07-OpenStack-queens版-控制节点keystone认证服务

Centos7安装部署openstack-queens版--Keystone认证服务
1、在安装配置 OpenStack 身份认证服务前，必须创建一个数据库和管理员令牌
[root@controller ~]# mysql -u root -p #以root用户身份是数据库访问客户端，连接到数据库服务器
Enter password:
MariaDB [(none)]> CREATE DATABASE keystone; #创建名称为keystone数据库
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'whj1218' ;# 授予来自本地的keystone账户全部权限
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'whj1218';#授予来自任何地址的keystone账户全部权限
MariaDB [(none)]> show databases; #查看数据库
+--------------------+
| Database |
+--------------------+
| information_schema |
| keystone |
| mysql |
| performance_schema |
+--------------------+
MariaDB [(none)]> quit #退出

---

2、安装和配置keystone及相关组件
①安装相关软件包
[root@controller ]#yum install openstack-keystone httpd mod_wsgi -y #mod_wsgi提供http服务与python之间的连接
[root@controller ]#yum install openstack-keystone python-keystoneclient openstack-utils -y#openstack-utils快速配置工具
②快速修改keystone配置，使用的快速配置方法需要安装Openstack-utils才可以实现
[root@controller ~]# openstack-config --set /etc/keystone/keystone.conf database connection mysql+pymysql://keystone:whj1218@controller/keystone #用户名：密码@服务器地址/数据库
[root@controller ~]# openstack-config --set /etc/keystone/keystone.conf token provider fernet
[root@controller ~]# egrep -v "^#|$" /etc/keystone/keystone.conf #查看生效的配置，除去注释和空格
③初始化同步keystone数据库
[root@controller ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone #同步keystone数据库
[root@controller ~]# mysql -h192.168.136.134 -ukeystone -pwhj1218 -e "use keystone;show tables;" #同步完成进行连接测，保证所有需要的表已经建立，否则后面可能无法进行下去试 -u用户名 -p密码
+------------------------------------+
| Tables_in_keystone |
+------------------------------------+
| access_rule |
| access_token |
| application_credential |
| application_credential_access_rule |
| application_credential_role |
| assignment |
| config_register |
.............
[root@controller ~]# mysql -h192.168.136.134 -ukeystone -pwhj1218 -e "use keystone;show tables;" |wc -l #统计有48张表
49
④初始化Fernet令牌库 keystone对自己授权的一个过程，创建一个keystone用户与一个keystone组，并对这个用户和组授权
[root@controller ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
[root@controller ~]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
⑤配置启动Apache（httpd）
[root@controller ~]# echo "ServerName controller" >> /etc/httpd/conf/httpd.conf #利用重定向修改httpd主配置文件
[root@controller ~]# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/ #创建keystone虚拟主机配置文件的快捷方式，做成软链接
[root@controller ~]# systemctl start httpd.service
[root@controller ~]# systemctl status httpd.service
[root@controller ~]# netstat -anptl|grep httpd
tcp6 0 0 :::5000 :::* LISTEN 4945/httpd
tcp6 0 0 :::80 :::* LISTEN 4945/httpd
[root@controller ~]# systemctl enable httpd.service
⑥初始化keystone认证服务
[root@controller ~]# keystone-manage bootstrap --bootstrap-password whj1218 \ #ADMIN_PASS密码为whj1218
--bootstrap-admin-url http://controller:5000/v3/
--bootstrap-internal-url http://controller:5000/v3/
--bootstrap-public-url http://controller:5000/v3/
--bootstrap-region-id RegionOne

需要创建一个密码ADMIN_PASS，作为登陆openstack的管理员用户，这里创建为whj1218

⑦临时配置管理员账户的相关变量进行管理
[root@controller ~]# export OS_PROJECT_DOMAIN_NAME=Default
[root@controller ~]# export OS_PROJECT_NAME=admin
[root@controller ~]# export OS_USER_DOMAIN_NAME=Default
[root@controller ~]# export OS_USERNAME=admin
[root@controller ~]# export OS_PASSWORD=whj1218 #这里的export OS_PASSWORD要使用上面配置的ADMIN_PASS
[root@controller ~]# export OS_AUTH_URL=http://controller:5000/v3
[root@controller ~]# export OS_IDENTITY_API_VERSION=3
[root@controller ~]# env | grep OS_ #查看声明的变量
OS_USER_DOMAIN_NAME=Default
OS_PROJECT_NAME=admin
OS_IDENTITY_API_VERSION=3
OS_PASSWORD=whj1218
OS_AUTH_URL=http://controller:5000/v3
OS_USERNAME=admin
OS_PROJECT_DOMAIN_NAME=Default
至此keystone认证服务配置完成。

---

常用的openstack管理命令，需要应用管理员的环境变量
查看keystone实例相关信息
[root@controller ~]# openstack endpoint list
+----------------------------------+-----------+--------------+--------------+---------+-----------+----------------------------+
| ID | Region | Service Name | Service Type | Enabled | Interface | URL |
+----------------------------------+-----------+--------------+--------------+---------+-----------+----------------------------+
| bcbf96c2a7d54d1181d75e752eb1642d | RegionOne | keystone | identity | True | internal | http://controller:5000/v3/ |
| d41a39b417964676b6cfea658a7f3d01 | RegionOne | keystone | identity | True | admin | http://controller:5000/v3/ |
| f25f1eab7c8b4c4489f1c84234be9912 | RegionOne | keystone | identity | True | public | http://controller:5000/v3/ |
+----------------------------------+-----------+--------------+--------------+---------+-----------+----------------------------+
[root@controller ~]# openstack project list
+----------------------------------+-------+
| ID | Name |
+----------------------------------+-------+
| 705ac96bcde14628b64e92c0d124825c | admin |
+----------------------------------+-------+

