1.安装Identity service（Keystone）
1.0 Identity service 简介
身份认证模块主要提供身份验证、授权、提供service目录（每个服务安装完了都要在这里注册）等服务。通常安装在controller节点上。一般用户要先通过Identity service获得授权后然后和其他的service进行交互。其他的服务利用Identity service确认用户身份、发现其他服务的位置。Identity service由以下三部分组成：
| 组成部分 | 描述 |
|---|---|
| Server | 使用RESTful接口的方式进行身份认证和授权 |
| Drivers | 存取身份信息 |
| Modules | 中间件模块 |
1.1 安装Identity service
1.1.1 数据库准备
创建数据库并设置授权
mysql MariaDB [(none)]> CREATE DATABASE keystone; MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'openstack'; MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'openstack';
1.1.2 安装配置软件
1.1.2.1.安装keystone 、apache2、libapache2-mod-wsgi
apt install keystone apache2 libapache2-mod-wsgi
1.1.2.2.修改keystone配置
vi /etc/keystone/keystone.conf
在database节添加如下内容：
[database] # ... connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone #这里这个KEYSTONE_DBPASS是刚刚设置的mysql里面keyston用户的密码
在token节添加如下内容,设置provider为fernet：
[token] # ... provider = fernet
1.1.2.3.迁移Identity service的数据库
su -s /bin/sh -c "keystone-manage db_sync" keystone
1.1.2.4.初始化Fernet key repositories
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
1.1.2.5.引导keystone
#ADMIN_PASS替换为自己的设置的密码 keystone-manage bootstrap --bootstrap-password ADMIN_PASS \ --bootstrap-admin-url http://controller:5000/v3/ \ --bootstrap-internal-url http://controller:5000/v3/ \ --bootstrap-public-url http://controller:5000/v3/ \ --bootstrap-region-id RegionOne
1.1.2.6.设置apache2
vi /etc/apache2/apache2.conf
添加如下内容
ServerName controller
重启apache2
service apache2 restart
1.1.2.7.导入环境变量
export OS_USERNAME=admin export OS_PASSWORD=ADMIN_PASS export OS_PROJECT_NAME=admin export OS_USER_DOMAIN_NAME=Default export OS_PROJECT_DOMAIN_NAME=Default export OS_AUTH_URL=http://controller:5000/v3 export OS_IDENTITY_API_VERSION=3 #ADMIN_PASS替换成刚刚引导keystone设置的keystone密码
1.1.3 创建域、项目、用户和规则
1.创建域
root@ubuntu-ControllerNode:/etc/apache2# openstack domain create --description "An Example Domain" example +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | An Example Domain | | enabled | True | | id | f974e67265a8422c8e3ab330b063d629 | | name | example | | tags | [] | +-------------+----------------------------------+
2.创建项目 首先创建一个用来管理的service项目
root@ubuntu-ControllerNode:/etc/apache2# openstack project create --domain default --description "Service Project" service +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | Service Project | | domain_id | default | | enabled | True | | id | fcb7986d7e544426a3f1162e0edbcaf7 | | is_domain | False | | name | service | | parent_id | default | | tags | [] | +-------------+----------------------------------+
然后创建一个普通项目myproject
openstack project create --domain default --description "Demo Project" myproject +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | Demo Project | | domain_id | default | | enabled | True | | id | 34033e75e58b4fe7af481d6df891f92c | | is_domain | False | | name | myproject | | parent_id | default | | tags | [] | +-------------+----------------------------------+
3.创建一个用户
root@ubuntu-ControllerNode:~# openstack user create --domain default --password-prompt myuser #要求设置一个该用户的密码 User Password: Repeat User Password: +---------------------+----------------------------------+ | Field | Value | +---------------------+----------------------------------+ | domain_id | default | | enabled | True | | id | 23ee05e8ca9a41db92eae7df293f2933 | | name | myuser | | options | {} | | password_expires_at | None | +---------------------+----------------------------------+
4.创建规则
root@ubuntu-ControllerNode:~# openstack role create myrole +-----------+----------------------------------+ | Field | Value | +-----------+----------------------------------+ | domain_id | None | | id | c089e2053e9c4601b69b514d16709422 | | name | myrole | +-----------+----------------------------------+
5.设置规则
openstack role add --project myproject --user myuser myrole
2.检测Identity service安装情况
1.取消环境变量
unset OS_AUTH_URL OS_PASSWORD
2.测试admin用户身份认证
root@ubuntu-ControllerNode:~# openstack --os-auth-url http://controller:5000/v3 \ --os-project-domain-name Default --os-user-domain-name Default \ --os-project-name admin --os-username admin token issue Password: +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires | 2019-01-09T09:32:04+0000 | | id | gAAAAABcNbGEpi1vfFJ2059WAfcTLCdbTIQZhV6kCewqssAjxJv5XoHtK0Mc-V4rVpYjG9wsNXhEMm-w01YK5TkP8SXYaQcqaENGlFMdWuwsNN3lxyNL1JX-WMrijRmB1JXSTaMMcjC05CLQP-9aznd-jh9T8bMIxg8eQc6fJoGSjMUclsMRp3A | | project_id | 37bb7182137c419995a57ccea6e2eff8 | | user_id | 2791f0fa251e4de28b314b86a0faaba9 | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
3.测试myuer用户获取token
root@ubuntu-ControllerNode:~# openstack --os-auth-url http://controller:5000/v3 \ --os-project-domain-name Default --os-user-domain-name Default \ --os-project-name myproject --os-username myuser token issue Password: +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires | 2019-01-09T09:34:03+0000 | | id | gAAAAABcNbH7Ih6qGbFDOYbVaG-YRVkvZetqhJN195hu-zuojyQLTjUHEGqTZvhW7KahVp4qXYJUmrOneR3Pi8YNM4qneJaGbOU7RR6b8bhCv3E8cDoymvz5WspIE8cFHvFL3hGSeS4YX7aBp7vtQ8N1t6rEfC6E7l9Ns8ziC__sycEWM4LFuYM | | project_id | 34033e75e58b4fe7af481d6df891f92c | | user_id | 23ee05e8ca9a41db92eae7df293f2933 | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
3.创建openstack客户端环境变量脚本
为了方便后期使用openstak client，建议创建一个环境变量脚本admin.opensrc，如下：
#将ADMIN_PASS修改为自己的admin密码 export OS_PROJECT_DOMAIN_NAME=Default export OS_USER_DOMAIN_NAME=Default export OS_PROJECT_NAME=admin export OS_USERNAME=admin export OS_PASSWORD=ADMIN_PASS export OS_AUTH_URL=http://controller:5000/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2
使用时只需要使用如下命令导入环境变量即可：
. admin.opensrc