# yum install -y openstack-keystone httpd mod_wsgi

# mysql -u root -p -e "CREATE DATABASE keystone "

MariaDB [(none)]> CREATE DATABASE keystone;

Query OK, 1 row affected (0.03 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \

IDENTIFIED BY 'zoomtech';

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \

->   IDENTIFIED BY 'zoomtech';

Query OK, 0 rows affected (0.01 sec)

MariaDB [(none)]> exit

Bye

[root@controller1 ~]# mysql -uroot -p -e "CREATE DATABASE keystone"

[root@controller1 ~]# mysql -uroot -p -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%'  IDENTIFIED BY 'zoomtech'"

[root@controller1 ~]# mysql -uroot -p -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost'  IDENTIFIED BY 'zoomtech'"

[root@controller1 ~]# openssl rand -hex 10

d68d8a32a75bdbfdb004

配置/etc/keystone/keystone.conf文件

[DEFAULT]

verbose = true

admin_token = 745faaa51f7c62f8a2a7

public_bind_host = 192.168.17.132

admin_bind_host = 192.168.17.132

bind_host = controller1

[database]

connection = mysql+pymysql://keystone:zoomtech@demo.open-stack.cn/keystone

[token]

provider = keystone.token.providers.uuid.Provider

dirver = keystone.token.persistence.backends.memcach.Token

caching = true

token = keystone.auth.plugins.token.Token

[revoke]

driver = keystone.contrib.revoke.backends.sql.Revoke

[identity]

driver = sql

#driver = keystone.identity.backends.sql.identity

[catalog]

driver = sql

#driver = keystone.catalog.backends.sql.Catalog

[memcache]

servers = controller1:11211,controller2:11211,controller3:11211

[root@controller1 ~]# openstack-config --set /etc/keystone/keystone.conf DEFAULT admin_token d68d8a32a75bdbfdb004

[root@controller1 ~]# openstack-config --set /etc/keystone/keystone.conf database connection mysql+pymysql://keystone:zoomtech@demo.open-stack.cn/keystone

[root@controller1 ~]# openstack-config --set /etc/keystone/keystone.conf token provider fernet

[root@controller1 ~]# openstack-config --set /etc/keystone/keystone.conf memcache servers controller1:11211,controller2:11211,controller3:11211

[root@controller1 ~]# scp /etc/keystone/keystone.conf controller2:/etc/keystone/

keystone.conf                                                          100%   72KB  71.9KB/s   00:00

[root@controller1 ~]# scp /etc/keystone/keystone.conf controller3:/etc/keystone/

[root@controller2 ~]# vim /etc/keystone/keystone.conf

admin_token = 745faaa51f7c62f8a2a7

public_bind_host = 192.168.17.151

bind_host = controller2

admin_bind_host = 192.168.17.151

[root@controller3 ~]# vim /etc/keystone/keystone.conf

[default]

public_bind_host = 192.168.17.138

bind_host = controller3

admin_bind_host = 192.168.17.138

确认权限

[root@controller1 ~]# ll /etc/keystone/keystone.conf

-rw-r----- 1 root keystone 73642 Feb 21 15:42 /etc/keystone/keystone.conf

[root@controller1 ~]# chown root:keystone /etc/keystone/keystone.conf

[root@controller1 ~]# chmod 640 /etc/keystone/keystone.conf

同步Keystone数据库

[root@controller1 ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone

初始化Fernet keys

[root@controller1 ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

配置Apache Http服务

1、三个节点配置 /etc/httpd/conf/httpd.conf

[root@controller1 ~] # vim /etc/httpd/conf/httpd.conf

ServerName controller1

Listen 8080

[root@controller2 ~]# vim /etc/httpd/conf/httpd.conf

ServerName controller2

Listen 8080

[root@controller3 ~]# vim /etc/httpd/conf/httpd.conf

ServerName controller3

Listen 8080

2、[root@controller1 ~]# vim /etc/httpd/conf.d/wsgi-keystone.conf

<VirtualHost *:5000>

WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}

WSGIProcessGroup keystone-public

WSGIScriptAlias / /usr/bin/keystone-wsgi-public

WSGIApplicationGroup %{GLOBAL}

WSGIPassAuthorization On

ErrorLogFormat "%{cu}t %M"

