构建OpenStack私有云--第一步：配置Keystone服务

这篇具有很好参考价值的文章主要介绍了构建OpenStack私有云--第一步：配置Keystone服务。希望对大家有所帮助。如果存在错误或未考虑完全的地方，请大家不吝赐教，您也可以点击"举报违法"按钮提交疑问。

配置Keystone服务

keystone是一个认证服务，所有服务在接收到用户请求时，都必须找keystone服务去做认证，把用户请求中的信息拿出来去匹配，能匹配到才去检查你有没有相应的权限，然后给你资源。
还有个作用是目录列表

1. 创建keystone数据库

[root@openstack-controller ~]# mysql -u root -h 172.16.10.2 -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 4
Server version: 10.1.20-MariaDB MariaDB Server

Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
+--------------------+
3 rows in set (0.00 sec)

MariaDB [(none)]> CREATE DATABASE keystone;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@localhost' IDENTIFIED BY 'keystone';
# 解释一下这句命令：授予keystone数据库上所有的权限（.*表示数据库上的所有表，*.*表示所有数据库的所有表）给keystone用户（@前的是用户名，这里将用户名起为keystone，@后的表示从哪里登录时才给你这个权限，localhost表示从本机登录时才给你这样的权限；IDENTIFIED后是给用户名起的密码）

不过最后一行命令会抱错，这是因为当前172这个地址登录之后的权限不够，不能GRANT其他数据库所有命令，这时候需要给它添加这个权限

[root@openstack-controller ~]# mysql -u root -p205247
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 8
Server version: 10.1.20-MariaDB MariaDB Server

Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> GRANT ALL PRIVILEGES ON *.* TO 'root'@'172.16.10.2' IDENTIFIED BY 'redhat' WITH GRANT OPTTION;
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON *.* TO 'root'@'172.16.10.%' IDENTIFIED BY 'redhat' WITH GRANT OPTTION;
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> SHOW GRANTS FOR 'root'@'172.16.10.%';
+------------------------------------------------------------------------------------------------------------------------------------------+
| Grants for root@172.16.10.%                                                                                                              |
+------------------------------------------------------------------------------------------------------------------------------------------+
| GRANT ALL PRIVILEGES ON *.* TO 'root'@'172.16.10.%' IDENTIFIED BY PASSWORD '*84BB5DF4823DA319BBF86C99624479A198E6EEE9' WITH GRANT OPTION |
+------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

MariaDB [(none)]> SHOW GRANTS FOR 'root'@'localhost';
+----------------------------------------------------------------------------------------------------------------------------------------+
| Grants for root@localhost                                                                                                              |
+----------------------------------------------------------------------------------------------------------------------------------------+
| GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY PASSWORD '*43C0877E648B1FAA97CF436B1449727E9A47673E' WITH GRANT OPTION |
| GRANT PROXY ON ''@'%' TO 'root'@'localhost' WITH GRANT OPTION                                                                          |
+----------------------------------------------------------------------------------------------------------------------------------------+
2 rows in set (0.00 sec)

MariaDB [(none)]> exit
Bye

[root@openstack-controller ~]# mysql -u root -h 172.16.10.2 -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 12
Server version: 10.1.20-MariaDB MariaDB Server

Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \
    -> IDENTIFIED BY 'keystone';
Query OK, 0 rows affected (0.00 sec)
# 这时就不会报错了

下面命令使得keystone用户无论从哪里登陆上来，都给你这样一个权限

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \
    -> IDENTIFIED BY 'keystone';
Query OK, 0 rows affected (0.00 sec)

2. 安装keystone软件包

MariaDB [(none)]> exit
Bye
[root@openstack-controller ~]# yum install openstack-keystone httpd mod_wsgi

安装时会报错，参考这个即可
https://blog.csdn.net/Qmilumilu/article/details/121330274

3. 修改配置文件并启动keystone服务

修改配置文件/etc/keystone/keystone.conf
主要有两处配置需要修改，一是数据库段：
需要在[database]下添加一行

[database]
connection = mysql+pymysql://keystone:keystone@controller/keystone

其中keystone:keystone表示连接keystone数据库的用户名和密码；controller/keystone表示keystone服务器的地址controller以及数据库名称keystone
另外一个是token提供者
找到[token]，在其下添加一行

