部署在controller节点
配置数据库
MariaDB [(none)]> CREATE DATABASE keystone;
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'127.0.0.1' IDENTIFIED BY 'keystone';
Query OK, 0 rows affected (0.00 se
MariaDB [(none)]> flush privileges ;
Query OK, 0 rows affected (0.00 sec)安装keystone
KeyStone服务的监听端口是5000和35357，配置Apache HTTP服务监听这两个端口，为了避免端口冲突，禁止KeyStone开机自启动：
[email protected]:~#?echo "manual" > /etc/init/keystone.override安装keystone及相关软件包：
[email protected]:~# apt-get install keystone python-openstackclient apache2 libapache2-mod-wsgi memcached python-memcache生成admin token?：
[email protected]:~# openssl rand -hex 10
38b35fc6a494b91f56cc配置keystone
配置文件：/etc/keystone/keystone.conf
[email protected]:~# vi /etc/keystone/keystone.conf
#[default]部分，配置初始admin_token
[DEFAULT]
verbose = True
admin_token = 38b35fc6a494b91f56cc?
#[database]部分，配置数据库连接
[database]
connection = mysql://keystone:[email protected]/keystone
#[memcache]部分，配置memcache服务
[memcache]
servers = 127.0.0.1:11211
#[revoke] 部分，配置SQL的撤回驱动
[revoke]
driver = keystone.contrib.revoke.backends.sql.Revoke
#[token]部分，配置UUID令牌的提供者和memcached的持久化驱动
[token]
provider = keystone.token.providers.uuid.Provider
driver = keystone.token.persistence.backends.sql.Token初始化keystone数据库：
[email protected]:~# su -s /bin/sh -c "keystone-manage db_sync" keystone配置keystone的apache2接口
apache2.conf添加：
[email protected]:~# vi /etc/apache2/apache2.conf
ServerName controller创建/etc/apache2/sites-available/wsgi-keystone.conf文件，添加如下内容：
Listen 5000
Listen 35357
<VirtualHost *:5000>
? ? WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone display-name=%{GROUP}
? ? WSGIProcessGroup keystone-public
? ? WSGIScriptAlias / /var/www/cgi-bin/keystone/main
? ? WSGIApplicationGroup %{GLOBAL}
? ? WSGIPassAuthorization On
? ? <IfVersion >= 2.4>
? ? ? ErrorLogFormat "%{cu}t %M"
? ? </IfVersion>
? ? LogLevel info
? ? ErrorLog /var/log/apache2/keystone-error.log
? ? CustomLog /var/log/apache2/keystone-access.log combined
</VirtualHost>
<VirtualHost *:35357>
? ? WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone display-name=%{GROUP}
? ? WSGIProcessGroup keystone-admin
? ? WSGIScriptAlias / /var/www/cgi-bin/keystone/admin
? ? WSGIApplicationGroup %{GLOBAL}
? ? WSGIPassAuthorization On
? ? <IfVersion >= 2.4>
? ? ? ErrorLogFormat "%{cu}t %M"
? ? </IfVersion>
? ? LogLevel info
? ? ErrorLog /var/log/apache2/keystone-error.log
? ? CustomLog /var/log/apache2/keystone-access.log combined
</VirtualHost>启用身份认证服务的虚拟主机：
[email protected]:~# ln -s /etc/apache2/sites-available/wsgi-keystone.conf /etc/apache2/sites-enabled为WSGI组件创建目录结构：
[email protected]:~# mkdir -p /var/www/cgi-bin/keystoneWSGI组件：
[email protected]:~# vi /var/www/cgi-bin/keystone/admin
import os
from keystone.server import wsgi as wsgi_server
name = os.path.basename(__file__)
application = wsgi_server.initialize_application(name)
[email protected]:~# vi /var/www/cgi-bin/keystone/main
import os
from keystone.server import wsgi as wsgi_server
name = os.path.basename(__file__)
application = wsgi_server.initialize_application(name)设置目录权限，并重启apache2：
[email protected]:~# chown -R keystone:keystone /var/www/cgi-bin/keystone
[email protected]:~# chmod 755 /var/www/cgi-bin/keystone/*
[email protected]:~# service apache2 restart
?* Restarting web server apache2? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?[ OK ]?删除ubuntu默认创建的SQLite数据库：
[email protected]:~# rm -f /var/lib/keystone/keystone.db配置服务实体与API端点
设置临时环境变量，校验令牌、端点URL：
[email protected]:~#? export OS_TOKEN=ADMIN_TOKEN
[email protected]:~#? export OS_URL=http://controller:35357/v2.0为认证服务创建服务实体：
[email protected]:~# openstack service create --name keystone --description "OpenStack Identity" identity配置认证服务的API端点：
[email protected]:~# openstack endpoint create --publicurl http://controller:5000/v2.0 --internalurl http://controller:5000/v2.0 --adminurl http://controller:35357/v2.0 --region RegionOne identity创建项目（租户）、用户和角色
创建admin租户：
[email protected]:~# openstack project create --description "Admin Project" admin创建admin用户：
[email protected]:~# openstack user create --password-prompt admin
User Password:admin
Repeat User Password:admin创建admin角色：
[email protected]:~# openstack role create admin添加admin角色到admin租户和用户：
[email protected]:~# openstack role add --project admin --user admin admin创建服务项目
为其他的OpenStack服务创建服务项目：
[email protected]:~# openstack project create --description "Service Project" service创建普通项目和用户
创建demo项目：
[email protected]:~# openstack project create --description "Demo Project" demo创建demo用户：
[email protected]:~# openstack user create --password-prompt demo
User Password:demo
Repeat User Password:demo创建demo角色：
[email protected]:~# openstack role create user添加user角色到demo租户和用户：
[email protected]:~# openstack role add --project demo --user demo user其他
基于安全的原因，禁止校验令牌的机制
- 编辑 vi /etc/keystone/keystone-paste.ini：
移除 admin_token_auth从 [pipeline:public_api], [pipeline:admin_api], 和 [pipeline:api_v3] 部分
- 取消设置的操作系统环境变量：
[email protected]:~# unset OS_TOKEN OS_URL- admin脚本，/root/admin-openrc.sh：
export OS_PROJECT_DOMAIN_ID=default
export OS_USER_DOMAIN_ID=default
export OS_PROJECT_NAME=admin
export OS_TENANT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_AUTH_URL=http://$(hostname):35357/v3
export OS_IMAGE_API_VERSION=2
export OS_VOLUME_API_VERSION=2
export OS_REGION_NAME=RegionOne
export OS_COMPUTE_API_VERSION=3
export OS_IDENTITY_API_VERSION=2原文地址：https://www.cnblogs.com/wshenjin/p/11365916.html
时间： 2024-10-01 04:49:44