ErrorLog /var/log/httpd/keystone-error.log

CustomLog /var/log/httpd/keystone-access.log combined

<Directory /usr/bin>

Require all granted

</Directory>

</VirtualHost>

<VirtualHost *:35357>

WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}

WSGIProcessGroup keystone-admin

WSGIScriptAlias / /usr/bin/keystone-wsgi-admin

WSGIApplicationGroup %{GLOBAL}

WSGIPassAuthorization On

ErrorLogFormat "%{cu}t %M"

ErrorLog /var/log/httpd/keystone-error.log

CustomLog /var/log/httpd/keystone-access.log combined

<Directory /usr/bin>

Require all granted

</Directory>

</VirtualHost>

将wsgi-keystone.conf复制到 controller2和controller3

3、启动apache

# systemctl enable httpd.service

# systemctl start httpd.service

[root@controller1 ~]# export OS_TOKEN=d68d8a32a75bdbfdb004

[root@controller1 ~]# export OS_URL=http://demo.open-stack.cn:35357/v3

[root@controller1 ~]# export OS_IDENTITY_API_VERSION=3

创建服务实体和身份认证服务:

[root@controller1 ~]# openstack service create   --name keystone --description "OpenStack Identity" identity

+-------------+----------------------------------+

| Field       | Value                            |

+-------------+----------------------------------+

| description | OpenStack Identity               |

| enabled     | True                             |

| id          | 5fe30200d9464aa384b5ddc1864b0244 |

| name        | keystone                         |

| type        | identity                         |

+-------------+----------------------------------+

error:

Unable to establish connection to http://demo.open-stack.cn:35357/v3/services

创建认证服务的 API 端点:

[root@controller1 ~]# openstack endpoint create --region RegionOne \

identity public http://demo.open-stack.cn:5000/v3

+--------------+-----------------------------------+

| Field        | Value                             |

+--------------+-----------------------------------+

| enabled      | True                              |

| id           | 527cfe77e4d64668ae4c5a92f5841607  |

| interface    | public                            |

| region       | RegionOne                         |

| region_id    | RegionOne                         |

| service_id   | 5fe30200d9464aa384b5ddc1864b0244  |

| service_name | keystone                          |

| service_type | identity                          |

| url          | http://demo.open-stack.cn:5000/v3 |

+--------------+-----------------------------------+

[root@controller1 ~]# openstack endpoint create --region RegionOne   identity internal http://demo.open-stack.cn:5000/v3

+--------------+-----------------------------------+

| Field        | Value                             |

+--------------+-----------------------------------+

| enabled      | True                              |

| id           | 9ecf73dab7c9481b9bb6976be271e93c  |

| interface    | internal                          |

| region       | RegionOne                         |

| region_id    | RegionOne                         |

| service_id   | 5fe30200d9464aa384b5ddc1864b0244  |

| service_name | keystone                          |

| service_type | identity                          |

| url          | http://demo.open-stack.cn:5000/v3 |

+--------------+-----------------------------------+

[root@controller1 ~]# openstack endpoint create --region RegionOne   identity admin http://demo.open-stack.cn:35357/v3

+--------------+------------------------------------+

| Field        | Value                              |

+--------------+------------------------------------+

| enabled      | True                               |

| id           | 4606f3b199a14167a9ebe76a0bda45f3   |

| interface    | admin                              |

| region       | RegionOne                          |

| region_id    | RegionOne                          |

| service_id   | 5fe30200d9464aa384b5ddc1864b0244   |

| service_name | keystone                           |

| service_type | identity                           |

| url          | http://demo.open-stack.cn:35357/v3 |

+--------------+------------------------------------+

[root@controller1 ~]# openstack domain create --description "Default Domain" default

