【N版】openstack——认证服务keystone
一.keystone介绍
1.1keystone
Keystone(OpenStack Identity Service)是 OpenStack 框架中负责管理身份验证、服务规则和服务令牌功能的模块。用户访问资源需要验证用户的身份与权限，服务执行操作也需要进行权限检测，这些都需要通过 Keystone 来处理。
用户认证：用户权限与用户行为跟踪
服务目录：提供一个服务目录，包括所有服务项与相关API的端点
主要涉及如下概念：
User： 用户
Project：项目（老版本中tenant：租户）
Token： 令牌
Role： 角色
1.2keystone配置
1.2.1创建库及用户
注:在这里为了方便，提前把之后要创建的库，以及用户和授权，都做好
[[email protected] ~]# mysql -uroot –p <- 登陆数据库 ->
MariaDB [(none)]> create database keystone; <- 创建keystone库 ->
MariaDB
[(none)]> grant all privileges on keystone.*to [email protected]‘localhost‘
identified by ‘keystone‘; <- 创建keystone用户 ->
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> grant all privileges on keystone.*to [email protected]‘%‘ identified by ‘keystone‘;
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> create database glance; <- 创建glance库 ->
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> grant all privileges on glance.* [email protected]‘localhost‘ identified by ‘glance‘;
Query OK, 0 rows affected (0.00 sec) <- 创建glance用户 ->
MariaDB [(none)]> grant all privileges on glance.* [email protected]‘%‘ identified by ‘glance‘;
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> create database nova; <- 创建nova库 ->
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> grant all privileges on nova.* [email protected]‘%‘ identified by ‘nova‘;
Query OK, 0 rows affected (0.00 sec) <- 创建nova用户 ->
MariaDB [(none)]> grant all privileges on nova.* [email protected]‘localhost‘ identified by ‘nova‘;
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> create database nova_api; <- 创建nova_api库 ->
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> grant all privileges on nova_api.*to ‘nova‘@‘localhost‘ identified by ‘nova‘;
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> grant all privileges on nova_api.*to ‘nova‘@‘%‘ identified by ‘nova‘;
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> create database neutron; <- 创建neutron库 ->
Query OK, 1 row affected (0.01 sec)
MariaDB [(none)]> grant all privileges on neutron.*to ‘neutron‘@‘%‘ identified by ‘neutron‘;
Query OK, 0 rows affected (0.00 sec) <- 创建neutron用户 ->
MariaDB [(none)]> grant all privileges on neutron.*to ‘neutron‘@‘localhost‘ identified by ‘neutron‘;
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> create database cinder; <- 创建cinder库 ->
Query OK, 1 row affected (0.00 sec)
MariaDB
[(none)]> grant all privileges on cinder.* to‘cinder‘@‘localhost‘
identified by ‘cinder‘; <- 创建cinder用户 ->
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> grant all privileges on cinder.* to‘cinder‘@‘%‘ identified by ‘cinder‘;
Query OK, 0 rows affected (0.00 sec)
1.2.2keystone配置文件
[[email protected] ~]# vim/etc/keystone/keystone.conf <- 编辑配置文件 ->
613 [database] <- 数据库设置->
640 connection = mysql+pymysql://keystone:[email protected]/keystone
1458 [memcache] <- memcache设置 ->
1472 servers = 192.168.56.11:11211 <- memcache服务地址 ->
2655 provider = fernet <- 配置令牌 ->
2665 driver = memcache <- 选择driver为memcache默认是sql ->
[[email protected] ~]# grep ‘^[a-z]‘/etc/keystone/keystone.conf <- 检查 ->
connection =mysql+pymysql://keystone:[email protected]2.168.56.11/keystone
servers = 192.168.56.11:11211
provider = fernet
driver = memcache
1.2.3数据库，memcache配置
[[email protected] ~]# su -s /bin/sh -c"keystone-manage db_sync" keystone
<- 初始化数据库 ->
[[email protected] ~]# mysql -h 192.168.56.11-ukeystone -pkeystone -e "use keystone;show tables;" <- 检查表是否导入成功 ->
[[email protected] ~]# vim/etc/sysconfig/memcached <- 修改memcache配置文件 ->
OPTIONS="-l 192.168.56.11,::1"
[[email protected] ~]# systemctl restartmemcached <- 重启memcache ->
[[email protected] ~]# cd /etc/keystone/
[[email protected] keystone]# keystone-managefernet_setup --keystone-user keystone --keystone-group keystone <- 初始化fernet key ->
[[email protected] keystone]# keystone-managecredential_setup --keystone-user keystone --keystone-group keystone <- 初始化fernet key ->
[[email protected] keystone]# keystone-manage bootstrap--bootstrap-password admin \ <- 引导身份服务 ->
--bootstrap-admin-urlhttp://192.168.56.11:35357/v3/ \
--bootstrap-internal-urlhttp://192.168.56.11:35357/v3/ \
--bootstrap-public-urlhttp://192.168.56.11:5000/v3/ \
