Openstack元件部署 — keystone(domain, projects, users, and roles)

阿新 • • 發佈：2019-02-11

前文列表

Create a domain, projects, users, and roles

The Identity service provides authentication services for each OpenStack service. The authentication service uses a combination of domains, projects (tenants), users, and roles.

Identity service為每一個Openstack service都提供了身份認證的服務，而身份認證服務使用domains, projects (tenants), users, and roles

的組合來實現。

domain, projects, users, and roles的意義和作用

Create the default domain

在上一篇Openstack元件部署 — Keystone Install & Create service entity and API endpoints 中解釋了，因為MySQL資料庫裡預設是沒有任何authentication 和catalog services資訊的，但是在呼叫Keystone的服務時，首先就需要進行token的校驗，這樣顯然無法完成。所以如果想在這樣的情況下使用Keystone服務，我們可以為其指定一個臨時的Token(keystone.conf中的admin_token引數項)，並且定義一個OS_TOKEN

系統變數，Keystone會通過匹配OS_TOKEN和admin_token的值是否一致來確定是否能夠使用Keystone的服務。如果不一致時，就會觸發An unexpected error prevented the server from fulfilling your request. 的ERROR。

載入臨時token的環境變數：

[root@controller ~]# cat auth_token
export OS_TOKEN=c44048d3212d3f977643
export OS_URL=http://controller.jmilk.com:35357/v3
export OS_IDENTITY_API_VERSION=3 


[root@controller ~]# source auth_token

建立domain：

[[email protected] ~]# openstack domain create --description "Default Domain" default
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Default Domain                   |
| enabled     | True                             |
| id          | 011fbf8c04f1479ab1a4e49b019b22d1 |
| name        | default                          |
+-------------+----------------------------------+

Create the service project(tenant)

This guide uses a service project that contains a unique user for each service that you add to your environment.
每一個Openstack service在service tenant都含有唯一的user。Openstack需要使用這個service tenant來將所有的Openstack service關聯起來。

[[email protected] ~]# openstack project create --domain default --description "Service Project" service
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Service Project                  |
| domain_id   | 011fbf8c04f1479ab1a4e49b019b22d1 |
| enabled     | True                             |
| id          | 358f241ed9ad4a2faf1e9796d761e4bf |
| is_domain   | False                            |
| name        | service                          |
| parent_id   | 011fbf8c04f1479ab1a4e49b019b22d1 |
+-------------+----------------------------------+

建立用於管理的使用者、租戶和角色

Create the admin project(tenant)

Create an administrative project, user, and role for administrative operations in your environment
為了在你的環境上執行管理操作，需要建立管理專案、使用者和角色。

建立一個屬於default域的tenant(租戶)

[[email protected] ~]# openstack project create --domain default --description "Admin Project" admin
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Admin Project                    |
| domain_id   | 011fbf8c04f1479ab1a4e49b019b22d1 |
| enabled     | True                             |
| id          | 6c04f1d3ecd04aafb427f4f8d01be534 |
| is_domain   | False                            |
| name        | admin                            |
| parent_id   | 011fbf8c04f1479ab1a4e49b019b22d1 |
+-------------+----------------------------------+

Note：Openstack會使用動態的id。

Create the admin user

需要為user設定密碼。

[[email protected] ~]# openstack user create --domain default --password-prompt admin
User Password:
Repeat User Password:
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | 011fbf8c04f1479ab1a4e49b019b22d1 |
| enabled   | True                             |
| id        | d5e5331d665540159f1bfabb7327eca5 |
| name      | admin                            |
+-----------+----------------------------------+

Create the admin role

[[email protected] ~]# openstack role create admin
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | None                             |
| id        | 192f3667f323410b83497d8898d2ec80 |
| name      | admin                            |
+-----------+----------------------------------+

Add the admin role to the admin project and user

新增admin tenant、admin user到admin role中

[[email protected] ~]# openstack role add --project admin --user admin admin

Note：Any roles that you create must map to roles specified in the policy.json file in the configuration file directory of each OpenStack service. The default policy for most services grants administrative access to the admin role.

注意：所有建立的roles都必須要對映到每一個Openstack service特定的policy.json配置檔案中，預設的policy會將大多數的services的管理許可權授予admin角色。所以上面我們建立了default domain、admin tenant、admin user、admin role，並且將tenant和user繫結到了roles中，這樣的話tenant和user就擁有了admin role的許可權。

/etc/keystone/policy.json

建立一般使用者、租戶和角色

Create the demo project(tenant)

Regular (non-admin) tasks should use an unprivileged project and user. As an example, this guide creates the demo project and user.
在Openstack中一般的任務我們都應該使用一個沒有太多許可權的project(tenant)和user來操作。在這裡我們建立一個demo user。

[[email protected] ~]# openstack project create --domain default --description "Demo Project" demo
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Demo Project                     |
| domain_id   | 011fbf8c04f1479ab1a4e49b019b22d1 |
| enabled     | True                             |
| id          | 4e069f1af37c4a37910e838365213530 |
| is_domain   | False                            |
| name        | demo                             |
| parent_id   | 011fbf8c04f1479ab1a4e49b019b22d1 |
+-------------+----------------------------------+

Note：Do not repeat this step when creating additional users for this project.

