一、安装配置控制节点
1.创建数据库并添加权限
mysql -uroot -p123123
CREATE DATABASE keystone;
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY '123123’;
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY '123123';
exit
2.生成一个随机值在初始的配置中作为管理员的令牌
openssl rand -hex 10
3.安装keystone
yum install openstack-keystone httpd mod_wsgi
4.编辑文件/etc/keystone/keystone.conf
vim /etc/keystone/keystone.conf
[DEFAULT]
admin_token = ADMIN_TOKEN #ADMIN_TOKEN是上一步产生的管理员令牌的值
[database]
connection = mysql+pymysql://keystone:[email protected]/keystone
[token]
provider = fernet
5.初始化身份认证服务的数据库
su -s /bin/sh -c "keystone-manage db_sync" keystone ##忽略所有输出
6.初始化FernetKeys
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
7.配置ApacheHTTP服务器
1）编辑/etc/httpd/conf/httpd.conf文件
vi /etc/httpd/conf/httpd.conf
ServerName controller ##配置ServerName为controller
2）创建文件/etc/httpd/conf.d/wsgi-keystone.conf
vi/etc/httpd/conf.d/wsgi-keystone.conf
Listen 5000
Listen 35357
<VirtualHost *:5000>
WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-public
WSGIScriptAlias / /usr/bin/keystone-wsgi-public
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
ErrorLogFormat "%{cu}t %M"
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
Require all granted
</Directory>
</VirtualHost>
<VirtualHost *:35357>
WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-admin
WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
ErrorLogFormat "%{cu}t %M"
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
Require all granted
</Directory>
</VirtualHost>
:wq
3）启动ApacheHTTP服务并配置其随系统启动
systemctl enable httpd.service
systemctl start httpd.service
二、创建服务实体和API端点
1.创建环境变量
export OS_TOKEN=ADMIN_TOKEN ##前面生成的认证令牌
export OS_URL=http://controller:35357/v3
export OS_IDENTITY_API_VERSION=3
2.创建服务实体和API端点
openstack service create --name keystone --description "OpenStack Identity" identity
openstack endpoint create --region RegionOne identity public http://controller:5000/v3
openstack endpoint create --region RegionOne identity internal http://controller:5000/v3
openstack endpoint create --region RegionOne identity admin http://controller:35357/v3
三、创建域、项目、用户和角色
1.创建域default
openstack domain create --description "Default Domain" default
2.创建admin项目
openstack project create --domain default --description "Admin Project" admin
3.创建admin用户
openstack user create --domain default --password-prompt admin #提示输入admin密码
4.创建admin角色
openstack role create admin
5.添加admin角色到admin项目和用户上
openstack role add --project admin --user admin admin
6.创建service项目
openstack project create --domain default --description "Service Project" service
7.创建demo项目
openstack project create --domain default --description "Demo Project" demo
8.创建demo用户
openstack user create --domain default --password-prompt demo #提示输入demo用户密码
9.创建user角色
openstack role create user
10.添加user角色到demo项目和用户
openstack role add --project demo --user demo user
四、验证操作
1.编辑/etc/keystone/keystone-paste.ini 文件，从[pipeline:public_api]`[pipeline:admin_api]和[pipeline:api_v3]部分删除admin_token_auth
2.重置OS_TOKEN和OS_URL环境变量
unset OS_TOKEN OS_URL
3.作为admin用户，请求认证令牌
openstack --os-auth-url http://controller:35357/v3 --os-project-domain-name default --os-user-domain-namedefault --os-project-name admin --os-username admin token issue ##输入admin用户的密码
4.作为demo用户，请求认证令牌
openstack --os-auth-url http://controller:5000/v3 --os-project-domain-name default --os-user-domain-namedefault --os-project-name demo --os-username demo token issue ##输入demo用户的密码
五、创建openstack客户端环境脚本
1.编辑文件 admin-openrc 并添加如下内容：
vim /root/admin-openrc.sh
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=123123 #改为admin用户密码
export OS_AUTH_URL=http://controller:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
2.编辑文件demo-openrc并添加如下内容
vim /root/demo-openrc.sh
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=123123 #改为demo用户密码
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
3.测试，使用admin环境变量
source /root/admin-openrc.sh
openstack token issue #获取admin用户的认证令牌
转载于:https://blog.51cto.com/19941212/1900500