高可用OpenStack（Queen版）集群-4.keystone集群

时间：2022-06-04 10:53:28

参考文档：

  1. Install-guide：https://docs.openstack.org/install-guide/
  2. OpenStack High Availability Guide：https://docs.openstack.org/ha-guide/index.html
  3. 理解Pacemaker：http://www.cnblogs.com/sammyliu/p/5025362.html
  4. Ceph: http://docs.ceph.com/docs/master/start/intro/

八．Keystone集群

1. 创建keystone数据库

# 在任意控制节点创建数据库，数据库自动同步，以controller01节点为例；

[root@controller01 ~]# mysql -uroot -pmysql_pass

MariaDB [(none)]> CREATE DATABASE keystone;

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'keystone_dbpass';

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone_dbpass';

MariaDB [(none)]> flush privileges;

MariaDB [(none)]> exit;

2. 安装keystone

# 在全部控制节点安装keystone，以controller01节点为例；

[root@controller01 ~]# yum install openstack-keystone httpd mod_wsgi mod_ssl -y

3. 配置keystone.conf

# 在全部控制节点设置，以controller01节点为例；

# 红色加粗字体为修改部分

[root@controller01 ~]# cp /etc/keystone/keystone.conf /etc/keystone/keystone.conf.bak

[root@controller01 ~]# egrep -v "^$|^#" /etc/keystone/keystone.conf

[DEFAULT]

[application_credential]

[assignment]

[auth]
[cache]

backend = oslo_cache.memcache_pool

enabled = true

memcache_servers = controller01:11211,controller02:11211,controller03:11211

[catalog]

[cors]

[credential]
[database]

connection = mysql+pymysql://keystone:keystone_dbpass@controller/keystone

[domain_config]

[endpoint_filter]

[endpoint_policy]

[eventlet_server]

[federation]

[fernet_tokens]

[healthcheck]

[identity]

[identity_mapping]

[ldap]

[matchmaker_redis]

[memcache]

[oauth1]

[oslo_messaging_amqp]

[oslo_messaging_kafka]

[oslo_messaging_notifications]

[oslo_messaging_rabbit]

[oslo_messaging_zmq]

[oslo_middleware]

[oslo_policy]

[paste_deploy]

[policy]

[profiler]

[resource]

[revoke]

[role]

[saml]

[security_compliance]

[shadow_users]

[signing]
[token]

provider = fernet

[tokenless_auth]

[trust]

[unified_limit]

4. 同步keystone数据库

# 任意控制节点操作

[root@controller01 ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone

#　查看验证

[root@controller01 ~]# mysql -h controller01 -ukeystone -pkeystone_dbpass -e "use keystone;show tables;"

5. 初始化fernet秘钥

# 选定任意控制节点（controller01）做fernet秘钥初始化，在/etc/keystone/生成相关秘钥及目录

[root@controller01 ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

[root@controller01 ~]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

# 向controller02/03节点同步秘钥

[root@controller01 ~]# scp -r /etc/keystone/fernet-keys/ /etc/keystone/credential-keys/ root@172.30.200.32:/etc/keystone/

[root@controller01 ~]# scp -r /etc/keystone/fernet-keys/ /etc/keystone/credential-keys/ root@172.30.200.33:/etc/keystone/

# 同步后，注意controller02/03节点上秘钥权限

[root@controller02 ~]# chown keystone:keystone /etc/keystone/credential-keys/ -R

[root@controller02 ~]# chown keystone:keystone /etc/keystone/fernet-keys/ -R

[root@controller03 ~]# chown keystone:keystone /etc/keystone/credential-keys/ -R

[root@controller03 ~]# chown keystone:keystone /etc/keystone/fernet-keys/ -R

6. 配置httpd.conf

# 在全部控制节点设置，以controller01节点为例；

[root@controller01 ~]# cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.bak

[root@controller01 ~]# sed -i "s/#ServerName www.example.com:80/ServerName ${HOSTNAME}/" /etc/httpd/conf/httpd.conf

# 注意不同的节点替换不同的ip地址

[root@controller01 ~]# sed -i "s/Listen\ 80/Listen\ 172.30.200.31:80/g" /etc/httpd/conf/httpd.conf

[root@controller02 ~]# sed -i "s/Listen\ 80/Listen\ 172.30.200.32:80/g" /etc/httpd/conf/httpd.conf

[root@controller03 ~]# sed -i "s/Listen\ 80/Listen\ 172.30.200.33:80/g" /etc/httpd/conf/httpd.conf

7. 配置wsgi-keystone.conf

# 在全部控制节点操作，以controller01节点为例；

# 复制wsgi-keystone.conf文件；

# 或者针对wsgi-keystone.conf创建软链接

[root@controller01 ~]# cp /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

# 修改wsgi-keystone.conf文件，注意各节点对应的ip地址或主机名等，以controller01节点为例

[root@controller01 ~]# sed -i "s/Listen\ 5000/Listen\ 172.30.200.31:5000/g" /etc/httpd/conf.d/wsgi-keystone.conf

[root@controller01 ~]# sed -i "s/Listen\ 35357/Listen\ 172.30.200.31:35357/g" /etc/httpd/conf.d/wsgi-keystone.conf