[token]
provider = fernet

初始化keystone数据库，表示切换到keystone用户，并以keystone用户执行keystone-manage db_sync命令

[root@openstack-controller ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone

初始化Fernet Key仓库

[root@openstack-controller ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
[root@openstack-controller ~]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

启动keystone服务
我们现在所有的服务（包括keystone服务）都有三个地址（即endpoint）

[root@openstack-controller ~]# keystone-manage bootstrap --bootstrap-password admin \
> --bootstrap-admin-url http://controller:5000/v3/ \
> --bootstrap-internal-url http://controller:5000/v3/ \
> --bootstrap-public-url http://192.168.245.137:5000/v3/ \
> --bootstrap-region-id RegionOne

其中RegionOne表示部署区域，如阿里云的华北地区、华东地区等，我们构建私有云默认使用RegionOne即可

4. 配置Apache HTTP服务

1）备份并修改配置文件
先备份再修改

[root@openstack-controller ~]# cp /etc/httpd/conf/httpd.conf{,.init.bak}
[root@openstack-controller ~]# vim /etc/httpd/conf/httpd.conf

找到ServerName，添加一行ServerName controller

ServerAdmin root@localhost

#
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
#
# If your host doesn't have a registered DNS name, enter its IP address here.
#
#ServerName www.example.com:80
ServerName controller

2）此时keystone已经创建好了apache使用的配置文件，我们只需要创建一个软链接文件，让apache能够读取到即可

[root@openstack-controller ~]# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

3）设置开机启动并启动Apache HTTP服务

[root@openstack-controller ~]# systemctl enable httpd.service
[root@openstack-controller ~]# systemctl start httpd.service
[root@openstack-controller ~]# netstat -nltp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:25672           0.0.0.0:*               LISTEN      62084/beam.smp      
tcp        0      0 172.16.10.2:3306        0.0.0.0:*               LISTEN      61962/mysqld        
tcp        0      0 172.16.10.2:11211       0.0.0.0:*               LISTEN      63270/memcached     
tcp        0      0 127.0.0.1:11211         0.0.0.0:*               LISTEN      63270/memcached     
tcp        0      0 0.0.0.0:4369            0.0.0.0:*               LISTEN      1/systemd           
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      18939/sshd          
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      19119/master        
tcp6       0      0 :::5000                 :::*                    LISTEN      69947/httpd         
tcp6       0      0 :::5672                 :::*                    LISTEN      62084/beam.smp      
tcp6       0      0 :::80                   :::*                    LISTEN      69947/httpd         
tcp6       0      0 :::22                   :::*                    LISTEN      18939/sshd          
tcp6       0      0 ::1:25                  :::*                    LISTEN      19119/master

可看到该服务监听在5000端口

5. 配置keystone客户端管理用户

方法：可写到配置文件中，需要使用时，source该文件即可：

[root@openstack-controller ~]# vim ~/.admin.openstack
[root@openstack-controller ~]# cat ~/.admin.openstack
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_PROJECT_NAME=admin
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3

[root@openstack-controller ~]# echo $OS_USERNAME

[root@openstack-controller ~]# source ~/.admin.openstack
[root@openstack-controller ~]# echo $OS_USERNAME
admin
[root@openstack-controller ~]# echo $OS_PASSWORD
admin

到目前位置，keystone服务已经准备好了，但是还没有用户，接下来介绍怎么创建项目、域、角色、用户

6. 创建域、项目、用户和角色

在OpenStack中，会使用域、项目、用户和角色（即domains, projects, users, and roles）来进行身份验证。
同一个域中，项目名称不能相同。在“项目”中创建“用户”，并且赋予用户相应的“角色”，这样就可以利用这个用户在该项目下申请使用相关的资源。
关于角色，在Rocky版本中，默认有reader | admin | member三者，其中reader主要用于API类的只读操作，admin是超级管理员角色，member指普通用户角色

1）创建一个demo_domain测试域
其实在我们使用keystone-manage bootstrap时已经创建了一个默认域，域名为default

# 下面的命令要先source之后才行，直接按上面的步骤顺着来即可
[root@openstack-controller ~]# openstack domain list
+---------+---------+---------+--------------------+
| ID      | Name    | Enabled | Description        |
+---------+---------+---------+--------------------+
| default | Default | True    | The default domain |
+---------+---------+---------+--------------------+

