openstack学习-KeyStone安装（二）

一、安装keystone

# yum install -y openstack-keystone httpd mod_wsgi memcached python-memcached

二、设置Memcache开启启动并启动Memcached

[root@linux-node1 ~]# systemctl enable memcached.service
[root@linux-node1 ~]# vim /etc/sysconfig/memcached
PORT=""
USER="memcached"
MAXCONN=""
CACHESIZE=""
OPTIONS="-l 192.168.56.11,::1"
[root@linux-node1 ~]# systemctl start memcached.service

三、Keystone配置

1、配置KeyStone数据库

[root@linux-node1 ~]# vim /etc/keystone/keystone.conf
[database]
connection = mysql+pymysql://keystone:keystone@192.168.56.11/keystone

2、设置Token和Memcached

[token]
provider = fernet

3、同步数据库

[root@linux-node1 ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone
[root@linux-node1 ~]# mysql -h 192.168.56.11 -ukeystone -pkeystone -e " use keystone;show tables;"

4、初始化fernet keys

[root@linux-node1 ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
[root@linux-node1 ~]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

5、初始化keystone

[root@linux-node1 ~]# keystone-manage bootstrap --bootstrap-password admin \
 --bootstrap-admin-url http://192.168.56.11:35357/v3/ \
 --bootstrap-internal-url http://192.168.56.11:35357/v3/ \
 --bootstrap-public-url http://192.168.56.11:5000/v3/ \
 --bootstrap-region-id RegionOne

6、验证Keystone修改的配置

[root@linux-node1 ~]# grep "^[a-z]" /etc/keystone/keystone.conf
connection = mysql+pymysql://keystone:keystone@192.168.56.11/keystone
provider = fernet

7、修改httpd配置

[root@linux-node1 ~]vi/etc/httpd/conf/httpd.conf

ServerName 192.168.56.11:

8、创建软连接

[root@linux-node1 ~]# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

四、启动Keystone

[root@linux-node1 ~]# systemctl enable httpd.service
[root@linux-node1 ~]# systemctl start httpd.service

五、设置环境变量

[root@linux-node1 ~]# export OS_USERNAME=admin
[root@linux-node1 ~]# export OS_PASSWORD=admin
[root@linux-node1 ~]# export OS_PROJECT_NAME=admin
[root@linux-node1 ~]# export OS_USER_DOMAIN_NAME=Default
[root@linux-node1 ~]# export OS_PROJECT_DOMAIN_NAME=Default
[root@linux-node1 ~]# export OS_AUTH_URL=http://192.168.56.11:35357/v3
[root@linux-node1 ~]# export OS_IDENTITY_API_VERSION=

六、创建项目和demo用户

# openstack project create --domain default --description "Demo Project" demo  --创建一个demo的项目
# openstack user create --domain default --password demo demo   --创建一个用户为demo 密码为demo的用户
# openstack role create user    --创建一个角色为user
# openstack role add --project demo --user demo user  --把demo的用户加入到demo的项目中并赋予user角色

七、创建Service项目

openstack project create --domain default --description "Service Project" service  --创建一个服务的项目为service

八、用户创建

1、创建glance用户

# openstack user create --domain default --password glance glance --创建一个glance用户，密码为glance
# openstack role add --project service --user glance admin  --把glance用户加入到service这个服务项目中，并授予admin角色

2、创建nova用户

# openstack user create --domain default --password nova nova  --创建一个nova用户，密码为nova

# openstack role add --project service --user nova admin  --把nova用户加入到service这个服务项目中，并授予admin角色

3、创建placement用户

# openstack user create --domain default --password placement placement --创建一个placement用户，密码为placement

# openstack role add --project service --user placement admin --把placement用户加入到service这个服务项目中，并授予admin角色

4、创建Neutron用户

# openstack user create --domain default --password neutron neutron --创建一个neutron用户，密码为neutron

# openstack role add --project service --user neutron admin--把neutron用户加入到service这个服务项目中，并授予admin角色

5、创建cinder用户（本次用不到）

# openstack user create --domain default --password cinder cinder
# openstack role add --project service --user cinder admin

九、验证Keystone

[root@linux-node1 ~]# unset OS_AUTH_URL OS_PASSWORD  ##清除环境变量
[root@linux-node1 ~]# openstack --os-auth-url http://192.168.56.11:35357/v3 \
--os-project-domain-name default --os-user-domain-name default \
--os-project-name admin --os-username admin token issue
Password:
…
[root@linux-node1 ~]# openstack --os-auth-url http://192.168.56.11:5000/v3 \
--os-project-domain-name default --os-user-domain-name default \
--os-project-name demo --os-username demo token issue
Password:

十、环境变量脚本

[root@linux-node1 ~]# vim /root/admin-openstack.sh
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_AUTH_URL=http://192.168.56.11:35357/v3
export OS_IDENTITY_API_VERSION=
export OS_IMAGE_API_VERSION=

[root@linux-node1 ~]# vim /root/demo-openstack.sh
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo
export OS_AUTH_URL=http://192.168.56.11:5000/v3
export OS_IDENTITY_API_VERSION=
export OS_IMAGE_API_VERSION=

