openstack-6:安装keystone、memcache和注册keystone

安装keystone：用户认证和用户行为跟踪，openstack所有的服务都需要在keystone上面注册
User用户：
Tenant：租户 项目
Token：令牌
Role：角色

Service: 服务
Endpoint：端点

yum install openstack-keystone httpd mod_wsgi memcached python-memcached -y

修改配置文件
cd /etc/keystone/
cp keystone.conf keystone.conf.bak

生成一个随机的10位admin_token
cdbcda72d620891f64b0

vi keystone.conf
admin_token = cdbcda72d620891f64b0
[database]
connection = mysql+pymysql://keystone:keystone@192.168.56.11/keystone
[memcache]
servers = 192.168.56.11:11211
[token]
provider = rernet
driver = memcache
[revoke]
driver = sql

vi /etc/sysconfig/memcached
OPTIONS="-l 192.168.56.11,::1"

启动memcache、keystone
systemctl enable memcached.service
systemctl start memcached.service

同步数据库
切换用户到keystone
su -s /bin/sh -c "keystone-manage db_sync" keystone
查看数据库keystone是否有表
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

keystone-manage bootstrap --bootstrap-password admin \
--bootstrap-admin-url http://192.168.56.11:35357/v3/ \
--bootstrap-internal-url http://192.168.56.11:35357/v3/ \
--bootstrap-public-url http://192.168.56.11:5000/v3/ \
--bootstrap-region-id RegionOne
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
复制配置文件
cp /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/wsgi-keystone.conf
ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

配置httpd.conf
vi /etc/httpd/conf/httpd.conf
ServerName 192.168.56.11:80

关闭selinux
vi /etc/selinux/config
SELINUX=disable
setenforce 0

重启httpd
systemctl enable httpd
systemctl start httpd

设置环境变量
vim /etc/keystone/keystone.sh
export OS_TOKEN=cdbcda72d620891f64b0
export OS_URL=http://192.168.56.11:35357/v3
export OS_IDENTITY_API_VERSION=3

执行source /etc/keystone/keystone.sh

############################################################
openstack配置
创建默认域default
openstack domain create --description "Default Domain" default
在默认域创建项目admin
openstack project create --domain default --description "Admin Project" admin
创建用户admin
openstack user create --domain default --password-prompt admin
输入密码也是admin

创建admin的角色
openstack role create admin

把admin用户admin1项目2用户3角色
openstack role add --project admin --user admin admin

创建demo项目
openstack project create --domain default --description "Demo Project" demo
创建用户demo
openstack user create --domain default --password-prompt demo
密码也是demo
创建角色uer
openstack role create user
把demo用户绑定到demo项目的user角色中
openstack role add --project demo --user demo user

创建项目，各个组件用
openstack project create --domain default --description "Service Project" service

创建keystone的service
openstack service create --name keystone --description "OpenStack Identity" identity
openstack endpoint create --region RegionOne identity public http://192.168.56.11:5000/v3
openstack endpoint create --region RegionOne identity internal http://192.168.56.11:5000/v3
openstack endpoint create --region RegionOne identity admin http://192.168.56.11:35357/v3

删除环境变量
unset OS_TOKEN
unset OS_URL
不让使用admin_token了，这样安全
vi /etc/keystone/keystone-paste.ini
从[pipeline:public_api], [pipeline:admin_api],[pipeline:api_v3] 删除admin_token_auth

admin用户请求获取token
openstack --os-auth-url http://192.168.56.11:35357/v3 --os-project-domain-id default --os-user-domain-id default --os-project-name admin --os-username admin --os-auth-type password token issue

demo用户请求获取token
openstack --os-auth-url http://192.168.56.11:5000/v3 --os-project-domain-name default --os-user-domain-name default --os-project-name demo --os-username demo token issue

设置admin环境变量
vi /etc/keystone/admin-openrc
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_AUTH_URL=http://192.168.56.11:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

chmod +x /etc/keystone/admin-openrc
source /etc/keystone/admin-openrc
openstack token issue
设置demo环境变量
vi /etc/keystone/demo-openrc
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo
export OS_AUTH_URL=http://192.168.56.11:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

chmod +x /etc/keystone/demo-openrc
source /etc/keystone/demo-openrc
openstack token issue