OpenStack搭建私有云一：认证服务

比眉伴天荒 2022-01-17 13:55 340阅读 0赞

**实验环境部署**

**![image.png][]**

![image.png][image.png 1]

<table> 
 <tbody> 
  <tr> 
   <td>主机名</td> 
   <td>IP</td> 
   <td>备注</td> 
  </tr> 
  <tr> 
   <td>controllre</td> 
   <td>192.168.80.184</td> 
   <td>控制节点</td> 
  </tr> 
  <tr> 
   <td colspan="1"><span style="color:rgb(0,0,0);font-family:sans-serif;font-size:16px;font-style:normal;font-variant:normal;font-weight:400;letter-spacing:normal;text-align:left;text-decoration:none;text-indent:0px;text-transform:none;word-spacing:0px;">compute01</span></td> 
   <td colspan="1"><span style="color:rgb(0,0,0);font-family:sans-serif;font-size:16px;font-style:normal;font-variant:normal;font-weight:400;letter-spacing:normal;text-align:left;text-decoration:none;text-indent:0px;text-transform:none;word-spacing:0px;">192.168.80.185</span></td> 
   <td colspan="1">计算节点</td> 
  </tr> 
 </tbody> 
</table>

注：计算节点可有多个

--------------------

**控制节点和计算节点 环境搭建**

*  分别配置主机名和hosts文件

\# hostnamectl set\-hostname controller \# hostnamectl set\-hostname compute01 //重启生效 \# vi /etc/hosts 192.168.80.184 controller  
192.168.80.185 compute01

*  关闭禁用 防火墙及SELinux

\# systemctl stop firewalld

\# systemctl disable firewalld

\# setenforce 0

\# vi /etc/sysconfig/selinux

SELINUX=disabled

*  时间同步

\# yum install -y ntp

\# ntpdate time1.aliyun.com //同步阿里云网络时间

\# date //查看时间是否同步

*  安装必要软件

\# yum install -y vim net-tools wget telnet

*  安装openstack包

安装对应版本的epel库：

\# yum install centos-release-openstack-rocky -y

安装openstack客户端：

\# yum install python-openstackclient -y

RHEL和CentOS 默认启用SELinux。安装 openstack-selinux软件包以自动管理OpenStack服务的安全策略：

\# yum install openstack-selinux -y

*  数据库安装

安装包：

\# yum install mariadb mariadb-server python2-PyMySQL -y

创建和编辑配置文件 /etc/my.cnf.d/openstack.cnf：

\# vi /etc/my.cnf.d/openstack.cnf

\[mysqld\]  
bind-address = 192.168.80.184  
default-storage-engine = innodb  
innodb\_file\_per\_table = on  
max\_connections = 4096  
collation-server = utf8\_general\_ci  
character-set-server = utf8

设置启动数据库：

\# systemctl enable mariadb.service  
\# systemctl start mariadb.service

通过运行mysql\_secure\_installation 脚本来保护数据库服务。特别是，为数据库root帐户选择合适的密码 ：

\# mysql\_secure\_installation

\# Enter current password for root (enter for none)： Enter(回车) //输入根目录的当前密码（输入表示无）

\# Set root password? \[Y/n\] y //是否设置root密码

\# New password:

\# Re-enter new password:

\# Remove anonymous users? \[Y/n\] y // 是否删除匿名用户

\# Disallow root login remotely? \[Y/n\] y // 是否禁止root远程登陆

\# Remove test database and access to it? \[Y/n\] y //是否删除test库

\# Reload privilege tables now? \[Y/n\] y //加载权限表

Thanks for using MariaDB!