十一、验证

[root@linux-node1 ~]# source admin-openstack.sh
[root@linux-node1 ~]#
[root@linux-node1 ~]# openstack token issue
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field      | Value                                                                                                                                                                                   |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires    | --22T15::+                                                                                                                                                                |
| id         | gAAAAABb9r8wqBesfIryKdPAzcskX7G1X3g6pA75zpWxQgp8YnDSCoVBgN9GQ9PJak9UnIX_KLCEUH2IuMQ2fqZBkbwrCxNnjDuMJo5LeGczOhlgUG3hsDV3jpJrtu1j9Q8po4cL9Kx48D8nKlpXG4OhJ4s0VCx2g3ZiTmevQKzgLdGsN32ejKI |
| project_id | 41501647e47f4eb3880b17ef9776e2c1                                                                                                                                                        |
| user_id    | 320ded70f6ea46c0bd640f7b7802d7de                                                                                                                                                        |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
[root@linux-node1 ~]#
[root@linux-node1 ~]# source demo-openstack.sh
[root@linux-node1 ~]# openstack token issue
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field      | Value                                                                                                                                                                                   |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires    | --22T15::+                                                                                                                                                                |
| id         | gAAAAABb9r9OsescK3fKptK0tF3FX6YRcFY1XPOEwDCVEV7yjgiGCoShLJYvewatNVtoJr3ebp4IjAy0lg7Bjd4zic-nVjUIzvaU2fIBYWbw1au2EMcwfFQIR5mSJ_0f3Th5Ts12SQKTHMZdD7NTTJjVu_Ym3yzNm8agDkmB6Gdi-oKLveH5oVQ |
| project_id | 61a918afeae24861ae08d0944737890c                                                                                                                                                        |
| user_id    | f3922f1b44e3483995e23aaf855161c0                                                                                                                                                        |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
[root@linux-node1 ~]#
[root@linux-node1 ~]# openstack  user list
You are not authorized to perform the requested action: identity:list_users. (HTTP ) (Request-ID: req-0aee9c60-f277-4abe-905d-72ef59609b17)
[root@linux-node1 ~]#
[root@linux-node1 ~]# source admin-openstack.sh
[root@linux-node1 ~]#
[root@linux-node1 ~]# openstack  user list
+----------------------------------+-----------+
| ID                               | Name      |
+----------------------------------+-----------+
| 2bb9ce88ae5649b58a2879e53bf60017 | glance    |
| 320ded70f6ea46c0bd640f7b7802d7de | admin     |
| 36d1834f4a524e4383068e193b042a0b | neutron   |
| 7fedca53c5bc42cebc396b5b690968d4 | nova      |
| f120f4c6fa074e76a2367b7b103b6c6f | placement |
| f3922f1b44e3483995e23aaf855161c0 | demo      |
+----------------------------------+-----------+
[root@linux-node1 ~]#
[root@linux-node1 ~]#
[root@linux-node1 ~]# openstack  role  list
+----------------------------------+-------+
| ID                               | Name  |
+----------------------------------+-------+
| aef5b0e9aca441c5aaaff560b15e2a46 | user  |
| c4229971a0834e629dcb69dc7a0b10cd | admin |
+----------------------------------+-------+
[root@linux-node1 ~]#
[root@linux-node1 ~]# openstack  project  list
+----------------------------------+---------+
| ID                               | Name    |
+----------------------------------+---------+
| 41501647e47f4eb3880b17ef9776e2c1 | admin   |
| 61a918afeae24861ae08d0944737890c | demo    |
| 6d0619edd470440abea5805ff47b4f1a | service |
+----------------------------------+---------+
[root@linux-node1 ~]#
[root@linux-node1 ~]# openstack  service  list
+----------------------------------+-----------+-----------+
| ID                               | Name      | Type      |
+----------------------------------+-----------+-----------+
| 7a75ea530f2d4af59e3ab423bd47a11b | keystone  | identity  |
+----------------------------------+-----------+-----------+
[root@linux-node1 ~]#
[root@linux-node1 ~]#
[root@linux-node1 ~]# openstack  endpoint  list
+----------------------------------+-----------+--------------+--------------+---------+-----------+--------------------------------+
| ID                               | Region    | Service Name | Service Type | Enabled | Interface | URL                            |
+----------------------------------+-----------+--------------+--------------+---------+-----------+--------------------------------+
| 6024f4be849d465e8201b1ab645a9b22 | RegionOne | keystone     | identity     | True    | admin     | http://192.168.56.11:35357/v3/ |
| cf6060b1424746d4bd0982229fe0a9c8 | RegionOne | keystone     | identity     | True    | public    | http://192.168.56.11:5000/v3/  |
| f70a576ffe2e4a008c0c05461ba7c3f5 | RegionOne | keystone     | identity     | True    | internal  | http://192.168.56.11:35357/v3/ |
+----------------------------------+-----------+--------------+--------------+---------+-----------+--------------------------------+

如果用户和密码写错了，就需要删除了重新创建，可以查看帮组信息 openstack   user --help

openstack  user  delete  用户的id

同理role、project、service、endpoint都是同样操作