文章目录
一、Keyston
1、主要功能
- 身份认证:对用户进行身份认证,并对应权限范围
- 用户授权(令牌管理权限):以token令牌的方式标识用户对应拥有的权限范围
- 用户管理(寻址功能):提供用户访问资源的寻址功能(URL)
- 服务目录:所有服务的交互/调用。均需要keyston进行认证
2、管理对象
- User:指使用OpenStack service的用户,nova glance (跑在OpenStack里面,是需要一个用户进行管理的)
- Project(Tenant):可以理解为一个人或服务所拥有的资源集合
- Role:用于划分权限,通过给User指定Role,使User获得Role对应操作权限
- Authentication:确定用户身份的过程
- Token:是一个字符串表示,作为访问资源的令牌。Token包含了在指定范围和有效时间内可以被访问的资源
- Credentials:用于确认用户身份的凭证,用户的用户名和密,或者是用户名和API密钥,或者身份管理服务提供的认证令牌
- Service OpenStack service,即OpenStack中运行的组件服务。例如:nova、swift、glance、neutron、cinder等
- Endpoint:一个可以通过网络来访问个定位某个OpenStack service的地址,通常是一个URL(即Apache的api(位置点))
3、Keystone认证过程
①user登录(keystone 认证)
②user进入控制台/命令行界面(位置点)
③user 发起创建虚拟的请求(向keystone认证指引位置点)
④请求到达nova组件(向keystone认证)
⑤nova 会开始执行请求,并且调用创建实例所需要的glance、neutron等资源(向keystone认证,指引对应服务的位置点)
⑥glance和neutron 服务收到请求后(向keystone认证)才会给与nova对应的资源
⑦nova拿到资源后,调用对应资源,创建实例,最后将创建结果返回给用户(成功?失败? 原因)
二、Keystone身份服务组件安装
1、创建数据库实例和数据库用户
[root@ct ~]# mysql -u root -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 16
Server version: 10.3.20-MariaDB MariaDB Server
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> create database keystone;
Query OK, 1 row affected (0.001 sec)
MariaDB [(none)]> grant all privileges on keystone.* to 'keystone'@'localhost' identified by 'keystone_dbpass';
Query OK, 0 rows affected (0.001 sec)
MariaDB [(none)]> grant all privileges on keystone.* to 'keystone'@'%' identified by 'keystone_dbpass';
Query OK, 0 rows affected (0.000 sec)
MariaDB [(none)]> flush privileges;
Query OK, 0 rows affected (0.000 sec)
MariaDB [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| keystone |
| mysql |
| performance_schema |
+--------------------+
4 rows in set (0.001 sec)
MariaDB [(none)]> exit
Bye
您在 /var/spool/mail/root 中有新邮件
[root@ct ~]#
2、安装keystone、http、mod_wsgi
[root@ct ~]# yum -y install openstack-keystone httpd mod_wsgi #mod_wsgi作用让Apache能代理Python程序组件
已加载插件:fastestmirror
Loading mirror speeds from cached hostfile
* base: mirrors.cn99.com
* centos-ceph-nautilus: mirrors.huaweicloud.com
* centos-nfs-ganesha28: mirrors.ustc.edu.cn
* centos-openstack-train: mirrors.ustc.edu.cn
* centos-qemu-ev: mirrors.ustc.edu.cn
* extras: mirrors.ustc.edu.cn
* updates: mirrors.ustc.edu.cn
软件包 1:openstack-keystone-16.0.2-1.el7.noarch 已安装并且是最新版本
软件包 httpd-2.4.6-97.el7.centos.x86_64 已安装并且是最新版本
软件包 mod_wsgi-3.4-18.el7.x86_64 已安装并且是最新版本
无须任何处理
[root@ct ~]# cd /etc/keystone/ #切换到此目录
[root@ct keystone]# cp -a keystone.conf{,.bak} #复制文件到.bak中
[root@ct keystone]# grep -Ev "^$|#" keystone.conf.bak > keystone.conf #过滤出不以$或#开头的行并覆盖配置文件
[root@ct keystone]# openstack-config --set /etc/keystone/keystone.conf database connection mysql+pymysql://keystone:keystone_dbpass@ct/keystone #通过pymysql模块连接mysql,指定用户名密码、数据库的域名、数据库名
[root@ct keystone]# openstack-config --set /etc/keystone/keystone.conf token provider fernet #指定token传递的消息传递模式
3、 初始化数据库
[root@ct keystone]# su -s /bin/sh -c "keystone-manage db_sync" keystone #使用keystone的身份切换环境来执行操作
[root@ct keystone]# mysql -uroot -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 18
Server version: 10.3.20-MariaDB MariaDB Server
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> use keystone;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
MariaDB [keystone]> show tables;
+------------------------------------+
| Tables_in_keystone |
+------------------------------------+
| access_rule |
| access_token |
| application_credential |
| application_credential_access_rule |
| application_credential_role |
| assignment |
| config_register |
| consumer |
| credential |
| endpoint |
| endpoint_group |
| federated_user |
| federation_protocol |
| group |
| id_mapping |
| identity_provider |
| idp_remote_ids |
| implied_role |
| limit |
| local_user |
| mapping |
| migrate_version |
| nonlocal_user |
| password |
| policy |
| policy_association |
| project |
| project_endpoint |
| project_endpoint_group |
| project_option |
| project_tag |
| region |
| registered_limit |
| request_token |
| revocation_event |
| role |
| role_option |
| sensitive_config |
| service |
| service_provider |
| system_assignment |
| token |
| trust |
| trust_role |
| user |
| user_group_membership |
| user_option |
| whitelisted_config |
+------------------------------------+
48 rows in set (0.000 sec)
4、初始化fernet密钥存储库
[root@ct ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone #生成密钥文件
[root@ct ~]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone #生成凭证文件
[root@ct ~]# ls /etc/keystone/
credential-keys keystone.conf policy.json
default_catalog.templates keystone.conf.bak sso_callback_template.html
fernet-keys logging.conf
5、配置bootstrap身份认证服务
- 初始化openstack,会把openstack的admin用户的信息写入到mysql的user表中,以及url等其他信息写入到mysql的相关表中
[root@ct ~]# keystone-manage bootstrap --bootstrap-password ADMIN_PASS \
> --bootstrap-admin-url http://ct:5000/v3/ \
> --bootstrap-internal-url http://ct:5000/v3/ \
> --bootstrap-public-url http://ct:5000/v3/ \
> --bootstrap-region-id RegionOne
6、配置Apache服务器
[root@ct ~]# echo "ServerName controller" >> /etc/httpd/conf/httpd.conf
[root@ct ~]# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/ #让apache调用wsgi
[root@ct ~]# systemctl enable httpd #开机自启
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
[root@ct ~]# systemctl start httpd
7、配置管理员账号的环境变量
[root@ct ~]# cat >> ~/.bashrc << EOF
> export OS_USERNAME=admin
> export OS_PASSWORD=ADMIN_PASS
> export OS_PROJECT_NAME=admin
> export OS_USER_DOMAIN_NAME=Default
> export OS_PROJECT_DOMAIN_NAME=Default
> export OS_AUTH_URL=http://ct:5000/v3
> export OS_IDENTITY_API_VERSION=3
> export OS_IMAGE_API_VERSION=2
> EOF
[root@ct ~]# source .bashrc
8、查看当前所有用户列表
[root@ct ~]# openstack user list
+----------------------------------+-------+
| ID | Name |
+----------------------------------+-------+
| e40d635d87de46d28bc0962c8ed1dbd4 | admin |
+----------------------------------+-------+
[root@ct ~]#