq-server
[root@sxb2 ~]# systemctl enable rabbitmq-server.service
Created symlink from /etc/systemd/system/multi-user.target.wants/rabbitmq-server.service to /usr/lib/systemd/system/rabbitmq-server.service.
[root@sxb2 ~]# systemctl start rabbitmq-server.service
4.创建一个OpenStack用户;并进行授权;
[root@sxb2 ~]# rabbitmqctl add_user openstack 123Creating user"openstack"[root@sxb2~]# rabbitmqctl set_permissions openstack ".*" ".*" ".*"Setting permissionsfor user "openstack" in vhost "/"
5.安装memcache,配置组件;
yum install memcached python-memcached
[root@sxb2~]# vim /etc/sysconfig/memcached
PORT="11211"USER="memcached"MAXCONN="1024"CACHESIZE="64"OPTIONS="-l 127.0.0.1,::1,192.168.88.102" 加上自己的IP地址
6.启动memcache,并设置成开机自启;
[root@sxb2 ~]# systemctl enable memcached.service
Created symlinkfrom /etc/systemd/system/multi-user.target.wants/memcached.service to /usr/lib/systemd/system/memcached.service.
[root@sxb2~]# systemctl start memcached.service
我们的前期准备就完成了;接下来我们开始安装一个最小化Stein版本
1.我们首先要完成用户验证服务的配置;创建mysql keystone库,并进行授权;
mysql>CREATE DATABASE keystone;
Query OK,1 row affected (0.00sec)
mysql> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY '123';
Query OK,0 rows affected, 1 warning (0.00sec)
mysql> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY '123'
->;
Query OK,0 rows affected, 1 warning (0.00 sec)
2.安装软件;配置文件;
[root@sxb2 ~]# yum install openstack-keystone httpd mod_wsgi
[root@sxb2~]# vim /etc/keystone/keystone.conf
[database]
connection= mysql+pymysql://keystone:123@192.168.88.102/keystone 这里需要改成刚才授权的mysql密码,IP
[token]
provider= fernet
3.更新数据库;
su -s /bin/sh -c "keystone-manage db_sync" keystone
4.初始化Fernet密钥存储库;
[root@sxb2 ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
[root@sxb2~]# keystone-manage credential_setup --keystone-user keystone --keystone-group
5.进行身份引导服务配置;admin、internal、public;
[root@sxb2 ~]# keystone-manage bootstrap --bootstrap-password 123 --bootstrap-admin-url http://192.168.88.102:5000/v3/ --bootstrap-internal-urlhttp://192.168.88.102:5000/v3/ --bootstrap-public-urlhttp://192.168.88.102:5000/v3/ --bootstrap-region-id RegionOne
6.配置httpd服务;
[root@sxb2 ~]# vim /etc/httpd/conf/httpd.conf
ServerName sxb2.102.com 改成自己的IP
7.创建符号链接到httpd服务;
ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/
8.启动,并设置成开机自启;
[root@sxb2 ~]# systemctl enable httpd.service
Created symlinkfrom /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
[root@sxb2~]# systemctl start httpd.service
我们可以提前创建好两个用户
[root@sxb2 ~]# vim admin-openrc
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=123export OS_AUTH_URL=http://192.168.88.102:5000/v3
export OS_IDENTITY_API_VERSION=3export OS_IMAGE_API_VERSION=2
[root@sxb2 ~]# vim demo-openrc
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=myproject
export OS_USERNAME=myuser
export OS_PASSWORD=123export OS_AUTH_URL=http://192.168.88.102:5000/v3
export OS_IDENTITY_API_VERSION=3export OS_IMAGE_API_VERSION=2
下一阶段我们进行域、项目、用户和角色
1.我们要创建一个新域;首先确保一定要是admin用户;
[root@sxb2 ~]# . admin-openrc
[root@sxb2~]# openstack domain create --description "An Example Domain"example+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | An Example Domain |
| enabled | True |
| id | 2f4f7bf3bb6545f9b4e5f6bbac653d6d |
| name | example |
| tags | [] |
+-------------+----------------------------------+
2.在域中创建一个service项目;
[root@sxb2 ~]# openstack project create --domain default --description "Service Project"service+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Service Project |
| domain_id | default |
| enabled | True |
| id | d6b9b42ec4de4a1fbd0574f2b23f883f |
| is_domain | False |
| name | service |
| parent_id | default |
| tags | [] |
+-------------+----------------------------------+
3.创建一个myproject项目;
[root@sxb2 ~]# openstack project create --domain default --description "Demo Project"myproject+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Demo Project |
| domain_id | default |
| enabled | True |
| id | a6dc8ef37cb543599c98083af439b8a0 |
| is_domain | False |
| name | myproject |
| parent_id | default |
| tags | [] |
+-------------+----------------------------------+
4.创建myuser用户,并设置密码;
[root@sxb2 ~]# openstack user create --domain default --password-prompt myuser
User Password:
Repeat User Password:+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | d9128e749b944e5e86422e917d910145 |
| name | myuser |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
5.创建myrole角色;
[root@sxb2 ~]# openstack role create myrole+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | None |
| domain_id | None |
| id | c3e9e6bb3f634807967ef128433334df |
| name | myrole |
+-------------+----------------------------------+
6.将myuser添加到myproject项目中,并以myrole的角色来管理项目;
openstack role add --project myproject --user myuser myrole
到这里我们的keystone组件就配置完成了,接下来进行验证
1.取消环境变量,admin进行身份验证;
[root@sxb2 ~]# unset OS_AUTH_URL OS_PASSWORD
[root@sxb2~]# openstack --os-auth-url http://192.168.88.102:5000/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name admin --os-username admin token issue
Password:+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires | 2019-08-10T13:42:33+0000 |
| id | gAAAAABdTru5XE9SIQFDp1POA_UXdgNkusBk3Sj4PFqFc7w9WBseyMI0uutM7M6WOrcYkZofJayT8Sbo0WXV7LojJmPBzJhaxtHV9bztHeS0M8rjc-8AfQoSZ9xkMng0pq4j_oA72RdfWOLTC13WY48d18W2ytUqaqCLXhrd39d3FiIV0xqt2dQ |
| project_id | 0efc3e774118464eb39800063ad7a64b |
| user_id | d17347f078034a83900df5d0b6f4a644 |
+------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
2.myuser进行身份验证;
[root@sxb2 ~]# openstack --os-auth-url http://192.168.88.102:5000/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name myproject --os-username myuser token issue
Password:
No password entered, or found via--os-password or OS_PASSWORD
[root@sxb2~]# openstack --os-auth-url http://192.168.88.102:5000/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name myproject --os-username myuser token issue
Password:+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires | 2019-08-10T13:47:03+0000 |
| id | gAAAAABdTrzHyiYveXthqNw_rkcGCS_lqYgE4rLB9YvOkcuDzdbwDnUZMTswP9ZrZu3ORRBj9QygPfFuW2e2XLY7Ua6Buq16BVVbut_R5QUU3359bzy2gkb63ixyJLfKwAEaLGl6ViJ_0qMb4WiHAdA80_Fyg5VWCAPQZ1aDt0oalDfvHCMLtJo |
| project_id | a6dc8ef37cb543599c98083af439b8a0 |
| user_id | d9128e749b944e5e86422e917d910145 |
+------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
在下一章里我们进行glance的配置;