私有云落地解决方案之openstack高可用（pike版本）-keystone

时间：2022-08-04 17:12:05

作者：【吴业亮】

博客：http://blog.csdn.net/wylfengyujiancheng

1、安装软件包（三个节点）

yum install memcached python-memcached -y

2、修改memcache配置文件（三个节点）
修改vim /etc/sysconfig/memcached配置文件

cat <<END > /etc/sysconfig/memcached
PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="64"
OPTIONS="-l 0.0.0.0"
END

3、启动服务并设置开机启动（三个节点）

systemctl enable memcached.service
systemctl restart memcached.service

4、安装keystone软件包（三个节点）

yum install openstack-keystone httpd mod_wsgi mod_ssl -y

5、修改httpd配置文件（三个节点）

# cp -a /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf_bak 
# sed -i "s/#ServerName www.example.com:80/ServerName ${HOSTNAME}/" /etc/httpd/conf/httpd.conf

节点1

# sed -i "s/Listen\ 80/Listen\ 172.16.8.60:80/g" /etc/httpd/conf/httpd.conf

节点2

sed -i "s/Listen\ 80/Listen\ 172.16.8.60:80/g" /etc/httpd/conf/httpd.conf

节点3

sed -i "s/Listen\ 80/Listen\ 172.16.8.60:80/g" /etc/httpd/conf/httpd.conf

6、创建数据库（任一节点）

mysql -u root -pChangeme_123
Create the keystone database:

MariaDB [(none)]> CREATE DATABASE keystone;
Grant proper access to the keystone database:

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \
IDENTIFIED BY 'Changeme_123';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \
IDENTIFIED BY 'Changeme_123';

7、修改配置文件（三个节点）

# cp -a /etc/keystone/keystone.conf /etc/keystone/keystone.conf_bak
# vi /etc/keystone/keystone.conf
[DEFAULT]
[assignment]
[auth]
[cache]
memcache_servers = node1:11211,node2:11211,node3:11211
[catalog]
[cors]
[credential]
[database]
connection = mysql+pymysql://keystone:Changeme_123@172.16.8.50/keystone
[domain_config]
[endpoint_filter]
[endpoint_policy]
[eventlet_server]
[federation]
[fernet_tokens]
[healthcheck]
[identity]
[identity_mapping]
[ldap]
[matchmaker_redis]
[memcache]
[oauth1]
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_messaging_zmq]
[oslo_middleware]
[oslo_policy]
[paste_deploy]
[policy]
[profiler]
[resource]
[revoke]
[role]
[saml]
[security_compliance]
[shadow_users]
[signing]
[token]
provider = fernet
driver = memcache
[tokenless_auth]
[trust]

8、同步数据库（任一节点）

su -s /bin/sh -c "keystone-manage db_sync" keystone

9、初始化密钥（node1上执行）

keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

10、拷贝密钥（node1上执行）

# cd /etc/keystone/


# scp -r credential-keys/ fernet-keys/ node2:$PWD

# scp -r credential-keys/ fernet-keys/ node3:$PWD

11、赋予权限（节点2和3）

# chown keystone:keystone /etc/keystone/credential-keys/ -R
# chown keystone:keystone /etc/keystone/fernet-keys/ -R

12、初始化（任一节点）

#  keystone-manage bootstrap --bootstrap-password Changeme_123 \
  --bootstrap-admin-url http://172.16.8.50:35357/v3/ \
  --bootstrap-internal-url http://172.16.8.50:5000/v3/ \
  --bootstrap-public-url http://172.16.8.50:5000/v3/ \
  --bootstrap-region-id RegionOne

注意不要有windows字符串 ，也可从该出复制后修改
https://docs.openstack.org/keystone/pike/install/keystone-install-rdo.html

13、创建文件/etc/httpd/conf.d/wsgi-keystone.conf（各个节点）

Listen 172.16.8.60:5000
Listen 172.16.8.60:35357

<VirtualHost 172.16.8.60:5000>
    WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-public
    WSGIScriptAlias / /usr/bin/keystone-wsgi-public
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    LimitRequestBody 114688
<IfVersion >= 2.4>
      ErrorLogFormat "%{cu}t %M"
</IfVersion>
    ErrorLog /var/log/httpd/keystone.log
    CustomLog /var/log/httpd/keystone_access.log combined

<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
            Allow from all
</IfVersion>
</Directory>
</VirtualHost>

<VirtualHost 172.16.8.60:35357>
    WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-admin
    WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    LimitRequestBody 114688
<IfVersion >= 2.4>
      ErrorLogFormat "%{cu}t %M"
</IfVersion>
    ErrorLog /var/log/httpd/keystone.log
    CustomLog /var/log/httpd/keystone_access.log combined

<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
            Allow from all
</IfVersion>
</Directory>
</VirtualHost>

Alias /identity /usr/bin/keystone-wsgi-public
<Location /identity>
    SetHandler wsgi-script
    Options +ExecCGI

    WSGIProcessGroup keystone-public
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
</Location>

Alias /identity_admin /usr/bin/keystone-wsgi-admin
<Location /identity_admin>
    SetHandler wsgi-script
    Options +ExecCGI

    WSGIProcessGroup keystone-admin
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
</Location>

注意：替换各个节点的IP

14、启动服务并设置开机启动 

# systemctl enable httpd.service
# systemctl restart httpd.service

创建文件~/keystonerc并写入如下内容 

export OS_USERNAME=admin
export OS_PASSWORD=Changeme_123
export OS_PROJECT_NAME=admin
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default
export OS_AUTH_URL=http://172.16.8.50:35357/v3
export OS_IDENTITY_API_VERSION=3 
export OS_IMAGE_API_VERSION=2

15、创建service项目

# openstack project create --domain default --description "Service Project" service

16、创建demo项目以及demo用户,并为用户创建密码

# openstack project create --domain default --description "Demo Project" demo
# openstack user create --domain default --password-prompt demo

17、创建user角色。并将demo用户赋予user角色

# openstack role create user
# openstack role add --project demo --user demo user

18、 验证

# unset OS_AUTH_URL OS_PASSWORD
openstack --os-auth-url http://172.16.8.50:35357/v3 \
--os-project-domain-name Default --os-user-domain-name Default \
--os-project-name admin --os-username admin token issue
 openstack --os-auth-url http://172.16.8.50:5000/v3 \
--os-project-domain-name Default --os-user-domain-name Default \
--os-project-name demo --os-username demo token issue

19、写入系统变量中（各个节点）

# echo "source ~/keystonerc " >> ~/.bash_profile
# source ~/.bash_profile
标签：

相关文章