+-------------+----------------------------------+

| Field       | Value                            |

+-------------+----------------------------------+

| description | Default Domain                   |

| enabled     | True                             |

| id          | 6fb0271bda4d459ab05a752b7708dee3 |

| name        | default                          |

+-------------+----------------------------------+

[root@controller1 ~]# openstack project create --domain default \

--description "Admin Project" admin

+-------------+----------------------------------+

| Field       | Value                            |

+-------------+----------------------------------+

| description | Admin Project                    |

| domain_id   | 6fb0271bda4d459ab05a752b7708dee3 |

| enabled     | True                             |

| id          | b81fade4255149c29aa53b87312f60de |

| is_domain   | False                            |

| name        | admin                            |

| parent_id   | 6fb0271bda4d459ab05a752b7708dee3 |

+-------------+----------------------------------+

[root@controller1 ~]# openstack user create --domain default \

--password-prompt admin

User Password:

Repeat User Password:

+-----------+----------------------------------+

| Field     | Value                            |

+-----------+----------------------------------+

| domain_id | 6fb0271bda4d459ab05a752b7708dee3 |

| enabled   | True                             |

| id        | e88caafd2c874b6ab4bc23d8b5fbf422 |

| name      | admin                            |

+-----------+----------------------------------+

[root@controller1 ~]# openstack role create admin

+-----------+----------------------------------+

| Field     | Value                            |

+-----------+----------------------------------+

| domain_id | None                             |

| id        | cb618462ef4a4479a7c0b611d3ead7ed |

| name      | admin                            |

+-----------+----------------------------------+

[root@controller1 ~]# openstack role add --project admin --user admin admin

创建Service

[root@controller1 ~]# openstack project create --domain default \

--description "Service Project" service

+-------------+----------------------------------+

| Field       | Value                            |

+-------------+----------------------------------+

| description | Service Project                  |

| domain_id   | 6fb0271bda4d459ab05a752b7708dee3 |

| enabled     | True                             |

| id          | b581d85c3bd642d88909f36a1ebb6387 |

| is_domain   | False                            |

| name        | service                          |

| parent_id   | 6fb0271bda4d459ab05a752b7708dee3 |

+-------------+----------------------------------+

创建``demo`` 项目:

[root@controller1 ~]# openstack project create --domain default \

--description "Demo Project" demo

+-------------+----------------------------------+

| Field       | Value                            |

+-------------+----------------------------------+

| description | Demo Project                     |

| domain_id   | 6fb0271bda4d459ab05a752b7708dee3 |

| enabled     | True                             |

| id          | da951d38bfd24ecc9d7384d3b8760dd6 |

| is_domain   | False                            |

| name        | demo                             |

| parent_id   | 6fb0271bda4d459ab05a752b7708dee3 |

+-------------+----------------------------------+

[root@controller1 ~]# openstack user create --domain default \

--password-prompt demo

User Password:

Repeat User Password:

+-----------+----------------------------------+

| Field     | Value                            |

+-----------+----------------------------------+

| domain_id | 6fb0271bda4d459ab05a752b7708dee3 |

| enabled   | True                             |

| id        | f113613d853342dba7b9636b571208bf |

| name      | demo                             |

+-----------+----------------------------------+

创建 user 角色:

[root@controller1 ~]# openstack role create user

+-----------+----------------------------------+

| Field     | Value                            |

+-----------+----------------------------------+

| domain_id | None                             |

| id        | 1c0bcc0e6ffe46d7b0366ead1d55908f |

| name      | user                             |

+-----------+----------------------------------+

[root@controller1 ~]# openstack role add --project demo --user demo user

编辑 /etc/keystone/keystone-paste.ini 文件,从``[pipeline:public_api]``,[pipeline:admin_api]``和``[pipeline:api_v3]``部分删除``admin_token_auth

[root@controller1 ~]# vim /etc/keystone/keystone-paste.ini

[root@controller1 ~]#

[root@controller1 ~]# unset OS_TOKEN OS_URL

[root@controller1 ~]# openstack --os-auth-url http://demo.open-stack.cn:35357/v3   --os-project-domain-name default --os-user-domain-name default   --os-project-name admin --os-username admin token issue

Password:

+------------+----------------------------------+

| Field      | Value                            |

+------------+----------------------------------+

| expires    | 2017-02-22T06:28:10.845869Z      |

| id         | cff141923edc40d69ead04bcde8f01c4 |

| project_id | b81fade4255149c29aa53b87312f60de |

| user_id    | e88caafd2c874b6ab4bc23d8b5fbf422 |

+------------+----------------------------------+

[root@controller1 ~]# vim admin-openrc.sh

export OS_PROJECT_DOMAIN_NAME=default

export OS_USER_DOMAIN_NAME=default

export OS_PROJECT_NAME=admin

export OS_USERNAME=admin

export OS_PASSWORD=zoomtech

export OS_AUTH_URL=http://demo.open-stack.cn:35357/v3

export OS_IDENTITY_API_VERSION=3

export OS_IMAGE_API_VERSION=2

[root@controller1 ~]# source admin-openrc.sh

[root@controller1 ~]# openstack token issue

+------------+----------------------------------+

| Field      | Value                            |

+------------+----------------------------------+

| expires    | 2017-02-22T06:30:45.484675Z      |

| id         | de745b965ce2466a904f18ce0a187279 |

| project_id | b81fade4255149c29aa53b87312f60de |

| user_id    | e88caafd2c874b6ab4bc23d8b5fbf422 |

+------------+----------------------------------+

[root@controller1 ~]# openstack service list

+----------------------------------+----------+----------+

| ID                               | Name     | Type     |

+----------------------------------+----------+----------+

| 5fe30200d9464aa384b5ddc1864b0244 | keystone | identity |

+----------------------------------+----------+----------+

在 Controller2上验证Keystone

[root@controller2 ~]# source admin-openrc.sh

[root@controller2 ~]# openstack token issue

+------------+----------------------------------+

| Field      | Value                            |

+------------+----------------------------------+

| expires    | 2017-02-22T06:31:51.487910Z      |

| id         | e2ffc4461c604107ac9ba7386d493a09 |

| project_id | b81fade4255149c29aa53b87312f60de |

| user_id    | e88caafd2c874b6ab4bc23d8b5fbf422 |

+------------+----------------------------------+

[root@controller2 ~]# openstack service list

+----------------------------------+----------+----------+

| ID                               | Name     | Type     |

+----------------------------------+----------+----------+

| 5fe30200d9464aa384b5ddc1864b0244 | keystone | identity |

+----------------------------------+----------+----------+

在 Controller2上验证Keystone

[root@controller3 ~]# source admin-openrc.sh

[root@controller3 ~]# openstack token issue

+------------+----------------------------------+

| Field      | Value                            |

+------------+----------------------------------+

| expires    | 2017-02-22T06:32:19.618061Z      |

| id         | 3db2b1cec73d48b496ac8845e0842bea |

| project_id | b81fade4255149c29aa53b87312f60de |

| user_id    | e88caafd2c874b6ab4bc23d8b5fbf422 |

+------------+----------------------------------+

[root@controller3 ~]# openstack service list

+----------------------------------+----------+----------+

| ID                               | Name     | Type     |

+----------------------------------+----------+----------+

| 5fe30200d9464aa384b5ddc1864b0244 | keystone | identity |

+----------------------------------+----------+----------+

本文转自 OpenStack2015 51CTO博客,原文链接:http://blog.51cto.com/andyliu/1917399,如需转载请自行联系原作者

Openstack HA集群5-Keystone HA的更多相关文章

  1. OpenStack Swift集群与Keystone的整合使用说明

    之前已经介绍了OpenStack Swift集群和Keystone的安装部署,最后来讲一讲Swift集群与Keystone的整合使用吧. 1. 简介 本文档描述了Keystone与Swift集群的整合 ...

  2. HUE配置文件hue.ini 的hdfs_clusters模块详解(图文详解)(分HA集群和非HA集群)

    不多说,直接上干货! 我的集群机器情况是 bigdatamaster(192.168.80.10).bigdataslave1(192.168.80.11)和bigdataslave2(192.168 ...

  3. HUE配置文件hue.ini 的hive和beeswax模块详解(图文详解)(分HA集群和非HA集群)

    不多说,直接上干货! 我的集群机器情况是 bigdatamaster(192.168.80.10).bigdataslave1(192.168.80.11)和bigdataslave2(192.168 ...

  4. HUE配置文件hue.ini 的yarn_clusters模块详解(图文详解)(分HA集群和非HA集群)

    不多说,直接上干货! 我的集群机器情况是 bigdatamaster(192.168.80.10).bigdataslave1(192.168.80.11)和bigdataslave2(192.168 ...