*  安装消息队列

安装rabbitmq：

\# yum install rabbitmq-server -y

启动rabbitmq：

\# systemctl enable rabbitmq-server.service  
\# systemctl start rabbitmq-server.service

使用此插件实现web管理：  
\# rabbitmq-plugins enable rabbitmq\_management

验证是否开启成功  
\# netstat -anpt | grep 5672

浏览器访问：192.168.80.184:15672

用户名 密码皆为 guest

![image.png][image.png 2]

**添加openstack用户**

添加的用户名为openstack，密码也是openstack

\# rabbitmqctl add\_user openstack openstack

对openstack用户进行读写授权：

\# rabbitmqctl set\_permissions openstack ".\*" ".\*" ".\*"

*  安装Memcached

安装Memacached：

\# yum install memcached python-memcached -y

编辑/etc/sysconfig/memcached，修改配置

\# vi /etc/sysconfig/memcached

PORT="11211"  
USER="memcached"  
MAXCONN="1024"  
CACHESIZE="64"  
OPTIONS="-l 127.0.0.1,::1,192.168.80.184"

注： 修改部分为 （ ,+本机ip）

启动memcached：

\# systemctl enable memcached.service  
\# systemctl start memcached.service

验证有没有开启  
\# netstat -anpt | grep memcache

到此环境部署完成。

--------------------

**控制节点：**开始安装openstack服务

**keystone服务安装**

配置keystone数据库：

使用数据库访问客户端以root用户身份连接到数据库服务器：

\# mysql -u root -p

创建keystone数据库,授予对keystone数据库的适当访问权限：

> CREATE DATABASE keystone;

> GRANT ALL PRIVILEGES ON keystone.\* TO 'keystone'@'localhost' IDENTIFIED BY 'keystone';

> GRANT ALL PRIVILEGES ON keystone.\* TO 'keystone'@'%' IDENTIFIED BY 'keystone';

> quit

安装配置keystone

运行以下命令以安装软件包：

\# yum install openstack-keystone httpd mod\_wsgi -y

编辑/etc/keystone/keystone.conf文件并完成以下操作：  
\# cd /etc/keystone/

\# cp keystone.conf keystone.conf.bak //以防误操作，尽量先将配置文件备份一份  
\# egrep -v "^\#|^$" keystone.conf.bak > keystone.conf

\# vi keystone.conf

\[database\]  
connection = mysql+pymysql://keystone:keystone@192.168.80.184/keystone  
\[token\]  
provider = fernet

填充Identity服务数据库：

\# su -s /bin/sh -c "keystone-manage db\_sync" keystone

验证数据库表  
\# mysql -ukeystone -pkeystone -e "use keystone; show tables;"

初始化Fernet密钥存储库：

\# keystone-manage fernet\_setup --keystone-user keystone --keystone-group keystone  
\# keystone-manage credential\_setup --keystone-user keystone --keystone-group keystone

引导身份服务：

admin为管理用户的密码,这里是设置密码。  
\# keystone-manage bootstrap --bootstrap-password admin \\  
\--bootstrap-admin-url http://192.168.80.184:5000/v3/ \\  
\--bootstrap-internal-url http://192.168.80.184:5000/v3/ \\  
\--bootstrap-public-url http://192.168.80.184:5000/v3/ \\  
\--bootstrap-region-id RegionOne

**配置Apache HTTP服务**  
  
编辑/etc/httpd/conf/httpd.conf  
\# vi /etc/httpd/conf/httpd.conf

ServerName 192.168.80.184

创建/usr/share/keystone/wsgi-keystone.conf文件的链接：

\# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

启动服务

启动Apache HTTP服务并将其配置为在系统引导时启动：  
\# systemctl enable httpd.service  
\# systemctl start httpd.service

**配置管理帐户**

\# export OS\_USERNAME=admin  
\# export OS\_PASSWORD=admin  
\# export OS\_PROJECT\_NAME=admin  
\# export OS\_USER\_DOMAIN\_NAME=Default  
\# export OS\_PROJECT\_DOMAIN\_NAME=Default  
\# export OS\_AUTH\_URL=http://192.168.80.184:5000/v3  
\# export OS\_IDENTITY\_API\_VERSION=3

查看全局变量是否生效  
\# env|grep ^OS

![image.png][image.png 3]

创建domain（域），projects（项目），users（用户） and roles（角色）

\# openstack domain create --description "An Example Domain" example

![image.png][image.png 4]

注：OpenStack 是动态生成 ID 的，因此您看到的输出会与示例中的命令行输出不相同。

使用默认的domain，创建service项目：用做服务。  
\# openstack project create --domain default \\  
\--description "Service Project" service

