(三)OpenStack---M版---双节点搭建---Keystone安装和配置

比眉伴天荒 2023-06-16 07:25 21阅读 0赞

# ↓↓↓↓↓↓↓↓视频已上线B站↓↓↓↓↓↓↓↓ #

# 》》》》》》[传送门][Link 1] #

# 1.创建keystone数据库 #

# 2.创建随机密码作为管理员令牌 #

# 3.安装openstack-keystone,httpd,mod\_wsgi服务并配置 #

# 4.初始化Keystone身份认证数据库连接并验证 #

# 5.初始化Fernet keys #

# 6.配置Apache服务(Http)并启动 #

# 7.创建服务实体和API端点 #

# 8.验证 #

# 9.创建OpenStack 客户端环境脚本 #

## 1.创建keystone数据库 ##

#mysql -uroot -p000000   #此处六个零是之前运行``mysql_secure_installation``脚本,为root用户设置的密码，请根据自己的实际情况实际修改
    >create database keystone;
    > grant all privileges on keystone.* to 'keystone'@'localhost' identified by '000000';
    > grant all privileges on keystone.* to 'keystone'@'%' identified by '000000';
    
    #注解:
    第一条数据库命令是创建keystone数据库
    第二条是创建keystone用户并授予所有权限本地登陆并设置密码
    第三条是创建keystone用户并授予所有权限任意地点登陆并设置密码

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70]

## 2.创建随机密码作为管理员令牌 ##

[root@controller ~]# openssl rand -hex 10
    #生成伪随机字节输出结果为16位进制数据并指定随即长度10

## 3.安装openstack-keystone,httpd,mod\_wsgi服务并配置 ##

#yum -y install openstack-keystone httpd mod_wsgi
    
    编辑keystone.conf配置文件
    #vi /etc/keystone/keystone.conf
    
    在[DEFAULT]下添加
    admin_token = ADMIN_TOKEN  #此处的ADMIN_TOKEN为上一步生成的随机数，请用随机数替换 ADMIN_TOKEN
    
    在[database]下添加
    connection = mysql+pymysql://keystone:000000@controller/keystone    #配置数据库连接
    
    在[token]下添加
    provider = fernet   #配置Fernet UUID令牌提供者

![在这里插入图片描述][20191124224546853.png]  
![在这里插入图片描述][20191124224552598.png]  
![在这里插入图片描述][20191124224553650.png]

## 4.初始化Keystone身份认证数据库连接并验证 ##

[root@controller ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone
    [root@controller ~]# mysql -uroot -p000000 -e 'show tables from keystone;'          #检查数据库是否同步

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 1]

## 5.初始化Fernet keys ##

#keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

![在这里插入图片描述][20191124224752363.png]

## 6.配置Apache服务(Http)并启动 ##

编辑配置文件httpd.conf
    #vi /etc/httpd/conf/httpd.conf
    修改
    ServerName controller

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 2]

### 复制文件到/etc/httpd/conf.d/下 ###

#cp -p /opt/mitaka/wsgi-keystone.conf /etc/httpd/conf.d/

![在这里插入图片描述][20191124224838104.png]

启动并设置开机启动
    #systemctl start httpd
    #systemctl enable httpd

## 7.创建服务实体和API端点 ##

#### 1.配置认证令牌 ####

查看admin_token 使用此命令
    [root@controller ~]# head /etc/keystone/keystone.conf |grep admin_token

![在这里插入图片描述][20191124225017728.png]

#export OS_TOKEN=ADMIN_TOKEN   #配置认证令牌，此处ADMIN_TOKEN为之前生成的随机数，请自行替换，
    #export OS_URL=http://controller:35357/v3  #配置端点URL
    #export OS_IDENTITY_API_VERSION=3   #配置认证 API 版本

![在这里插入图片描述][20191124225037544.png]

#### 2.创建服务实体和API端点 ####

创建服务实体和身份认证服务：
    #openstack service create --name keystone --description "OpenStack Identity" identity
    
    创建认证服务的 API 端点：
    #openstack endpoint create --region RegionOne identity public http://controller:5000/v3
    #openstack endpoint create --region RegionOne identity internal http://controller:5000/v3
    #openstack endpoint create --region RegionOne identity admin http://controller:35357/v3

![在这里插入图片描述][20191124225324975.png]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 3]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 4]

#### 3.创建域，项目，用户以及角色 ####

创建域 default     #这里的default只是名字，可自行修改，但是要与后面相对应
    [root@controller ~]# openstack domain create --description "Default Domain" default  
    创建admin项目
    [root@controller ~]# openstack project create --domain default --description "Admin Project" admin
    创建admin用户
    [root@controller ~]# openstack user create --domain default --password 000000 admin  #此处六个零为admin用户的密码
    创建admin角色
    [root@controller ~]# openstack role create admin
    添加`admin` 角色到 admin 项目和用户上：
    [root@controller ~]# openstack role add --project admin --user admin admin

