openstack运维实战系列(一)之keystone用户建立
1. 前言
在生产环境中，使用openstack已经有1年多的时间了，苦于一直没有时间，加上工作带来的懒惰，一直迟迟没有对openstack方面的知识做个总结，趁着年底，把过去一年多在生产环境中所遇到的一些常见运维操作做个总结。需要说明的是，相关的操作，基本都建立在openstack的官方文档和帮助，所以最好的方式莫过于看官方文档，此处只作为抛砖引玉之用，望须知。
2. 关于keystone
keystone是openstack中负责认证授权的服务，主要负责两方面的工作：1. 用户认证授权，2.目录catalog服务。总体而言，keystone承担着openstack中的注册表服务，即所有的用户都需要到keystone中注册其信息，所有openstack的服务，都需要将其catalog信息注册到keystone，以方便组件之间相互调用。
3. keystone开放用户
openstack中最小的资源单位集合是租户，即tenant，tenant是一系列资源的集合，包括计算资源，网络资源和存储资源，tenant一般来说是指公司，部门，或者个人，比如某个公司去申请阿里云，某个部门申请使用内部的openstack私有云资源等等，作为openstack云管理员，为用户开放访问权限，是一项基本的工作。此外tenant会得到一个默认计算的quota，存储的quota以及网络的quota，关于quota的调整，参考后续的博客。如下为创建user的过程，主要分为三个阶段：1.用户创建，2. 租户创建，3. 将用户加入到租户和角色
3.1 创建用户
[root@controller ~]# keystone user-create --name user1 --pass password --email [email protected] --enabled true +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | email | [email protected] | | enabled | True | | id | ce398fc13d224c63b9d90b3cc2b6d464 | #用户的id号 | name | user1 | | username | user1 | +----------+----------------------------------+ 查看用户列表: [root@controller ~]# keystone user-list +----------------------------------+---------+---------+---------------------+ | id | name | enabled | email | +----------------------------------+---------+---------+---------------------+ | bc5e46fc4204497185ae3ca6f8b7affb | admin | True | [email protected] | | ac86694e3053492f921e19aca9c9d646 | cinder | True | [email protected] | | 0ed4f1c5af2a496a8d56e256d966ef9d | demo | True | [email protected] | | 0922aae9b7bf4f80a7811fd0c7db49c6 | glance | True | [email protected] | | 053262aa44ce430d91465417f045cead | neutron | True | [email protected] | | b709f56c61114ce78768b34d76d5af90 | nova | True | [email protected] | | ce398fc13d224c63b9d90b3cc2b6d464 | user1 | True | [email protected] | #刚创建的user,id号，后续需要使用 +----------------------------------+---------+---------+---------------------+ 查看用户具体信息: [root@controller ~]# keystone user-get ce398fc13d224c63b9d90b3cc2b6d464 +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | email | [email protected] | | enabled | True | | id | ce398fc13d224c63b9d90b3cc2b6d464 | | name | user1 | | username | user1 | +----------+----------------------------------+
小结: 用户管理相关操作包括:user-create,user-delete,user-update,user-list,user-get即增删改查，以及user-password-update修改用户密码等操作，其他的操作如tenant，role，service和endpoint相类似，举一反三。
3.2 创建租户
[root@controller ~]# keystone tenant-create --name companyA --description "Project For ComputeA" --enabled true +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Project For ComputeA | | enabled | True | | id | 7ff1dfb5a6f349958c3a949248e56236 | #tenant的id号，后续使用使用 | name | companyA | +-------------+----------------------------------+ 查看tenant列表: [root@controller ~]# keystone tenant-list +----------------------------------+----------+---------+ | id | name | enabled | +----------------------------------+----------+---------+ | 842ab3268a2c47e6a4b0d8774de805ae | admin | True | | 7ff1dfb5a6f349958c3a949248e56236 | companyA | True | #刚所创建的tenant | 10d1465c00d049fab88dec1af0f56b1b | demo | True | | 3b57a14f7c354a979c9f62b60f31a331 | service | True | +----------------------------------+----------+---------+ 查看tenant的详细信息: [root@controller ~]# keystone tenant-get 7ff1dfb5a6f349958c3a949248e56236 +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Project For ComputeA | | enabled | True | | id | 7ff1dfb5a6f349958c3a949248e56236 | | name | companyA | +-------------+----------------------------------+
3.3 用户与租户角色关联
