1. 前言

    在生产环境中,使用openstack已经有1年多的时间了,苦于一直没有时间,加上工作带来的懒惰,一直迟迟没有对openstack方面的知识做个总结,趁着年底,把过去一年多在生产环境中所遇到的一些常见运维操作做个总结。需要说明的是,相关的操作,基本都建立在openstack的官方文档和帮助,所以最好的方式莫过于看官方文档,此处只作为抛砖引玉之用,望须知。


2. 关于keystone

    keystone是openstack中负责认证授权的服务,主要负责两方面的工作:1. 用户认证授权,2.目录catalog服务。总体而言,keystone承担着openstack中的注册表服务,即所有的用户都需要到keystone中注册其信息,所有openstack的服务,都需要将其catalog信息注册到keystone,以方便组件之间相互调用。


3. keystone开放用户

    openstack中最小的资源单位集合是租户,即tenant,tenant是一系列资源的集合,包括计算资源,网络资源和存储资源,tenant一般来说是指公司,部门,或者个人,比如某个公司去申请阿里云,某个部门申请使用内部的openstack私有云资源等等,作为openstack云管理员,为用户开放访问权限,是一项基本的工作。此外tenant会得到一个默认计算的quota,存储的quota以及网络的quota,关于quota的调整,参考后续的博客。如下为创建user的过程,主要分为三个阶段:1.用户创建,2. 租户创建,3. 将用户加入到租户和角色

3.1 创建用户

[root@controller ~]# keystone user-create --name user1 --pass password --email [email protected] --enabled true
+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |        [email protected]         |
| enabled  |               True               |
|    id    | ce398fc13d224c63b9d90b3cc2b6d464 |        #用户的id号
|   name   |              user1               |
| username |              user1               |
+----------+----------------------------------+

查看用户列表:
[root@controller ~]# keystone user-list
+----------------------------------+---------+---------+---------------------+
|                id                |   name  | enabled |        email        |
+----------------------------------+---------+---------+---------------------+
| bc5e46fc4204497185ae3ca6f8b7affb |  admin  |   True  |  [email protected]  |
| ac86694e3053492f921e19aca9c9d646 |  cinder |   True  |  [email protected] |
| 0ed4f1c5af2a496a8d56e256d966ef9d |   demo  |   True  |   [email protected]  |
| 0922aae9b7bf4f80a7811fd0c7db49c6 |  glance |   True  |  [email protected] |
| 053262aa44ce430d91465417f045cead | neutron |   True  | [email protected] |
| b709f56c61114ce78768b34d76d5af90 |   nova  |   True  |   [email protected]  |
| ce398fc13d224c63b9d90b3cc2b6d464 |  user1  |   True  |  [email protected]  |        #刚创建的user,id号,后续需要使用
+----------------------------------+---------+---------+---------------------+

查看用户具体信息:
[root@controller ~]# keystone user-get ce398fc13d224c63b9d90b3cc2b6d464
+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |        [email protected]         |
| enabled  |               True               |
|    id    | ce398fc13d224c63b9d90b3cc2b6d464 |
|   name   |              user1               |
| username |              user1               |
+----------+----------------------------------+

小结: 用户管理相关操作包括:user-create,user-delete,user-update,user-list,user-get即增删改查,以及user-password-update修改用户密码等操作,其他的操作如tenant,role,service和endpoint相类似,举一反三。


3.2 创建租户

[root@controller ~]# keystone tenant-create --name companyA --description "Project For ComputeA" --enabled true           
+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |       Project For ComputeA       |
|   enabled   |               True               |
|      id     | 7ff1dfb5a6f349958c3a949248e56236 |        #tenant的id号,后续使用使用
|     name    |             companyA             |
+-------------+----------------------------------+

查看tenant列表:
[root@controller ~]# keystone tenant-list
+----------------------------------+----------+---------+
|                id                |   name   | enabled |
+----------------------------------+----------+---------+
| 842ab3268a2c47e6a4b0d8774de805ae |  admin   |   True  |
| 7ff1dfb5a6f349958c3a949248e56236 | companyA |   True  |        #刚所创建的tenant
| 10d1465c00d049fab88dec1af0f56b1b |   demo   |   True  |
| 3b57a14f7c354a979c9f62b60f31a331 | service  |   True  |
+----------------------------------+----------+---------+

查看tenant的详细信息:
[root@controller ~]# keystone tenant-get 7ff1dfb5a6f349958c3a949248e56236
+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |       Project For ComputeA       |
|   enabled   |               True               |
|      id     | 7ff1dfb5a6f349958c3a949248e56236 |
|     name    |             companyA             |
+-------------+----------------------------------+

