Centos7安装部署openstack--Keystone认证服务

一、openstack概述

　　1、拓扑图

         

 　　Horizon 是一个 dashboard 就是一个控制面板 Celiometer 是一个监控计费 像快照，配置都要计费的 Keystone 是一个登录认证 像有些网站都是qq登录 或者微信登录 Heat 是一个编排服务（playbook） 就是通过定义剧本 来批量启动一系列的虚拟机，然后一键实现一个集群的搭建（利用ansible 来执行） swift 是一个对象存储 就是用户的东西不在是存在某一个目录下面，因为传统的目录下没有数据库，而swift （对象存储 ）就专门建一个数据库 把每一个文件当成一个记录对象，而不是目录级别的，就是一个文件变成数据库里的一条记录。

　　2、openstck架构（soa架构）

　　　　模块：（keystone认证服务，glance镜像服务，nova计算服务，neutron网络服务，cinder存储服务，horizon web界面）

　　3、soa架构

　　　　SOA：拆业务，把每一个功能都拆成一个独立的web服务，每一个独立的web服务，至少拥有一个集群。

　　　　开源的微服框架 ：阿里开源的dubbo 、spring boot。

二、安装keystone认证服务

　　1、安装服务

[root@controller ]#yum install openstack-keystone httpd mod_wsgi -y                      mod_wsgi提供http服务与python之间的连接

　　2、在你配置 OpenStack 身份认证服务前，你必须创建一个数据库和管理员令牌。

[root@controller ~]# mysql -u root -p
MariaDB [(none)]> CREATE DATABASE keystone;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost'  IDENTIFIED BY 'KEYSTONE_DBPASS';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%'  IDENTIFIED BY 'KEYSTONE_DBPASS';

　　3、生成一个随机值在初始的配置中作为管理员的令牌。

[root@controller ~]# openssl rand -hex 10

　　4、修改配置文件

[root@controller ]# cp /etc/keystone/keystone.conf /etc/keystone/keystone.conf.bak                       备份配置文件
[root@controller ]# grep -Ev '^$|#' /etc/keystone/keystone.conf.bak >/etc/keystone/keystone.conf         过滤掉空格和注释，然后导入配置文件
[root@controller ]# vim /etc/keystone/keystone.conf                                                      编辑配置文件，如下图
[root@controller ]# md5sum /etc/keystone/keystone.conf                                                   用MD5记录配置文件

[DEFAULT]
...
admin_token = ADMIN_TOKEN

[database]
...
connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone

[token]
...
provider = fernet

　　

 　　5、安装专门用于修改配置文件的服务

[root@controller ]# yum install openstack-utils -y
[root@controller ]# grep -Ev '^$|#' /etc/keystone/keystone.conf.bak >/etc/keystone/keystone.conf                  还原刚第二步修改的配置文件
[root@controller ]# openstack-config --set /etc/keystone/keystone.conf DEFAULT admin_token ADMIN_TOKEN            用工具修改配置文件
[root@controller ]# openstack-config --set /etc/keystone/keystone.conf database connection mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone
[root@controller ]# openstack-config --set /etc/keystone/keystone.conf token provider fernet
[root@controller ]# cat /etc/keystone/keystone.conf                                                               查看配置文件
[root@controller ]# md5sum /etc/keystone/keystone.conf                                                            查看修改的配置文件与上一步手动修改的配置文件MD5值

　　6、初始化身份认证服务的数据库

[root@controller ]# mysql keystone -e 'show tables;'                                                     切换到数据库，查看数据库下面的表
[root@controller ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone                                 同步数据库，同步完成在去查看，就会多出很多表

 　　7、初始化Fernet keys

[root@controller ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

　　初始化之后，在 /etc/keystone/下面会多出fernet-keys的文件夹

     

 　　8、配置 Apache HTTP 服务器

[root@controller ~]# echo "ServerName controller" >> /etc/httpd/conf/httpd.conf

　　9、用下面的内容创建`/etc/httpd/conf.d/wsgi-keystone.conf``文件

[root@controller ~]# vim /etc/httpd/conf.d/wsgi-keystone.conf

Listen 5000
Listen 35357

<VirtualHost *:5000>
    WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-public
    WSGIScriptAlias / /usr/bin/keystone-wsgi-public
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    ErrorLogFormat "%{cu}t %M"
    ErrorLog /var/log/httpd/keystone.log
    CustomLog /var/log/httpd/keystone_access.log combined

