目录
一、keystone安装
keystone集群通过安装一台节点,然后将本节点的所有配置同步到其他节点来完成,因此本节中的所有命令在任意一个节点执行即可,本例中是在controller01节点上执行。
1.创建keystone数据库
**1q2w3e4r是keystone库的密码,在某一个节点执行。
mysql -h vip -u root -p -e "
create database keystone;
grant all privileges on keystone.* to 'keystone'@'localhost' identified by '1q2w3e4r';
grant all privileges on keystone.* to 'keystone'@'%' identified by '1q2w3e4r';"
2.安装keystone相关模块
安装keystone模块
yum install -y openstack-keystone httpd mod_wsgi apr-util -y
3.修改配置
将keystone的默认端口5000和35357进行修改,默认的端口留给vip使用。
sed -i 's/5000/4999/' /usr/share/keystone/wsgi-keystone.conf
sed -i 's/35357/35356/' /usr/share/keystone/wsgi-keystone.conf
修改http配置文件
#将80端口留给vip使用
sed -i 's#^Listen 80#Listen 8080#' /etc/httpd/conf/httpd.conf
#当前节点使用8080端口
echo "ServerName 当前节点的ip地址:8080">>/etc/httpd/conf/httpd.conf
创建http配置软连接
ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/
测试主页
echo `hostname`>/var/www/html/index.html
启动http服务
systemctl enable httpd.service
systemctl restart httpd.service
netstat -antp|egrep 'httpd'
4.配置keystone高可用
echo '
#keystone
listen keystone_admin_cluster
bind vip:35357
#balance source
option tcpka
option httpchk
option tcplog
server keystone部署节点1的ip keystone部署节点1的ip:35356 check inter 2000 rise 2 fall 5
server keystone部署节点2的ip keystone部署节点2的ip:35356 check inter 2000 rise 2 fall 5
listen keystone_public_cluster
bind vip:5000
#balance source
option tcpka
option httpchk
option tcplog
server keystone部署节点1的ip keystone部署节点1的ip:4999 check inter 2000 rise 2 fall 5
server keystone部署节点2的ip keystone部署节点2的ip:4999 check inter 2000 rise 2 fall 5
'>>/etc/haproxy/haproxy.cfg
启动服务
systemctl restart haproxy.service
netstat -antp|egrep 'haproxy|httpd
5.keystone.conf
先生成秘钥
Keys=$(openssl rand -hex 10)
#将秘钥保存
echo "kestone $Keys">/root/openstack.log。
[database]
#1q2w3e4r为keystone数据库的密码
#vip:虚ip
connection = mysql+pymysql://keystone:1q2w3e4r@vip/keystone
[memcache]
servers =缓存节点1的IP:11211,缓存节点2的IP:11211
[token]
provider = fernet
driver = memcache
# expiration = 86400
# caching = true
# cache_time = 86400
[cache]
enabled = true
backend = oslo_cache.memcache_pool
memcache_servers = 缓存节点1的IP:11211,缓存节点2的IP:11211
[DEFAULT]
admin_token = 秘钥的值
verbose = true
6.同步数据库
创建数据表
su -s /bin/sh -c "keystone-manage db_sync" keystone
检查是否成功
mysql -h vip -ukeystone -p -e "use keystone;show tables;"
7.初始化Fernet密匙
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
二、安装其他控制节点
**依次在本节点安装其他节点的keystone服务
1.安装
ssh 其他节点的ip地址 "yum install -y openstack-keystone httpd mod_wsgi apr-util -y"
2.将keystone的默认端口5000和35357进行修改,默认的端口留给vip使用。
ssh 其他节点的ip地址 "sed -i 's/5000/4999/' /usr/share/keystone/wsgi-keystone.conf"
ssh 其他节点的ip地址 "sed -i 's/35357/35356/' /usr/share/keystone/wsgi-keystone.conf"
3.修改http配置文件
#将80端口留给vip使用
ssh 其他keystone节点的ip地址 "sed -i 's#^Listen 80#Listen 8080#' /etc/httpd/conf/httpd.conf "
#当前节点使用8080端口
ssh 其他keystone节点的ip地址 "echo "ServerName 当前节点的ip地址:8080">>/etc/httpd/conf/httpd.conf"
4.创建http配置软连接
ssh 其他keystone节点的ip地址 "ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/"
5.测试主页
ssh 其他keystone节点的ip地址 "echo `hostname`>/var/www/html/index.html"
6.启动http服务
ssh 其他keystone节点的ip地址 "systemctl enable httpd.service systemctl restart httpd.service
netstat -antp|egrep 'httpd'"
8.同步keystone配置
rsync -avzP -e 'ssh -p 22' /etc/keystone/* 其他keystone节点的ip地址:/etc/keystone/
9.同步haproxy配置
rsync -avzP -e 'ssh -p 22' /etc/haproxy/haproxy.cfg 其他keystone节点的ip地址:/etc/haproxy/haproxy.cfg
10重启服务并检查
启动服务
systemctl restart httpd.service
ssh 其他keystone节点的ip地址 "systemctl restart httpd.service"
11.检查集群
curl http://每个keystone节点的ip:35356/v3 #查看单个节点
curl http://vip:35357/v3 #查看群集代理
三、创建项目以及keystone用户
本节内容只在某一个节点执行即可。
1.创建keystone的endpoint
**1q2w3e4是admin的密码。
keystone-manage bootstrap --bootstrap-password 1q2w3e4r \
--bootstrap-admin-url http://vip:35357/v3/ \
--bootstrap-internal-url http://vip:5000/v3/ \
--bootstrap-public-url http://vip:5000/v3/ \
--bootstrap-region-id RegionOne
2.admin环境脚本
**用户为admin,密码为1q2w3e4r
echo "
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=1q2w3e4r
export OS_AUTH_URL=http://vip:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
">./admin-openstack.sh
#测试脚本是否生效
source ./admin-openstack.sh
openstack token issue
3.创建项目以及demo用户
1.创建项目
openstack project create --domain default --description "Service Project" service
openstack project create --domain default --description "Demo Project" demo
2.创建demo用户
openstack user create --domain default --password=demo demo
3.创建user角色
openstack role create user
4.将demo用户添加到user角色
openstack role add --project demo --user demo user
5.创建demo脚本
echo "
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo
export OS_AUTH_URL=http://vip:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
">./demo-openstack.sh
6.测试
source ./demo-openstack.sh
openstack token issue