重庆建设网站公司哪家好,网站怎样制作吸引人,淮北房产网,百度排行榜风云榜小说目录 Keystone简介
1、登录数据库配置#xff08;在controller执行#xff09;
1.1登录数据库 1.2数据库里创建keystone 1.3授权对keystone数据库的正确访问 1.4退出数据库
2、数据库导入Keystone表#xff08;在controller执行#xff09; 2.1安装httpd mod_wsgi 2.2备…目录 Keystone简介
1、登录数据库配置在controller执行
1.1登录数据库 1.2数据库里创建keystone 1.3授权对keystone数据库的正确访问 1.4退出数据库
2、数据库导入Keystone表在controller执行 2.1安装httpd mod_wsgi 2.2备份配置文件并且修改 2.3同步数据库 2.4数据库初始化 2.5引导Identity服务:
3、配置http服务在controller执行 3.1编辑http配置文件 3.2生成软链接 3.3启动httpd 3.4配置环境变量
4、创建域、用户在controller执行 4.1创建域 4.2创建服务项目 4.3创建平台demo项目 4.4创建demo用户 4.5创建用户角色 4.6添加用户角色到demo项目和用户
5、验证操作在controller执行 5.1取消环境变量 5.2admin用户返回的认证token 5.3demo用户返回的认证token 5.4创建openstack 客户端环境脚本 5.5使用脚本,返回认证token Keystone简介
KeystoneOpenStack Identity Service是 OpenStack 框架中负责管理身份验证、服务访问规则和服务令牌功能的组件。用户访问资源需要验证用户的身份与权限服务执行操作也需要进行权限检测这些都需要通过 Keystone 来处理。Keystone 类似一个服务总线 或者说是整个 Openstack 框架的注册表OpenStack 服务通过 Keystone 来注册其 Endpoint服务访问的URL任何服务之间的相互调用都需要先经过 Keystone 的身份验证获得目标服务的 Endpoint 然后再调用。
Keystone 的主要功能如下
管理用户及其权限维护 OpenStack 服务的 EndpointAuthentication认证和 Authorization鉴权。
用户认证介绍 在用户认证中有以下名词1、User用户
在Openstack中使用一个数字来代表使用Openstack的人、系统或者是一个服务Openstack会对用户的请求进行验证。在Openstack中一个租户可以有多个用户、一个用户也可以有多个租户用户对租户的操作权限由用户在租户中承担的角色来确定。
2、Project项目
Project是Openstack中一些可被访问的资源或者是资源组本质上是一个容器可以起到隔离的作用或者用于标识对象。
3、Token令牌
Openstack中的用户用来进行身份验证的凭证。
4、Role角色
在Openstack中Role代表一组权限并且总是和用户所绑定用于声明用户可以访问的资源。
服务目录介绍 在服务目录中有以下名词1、Service服务
Service就是Openstack中的服务比如Nova、Glance、Swift等等。
2、Endpoints端点
一个Endpoints即一个服务所对外暴露的接口如果我们要访问一个服务那么我们必须知道该服务的Endpoints。Endpoint的每个URL都对应一个服务实例访问地址并且具有public、private和admin三种权限。public url可以被公开访问private url可以被局域网内的设备所访问而admin url则被从常规的访问中分离。
KeystoneOpenStack Identity Service是 OpenStack 框架中负责管理身份验证、服务访问规则和服务令牌功能的组件。下面我们进行Keystone的安装部署
1、登录数据库配置在controller执行
1.1登录数据库
[rootcontroller ~]# mysql -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 18
Server version: 10.3.20-MariaDB MariaDB ServerCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.Type help; or \h for help. Type \c to clear the current input statement.MariaDB [(none)] 1.2数据库里创建keystone
MariaDB [(none)] CREATE DATABASE keystone; 1.3授权对keystone数据库的正确访问
GRANT ALL PRIVILEGES ON keystone.* TO keystonelocalhost IDENTIFIED BY 000000;
GRANT ALL PRIVILEGES ON keystone.* TO keystone% IDENTIFIED BY 000000; 1.4退出数据库
MariaDB [(none)] quit;2、数据库导入Keystone表在controller执行 2.1安装httpd mod_wsgi
[rootcontroller ~]# yum install openstack-keystone httpd mod_wsgi -y##我在这里安装openstack-keystone httpd mod_wsgi时报错 解决办法执行下面命令后重新安装
yum install -y python2-qpid-proton-0.22.0-1.el7.x86_64 2.2备份配置文件并且修改
[rootcontroller ~]# cp /etc/keystone/keystone.conf{,.bak}
[rootcontroller ~]# grep -Ev ^$|# /etc/keystone/keystone.conf.bak /etc/keystone/keystone.conf#vi /etc/keystone/keystone.conf
[DEFAULT]
admin_token ADMIN_TOKEN
[application_credential]
[assignment]
[auth]
[cache]
[catalog]
[cors]
[credential]
[database]
[domain_config]
[endpoint_filter]
[endpoint_policy]
[eventlet_server]
[DEFAULT]
[application_credential]
[assignment]
[auth]
[cache]
[catalog]
[cors]
[credential]
[database]
connection mysqlpymysql://keystone:123controller/keystone
[domain_config]
[endpoint_filter]
[endpoint_policy]
[eventlet_server]
[federation]
[fernet_receipts]
[fernet_tokens]
[healthcheck]
[identity]
[identity_mapping]
[jwt_tokens]
[ldap]