Create the demo user:

[[email protected] ~]# openstack user create --domain default --password-prompt demo
User Password:
Repeat User Password:
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | 011fbf8c04f1479ab1a4e49b019b22d1 |
| enabled   | True                             |
| id        | 27549a09628a453ea4fea34feb201855 |
| name      | demo                             |
+-----------+----------------------------------+

Create the user role

[[email protected] ~]# openstack role create user
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | None                             |
| id        | ed533bf15c0b4487a7023c3d489c9411 |
| name      | user                             |
+-----------+----------------------------------+

Add the user role to the demo project and user

[[email protected] ~]# openstack role add --project demo --user demo user

Verify operation 驗證操作

在安裝Openstack的其他services之前，我們需要確定Keystone service能夠正常使用。
Step1.For security reasons, disable the temporary authentication token mechanism
出於安全考慮，我們現在可以禁用掉臨時的認證token機制。
Edit the /etc/keystone/keystone-paste.ini file and remove admin_token_auth from the [pipeline:public_api], [pipeline:admin_api], and [pipeline:api_v3] sections.
將/etc/keystone/keystone-paste.ini檔案中的節點[pipeline:public_api]、[pipeline:admin_api]、[pipeline:api_v3]中的admin_token_auth引數刪除。

vim /etc/keystone/keystone-paste.ini

[pipeline:public_api]
# The last item in this pipeline must be public_service or an equivalent
# application. It cannot be a filter.
pipeline = cors sizelimit url_normalize request_id build_auth_context token_auth json_body ec2_extension public_service

[pipeline:admin_api]
# The last item in this pipeline must be admin_service or an equivalent
# application. It cannot be a filter.
pipeline = cors sizelimit url_normalize request_id build_auth_context token_auth json_body ec2_extension s3_extension admin_service

[pipeline:api_v3]
# The last item in this pipeline must be service_v3 or an equivalent
# application. It cannot be a filter.
pipeline = cors sizelimit url_normalize request_id build_auth_context token_auth json_body ec2_extension_v3 s3_extension service_v3

Step2.Unset the temporary OS_TOKEN and OS_URL environment variables

[root@controller ~]# unset OS_TOKEN OS_URL

Step3.As the admin user, request an authentication token
使用admin user來請求獲取authentication token
獲取一個authentication token需要指定：

--os-auth-url確定keystone service，並且admin使用者需要使用Post：35357來區分，Post：35357是admin專用的Endpoint。
--os-project-domain-name確定一個admin tenant所處在的domain
--os-user-domain-name確定admin user所處在的domain
os-project-name確定admin tenant
--os-username確定admin user，這樣才能唯一的定位到一個user，之後在指定申請token
注意：因為在之前建立了admin tenant、admin user、admin role，就是說現在資料庫中已經存在了admin user的相關資訊，所以keystone可以在不需要使用臨時token的情況下直接申請admin user的token。 —— 也就是說如果一個User希望從Keystone上申請到一個Token並以此來登陸Openstack進行操作的話，首先需要建立這個User和對應的tenant並將其加入role中。

[[email protected] ~]# openstack --os-auth-url http://controller.jmilk.com:35357/v3 \
>   --os-project-domain-name default --os-user-domain-name default \
>   --os-project-name admin --os-username admin token issue
Password: 
+------------+----------------------------------------------------------------------------+
| Field      | Value                                                                      |
+------------+----------------------------------------------------------------------------+
| expires    | 2016-06-15T16:15:15.389159Z                                                |
| id         | gAAAAABXYXEDwdmX7VMLYkNas7r_aAz91zrfUvoJCwGLIE6qOWcdjVH9NjJwNl3bkeYaspbrm9 |
|            | _Ygm_Eba8kUNUnipTHM8D9ASOxOV4BQUmn-                                        |
|            | uSZO9vmrHy91B7vx3vfidKz2_83X5PhOMhZxrFkluYzsJtIuH9T0UTiuaVA_THJ4zNOXzKYEtA |
| project_id | 6c04f1d3ecd04aafb427f4f8d01be534                                           |
| user_id    | d5e5331d665540159f1bfabb7327eca5                                           |
+------------+----------------------------------------------------------------------------+

ERROR：Unable to establish connection to http://controller:35357/v3/auth/tokens
出現這個錯誤時候，檢查認證Endpoint URL選項--os-auth-url的引數是否正確，openstack需要通過Endpoint URL來確定auth-Keystone服務。

