Keystone 高可靠性部署与性能测试

Goal

Keystone Region 为跨地域的 Openstack 集群提供了统一的认证和用户租户管理。目前公司在国内外部署了数十套 Openstack 集群，其中既有集群在内网，又有集群在公网；既有 Havana 集群，也有 Icehouse 集群；既有 nova-network 集群，又有 Neutron 集群，如下图：

为了集中管理，全局共享一个 Keystone Server, 因此对 Keystone
Server 的安全性和性能，都有特殊的要求。

安全性通过 SSL 实现和防止 DDOS 实现，可靠性通过 Apache、Haproxy、mysqlcluster 实现（关于 openstack
整体 HA 的实现，可以参考  http://blog.csdn.net/wsfdl/article/details/41386155），如下图：

Deployment

物理主机信息

Host Name            IP                         VIP/DNS                                 CPU                                        Memory

keystone01            internal_ip01        public_ip/keystone-server       E5-2620(24 Processor)          64G

keystone02            internal_ip02        public_ip/keystone-server       E5-2620(24 Processor)          64G

说明：若无注明，keystone01 和 keystone02 的部署与配置相同

# yum   -y   install   mysql mysql-server MySQL-python

# yum   -y   install   openstack-keystone python-keystoneclient

# yum   -y   install   haproxy

# yum   -y   install   httpd

# yum   -y   install   keepalived

# yum   -y   install   haproxy

# yum   -y   install   httpd

# yum   -y   install   keepalived

Configuration

/etc/keystone/keystone.conf

/etc/httpd/conf.d/wsgi-keystone.conf

/etc/haproxy/haproxy.cfg

<span style="font-family:Courier New;">global
    daemon
    log 127.0.0.1 local3

defaults
    maxconn 4000
    log     global
    timeout server 10s
    timeout connect 10s
    timeout client 10s
    mode http
    option forwardfor
    option http-server-close
    log global

listen stats
    mode http
    bind public_ip:8000
    stats enable
    stats hide-version
    stats uri     /
    stats realm   Haproxy\ Statistics
    stats auth    lecloud:openstack
    stats admin if TRUE

frontend keystone_frontend
    bind </span><span style="font-family: 'Courier New';">public_ip</span><span style="font-family:Courier New;">:443 ssl crt /etc/haproxy/keystone_https.pem
    reqadd X-Forwarded-Proto:\ https
    acl admin_path path_beg  /admin
    acl main_path  path_beg  /main
    use_backend admin_backend if admin_path
    use_backend main_backend if main_path

backend admin_backend
    balance roundrobin
    redirect scheme https if !{ ssl_fc }
    server keystone-server-01 internal_ip01:35357 check inter 10s
    server keystone-server-02 internal_ip02:35357 check inter 10s

backend main_backend
    balance roundrobin
    redirect scheme https if !{ ssl_fc }
    server keystone-server-01 internal_ip01:5000 check inter 10s
    server keystone-server-02 internal_ip02:5000 check inter 10s</span>

/etc/keepalived/keepalived.conf

<span style="font-family:Courier New;"><span style="color:#333333;">vrrp_script haproxy-check {
    script "killall -0 haproxy"
    interval 2
    weight 10
}

vrrp_instance openstack-vip {
    state MASTER               </span><span style="color:#ff0000;"># 注：keystone01 为 MASTER, keystone02 为 BACKUP</span><span style="color:#333333;">
    priority 102
    interface eth0
    virtual_router_id 108
    advert_int 3
    virtual_ipaddress {
        public_ip
    }
    track_script {
        haproxy-check
    }
}</span></span>

# mkdir   /var/www/cgi-bin/keystone/

# chkconfig   httpd   on

# keystone-manage   ssl_setup   --keystone-user   keystone   --keystone-group   keystone                     注：keystone01

# cat  /etc/keystone/ssl/certs/keystone.pem   /etc/keystone/ssl/private/keystonekey.pem   >   /etc/haproxy/keystone_https.pem              注：keystone01，同时把 keystone_https.pem
拷贝至 keystone02 /etc/haproxy/ 目录下

# (crontab   -l   -u   keystone   2>&1 | grep   -q   token_flush)   ||   echo ‘@dayly   /usr/bin/keystone-manage   token_flush >/var/log/keystone/keystone-tokenflush.log   2>&1‘   >>
  /var/spool/cron/keystone

# chkconfig   keepalived   on

Benchmark

Configure Rally

关于 Rally，详情请参见  Openstack 性能测试 http://blog.csdn.net/wsfdl/article/details/41654373

# git   clone   https://git.openstack.org/stackforge/rally   &&   cd   rally

#  rally   -v   task   start   create-user.json

<span style="font-family:Courier New;">(rally)[[email protected] rally]# cat existing.json
{
    "type": "ExistingCloud",
    "auth_url": "https://keystone-server/admin/v2.0",
    "admin": {
        "username": "test",
        "password": "test",
        "tenant_name": "test"
    }
}</span>

create-user.json

<span style="font-family:Courier New;">(rally)[[email protected] rally]# cat create-user.json
{
    "KeystoneBasic.create_user": [
        {
            "args": {
                "name_length": 10
            },
            "runner": {
                "type": "constant",
                "times": 10000,
                "concurrency": 900
            }
        }
    ]
}</span>

/etc/rally/rally.conf

<span style="font-family:Courier New;"><span style="color:#333333;">[default]
# Use SSL for all OpenStack API interfaces
https_insecure=False      </span><span style="color:#ff0000;">#Rally 对 HTTPS 测试的支持有个 Bug，已被小弟修复合入社区</span><span style="color:#333333;">
# Path to CA server cetrificate for SSL
https_cacert=/etc/ca.pem</span></span>

Result

注：以创建用户为例，一个并发数(Concurrency)，包含两个 HTTPS 请求（一个为申请 token，另一个为创建用户）。此处仅给出 mysql(单点) 数据库下keystone server 的并发性能。