---

3、创建keystone的一般实例
1）创建一个名为example的keystone域
[root@controller ~]# openstack domain create --description "An Example Domain" example #在project表中创建名为example的项目
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | An Example Domain |
| enabled | True |
| id | 75403e40df574846a19e3c131debe385 |
| name | example |
| options | {} |
| tags | [] |
+-------------+----------------------------------+
2）为keystone系统环境创建名为service的项目提供服务
[root@controller ~]# openstack project create --domain default --description "Service Project" service#在project表中创建名为service的项目
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Service Project |
| domain_id | default |
| enabled | True |
| id | 155cc812ad054ff798abc95ca3aa0317 |
| is_domain | False |
| name | service |
| options | {} |
| parent_id | default |
| tags | [] |
+-------------+----------------------------------+
3）创建myproject项目和对应的用户及角色
[root@controller ~]# openstack project create --domain default --description "Demo Project" myproject #在project表中创建名为myproject项目
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Demo Project |
| domain_id | default |
| enabled | True |
| id | 82d091f3306344d4b240e5e66b6f0b64 |
| is_domain | False |
| name | myproject |
| options | {} |
| parent_id | default |
| tags | [] |
+-------------+----------------------------------+
4）在默认域创建myuser用户
[root@controller ~]# openstack user create --domain default --password=myuser myuser # 直接创建用户和密码，使用--password选项为直接配置明文密码
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | 9c1f982fc354433dbea4d060681619bf |
| name | myuser |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
[root@controller ~]# openstack user create --domain default --password-prompt my_user ## 交互式输入密码
，使用--password-prompt选项为交互式输入密码
User Password:
Repeat User Password:
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | 0356c4d61dcf4afb9d8df45c1dea3ffc |
| name | my_user |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
5）在role表创建myrole角色
[root@controller ~]# openstack role create myrole
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | None |
| domain_id | None |
| id | e5aa58dcd4904ed2a4fb001df90d1477 |
| name | myrole |
| options | {} |
+-------------+----------------------------------+
6）将myrole角色添加到myproject项目中和myuser用户组中
[root@controller ~]# openstack role add --project myproject --user myuser myrole #无返回信息

---

4、验证操作keystone是否安装成功
1）去除环境变量

关闭临时认证令牌机制，获取 token，验证keystone配置成功

[root@controller ~]# unset OS_AUTH_URL OS_PASSWORD #去除OS_AUTH_URL OS_PASSWORD这2个环境变量
[root@controller ~]# env | grep OS_
OS_USER_DOMAIN_NAME=Default
OS_PROJECT_NAME=admin
OS_IDENTITY_API_VERSION=3
OS_USERNAME=admin
OS_PROJECT_DOMAIN_NAME=Default
2）作为管理员用户去请求一个认证的token

测试是否可以使用admin账户进行登陆认证，请求认证令牌

[root@controller ~]# openstack --os-auth-url http://controller:5000/v3 \

--os-project-domain-name Default --os-user-domain-name Default
--os-project-name admin --os-username admin token issue
Password: #为admin的密码whj1218
Password:
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires | 2020-07-30T09:08:50+0000 |
| id | gAAAAABfIoASFGZCxWrel80Fzf3KVyTelbCXF4Ooav4z_GDmtFfQoNJGR8pIrfPYkjTDez-lWoA04FQALogU5Enpu9zYnKMYX3Gm4LB4E3L6MhrBpcw9Z_wFJPqXW8BOs_qwZdrgqO7t0c67oNCP6Q8ub1Sce8SemyR55F1emZG-tTwdUAF-Bl0 |
| project_id | 705ac96bcde14628b64e92c0d124825c |
| user_id | 4640a445474e44abba73328aa81a805b |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
3）使用普通用户获取认证token
使用”myuser“用户的密码和API端口5000，只允许对身份认证服务API的常规（非管理）访问
[root@controller ~]openstack --os-auth-url http://controller:5000/v3
--os-project-domain-name Default --os-user-domain-name Default
--os-project-name myproject --os-username myuser token issue
.........

---

5、创建OpenStack客户端环境脚本
1）创建admin用户的环境管理脚本
[root@controller ~]# vim keystone-admin-pass.sh
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=whj1218
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
[root@controller ~]# env |grep OS_ #查看声明变量
[root@controller ~]# source keystone-admin-pass.sh 使用脚本加载相关客户端环境变量配置
[root@controller ~]# openstack token issue #请求认证令牌
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires | 2020-07-30T09:21:45+0000 |
| id | gAAAAABfIoMZAZ7SOVz0xb13YQFFFBuB8Ve3ACzQZzZX_Xgs0IuZHj-_aBzHtFiMffiGbHEsWZGR92zdrM6_m5WxZsDuSIINNUMDzqGvJTyvH_74ZfkspER1yLYt9BJuCdQ7v470Djo4gS_cPggRgw7OQvSvDZDzX9UjgLxOVxuScrrf705Bn04 |
| project_id | 705ac96bcde14628b64e92c0d124825c |
| user_id | 4640a445474e44abba73328aa81a805b |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
可以看到user_id和上面用命令获取到的是一样的，说明配置成功