iaas-install-keystone.sh脚本详解

iaas-install-keystone.sh

#!/bin/bash
source /etc/iaas-openstack/openrc.sh
#keystone mysql
mysql -uroot -p$DB_PASS -e "create database IF NOT EXISTS keystone ;"  # 创建keystone数据库 
mysql -uroot -p$DB_PASS -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY '$KEYSTONE_DBPASS' ;" # 授权 keystone 用户拥有从本地访问 keystone 数据库的所有权限
mysql -uroot -p$DB_PASS -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY '$KEYSTONE_DBPASS' ;" # 授权 keystone 用户拥有从任何主机访问 keystone 数据库的所有权限

#install keystone
yum install openstack-keystone httpd mod_wsgi -y   # 安装 keystone 包

#/etc/keystone/keystone.conf
crudini --set /etc/keystone/keystone.conf database connection  mysql+pymysql://keystone:$KEYSTONE_DBPASS@$HOST_NAME/keystone   # 数据库的连接
crudini --set /etc/keystone/keystone.conf token provider  fernet    # 安全消息传递格式
ADMIN_TOKEN=$(openssl rand -hex 10)   # 创建令牌
crudini --set /etc/keystone/keystone.conf DEFAULT admin_token $ADMIN_TOKEN   # 将令牌添加到配置文件/etc/keystone/keystone.conf 中
su -s /bin/sh -c "keystone-manage db_sync" keystone # 将 keystone 身份认证服务信息同步到 keystone 数据库
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone  # 创建签名密钥
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone  # 创建证书
sed -i "s/#ServerName www.example.com:80/ServerName $HOST_NAME/g" /etc/httpd/conf/httpd.conf   # 将ServerName www.example.com:80 替换为ServerName controller  
ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/  # 创建启用认证服务的虚拟主机（两台虚拟主机，各监听5000端口，和35357端口）
systemctl enable httpd.service
systemctl restart httpd.service

export OS_TOKEN=$ADMIN_TOKEN    # 配置admin_token，校验令牌
export OS_URL=http://$HOST_NAME:35357/v3   # 配置endpoint的通信地址，端点url
export OS_IDENTITY_API_VERSION=3    # 配置keystone身份认证服务组件的API版本

openstack service create --name keystone --description "OpenStack Identity" identity  # 创建 keystone 身份认证服务组件的 service
openstack endpoint create --region RegionOne identity public http://$HOST_NAME:5000/v3    # 创建 keystone 身份认证服务组件的处理外部访问端点
openstack endpoint create --region RegionOne identity internal http://$HOST_NAME:5000/v3   # 创建 keystone 身份认证服务组件的处理内部访问端点
openstack endpoint create --region RegionOne identity admin http://$HOST_NAME:35357/v3     # 创建 keystone 身份认证服务组件的处理 admin 端点

openstack domain create --description "Default Domain" $DOMAIN_NAME   # 创建名称为 $DOMAIN_NAME 的域
openstack project create --domain $DOMAIN_NAME --description "Admin Project" admin   # 创建 admin 项目
openstack user create --domain $DOMAIN_NAME --password $ADMIN_PASS admin   # 创建 admin 用户，密码为$ADMIN_PASS

openstack role create admin  # 创建 admin 角色
openstack role add --project admin --user admin admin  # 赋予 admin project 和 admin admin

openstack project create --domain $DOMAIN_NAME --description "Service Project" service   # 创建 service 项目 该项目属于 $DOMAIN_NAME 域
openstack project create --domain $DOMAIN_NAME --description "Demo Project" demo    # 创建 demo 项目 该项目属于 $DOMAIN_NAME 域

openstack user create --domain $DOMAIN_NAME --password $DEMO_PASS demo  # 创建demo用户 密码为$ADMIN_PASS 该用户属于 $DOMAIN_NAME 域
openstack role create user  # 创建user role
openstack role add --project demo --user demo user # 赋予 demo project 和 demo user

unset OS_TOKEN OS_URL  # 清除环境变量（admin用户和demo用户）

cat > /etc/keystone/admin-openrc.sh <<-EOF  # 创建 admin-openrc.sh 环境变量脚本(admin 用户脚本)
export OS_PROJECT_DOMAIN_NAME=$DOMAIN_NAME
export OS_USER_DOMAIN_NAME=$DOMAIN_NAME
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=$ADMIN_PASS
export OS_AUTH_URL=http://$HOST_NAME:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
EOF

cat > /etc/keystone/demo-openrc.sh <<-EOF  # 创建demo-openrc.sh 环境变量脚本(demo 用户脚本)
export OS_PROJECT_DOMAIN_NAME=$DOMAIN_NAME
export OS_USER_DOMAIN_NAME=$DOMAIN_NAME
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=$DEMO_PASS
export OS_AUTH_URL=http://$HOST_NAME:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
EOF

source /etc/keystone/admin-openrc.sh   # 生效admin用户脚本
openstack token issue   # 获取token