查看租户的id号 [root@controller ~]# keystone tenant-list +----------------------------------+----------+---------+ | id | name | enabled | +----------------------------------+----------+---------+ | 842ab3268a2c47e6a4b0d8774de805ae | admin | True | | 7ff1dfb5a6f349958c3a949248e56236 | companyA | True | #tenant的id号 | 10d1465c00d049fab88dec1af0f56b1b | demo | True | | 3b57a14f7c354a979c9f62b60f31a331 | service | True | +----------------------------------+----------+---------+ 查看角色的id号： [root@controller ~]# keystone role-list +----------------------------------+----------+ | id | name | +----------------------------------+----------+ | 9fe2ff9ee4384b1894a90878d3e92bab | _member_ | #_member_角色的id号 | 7b0ceee10fb64960acb2b6f0b9247b4f | admin | +----------------------------------+----------+ 查看用户的id号： [root@controller ~]# keystone user-role-add --user ce398fc13d224c63b9d90b3cc2b6d464 --role 9fe2ff9ee4384b1894a90878d3e92bab --tenant 7ff1dfb5a6f349958c3a949248e56236 查看用户的关联信息： [root@controller ~]# keystone user-role-list --user user1 --tenant companyA +----------------------------------+----------+----------------------------------+----------------------------------+ | id | name | user_id | tenant_id | +----------------------------------+----------+----------------------------------+----------------------------------+ | 9fe2ff9ee4384b1894a90878d3e92bab | _member_ | ce398fc13d224c63b9d90b3cc2b6d464 | 7ff1dfb5a6f349958c3a949248e56236 | +----------------------------------+----------+----------------------------------+----------------------------------+
4. 总结
以上是keystone开放用户的过程，keystone的操作涉及到:user,tenant,role,service和endpoint，每个对象都有相应的增删改查的方法实现，查看keystone的命令即可，如keystone help user-create可以查看到user-create的具体用法。
5. keystone用法附录
[root@controller ~]# keystone -h
usage: keystone [--version] [--timeout <seconds>]
[--os-username <auth-user-name>]
[--os-password <auth-password>]
[--os-tenant-name <auth-tenant-name>]
[--os-tenant-id <tenant-id>] [--os-auth-url <auth-url>]
[--os-region-name <region-name>]
[--os-identity-api-version <identity-api-version>]
[--os-token <service-token>]
[--os-endpoint <service-endpoint>]
[--os-cacert <ca-certificate>] [--insecure]
[--os-cert <certificate>] [--os-key <key>] [--os-cache]
[--force-new-token] [--stale-duration <seconds>]
<subcommand> ...
Pending deprecation: Command-line interface to the OpenStack Identity API.
This CLI is pending deprecation in favor of python-openstackclient. For a
Python library, continue using python-keystoneclient.
Positional arguments:
<subcommand>
catalog List service catalog, possibly filtered by service.
ec2-credentials-create #兼容于亚马逊的EC2
Create EC2-compatible credentials for user per tenant.
ec2-credentials-delete
Delete EC2-compatible credentials.
ec2-credentials-get
Display EC2-compatible credentials.
ec2-credentials-list
List EC2-compatible credentials for a user. #访问端点endpoint管理
endpoint-create Create a new endpoint associated with a service.
endpoint-delete Delete a service endpoint.
endpoint-get Find endpoint filtered by a specific attribute or
service type.
endpoint-list List configured service endpoints.
password-update Update own password.
role-create Create new role. #角色role的管理
role-delete Delete role.
role-get Display role details.
role-list List all roles.
service-create Add service to Service Catalog. #服务service的管理
service-delete Delete service from Service Catalog.
service-get Display service from Service Catalog.
service-list List all services in Service Catalog.
tenant-create Create new tenant. #租户tenant的管理
tenant-delete Delete tenant.
tenant-get Display tenant details.
tenant-list List all tenants.
tenant-update Update tenant name, description, enabled status.
token-get Display the current user token.
user-create Create new user #用户user的管理
user-delete Delete user.
user-get Display user details.
user-list List users.
user-password-update
Update user password.
user-role-add Add role to user. #用户角色和tenant的管理
user-role-list List roles granted to a user.
user-role-remove Remove role from user.
user-update Update user's name, email, and enabled status.
discover Discover Keystone servers, supported API versions and
extensions.
bootstrap Grants a new role to a new user on a new tenant, after
creating each.
bash-completion Prints all of the commands and options to stdout.
help Display help about this program or one of its
subcommands.
本文出自 “Happy实验室” 博客，转载请与作者联系！