[TOC] ## 功能簡述 keystone的主要功能：認證管理，授權管理和服務目錄 認證：也可以理解成賬號管理，openstack所有的用戶，都是在keystone上注冊的。 授權: glance,nova,neutron,cinder等其他服務都統一使用keystone的賬號管理，就像現在很多網站支持qq登陸是一樣的。 服務目錄：每增加一個服務，都需要在keystone上做注冊登記，用戶通過keystone可以知道由有那些服務，這么服務的url地址是多少，然后用戶就可以直接訪問這些服務。 ## 服務部署 [官網參考鏈接](https://docs.openstack.org/mitaka/zh_CN/install-guide-rdo/keystone-install.html) ### 安裝配置keystone **a：創庫授權** ```sh #需先登錄數據庫 CREATE DATABASE keystone; GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \ IDENTIFIED BY 'KEYSTONE_DBPASS'; GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \ IDENTIFIED BY 'KEYSTONE_DBPASS'; ``` **b：安裝keystone相關軟件包** ```sh yum install openstack-keystone httpd mod_wsgi -y yum install openstack-utils -y ``` **c:修改配置文件** ```sh # 備份 \cp /etc/keystone/keystone.conf{,.bak} grep -Ev '^$|#' /etc/keystone/keystone.conf.bak >/etc/keystone/keystone.conf #非交互式配置 openstack-config --set /etc/keystone/keystone.conf DEFAULT admin_token ADMIN_TOKEN openstack-config --set /etc/keystone/keystone.conf database connection mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone openstack-config --set /etc/keystone/keystone.conf token provider fernet #校驗 [root@controller opt]# md5sum /etc/keystone/keystone.conf d5acb3db852fe3f247f4f872b051b7a9 /etc/keystone/keystone.conf ``` **d：同步數據庫** ```sh su -s /bin/sh -c "keystone-manage db_sync" keystone #確認庫中是否有表: mysql -e "show tables from keystone;" ``` **e：初始化fernet** ```sh keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone ``` ### 配置啟動httpd **修改httpd配置** ```sh echo "ServerName controller" >>/etc/httpd/conf/httpd.conf ``` **創建wsgi配置** ```sh vi /etc/httpd/conf.d/wsgi-keystone.conf Listen 5000 Listen 35357 <VirtualHost *:5000> WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP} WSGIProcessGroup keystone-public WSGIScriptAlias / /usr/bin/keystone-wsgi-public WSGIApplicationGroup %{GLOBAL} WSGIPassAuthorization On ErrorLogFormat "%{cu}t %M" ErrorLog /var/log/httpd/keystone-error.log CustomLog /var/log/httpd/keystone-access.log combined <Directory /usr/bin> Require all granted </Directory> </VirtualHost> <VirtualHost *:35357> WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP} WSGIProcessGroup keystone-admin WSGIScriptAlias / /usr/bin/keystone-wsgi-admin WSGIApplicationGroup %{GLOBAL} WSGIPassAuthorization On ErrorLogFormat "%{cu}t %M" ErrorLog /var/log/httpd/keystone-error.log CustomLog /var/log/httpd/keystone-access.log combined <Directory /usr/bin> Require all granted </Directory> </VirtualHost> ``` **校驗并啟動** ```sh [root@controller ~]# md5sum /etc/httpd/conf.d/wsgi-keystone.conf 8f051eb53577f67356ed03e4550315c2 /etc/httpd/conf.d/wsgi-keystone.conf systemctl enable httpd.service systemctl start httpd.service ``` ### 創建服務和注冊api： **設置環境變量** ```sh export OS_TOKEN=ADMIN_TOKEN export OS_URL=http://controller:35357/v3 export OS_IDENTITY_API_VERSION=3 ``` **創建服務注冊API** ```sh openstack service create --name keystone --description "OpenStack Identity" identity openstack endpoint create --region RegionOne identity public http://controller:5000/v3 openstack endpoint create --region RegionOne identity internal http://controller:5000/v3 openstack endpoint create --region RegionOne identity admin http://controller:35357/v3 ``` ### 權限相關設置 **創建域、項目、用戶、角色** ```sh openstack domain create --description "Default Domain" default openstack project create --domain default --description "Admin Project" admin openstack user create --domain default --password ADMIN_PASS admin openstack role create admin ``` **關聯項目，用戶，角色** ```sh openstack role add --project admin --user admin admin ``` **在admin項目上，給admin用戶賦予admin角色** ```sh openstack project create --domain default --description "Service Project" service ``` **測試keystone的授權** ```sh unset OS_TOKEN OS_URL openstack --os-auth-url http://controller:35357/v3 \ --os-project-domain-name default --os-user-domain-name default \ --os-project-name admin --os-username admin --os-password ADMIN_PASS token issue openstack --os-auth-url http://controller:35357/v3 \ --os-project-domain-name default --os-user-domain-name default \ --os-project-name admin --os-username admin --os-password ADMIN_PASS user list ``` 取消環境變量后,執行openstack就會如上面那樣要求輸入很多參數,才能執行命令,如果測試OK的話,可以寫腳本定義好環境變量,每次登陸后手動載入環境變量即可 ### 創建環境變量腳本 **創建腳本** ```sh cat >admin-openrc <<EOF export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=admin export OS_USERNAME=admin export OS_PASSWORD=ADMIN_PASS export OS_AUTH_URL=http://controller:35357/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 EOF ``` **載入腳本** ```sh source admin-openrc #試試執行腳本然后 openstack service list openstack user list ```