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 5]  
![在这里插入图片描述][20191124225634885.png]  
![在这里插入图片描述][20191124225639175.png]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 6]  
![在这里插入图片描述][20191124225644810.png]

#### 4.创建service项目,以后添加的每个服务都会添加到service项目 ####

[root@controller ~]# openstack project create --domain default --description "Service Project" service

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 7]

#### 5.创建demo项目，无特殊权限的项目，类似于普通用户组 ####

[root@controller ~]# openstack project create --domain default --description "Demo Project" demo
    创建demo用户:
    [root@controller ~]# openstack user create --domain default --password 000000 demo
    创建user角色
    [root@controller ~]# openstack role create user
    添加 user角色到 demo 项目和用户：
    [root@controller ~]# openstack role add --project demo --user demo user

![在这里插入图片描述][20191124225902795.png]  
![在这里插入图片描述][20191124225908813.png]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 8]  
![在这里插入图片描述][20191124225920262.png]

## 8.验证 ##

重置OS_TOKEN和OS_URL 环境变量:
    [root@controller ~]# unset OS_TOKEN OS_URL
    
    作为 admin 用户，请求认证令牌：
    [root@controller ~]# openstack --os-auth-url http://controller:35357/v3 --os-project-domain-name default --os-user-domain-name default --os-project-name admin --os-username admin token issue

![在这里插入图片描述][20191124225936899.png]

## 9.创建OpenStack 客户端环境脚本 ##

在/root/目录下创建脚本
    #vi /root/admin-openrc
    添加如下内容
    export OS_PROJECT_DOMAIN_NAME=default
    export OS_USER_DOMAIN_NAME=default
    export OS_PROJECT_NAME=admin
    export OS_USERNAME=admin
    export OS_PASSWORD=000000  #此处的ADMIN_PASS为之前设置的admin用户密码000000
    export OS_AUTH_URL=http://controller:35357/v3
    export OS_IDENTITY_API_VERSION=3
    export OS_IMAGE_API_VERSION=2
    
    #vi /root/demo-openrc
    添加如下内容
    export OS_PROJECT_DOMAIN_NAME=default
    export OS_USER_DOMAIN_NAME=default
    export OS_PROJECT_NAME=demo
    export OS_USERNAME=demo
    export OS_PASSWORD=000000   #这里的DEMO_PASS为之前的demo用户密码000000
    export OS_AUTH_URL=http://controller:5000/v3
    export OS_IDENTITY_API_VERSION=3
    export OS_IMAGE_API_VERSION=2

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 9]

#### 验证 ####

# . /root/admin-openrc
    #openstack token issue

![在这里插入图片描述][20191124230039632.png]

[Link 1]: https://www.bilibili.com/video/av76916516?p=4
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20191124224320351.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ=,size_16,color_FFFFFF,t_70
[20191124224546853.png]: https://img-blog.csdnimg.cn/20191124224546853.png
[20191124224552598.png]: https://img-blog.csdnimg.cn/20191124224552598.png
[20191124224553650.png]: https://img-blog.csdnimg.cn/20191124224553650.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20191124224733864.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ=,size_16,color_FFFFFF,t_70
[20191124224752363.png]: https://img-blog.csdnimg.cn/20191124224752363.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20191124224820227.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ=,size_16,color_FFFFFF,t_70
[20191124224838104.png]: https://img-blog.csdnimg.cn/20191124224838104.png
[20191124225017728.png]: https://img-blog.csdnimg.cn/20191124225017728.png
[20191124225037544.png]: https://img-blog.csdnimg.cn/20191124225037544.png
[20191124225324975.png]: https://img-blog.csdnimg.cn/20191124225324975.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/2019112422532977.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20191124225334196.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/20191124225626971.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ=,size_16,color_FFFFFF,t_70
[20191124225634885.png]: https://img-blog.csdnimg.cn/20191124225634885.png
[20191124225639175.png]: https://img-blog.csdnimg.cn/20191124225639175.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 6]: https://img-blog.csdnimg.cn/20191124225643252.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ=,size_16,color_FFFFFF,t_70
[20191124225644810.png]: https://img-blog.csdnimg.cn/20191124225644810.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 7]: https://img-blog.csdnimg.cn/2019112422574030.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ=,size_16,color_FFFFFF,t_70
[20191124225902795.png]: https://img-blog.csdnimg.cn/20191124225902795.png
[20191124225908813.png]: https://img-blog.csdnimg.cn/20191124225908813.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 8]: https://img-blog.csdnimg.cn/20191124225916191.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ=,size_16,color_FFFFFF,t_70
[20191124225920262.png]: https://img-blog.csdnimg.cn/20191124225920262.png
[20191124225936899.png]: https://img-blog.csdnimg.cn/20191124225936899.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ_size_16_color_FFFFFF_t_70 9]: https://img-blog.csdnimg.cn/20191124230011697.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZseTE1NzQ=,size_16,color_FFFFFF,t_70
[20191124230039632.png]: https://img-blog.csdnimg.cn/20191124230039632.png