--bootstrap-region-id RegionOne
1.2.4配置apache服务
[[email protected] keystone]# vim/etc/httpd/conf/httpd.conf <- 编辑配置文件 ->
95 ServerName 192.168.56.11:80
[[email protected] ~]# ln -s/usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/ <- 软连接配置文件 ->
[[email protected] ~]# systemctl enablehttpd.service <- 启动apache ->
[[email protected] ~]# systemctl start httpd.service
[[email protected] ~]# exportOS_USERNAME=admin <- 配置环境变量 ->
[[email protected] ~]# exportOS_PASSWORD=admin
[[email protected] ~]# exportOS_PROJECT_NAME=admin
[[email protected] ~]# exportOS_USER_DOMAIN_NAME=Default
[[email protected] ~]# exportOS_PROJECT_DOMAIN_NAME=Default
[[email protected] ~]# exportOS_AUTH_URL=http://192.168.56.11:35357/v3
[[email protected] ~]# exportOS_IDENTITY_API_VERSION=3
[[email protected] ~]# openstack user list <- 查看用户列表 ->
[[email protected] ~]# openstack role list <- 查看角色列表 ->
[[email protected] ~]# openstack project list <- 查看项目列表 ->
[[email protected] ~]# openstack endpointlist <- 查看端点列表 ->
1.2.5创建项目
[[email protected] ~]# openstack project create --domaindefault --description "Service Project" service <- 创建服务项目 ->
[[email protected] ~]# openstack project list <- 查看是否创建成功 ->
[[email protected] ~]# openstack project create --domaindefault --description "Demo Project" demo <- 创建demo项目 ->
[[email protected] ~]# openstack project list <- 查看是否创建成功 ->
[[email protected] ~]# openstack user create --domaindefault --password-prompt demo
User Password:demo
Repeat User Password:demo <- 创建demo用户，密码：demo ->
[[email protected] ~]# openstack user list <- 查看是否创建成功 ->
[[email protected] ~]# openstack role create user <- 创建user角色 ->
[[email protected] ~]# openstack role list <- 查看是否创建成功 ->
[[email protected] ~]# openstack role add --project demo--user demo user
<- 将demo用户加入到demo项目并且赋予user角色->
注:为了方便，以下操作将之后要用到的所有用户都创建好
[[email protected] ~]# openstack user create --domaindefault --password-prompt glance <- 创建glance用户，密码：glance ->
User Password:glance
[[email protected] ~]# openstack role add --projectservice --user glance admin
<- 将glance用户加入到service项目并且赋予admin角色->
[[email protected] ~]# openstack user create --domaindefault --password-prompt nova <- 创建nova用户，密码：nova ->
User Password:nova
[[email protected] ~]# openstack role add --projectservice --user nova admin
<- 将glance用户加入到service项目并且赋予admin角色->
[[email protected] ~]# openstack user create --domaindefault --password-prompt neutron <- 创建neutron用户，密码：neutron ->
User Password: neutron
[[email protected] ~]# openstack role add --projectservice --user neutron admin
<- 将glance用户加入到service项目并且赋予admin角色->
[[email protected] ~]# openstack user create --domaindefault --password-prompt cinder <- 创建cinder用户，密码：cinder ->
User Password:cinder
[[email protected] ~]# openstack role add --projectservice --user cinder admin
<- 将glance用户加入到service项目并且赋予admin角色->
1.3验证keystone
1.3.1验证用户
[[email protected] ~]# unset OS_AUTH_URL OS_PASSWORD <- 取消之前的环境变量 ->
[[email protected]~]# openstack \
--os-auth-urlhttp://192.168.56.11:35357/v3 \
--os-project-domain-namedefault \
--os-user-domain-namedefault \
--os-project-nameadmin \
--os-usernameadmin token issue
<-验证admin用户，提示密码时输入admin出来如下界面证明admin用户没问题 ->
[[email protected]]# openstack \
--os-auth-urlhttp://192.168.56.11:35357/v3 \
--os-project-domain-namedefault \
--os-user-domain-namedefault \
--os-project-namedemo \
--os-usernamedemo token issue
<-验证demo用户，提示密码时输入demo出来如下界面证明demo用户没问题 ->
1.3.2创建环境变量脚本
[[email protected] ~]# vim admin-openstack <- admin环境变量 ->
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_AUTH_URL=http://192.168.56.11:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
[[email protected] ~]# vim demo-openstack <- demo环境变量 ->
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo
export OS_AUTH_URL=http://192.168.56.11:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
[[email protected] ~]# source admin-openstack <- source环境变量 ->
[[email protected] ~]# source demo-openstack
1.4Keystone常见错误
401 #验证失败，keystone相关用户账户密码设置错误,时间不同步，或者输入的项目名称不对
403 #可能未初始化OS_token变量，需要使用source命令使其生效，也可能是配置的配置文件未生效，需要重启相关服务
409 #keystone创建用户，用户已存在
500 #服务器内部错误，服务配置有问题，看日志，检查配置
503 #keystone相关账户密码设置有问题，请将相关的glance账户删除，重新创建即可
服务故障 #相关服务没有起来