![image.png][image.png 5]

创建myproject项目：用做常规（非管理员）任务应使用非特权项目和用户。  
\# openstack project create --domain default \\  
\--description "Demo Project" myproject

![image.png][image.png 6]

**创建myuser用户：**

创建用户需要设置密码  
\# openstack user create --domain default \\  
\--password-prompt myuser

![image.png][image.png 7]

注：密码自定义

**创建myrole角色：**  
\# openstack role create myrole

![image.png][image.png 8]

将myuser添加到myproject项目中并赋予myrole的角色：  
\# openstack role add --project myproject --user myuser myrole

验证用户  
取消设置临时 变量OS\_AUTH\_URL和OS\_PASSWORD环境变量：  
\# unset OS\_AUTH\_URL OS\_PASSWORD

作为admin用户，请求身份验证令牌：  
执行后需要输入admin密码

\# openstack --os-auth-url http://192.168.80.184:5000/v3 \\  
\--os-project-domain-name Default --os-user-domain-name Default \\  
\--os-project-name admin --os-username admin token issue

![image.png][image.png 9]

注：

![image.png][image.png 10] 用户名密码皆为admin

作为myuser用户，请求身份验证令牌：  
\# openstack --os-auth-url http://192.168.80.184:5000/v3 \\  
\--os-project-domain-name Default --os-user-domain-name Default \\  
\--os-project-name myproject --os-username myuser token issue

![image.png][image.png 11]

注：上面注册之后输入的密码

![image.png][image.png 12]

**创建openstack 客户端环境脚本**

openstack客户端通过添加参数或使用环境变量的方式来与Identity服务进行交互，为了提高效率，创建环境脚本：

创建admin用户环境脚本：admin-openstack.sh

\# vi admin-openstack.sh

export OS\_USERNAME=admin  
export OS\_PASSWORD=admin  
export OS\_PROJECT\_NAME=admin  
export OS\_USER\_DOMAIN\_NAME=Default  
export OS\_PROJECT\_DOMAIN\_NAME=Default  
export OS\_AUTH\_URL=http://192.168.80.184:5000/v3  
export OS\_IDENTITY\_API\_VERSION=3

创建myuser用户环境脚本：demo-openstack.sh

\# vi demo-openstack.sh

export OS\_USER\_DOMAIN\_NAME=Default  
export OS\_PROJECT\_NAME=myproject  
export OS\_USERNAME=myuser  
export OS\_PASSWORD=myuser  
export OS\_AUTH\_URL=http://192.168.80.184:5000/v3  
export OS\_IDENTITY\_API\_VERSION=3  
export OS\_IMAGE\_API\_VERSION=2

使用脚本

\# source admin-openstack.sh 或者 demo-openstack.sh

\# openstack token issue //请求身份验证令牌![image.png][image.png 13]

转载于:https://blog.51cto.com/14188767/2382100

[image.png]: https://s1.51cto.com/images/20190421/1555776036898138.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[image.png 1]: https://s1.51cto.com/images/20190420/1555774258209090.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[image.png 2]: https://s1.51cto.com/images/20190420/1555770284199713.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[image.png 3]: https://s1.51cto.com/images/20190420/1555774972853749.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[image.png 4]: https://s1.51cto.com/images/20190420/1555775022881584.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[image.png 5]: https://s1.51cto.com/images/20190420/1555775094100069.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[image.png 6]: https://s1.51cto.com/images/20190420/1555775121464405.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[image.png 7]: https://s1.51cto.com/images/20190420/1555775193428950.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[image.png 8]: https://s1.51cto.com/images/20190420/1555775231742511.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[image.png 9]: https://s1.51cto.com/images/20190420/1555775627132219.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[image.png 10]: https://s1.51cto.com/images/20190420/1555775328502226.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[image.png 11]: https://s1.51cto.com/images/20190420/1555775661605084.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[image.png 12]: https://s1.51cto.com/images/20190420/1555775528932067.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[image.png 13]: https://s1.51cto.com/images/20190420/1555775849139606.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=