  5. HUE配置文件hue.ini 的database模块详解(包含qlite、mysql、 psql、和oracle)(图文详解)(分HA集群和非HA集群)

    不多说,直接上干货! Hue配置文件里,提及到,提供有postgresql_psycopg2, mysql, sqlite3 or oracle. 注意:Hue本身用到的是sqlite3. 在哪里呢, ...

  6. HUE配置文件hue.ini 的hbase模块详解(图文详解)(分HA集群和非HA集群)

    不多说,直接上干货! 我的集群机器情况是 bigdatamaster(192.168.80.10).bigdataslave1(192.168.80.11)和bigdataslave2(192.168 ...

  7. HUE配置文件hue.ini 的pig模块详解(图文详解)(分HA集群和非HA集群)

    不多说,直接上干货! 一.默认的pig配置文件 ########################################################################### ...

  8. HUE配置文件hue.ini 的sqoop模块详解(图文详解)(分HA集群和非HA集群)

    不多说,直接上干货! 我的集群机器情况是 bigdatamaster(192.168.80.10).bigdataslave1(192.168.80.11)和bigdataslave2(192.168 ...

  9. HUE配置文件hue.ini 的filebrowser模块详解(图文详解)(分HA集群和非HA集群)

    不多说,直接上干货! 我的集群机器情况是 bigdatamaster(192.168.80.10).bigdataslave1(192.168.80.11)和bigdataslave2(192.168 ...

  10. HUE配置文件hue.ini 的mapred_clusters模块详解(图文详解)(分HA集群和非HA集群)

    不多说,直接上干货! 我的集群机器情况是 bigdatamaster(192.168.80.10).bigdataslave1(192.168.80.11)和bigdataslave2(192.168 ...

随机推荐

  1. MYSQL索引类型。MYSQLc储存引擎

                                                            MYSQL索引类型,MYSQLc储存引擎 MySQL索引创建与删除 MySQL存储引擎的 ...

  2. PHP中涉及文件路径的讨论

    #1 $_SERVER中的PHP_SELF,当前执行脚本的文件名,与 document root 有关.例如,在地址为 http://example.com/test.php/foo.bar 的脚本中 ...

  3. Hadoop(一)基本简介

    是一个由Apache基金会所开发的分布式系统基础架构. 广义上来说,是一个Hadoop生态圈(由一堆框架.软件组成) 版本介绍 分为社区版和商业版 1.x,2.x,-是并行发展的 1.x : 由一个分 ...

  4. win下youtube-dl 【ERROR: requested format not available】选下载视频质量的坑--【值得一看】

    需求说明(bug出处): 简单说:下载youtube的视频,嵌入翻译好的中文字幕. 详细说(可略过): 阿里的海外服务器需要布一个Web Service---用以接收国内(本地服务器)的请求, 然后用 ...

  5. 中阶d01-- web前端 html css js bootstrap

    html 页面骨架结构css 页面优化js(脚本语言) 页面和用户互动 bootstrap 前端框架,主要实现不同设备直接打开页面时播放比例设置(全屏暂时,不要滚动条)

  6. Python zipfile模块学习

    转载自https://www.j4ml.com/t/15270 import zipfile import os from zipfile import ZipFile class ZipManage ...

  7. 使用malloc和free函数进行内存动态分配

    一.在学习c语言里面,内存分配这个话题非常有意思,因为我们平时在开发的时候,如果一不小心没注意内存释放的话,写的的程序很容易出错,所以今天就来回顾一下c语言里面的内存动态分配,下面我们先来看一个实例来 ...

  8. D. Minimax Problem Codeforces 1288D binary_search+二进制

    题目大意:n*m的矩阵中,找到两行数,可以形成两个一维数组,数组1的位置i和数组2的位置i去最大构成新数组b的元素b[i],最终目的要使数组b中最小的数尽可能的大 题解: m的范围是(1,8),比较小 ...

  9. 使用jquery清空input 文本框中的内容

    只需要将文本框的值置为空即可: function resetBtn(){ $("#name").val(""); }

  10. 远程登录redis

    没想到吧,我居然已经摸到了redis. 远程登录redis redis-cli -h 127.0.0.1 -p 6379 ip地址和端口记得换成自己的