安装keystone服务(二)

 

一:先决条件:

1.登录数据库

$ mysql -u root -p

2.创建keystone及授权

MariaDB [(none)]> CREATE DATABASE keystone;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \
IDENTIFIED BY 'keystone';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \
IDENTIFIED BY 'keystone';

二:安装及配置组件

 1.安装对应的包

# yum install openstack-keystone httpd mod_wsgi

2.编辑/etc/keystone/keystone.conf文件

　　　找到[database]中connection,去掉前面#,并进行如下所示编辑

[database]
# ...
connection = mysql+pymysql://keystone:keystone@192.168.56.11/keystone

　　　找到[Token],并去除provider前面#

[token]
# ...
provider = fernet

3.同步数据库

# su -s /bin/sh -c "keystone-manage db_sync" keystone
注:可输入 mysql -ukeystone -pkeystone -h controller -e 'use keystone;show tables;'   
进行检查,如果显示出大量表证明没问题,否则可以去/var/log/keystone/keystone.log查看日志报错

4.初始化Fernet密钥存储库

# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

5.引导身份识别服务(Q版后35357端口已不再使用,统一使用5000端口)

# keystone-manage bootstrap --bootstrap-password admin \
  --bootstrap-admin-url http://controller:5000/v3/ \
  --bootstrap-internal-url http://controller:5000/v3/ \
  --bootstrap-public-url http://controller:5000/v3/ \
  --bootstrap-region-id RegionOne

三:配置apache HTTP Server

1.编辑/etc/httpd/conf/httpd.conf文件，配置ServerName选项以配置控制器节点

ServerName controller:80

2.创建一个到/usr/share/keystone/wsgi-keystone.conf文件的链接

# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

四:完成安装

1.开启Apache Http服务并设置成开机自启动

# systemctl enable httpd.service
# systemctl start httpd.service

2.通过设置适当的环境变量来配置管理帐户(这些是创建时需带的参数,可以先设置,后续创建不需要在带这些参数了)

$ export OS_USERNAME=admin
$ export OS_PASSWORD=admin
$ export OS_PROJECT_NAME=admin
$ export OS_USER_DOMAIN_NAME=Default
$ export OS_PROJECT_DOMAIN_NAME=Default
$ export OS_AUTH_URL=http://controller:5000/v3
$ export OS_IDENTITY_API_VERSION=3

五:创建 a domain, projects, users, and roles

1.创建service 项目,该项目可以使添加到环境中的每个服务包含一个惟一的用户。创建服务项目:

$ openstack project create --domain default \
  --description "Service Project" service

2.常规(非管理)任务应该使用非特权项目和用户。如下,创建myproject项目和myuser用户。

# 创建myproject项目

$ openstack project create --domain default \
  --description "Demo Project" myproject

#在为该项目创建其他用户时，不要重复此步骤

#创建myuser用户,输入两次密码myuser
$ openstack user create --domain default \
  --password-prompt myuser

#创建myrole 角色
$ openstack role create myrole

　#将myrole角色添加到myproject项目和myuser用户

$ openstack role add --project myproject --user myuser myrole

六:验证操作

1.取消设置临时OS_AUTH_URL和OS_PASSWORD环境变量:

$ unset OS_AUTH_URL OS_PASSWORD

2.作为admin用户，请求一个身份验证令牌,得到token即可证明无误

$ openstack --os-auth-url http://controller:5000/v3 \
  --os-project-domain-name Default --os-user-domain-name Default \
  --os-project-name admin --os-username admin token issue

Password:
Password:
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires | 2020-11-23T14:40:06+0000 |
| id | gAAAAABfu7u2wEUCeJ1McZVKZcQwvmBbdPk0UrRuXM860IQh4HpDBOUIyA3dIuB8ILtCYpGTYxUAfNUwyw6WUkP6wfJCcjyD70iridCTn6_EXMhdueItUzSs84ERc-sSottrnBXAO1PLqxp8TkUHuBE2vOPBOmvlzGNTeo2fctSHaZhlQJpWglE |
| project_id | 6de584f95c244dfcb309f255162cd65d |
| user_id | 848ff0644d0447ac9688031885afa3bc |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

3.作为myuser用户，请求一个身份验证令牌

$ openstack --os-auth-url http://controller:5000/v3 \
  --os-project-domain-name Default --os-user-domain-name Default \
  --os-project-name myproject --os-username myuser token issue

Password:
Password:
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires | 2020-11-23T14:42:07+0000 |
| id | gAAAAABfu7wvmW4EcZ2Czp4wpXXSH_4s58OZjHSZHrmjeIkwbFVvnna8wvpMZ5TSHa_tOE_zjp4YppB1xoEk4EwK5bUUGWanF4awzqPns9I5H3db5uaya8DAUDBDuVbeyyWnSOPpHJJcKiN-DlGC6FLOOBAbv4nAeagrJrookaLsE3ATLGTbstk |
| project_id | 64777b3c890f4afda9afe0b40e9252db |
| user_id | bfcdc510218a4c1cbd5404a0267609cc |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+