3.3 用户与租户角色关联

查看租户的id号
[root@controller ~]# keystone tenant-list
+----------------------------------+----------+---------+
|                id                |   name   | enabled |
+----------------------------------+----------+---------+
| 842ab3268a2c47e6a4b0d8774de805ae |  admin   |   True  |
| 7ff1dfb5a6f349958c3a949248e56236 | companyA |   True  |        #tenant的id号
| 10d1465c00d049fab88dec1af0f56b1b |   demo   |   True  |
| 3b57a14f7c354a979c9f62b60f31a331 | service  |   True  |
+----------------------------------+----------+---------+

查看角色的id号:
[root@controller ~]# keystone role-list
+----------------------------------+----------+
|                id                |   name   |
+----------------------------------+----------+
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ |                  #_member_角色的id号
| 7b0ceee10fb64960acb2b6f0b9247b4f |  admin   |
+----------------------------------+----------+

查看用户的id号:
[root@controller ~]# keystone user-role-add --user ce398fc13d224c63b9d90b3cc2b6d464 --role 9fe2ff9ee4384b1894a90878d3e92bab --tenant 7ff1dfb5a6f349958c3a949248e56236

查看用户的关联信息:

[root@controller ~]# keystone user-role-list --user user1 --tenant companyA
+----------------------------------+----------+----------------------------------+----------------------------------+
|                id                |   name   |             user_id              |            tenant_id             |
+----------------------------------+----------+----------------------------------+----------------------------------+
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ | ce398fc13d224c63b9d90b3cc2b6d464 | 7ff1dfb5a6f349958c3a949248e56236 |
+----------------------------------+----------+----------------------------------+----------------------------------+


4. 总结

    以上是keystone开放用户的过程,keystone的操作涉及到:user,tenant,role,service和endpoint,每个对象都有相应的增删改查的方法实现,查看keystone的命令即可,如keystone help user-create可以查看到user-create的具体用法。


5. keystone用法附录

[root@controller ~]# keystone -h

usage: keystone [--version] [--timeout ]

                [--os-username ]

                [--os-password ]

                [--os-tenant-name ]

                [--os-tenant-id ] [--os-auth-url ]

                [--os-region-name ]

                [--os-identity-api-version ]

                [--os-token ]

                [--os-endpoint ]

                [--os-cacert ] [--insecure]

                [--os-cert ] [--os-key ] [--os-cache]

                [--force-new-token] [--stale-duration ]

                ...


Pending deprecation: Command-line interface to the OpenStack Identity API.

This CLI is pending deprecation in favor of python-openstackclient. For a

Python library, continue using python-keystoneclient.


Positional arguments:

 

    catalog             List service catalog, possibly filtered by service.

    ec2-credentials-create                                             #兼容于亚马逊的EC2

                        Create EC2-compatible credentials for user per tenant.

    ec2-credentials-delete

                        Delete EC2-compatible credentials.

    ec2-credentials-get

                        Display EC2-compatible credentials.

    ec2-credentials-list

                        List EC2-compatible credentials for a user.   #访问端点endpoint管理

    endpoint-create     Create a new endpoint associated with a service.

    endpoint-delete     Delete a service endpoint.

    endpoint-get        Find endpoint filtered by a specific attribute or

                        service type.

    endpoint-list       List configured service endpoints.

    password-update     Update own password.

    role-create         Create new role.                               #角色role的管理

    role-delete         Delete role.

    role-get            Display role details.

    role-list           List all roles.

    service-create      Add service to Service Catalog.                #服务service的管理

    service-delete      Delete service from Service Catalog.

    service-get         Display service from Service Catalog.

    service-list        List all services in Service Catalog.

    tenant-create       Create new tenant.                             #租户tenant的管理

    tenant-delete       Delete tenant.

    tenant-get          Display tenant details.

    tenant-list         List all tenants.

    tenant-update       Update tenant name, description, enabled status.

    token-get           Display the current user token.

    user-create         Create new user                                #用户user的管理

    user-delete         Delete user.

    user-get            Display user details.

    user-list           List users.

    user-password-update

                        Update user password.

    user-role-add       Add role to user.                           #用户角色和tenant的管理

    user-role-list      List roles granted to a user.

    user-role-remove    Remove role from user.

    user-update         Update user's name, email, and enabled status.

    discover            Discover Keystone servers, supported API versions and

                        extensions.

    bootstrap           Grants a new role to a new user on a new tenant, after

                        creating each.

    bash-completion     Prints all of the commands and options to stdout.

    help                Display help about this program or one of its

                        subcommands.