OpenStack基础组件安装keystone身份认证服务

时间:2022-07-27 14:12:39

域名解析

vim /etc/hosts

192.168.245.172 controller01

192.168.245.171 controller02

192.168.245.173 controller03

配置源码

配置 dns 全局解释器:

vim /etc/resolv.conf

nameserver 192.168.254.251            #连接learn.yunwei.edu的内网
nameserver 223.5.5.5

wget http://download2.yunwei.edu/shell/yum-repo.sh
sh yum-repo.sh

清空,更新下源码

yum clean all (清空)

yum makecache (更新)

OpenStack 环境组件安装

由于我们配置好了公司源码,所以直接下载所需的组件

安装 OpenStack包:

1.安装启用 OpenStack 仓库的包

# yum install centos-release-openstack-ocata -y

2.安装 OpenStack 客户端

# yum install pythone-openstackclient -y

3.安装 OpenStack-selinux 软件包以便自动管理 OpenStack 服务的安全策略

# yum install openstack-selinux -y

安装 SQL 数据库:

1.安装软件包

# yum install  mariadb mariadb-server python2-PyMySQL -y

2.创建并编辑 /etc/my.cnf.d/openstack.cnf,然后完成如下动作:

在 [mysqld] 部分,设置 ``bind-address``值为控制节点的管理网络IP地址以使得其它节点可以通过管理网络访问数据库:

# cat /etc/my.cnf.d/openstack.cnf

[mysqld]
bind-address = 192.168.245.172 #绑定控制节点IP,填主机名或者Ip
default-storage-engine = innodb
innodb_file_per_table = on
max_connections = 4096
collation-server = utf8_general_ci
character-set-server = utf8

3.启动数据库服务,并将其配置为开机自启

# systemctl start mariadb.service

# systemctl enable mariadb.service

并检查端口是否存在

ss -ntl | grep 3306 或者 netstat -ntpl | grep 3306

4.为了保证数据库服务的安全性,运行 mysql_secure_installation 设置密码

# mysql_secure_installation

安装rabbitmq消息队列

yum -y install rabbitmq-server

systemctl start rabbitmq-server.service

systemctl enable rabbitmq-server.service

在rabbitmq中添加用户

rabbitmqctl add_user openstack admin

设置权限

rabbitmqctl set_permissions openstack ".*" ".*" ".*"
Setting permissions for user "openstack" in vhost "/" ...

安装memcached

yum -y install memcached python-memcached

编辑配置文件

vim /etc/sysconfig/memcached

PORT=“”
USER=“memcached”
MAXCONN=“”
CACHESIZE=“”
OPTIONS="-l 127.0.0.1,::1,controller01"

systemctl start memcached.service

systemctl enable memcached.service

Identity service安装

mysql -uroot -p123

CREATE DATABASE keystone;

建立keystone用户与权限

GRANT ALL PRIVILEGES ON keystone.* TO ‘keystone’@‘localhost’
IDENTIFIED BY ‘123’;

设置远程登录

GRANT ALL PRIVILEGES ON keystone.* TO ‘keystone’@’%’
IDENTIFIED BY ‘123’;

下载keystone httpd mod_wsgi

yum -y install openstack-keystone httpd mod_wsgi

先备份配置文件

cp /etc/keystone/keystone.conf /etc/keystone/keystone.conf.bak

编辑配置文件,在database模块中添加

[DEFAULT]

[assignment]

[auth]

[cache]

[catalog]

[cors]

[cors.subdomain]

[credential]

[database]
connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone [domain_config] [endpoint_filter] [endpoint_policy] [eventlet_server] [federation] [fernet_tokens] [healthcheck] [identity] [identity_mapping] [kvs] [ldap] [matchmaker_redis] [memcache] [oauth1] [oslo_messaging_amqp] [oslo_messaging_kafka] [oslo_messaging_notifications] [oslo_messaging_rabbit] [oslo_messaging_zmq] [oslo_middleware] [oslo_policy] [paste_deploy] [policy] [profiler] [resource] [revoke] [role] [saml] [security_compliance] [shadow_users] [signing] [token]
provider = fernet [tokenless_auth] [trust]

导入数据库

su -s /bin/sh -c “keystone-manage db_sync” keystone

mysql -ukeystone -p123

use keystone;

show tables;

+------------------------+
| access_token |
| assignment |
| config_register |
| consumer |
| credential |
| endpoint |
| endpoint_group |
| federated_user |
| federation_protocol |
| group |
| id_mapping |
| identity_provider |
| idp_remote_ids |
| implied_role |
| local_user |
| mapping |
| migrate_version |
| nonlocal_user |
| password |
| policy |
| policy_association |
| project |
| project_endpoint |
| project_endpoint_group |
| region |
| request_token |
| revocation_event |
| role |
| sensitive_config |
| service |
| service_provider |
| token |
| trust |
| trust_role |
| user |
| user_group_membership |
| user_option |
| whitelisted_config |
+------------------------+
rows in set (0.00 sec)

建立管理员的用户

keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

设置keystone服务端点

keystone-manage bootstrap --bootstrap-password admin \
--bootstrap-admin-url http://controller01:35357/v3/ \
--bootstrap-internal-url http://controller01:5000/v3/ \
--bootstrap-public-url http:///controller01:5000/v3/ \
--bootstrap-region-id RegionOne

链接keystone的配置文件

ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/ #软链接

开启httpd服务

systemctl start httpd.service

systemctl enable httpd.service

httpd中写入服务器的地址

vim /etc//httpd/conf/httpd.conf  #在ServerName模块下写入

ServerName comtroller01

systemctl restart httpd

宣告环境变量

vim openrc

export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_PROJECT_NAME=admin
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default
export OS_AUTH_URL=http://controller01:35357/v3
export OS_IDENTITY_API_VERSa

source openrc 启动环境变量

显示如下则为成功

openstack user list

OpenStack基础组件安装keystone身份认证服务

创建名为service的项目

openstack project create --domain default \
  --description "Service Project" service

OpenStack基础组件安装keystone身份认证服务

创建demo项目

openstack project create --domain default \
  --description "Demo Project" demo
OpenStack基础组件安装keystone身份认证服务

创建demo项目的用户,并设置为管理员

openstack user create --domain default \
  --password=demo demo

OpenStack基础组件安装keystone身份认证服务

创建用户user的角色

openstack role create user

OpenStack基础组件安装keystone身份认证服务

在项目demo中添加角色,并设为普通

openstack role add --project demo --user demo user