一、 Base Node配置

mysql -uroot -proot

CREATE DATABASE keystone

GRANT ALL PRIVILEGES ON keystone.* to ‘keystone‘@‘localhost‘IDENTIFIED BY ‘KEYSTONE_DBPASS‘;

SHOW DATABASES;

EXIT

二、 ctrl Node（控制節點）配置

#網卡1：eth0

IP：172.16.2.52/16，網關：172.16.0.1，DNS：172.16.2.51。

#網卡2：eth1

vim /etc/sysconfig/network-scripts/ifcfg-eth1

TYPE=Ethernet
BOOTPROTO=none
NAME=eth1
DEVICE=eth1
ONBOOT=yes
UUID=5fb06bd0-0bb0-7ffb-45f1-d6edd65f3e03

#NTP Server配置

yum install python-openstackclient

vim /etc/chrony.conf

server base.test.com

systemctl restart chronyd.service

systemctl enable chronyd.service

chronyc sources -v

#安裝openstack-keystone軟件

yum install python-openstackclient -y

yum install openstack-selinux -y

yum install openstack-keystone httpd mod_wsgi -y

#編輯配置文件

vim /etc/keystone/keystone.conf

[database]
connection = mysql+pymysql://keystone:[email protected]/keystone

[token] 
provider = fernet

#初始化身份認證服務的數據庫

su -s /bin/sh -c "keystone-manage db_sync" keystone

#初始化fernet秘鑰存儲庫

keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

#引導identify service

keystone-manage bootstrap --bootstrap-password ADMIN_PASS --bootstrap-admin-url  http://ctrl.test.com:35357/v3/ \
--bootstrap-internal-url  http://ctrl.test.com:5000/v3/ \
--bootstrap-public-url  http://ctrl.test.com:5000/v3/ \
--bootstrap-region-id RegionOne

#HTTP配置

vim /etc/httpd/conf/httpd.conf

ServerName ctrl.test.com

#創建軟連接，啟動hhtpd時啟動wsgi模塊（端口為5000和35357）

ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

#啟動http服務

systemctl restart httpd

systemctl enable httpd

systemctl status httpd

#環境變量（配置管理賬戶）

export OS_USERNAME=admin
export OS_PASSWORD=ADMIN_PASS
export OS_PROJECT_NAME=admin
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default
export OS_AUTH_URL=HTTP://ctrl.test.com:35357/v3
export OS_IDENTITY_API_VERSION=3

#創建項目、用戶和角色

openstack project create --domain default --description "Server Project" service

openstack project create --domain default --description "Demo Project" demo

openstack user create --domain default --password DEMO_PASS demo

openstack role create user

openstack role add --project demo --user demo user

#查看創建的項目和用戶

openstack project list、openstack user list

#校驗操作，出於安全原因，禁用臨時身份驗證令牌機制

vim /etc/keystone/keystone-paste.ini

[pipeline:public_api]
pipeline = healthcheck cors sizelimit http_proxy_to_wsgi osprofiler url_normalize request_id (刪除admin_token_auth) build_auth_context token_auth json_body ec2_extension public_service


[pipeline:admin_api]
pipeline = healthcheck cors sizelimit http_proxy_to_wsgi osprofiler url_normalize request_id (刪除admin_token_auth) build_auth_context token_auth json_body ec2_extension s3_extension admin_service


[pipeline:api_v3]
pipeline = healthcheck cors sizelimit http_proxy_to_wsgi osprofiler url_normalize request_id (刪除admin_token_auth) build_auth_context token_auth json_body ec2_extension_v3 s3_extension service_v3

#刪除OS_AUTH_URL OS-PASSWORD 臨時環境變量

unset OS_AUTH_URL OS_PASSWORD

#作為管理用戶，請求身份驗證令牌

openstack --os-auth-url http://ctrl.test.com:35357/v3 \

--os-project-domain-name default \

--os-user-domain-name default \

--os-project-name admin \

--os-username admin token issue

輸入PASSWORD：ADMIN_PASS

#作為demo用戶，請求身份驗證令牌

openstack --os-auth-url http://ctrl.test.com:5000/v3 \

--os-project-domain-name default \

--os-user-domain-name default \

--os-project-name demo \

--os-username demo token issue

輸入PASSWORD：DEMO_PASS

#創建admin管理員運行腳本

vim /root/admin-openrc

#!/bin/bash
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=ADMIN_PASS
export OS_AUTH_URL=HTTP://ctrl.test.com:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

#創建demo用戶運行腳本

vim /root/demo-openrc

#!/bin/bash
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=DEMO_PASS
export OS_AUTH_URL=HTTP://ctrl.test.com:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

#測試

. admin-openrc

openstack token issue

openstack搭建之-keystone配置（16）