CentOS7 安裝Opentack - Keystone

環境準備

目前Openstack最新版本為KILO，先安裝KILO的Repository:

[root@keystone ~]# rpm -ivh  http://rdo.fedorapeople.org/openstack-kilo/rdo-release-kilo.rpm

安裝Mariadb :

[root@keystone ~]# yum install mariadb mariadb-server MySQL-python -y

修改my.cnf :

[root@keystone ~]# vim /etc/my.cnf

[mysqld]

...

# near line 10 add

default-storage-engine = innodb

innodb_file_per_table

collation-server = utf8_general_ci

init-connect = 'SET NAMES utf8'

character-set-server = utf8

啟動MariaDB並初始化設定:

[root@keystone ~]# systemctl enable mariadb.service

[root@keystone ~]# systemctl start mariadb.service

[root@keystone ~]# mysql_secure_installation

建立keystone資料庫，並新增一個keystone的使用者 :

[root@keystone ~]# mysql -u root -p 

MariaDB [(none)]> CREATE DATABASE keystone;

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'YOURPASSWORD';

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'YOURPASSWORD';

安裝Keystone

安裝套件 :

[root@keystone ~]# yum install openstack-keystone httpd mod_wsgi python-openstackclient memcached python-memcached  -y

新版的安裝建議使用apache的wsgi模組啟動keystone，因此安裝httpd與mod_wsgi這兩個套件。

設定keystone.conf :

[root@keystone ~]# vim /etc/keystone/keystone.conf

#line 12 uncomment 
admin_token = YOURTOKEN

# line 419 uncomment
connection = mysql://keystone:YOURPASSWORD@localhost/keystone

# line 1126 uncomment

servers = localhost:11211

# line 1496 uncomment

driver = keystone.contrib.revoke.backends.sql.Revoke

# line 1685 uncomment

provider = keystone.token.providers.uuid.Provider

# line 1688 uncomment

driver = keystone.token.persistence.backends.memcache.Token

啟動memcached :

[root@keystone ~]# systemctl enable memcached.service 

[root@keystone ~]# systemctl start memcached.service 

初始化Keystone 資料庫 :

[root@keystone ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone 

設定apache mod_wsgi

新增一個wsgi的apache設定檔 :

[root@keystone ~]# vim  /etc/httpd/conf.d/wsgi-keystone.conf

# add following

Listen 5000

Listen 35357

<VirtualHost *:5000>

 WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}

 WSGIProcessGroup keystone-public

 WSGIScriptAlias / /var/www/cgi-bin/keystone/main

 WSGIApplicationGroup %{GLOBAL}

 WSGIPassAuthorization On

 LogLevel info

 ErrorLogFormat "%{cu}t %M"

 ErrorLog /var/log/httpd/keystone-error.log

 CustomLog /var/log/httpd/keystone-access.log combined

</VirtualHost>

<VirtualHost *:35357>

 WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}

 WSGIProcessGroup keystone-admin

 WSGIScriptAlias / /var/www/cgi-bin/keystone/admin

 WSGIApplicationGroup %{GLOBAL}

 WSGIPassAuthorization On

 LogLevel info

 ErrorLogFormat "%{cu}t %M"

 ErrorLog /var/log/httpd/keystone-error.log

 CustomLog /var/log/httpd/keystone-access.log combined

</VirtualHost>

建立執行的資料夾，並下載執行檔 :

[root@keystone ~]# mkdir -p /var/www/cgi-bin/keystone
[root@keystone ~]# curl http://git.openstack.org/cgit/openstack/keystone/plain/httpd/keystone.py?h=stable/kilo | tee /var/www/cgi-bin/keystone/main /var/www/cgi-bin/keystone/admin

修改權限並啟動apache :

[root@keystone ~]# chown -R keystone:keystone /var/www/cgi-bin/keystone
[root@keystone ~]# chmod 755 /var/www/cgi-bin/keystone/*

[root@keystone ~]# systemctl enable httpd.service

[root@keystone ~]# systemctl start httpd.service

到目前為止我們已經將Keystone的服務設定完畢，接下來我們將新增一個admin的使用者。

新增admin使用者

載入keystone的管理token :

[root@keystone ~]# vim ~/.keystone-admin-token
# add following
export OS_TOKEN=YOURTOKEN
export =http://localhost:35357/v2.0

[root@keystone ~]# source ~/.keystone-admin-token

建立一個keystone的service :

[root@keystone ~]# openstack service create --name keystone --description "OpenStack Identity" identity

建立Endpoint ，若前端有Load balance的伺服器，則改成Load balance伺服器的IP或DNS名稱:

[root@keystone ~]# openstack endpoint create \
--publicurl http://192.168.10.221:5000/v2.0 \
--internalurl http://192.168.10.221:5000/v2.0 \
--adminurl http://192.168.10.221:35357/v2.0 \
--region RegionOne \
identity

建立一個admin的project與user，並設定密碼:

[root@keystone ~]# openstack project create --description "Admin Project" admin
[root@keystone ~]# openstack user create --password-prompt admin
User Password: YOURADMINPASSWORD
Repeat User Password: YOURADMINPASSWORD

建立一個admin的role，並將admin user加到此role :

[root@keystone ~]# openstack role create admin
[root@keystone ~]# openstack role add --project admin --user admin admin

新增admin的user後，要先將之前載入的keystone環境變數清掉，才能進行後面的測試 :

[root@keystone ~]# unset OS_TOKEN
[root@keystone ~]# unset OS_URL

測試

新增並載入admin user登入的環境變數檔 :

[root@keystone ~]# vim ~/.keystone-admin

# add following
export OS_PROJECT_DOMAIN_ID=default
export OS_USER_DOMAIN_ID=default
export OS_PROJECT_NAME=admin
export OS_TENANT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=YOURADMINPASSWORD
export OS_AUTH_URL=http://localhost:35357/v3

[root@keystone ~]# source ~/.keystone-admin

查看user屬於哪一個Project與Role :

[root@keystone ~]# openstack user role list
+------------------------------------------------+--------+----------+---------+
| ID                                                          | Name | Project | User   |
+------------------------------------------------+--------+----------+---------+
| c3704f46fa2846e99a8060f4a451d177 | admin | admin  | admin |
+------------------------------------------------+--------+----------+---------+