OpenStack--部署认证服务keystone

官方安装文档：https://docs.openstack.org/ocata/zh_CN/install-guide-rdo/index.html

1、keystone数据库配置：

#1：创建数据库：
[root@linux-host4 ~]# mysql -uroot -p123456
MariaDB [(none)]> create database keystone;
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> grant all on keystone.* to 'keystone'@'%' identified by 'keystone'; 
Query OK, 0 rows affected (0.00 sec)

#2：验证数据库：
#验证可以从 openstack 控制端使用 keystone 访问数据库：
[root@linux-host1 ~]# mysql -ukeystone -h192.168.10.100 -pkeystone

#3：配置 haproxy 代理：
#openstack-mysql================================================================
frontend openstack_mysql
 bind 192.168.10.100:3306
 mode tcp
 default_backend openstack_mysql_node
backend openstack_mysql_node
 mode tcp
 balance source
 server 192.168.10.204 192.168.10.204:3306 check inter 2000 fall 3 rise 5
#openstack-memcached================================================================
frontend openstack_memcached
 bind 192.168.10.100:11211
 mode tcp
 default_backend openstack_memcached_node
backend openstack_memcached_node
 mode tcp
 balance source
 server 192.168.10.100 192.168.10.205:11212 check inter 2000 fall 3 rise 5
 
#4：验证端口：
#5：验证访问 VIP 数据库端口：
#6：验证使用 VIP 访问 memcached:

2、部署及配置 keystone：

#1：安装 keystone：
#openstack-keystone是keystone服务，http是web服务，mod_wsgi是python 的通用网关
[root@linux-host1 ~]# yum install -y openstack-keystone httpd mod_wsgi python-memcached

#2：编辑 keystone 配置文件：
[root@linux-host1 ~]# openssl rand -hex 10 #生成临时token
a734fda7b075fb62b75c
[root@linux-host1 ~]# vim /etc/keystone/keystone.conf
17 admin_token = a734fda7b075fb62b75c
714 connection = mysql+pymysql://keystone:keystone@192.168.10.100/keystone
2833 provider = fernet

#3：当前最终配置：
[root@linux-host1 ~]# grep -n "^[a-Z\[]" /etc/keystone/keystone.conf
1:[DEFAULT]
17:admin_token = a734fda7b075fb62b75c
686:[database]
714:connection = mysql+pymysql://keystone:keystone@192.168.10.100/keystone
1494:[memcache]
2791:[token]
2833:provider = fernet

#4：初始化并验证数据库：
#会在数据库创建默认表等操作
[root@linux-host1 ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone

#5：keystone日志文件：
[root@linux-host1 ~]# ll /var/log/keystone/keystone.log
-rw-rw---- 1 root keystone 12702 Sep 10 10:26 /var/log/keystone/keystone.log

#6：初始化证书并验证：
[root@linux-host1 ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
[root@linux-host1 ~]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
[root@linux-host1 ~]# ll /etc/keystone/fernet-keys/
total 8
-rw------- 1 keystone keystone 44 Sep 10 10:56 0
-rw------- 1 keystone keystone 44 Sep 10 10:56 1

3、配置keystone：

通过apache代理python：

#1：编辑 apache 配置文件：
[root@linux-host1 ~]# vim /etc/httpd/conf/httpd.conf
95 ServerName 192.168.10.201:80

#2：软连接配置文件：
[root@linux-host1 ~]# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

#3：启动apache：
[root@linux-host1 ~]# systemctl start httpd
[root@linux-host1 ~]# systemctl enable httpd

#4：验证端口：

4、创建域、用户、项目和角色：

#1：通过admin的token设置环境变量进行操作：
[root@linux-host1 ~]