[root@controller01 ~]# sed -i "s/*:5000/172.30.200.31:5000/g" /etc/httpd/conf.d/wsgi-keystone.conf

[root@controller01 ~]# sed -i "s/*:35357/172.30.200.31:35357/g" /etc/httpd/conf.d/wsgi-keystone.conf

8. 认证引导

# 任意控制节点操作；

# 初始化admin用户（管理用户）与密码，3种api端点，服务实体可用区等

[root@controller01 ~]# keystone-manage bootstrap --bootstrap-password admin_pass \

  --bootstrap-admin-url http://controller:35357/v3/ \

  --bootstrap-internal-url http://controller:5000/v3/ \

  --bootstrap-public-url http://controller:5000/v3/ \

  --bootstrap-region-id RegionTest 

9. 启动服务

# 在全部控制节点操作，以controller01节点为例

[root@controller01 ~]# systemctl enable httpd.service

[root@controller01 ~]# systemctl restart httpd.service

[root@controller01 ~]# systemctl status httpd.service

10. 创建domain, projects, users, 与roles

1）domain

# projrct/user等基于domain存在；

# 在”认证引导”章节中，初始化admin用户即生成”default” domain

[root@controller01 ~]# openstack domain list

高可用OpenStack（Queen版）集群-4.keystone集群

# 如果需要生成新的domain，

[root@controller01 ~]# openstack domain create --description "An Example Domain" example

[root@controller01 ~]# openstack domain list

高可用OpenStack（Queen版）集群-4.keystone集群

2）projects

# project属于某个domain；

# 以创建demo项目为例，demo项目属于”default” domain

[root@controller01 ~]# openstack project create --domain default --description "Demo Project" demo

高可用OpenStack（Queen版）集群-4.keystone集群

3）users

# user属于某个domain；

# 以创建demo用户为例，demo用户属于”default” domain

[root@controller01 ~]# openstack user create --domain default --password=demo_pass demo

高可用OpenStack（Queen版）集群-4.keystone集群

4）roles

# 创建普通用户角色（区别于admin用户）

[root@controller01 ~]# openstack role create user

高可用OpenStack（Queen版）集群-4.keystone集群

# 向demo项目的demo用户赋予user权限，

[root@controller01 ~]# openstack role add --project demo --user demo user

# 查看权限分配

[root@controller01 ~]# openstack user list

[root@controller01 ~]# openstack role list

[root@controller01 ~]# openstack role assignment list

高可用OpenStack（Queen版）集群-4.keystone集群

11. openstack client 环境变量脚本

1）admin-openrc

# openstack client环境脚本定义client调用openstack api环境变量，以方便api的调用（不必在命令行中携带环境变量）；

# 根据不同的用户角色，需要定义不同的脚本；

# 这里以“认证引导”章节定义的admin用户为例，设置其环境脚本，再根据需要分发到需要运行openstack client工具的节点；

# 一般将脚本创建在用户主目录

[root@controller01 ~]# touch admin-openrc

[root@controller01 ~]# chmod u+x admin-openrc

[root@controller01 ~]# vim admin-openrc

export OS_PROJECT_DOMAIN_NAME=Default

export OS_USER_DOMAIN_NAME=Default

export OS_PROJECT_NAME=admin

export OS_USERNAME=admin

export OS_PASSWORD=admin_pass

export OS_AUTH_URL=http://controller:5000/v3

# 从安全角度考虑，一般不对client暴露admin-api，这里admin-api与public-api共用1个vip地址

# export OS_AUTH_URL=http://controller:35357/v3

export OS_IDENTITY_API_VERSION=3

export OS_IMAGE_API_VERSION=2

# 验证

[root@controller01 ~]# openstack token issue 

高可用OpenStack（Queen版）集群-4.keystone集群

2）demo-openrc

# 同admin-openrc，注意project/user/password的区别

[root@controller01 ~]# touch demo-openrc

[root@controller01 ~]# chmod u+x demo-openrc

[root@controller01 ~]# vim demo-openrc

export OS_PROJECT_DOMAIN_NAME=Default

export OS_USER_DOMAIN_NAME=Default

export OS_PROJECT_NAME=demo

export OS_USERNAME=demo

export OS_PASSWORD=demo_pass

export OS_AUTH_URL=http://controller:5000/v3

export OS_IDENTITY_API_VERSION=3

export OS_IMAGE_API_VERSION=2

# 验证

[root@controller01 ~]# openstack token issue

高可用OpenStack（Queen版）集群-4.keystone集群

# 分发脚本

[root@controller01 ~]# scp admin-openrc demo-openrc root@172.30.200.32:~/

[root@controller01 ~]# scp admin-openrc demo-openrc root@172.30.200.33:~/

12. 设置pcs资源

# 在任意控制节点操作；

# 添加资源openstack-keystone-clone；

# pcs实际控制的是各节点system unit控制的httpd服务

[root@controller01 ~]# pcs resource create openstack-keystone systemd:httpd --clone interleave=true

[root@controller01 ~]# pcs resource

高可用OpenStack（Queen版）集群-4.keystone集群

相关文章