    <Directory /usr/bin>
        Require all granted
    </Directory>
</VirtualHost>

<VirtualHost *:35357>
    WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-admin
    WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    ErrorLogFormat "%{cu}t %M"
    ErrorLog /var/log/httpd/keystone.log
    CustomLog /var/log/httpd/keystone_access.log combined

    <Directory /usr/bin>
        Require all granted
    </Directory>
</VirtualHost>

 　　10、启动http服务，并加入开机自启动

[root@controller etc]# systemctl start httpd.service
[root@controller etc]# systemctl enable httpd.service

         

三、配置令牌，并注册服务 　　

　　1、配置令牌

[root@controller etc]# export OS_TOKEN=ADMIN_TOKEN                                   配置认证令牌
[root@controller etc]# export OS_URL=http://controller:35357/v3                      配置端点URL
[root@controller etc]# export OS_IDENTITY_API_VERSION=3                              配置认证 API 版本

　　

 　　2、创建服务实体和API端点

[root@controller ~]# openstack service create   --name keystone --description "OpenStack Identity" identity
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Identity |
| enabled | True |
| id | 0636e3be3cd148c6b54fd24686e8d6ea |
| name | keystone |
| type | identity |
+-------------+----------------------------------+

[root@controller ~]# openstack endpoint create --region RegionOne   identity public http://controller:5000/v3
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 8227630dece449018c6dd7f3199c18b6 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 0636e3be3cd148c6b54fd24686e8d6ea |
| service_name | keystone |
| service_type | identity |
| url | http://controller:5000/v3 |
+--------------+----------------------------------+

[root@controller ~]# openstack endpoint create --region RegionOne   identity internal http://controller:5000/v3

+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | b1c3e0e738854c568ad236ae00a0da6d |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 0636e3be3cd148c6b54fd24686e8d6ea |
| service_name | keystone |
| service_type | identity |
| url | http://controller:5000/v3 |
+--------------+----------------------------------+

[root@controller ~]# openstack endpoint create --region RegionOne   identity admin http://controller:35357/v3
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | fb800ecf21c845a6bfdd05c5de1f4656 |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 0636e3be3cd148c6b54fd24686e8d6ea |
| service_name | keystone |
| service_type | identity |
| url | http://controller:35357/v3 |
+--------------+----------------------------------+

　　创建service项目

openstack project create --domain default 
  --description "Service Project" service
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Service Project                  |
| domain_id   | e0353a670a9e496da891347c589539e9 |
| enabled     | True                             |
| id          | 894cdfa366d34e9d835d3de01e752262 |
| is_domain   | False                            |
| name        | service                          |
| parent_id   | None                             |
+-------------+----------------------------------+

openstack project create --domain default 
  --description "Demo Project" demo
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Demo Project                     |
| domain_id   | e0353a670a9e496da891347c589539e9 |
| enabled     | True                             |
| id          | ed0b60bf607743088218b0a533d5943f |
| is_domain   | False                            |
| name        | demo                             |
| parent_id   | None                             |
+-------------+----------------------------------+

openstack user create --domain default 
>   --password DEMO_PASS demo
+---------------------+----------------------------------+
| Field               | Value                            |
+---------------------+----------------------------------+
| domain_id           | d0fb278401404c569f5cf9c00c750817 |
| enabled             | True                             |
| id                  | 1ca7f08e5e954074837db6c877834c07 |
| name                | demo                             |
| options             | {}                               |
| password_expires_at | None                             |
+---------------------+----------------------------------+

 openstack role create user
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | None                             |
| id        | 3db197f5d549400eb825ae24e839e7ea |
| name      | user                             |
+-----------+----------------------------------+

openstack role add --project demo --user demo user

　　注解：每个添加到OpenStack环境中的服务要求一个或多个服务实体和三个认证服务中的API 端点变种。

四、创建域、项目（租户）、用户和角色

　　1、创建域``default``

[root@controller ~]# openstack domain create --description "Default Domain" default
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Default Domain                   |
| enabled     | True                             |
| id          | 73e42b9fc6b64cfdb17940cdf0a0f692 |
| name        | default                          |
| tags        | []                               |
+-------------+----------------------------------+