来创建

[root@openstack-controller ~]# openstack domain create --description "An demo Domain" demo_domain
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | An demo Domain                   |
| enabled     | True                             |
| id          | 174cfbd8061d403fb7ec9134bc9a437b |
| name        | demo_domain                      |
| tags        | []                               |
+-------------+----------------------------------+

# 这时候就有两个域了
[root@openstack-controller ~]# openstack domain list
+----------------------------------+-------------+---------+--------------------+
| ID                               | Name        | Enabled | Description        |
+----------------------------------+-------------+---------+--------------------+
| 174cfbd8061d403fb7ec9134bc9a437b | demo_domain | True    | An demo Domain     |
| default                          | Default     | True    | The default domain |
+----------------------------------+-------------+---------+--------------------+

下面演示删除一个域

[root@openstack-controller ~]# openstack domain set --disable demo_domain
[root@openstack-controller ~]# openstack domain delete demo_domain

2）创建一个管理项目和测试项目

service项目主要用来做服务管理

[root@openstack-controller ~]# openstack project create --domain default \
> --description "Service Project" service
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Service Project                  |
| domain_id   | default                          |
| enabled     | True                             |
| id          | 796543d538824b9b8068d137ccb4ac21 |
| is_domain   | False                            |
| name        | service                          |
| parent_id   | default                          |
| tags        | []                               |
+-------------+----------------------------------+

myproject项目是用来管理普通（non-admin）任务以及普通用户和权限的

[root@openstack-controller ~]# openstack project create --domain default \
> --description "Demo Project" myproject
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Demo Project                     |
| domain_id   | default                          |
| enabled     | True                             |
| id          | 55575380f90040b5ba0395abf82b799b |
| is_domain   | False                            |
| name        | myproject                        |
| parent_id   | default                          |
| tags        | []                               |
+-------------+----------------------------------+

3）创建用户

[root@openstack-controller ~]# openstack user create --domain default \
> --password-prompt myuser
User Password:
Repeat User Password:
+---------------------+----------------------------------+
| Field               | Value                            |
+---------------------+----------------------------------+
| domain_id           | default                          |
| enabled             | True                             |
| id                  | 8205cbff00094898951d04106ec941f5 |
| name                | myuser                           |
| options             | {}                               |
| password_expires_at | None                             |
+---------------------+----------------------------------+

4）创建角色

[root@openstack-controller ~]# openstack role create myrole
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | None                             |
| id        | c37cb947401c495ab94f29ef082bfcdc |
| name      | myrole                           |
+-----------+----------------------------------+

5）把角色myrole添加到myproject和myuser上（附加角色到项目和用户）

[root@openstack-controller ~]# openstack role add --project myproject --user myuser myrole

7. 验证keystone

a）撤销当前的OS_AUTH_URL和OS_PASSWORD环境变量

[root@openstack-controller ~]# echo $OS_AUTH_URL
http://controller:5000/v3
[root@openstack-controller ~]# echo $OS_PASSWORD
admin
[root@openstack-controller ~]# unset OS_AUTH_URL
[root@openstack-controller ~]# unset OS_PASSWORD
[root@openstack-controller ~]# echo $OS_AUTH_URL

[root@openstack-controller ~]# echo $OS_PASSWORD

[root@openstack-controller ~]# openstack domain list
Missing value auth-url required for auth plugin password

b）作为一个admin用户，获取token

[root@openstack-controller ~]# openstack --os-auth-url http://controller:5000/v3 \
> --os-project-domain-name Default --os-user-domain-name Default \
> --os-project-name admin --os-username admin token issue
Password:   # 输入admin的密码：admin
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field      | Value                                                                                                                                                                                   |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires    | 2022-04-11T23:46:25+0000                                                                                                                                                                |
| id         | gAAAAABiVK_BCAu86axHi4MyF89vlxmIKEM2VJl9iEcoYsBvClJECBl_RtK9GFwHgeY9CTMyhuWoTf6sVn0egamsaIzeI1Gr46LVu8sudS1OsaWLlLB_GFU6VvB3S76p4l1PGpRS0DKEQQWasRPM2tnBqotzoZ8QssbG-9ADbz-6Vdg-1akxMBI |
| project_id | 7d3b70fafbfe4391ab3b305f378c8911                                                                                                                                                        |
| user_id    | dad0fd43430f4c4cb91cd3d38c8bb8ab                                                                                                                                                        |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