Step4.As the demo user, request an authentication token

[[email protected] ~]# openstack --os-auth-url http://controller.jmilk.com:5000/v3 \
>   --os-project-domain-name default --os-user-domain-name default \
>   --os-project-name demo --os-username demo token issue
Password: 
+------------+----------------------------------------------------------------------------+
| Field      | Value                                                                      |
+------------+----------------------------------------------------------------------------+
| expires    | 2016-06-15T16:26:46.556759Z                                                |
| id         | gAAAAABXYXO2Tn4c9mO5TAY5gBeGxgSRmbAkDRfB8gyuELVtAB6BVARzY8d6OL9diCtAy-     |
|            | mNyY3uA7DFBrnKoTtyu5jX5oEf9ax61q8StnYjNDtRdiOKLN2Q23f-                     |
|            | jNYALrWUkr91Z98oLD7LVrjRLcSaC-XCpK5tB-kU-Piyu7Y0rzbEXM06AIo                |
| project_id | 4e069f1af37c4a37910e838365213530                                           |
| user_id    | 27549a09628a453ea4fea34feb201855                                           |
+------------+----------------------------------------------------------------------------+

Note：This command uses the password for the demo user and API port 5000 which only allows regular (non-admin) access to the Identity service API.
注意：非管理員賬戶使用Port：5000來定位Keystone service。

Step5.使用admin賬戶身份來檢視project、user、role的列表

[[email protected] ~]# openstack --os-auth-url http://controller.jmilk.com:35357/v3   --os-project-domain-name default --os-user-domain-name default   --os-project-name admin --os-username admin project list
Password: 
+----------------------------------+---------+
| ID                               | Name    |
+----------------------------------+---------+
| 358f241ed9ad4a2faf1e9796d761e4bf | service |
| 4e069f1af37c4a37910e838365213530 | demo    |
| 6c04f1d3ecd04aafb427f4f8d01be534 | admin   |
+----------------------------------+---------+

[[email protected] ~]# openstack --os-auth-url http://controller.jmilk.com:35357/v3   --os-project-domain-name default --os-user-domain-name default   --os-project-name admin --os-username admin user list
Password: 
+----------------------------------+-------+
| ID                               | Name  |
+----------------------------------+-------+
| 27549a09628a453ea4fea34feb201855 | demo  |
| d5e5331d665540159f1bfabb7327eca5 | admin |
+----------------------------------+-------+

[[email protected] ~]# openstack --os-auth-url http://controller.jmilk.com:35357/v3   --os-project-domain-name default --os-user-domain-name default   --os-project-name admin --os-username admin role list
Password: 
+----------------------------------+-------+
| ID                               | Name  |
+----------------------------------+-------+
| 192f3667f323410b83497d8898d2ec80 | admin |
| ed533bf15c0b4487a7023c3d489c9411 | user  |
+----------------------------------+-------+

Create OpenStack client environment scripts

The previous section used a combination of environment variables and command options to interact with the Identity service via the openstack client. To increase efficiency of client operations, OpenStack supports simple client environment scripts also known as OpenRC files. These scripts typically contain common options for all clients, but also support unique options。
在上面的操作中，我們通過openstack client使用了環境變數和指令選項的組合來進行操作。為了增加openstack client的操作效率(每一次都需要使用--os-auth-url這類的選項實在是非常繁複)，Openstack支援簡易的環境指令碼，也稱之為OpenRC檔案。這些指令碼可以包含有常用的openstack client選項，但是每一個指令碼只支援唯一的選項值。簡而言之，使用這些指令碼能夠讓我們不需要為每一條openstack client指令都新增這麼多的認證選項。

Edit the admin-openrc file and add the following content

為admin user建立OpenRC檔案
vim ~/admin-openrc

export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=fanguiju            #給出admin的password
export OS_AUTH_URL=http://controller.jmilk.com:35357/v3            #給出admin的Endpoint
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

Edit the demo-openrc file and add the following content

為demo user建立OpenRC檔案
vim ~/demo-openrc

export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=fanguiju
export OS_AUTH_URL=http://controller.jmilk.com:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

Using the scripts

[[email protected] ~]# . admin-openrc
[[email protected] ~]# openstack token issue
+------------+----------------------------------------------------------------------------+
| Field      | Value                                                                      |
+------------+----------------------------------------------------------------------------+
| expires    | 2016-06-15T16:59:48.937673Z                                                |
| id         | gAAAAABXYXt0PviJjz-fzA89XNr7w2KxM5jOOzg868rTDLXE-                          |
|            | 2l__BMNLBYDX0nWKlrjlLRvqwFXMpAL2WhAlZVEZis6Ud-dqcSA4JV-                    |
|            | 4Ehr9aRCwSK3cm4L_eHnoLeAoDU-                                               |
|            | 40RYHViL0GB3kav8ML5DbTGNRPq3aHVNsvQHgkfAWiHKm9YM5xo                        |
| project_id | 6c04f1d3ecd04aafb427f4f8d01be534                                           |
| user_id    | d5e5331d665540159f1bfabb7327eca5                                           |
+------------+----------------------------------------------------------------------------+

再次獲取admin的token變得非常的簡單

最後

到這裡Keystone元件的安裝就全部結束了。 : )