　　2、创建 admin 项目

[root@controller ~]# openstack project create --domain default   --description "Admin Project" admin
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Admin Project                    |
| domain_id   | 73e42b9fc6b64cfdb17940cdf0a0f692 |
| enabled     | True                             |
| id          | 17e6fb94c09347fc8bdc854afef7922f |
| is_domain   | False                            |
| name        | admin                            |
| parent_id   | 73e42b9fc6b64cfdb17940cdf0a0f692 |
| tags        | []                               |
+-------------+----------------------------------+

　　3、创建 admin 用户

[root@controller ~]# openstack user create --domain default  --password ADMIN_PASS admin
+---------------------+----------------------------------+
| Field               | Value                            |
+---------------------+----------------------------------+
| domain_id           | 73e42b9fc6b64cfdb17940cdf0a0f692 |
| enabled             | True                             |
| id                  | 0a48bf33893b4854bf85fbd69050c2f6 |
| name                | admin                            |
| options             | {}                               |
| password_expires_at | None                             |
+---------------------+----------------------------------+

　　4、创建 admin 角色

[root@controller ~]# openstack role create admin
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | None                             |
| id        | 2ef07766d0a04bacb8778b0b0ac0be51 |
| name      | admin                            |
+-----------+----------------------------------+

　　5、添加``admin`` 角色到 admin 项目和用户上

[root@controller ~]# openstack role add --project admin --user admin admin

　　6、删除环境变量，因为安全性的原因，关闭临时认证令牌机制

　　　　###编辑 /etc/keystone/keystone-paste.ini 文件，从``[pipeline:public_api]``，[pipeline:admin_api]``和``[pipeline:api_v3]``部分删除``admin_token_auth 。

　　　　重置``OS_TOKEN``和``OS_URL`` 环境变量

[root@controller ~]# unset OS_TOKEN OS_URL

　　7、作为 admin 用户，请求认证令牌

[root@controller ~]# openstack --os-auth-url http://controller:35357/v3  --os-project-domain-name default --os-user-domain-name default --os-project-name admin --os-username admin token issue

　　　　注解：这个命令使用``admin``用户的密码：ADMIN_PASS

　　8、用环境变量，执行命令

[root@controller ~]# export OS_PROJECT_DOMAIN_NAME=default
[root@controller ~]# export OS_USER_DOMAIN_NAME=default
[root@controller ~]# export OS_PROJECT_NAME=admin
[root@controller ~]# export OS_USERNAME=admin
[root@controller ~]# export OS_PASSWORD=ADMIN_PASS
[root@controller ~]# export OS_AUTH_URL=http://controller:35357/v3
[root@controller ~]# export OS_IDENTITY_API_VERSION=3
[root@controller ~]# export OS_IMAGE_API_VERSION=2

[root@controller ~]# openstack user list                   执行了环境变量，才能使用这个命令
+----------------------------------+-------+
| ID | Name |
+----------------------------------+-------+
| 0a48bf33893b4854bf85fbd69050c2f6 | admin |
+----------------------------------+-------+

[root@controller ~]# openstack --os-auth-url http://controller:35357/v3  --os-project-domain-name default --os-user-domain-name default  --os-project-name admin --os-username admin user list      用参数执行命令

　　9、把环境变量创建成脚本，创建admin-openrc文件

[root@controller ~]# vim admin-openrc
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=ADMIN_PASS
export OS_AUTH_URL=http://controller:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

[root@controller ~]# source admin-openrc                 每次执行openstack命令之前，保证有环境变量，登出之后，重新执行此命令

 　　10、自动执行，开机拥有环境变量

[root@controller ~]# vim .bashrc
# .bashrc

# User specific aliases and functions

alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'

# Source global definitions
if [ -f /etc/bashrc ]; then
. /etc/bashrc
fi
source admin-openrc                             在最后加入这段

　　11、验证keystone服务是否正常