c）作为一个普通用户myuser，获取token

[root@openstack-controller ~]# openstack --os-auth-url http://controller:5000/v3 \
> --os-project-domain-name Default --os-user-domain-name Default \
> --os-project-name myproject --os-username myuser token issue
Password:   # 这里输入myuser的密码：myuser
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field      | Value                                                                                                                                                                                   |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires    | 2022-04-11T23:49:28+0000                                                                                                                                                                |
| id         | gAAAAABiVLB4T-YsSa1lDN20GTBS_khBhhZEey6oxOmgGg1lIkwoNyr_vVHRH51n16YMMZ13-orxNv_95mb4towa-9N6azO5hzLaKodIuhpqUWu8PiP7u0FDsRSXSfUQNqrHmefSizERV1LhSo71Kvht0N89Xz5Mup5ganFiu4vavCCtkP7P4Gw |
| project_id | 55575380f90040b5ba0395abf82b799b                                                                                                                                                        |
| user_id    | 8205cbff00094898951d04106ec941f5                                                                                                                                                        |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

如果能够为不同用户获取到不同的token，则表示keystone服务部署以及用户创建等操作成功。
这说明，我们可以通过keystone来获取token，而获取token是keystone非常重要的功能，keystone就是通过token去认证的。你用户来，我给你发一个token，你通过用户名密码过来请求，请求完之后我给你发一个token，然后你拿着token就可以去做其他的事情了。

8. 创建OpenStack客户端环境变量脚本

其实跟我们之前说的环境变量处理方式一致，把变量写入到文件中，需要用到的时候通过source或者.的方式读取变量内容。

[root@openstack-controller ~]# vim ~/.myuser.openstack
[root@openstack-controller ~]# vim ~/.admin.openstack
[root@openstack-controller ~]# cat ~/.admin.openstack
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_PROJECT_NAME=admin
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
[root@openstack-controller ~]# cat ~/.myuser.openstack
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=myproject
export OS_USERNAME=myuser
export OS_PASSWORD=myuser
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

接下来验证一下文章来源地址https://www.toymoban.com/news/detail-410578.html

[root@openstack-controller ~]# source ~/.admin.openstack
[root@openstack-controller ~]# openstack token issue
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field      | Value                                                                                                                                                                                   |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires    | 2022-04-12T00:04:29+0000                                                                                                                                                                |
| id         | gAAAAABiVLP9pumUxh-BEStjvx1E-J1dIAwjPQEpFVNlR597IRC0Vtk18CswVaeL1CbV19AI4pCFLDoqreBc5Oyq2iMUoK2xW6J1gfbfXPzGXEN45UzPoxXb-mQOs4YpCGtFEUmJvHdAN_p3j3mhCUP4LQT9hGK8zpEMX5uxJXKzrfgY1V4X-Sw |
| project_id | 7d3b70fafbfe4391ab3b305f378c8911                                                                                                                                                        |
| user_id    | dad0fd43430f4c4cb91cd3d38c8bb8ab                                                                                                                                                        |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
[root@openstack-controller ~]# source ~/.myuser.openstack
[root@openstack-controller ~]# openstack token issue
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field      | Value                                                                                                                                                                                   |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires    | 2022-04-12T00:04:46+0000                                                                                                                                                                |
| id         | gAAAAABiVLQOIkhfHM20dUbupfYFap3vWYx3IICI6XLTxrXzkg5rl3Tj_jLhSv0Z3QCzpgSSNVDMPByW0QBMGGzZhRIZ4NV6d_2Z6IRct3ektcv6CQYLgyETMLPEwNgPL7CZDLGzMIDXDtwoBJd57MFYLujGFxCOKfkXNdvUCh7WsY8dE9JKuN8 |
| project_id | 55575380f90040b5ba0395abf82b799b                                                                                                                                                        |
| user_id    | 8205cbff00094898951d04106ec941f5                                                                                                                                                        |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

到了这里，关于构建OpenStack私有云--第一步：配置Keystone服务的文章就介绍完了。如果您还想了解更多内容，请在右上角搜索TOY模板网以前的文章或继续浏览下面的相关文章，希望大家以后多多支持TOY模板网！