[memcache]
[oauth1]
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_middleware]
[oslo_policy]
[policy]
[profiler]
[receipt]
[resource]
[revoke]
[role]
[saml]
[security_compliance]
[shadow_users]
[token]
provider fernet
[tokenless_auth]
[totp]2.3同步数据库
su -s /bin/sh -c keystone-manage db_sync keystone进数据库检查一下看keystone是否有表了如下说明同步完成
[rootcontroller ~]# mysql -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 25
Server version: 10.3.20-MariaDB MariaDB ServerCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.Type help; or \h for help. Type \c to clear the current input statement.MariaDB [(none)] show databases;
--------------------
| Database |
--------------------
| information_schema |
| keystone |
| mysql |
| performance_schema |
--------------------
4 rows in set (0.001 sec)MariaDB [(none)] use keystone;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -ADatabase changed
MariaDB [keystone] show tables;
------------------------------------
| Tables_in_keystone |
------------------------------------
| access_rule |
| access_token |
| application_credential |
| application_credential_access_rule |
| application_credential_role |
| assignment |
| config_register |
| consumer |
| credential |
| endpoint |
| endpoint_group |
| federated_user |
| federation_protocol |
| group |
| id_mapping |
| identity_provider |
| idp_remote_ids |
| implied_role |
| limit |
| local_user |
| mapping |
| migrate_version |
| nonlocal_user |
| password |
| policy |
| policy_association |
| project |
| project_endpoint |
| project_endpoint_group |
| project_option |
| project_tag |
| region |
| registered_limit |
| request_token |
| revocation_event |
| role |
| role_option |
| sensitive_config |
| service |
| service_provider |
| system_assignment |
| token |
| trust |
| trust_role |
| user |
| user_group_membership |
| user_option |
| whitelisted_config |
------------------------------------ 2.4数据库初始化
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone 2.5引导Identity服务:
keystone-manage bootstrap --bootstrap-password 000000 --bootstrap-admin-url http://controller:35357/v3/ --bootstrap-internal-url http://controller:5000/v3/ --bootstrap-public-url http://controller:5000/v3/ --bootstrap-region-id RegionOne3、配置http服务在controller执行 3.1编辑http配置文件
[rootcontroller ~]# vi /etc/httpd/conf/httpd.conf
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
#
# If your host doesnt have a registered DNS name, enter its IP address here.
#
#ServerName www.example.com:80
ServerName controller3.2生成软链接
ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/ 3.3启动httpd
systemctl enable httpd.service;systemctl start httpd.service 3.4配置环境变量
export OS_USERNAMEadmin
export OS_PASSWORD000000
export OS_PROJECT_NAMEadmin
export OS_USER_DOMAIN_NAMEDefault
export OS_PROJECT_DOMAIN_NAMEDefault
export OS_AUTH_URLhttp://controller:35357/v3
export OS_IDENTITY_API_VERSION3
4、创建域、用户在controller执行 4.1创建域
openstack domain create --description Domain example 4.2创建服务项目
openstack project create --domain default --description Service Project service 4.3创建平台demo项目
openstack project create --domain default --description Demo Project demo 4.4创建demo用户
openstack user create --domain default --password-prompt demo 4.5创建用户角色
openstack role create user 4.6添加用户角色到demo项目和用户
openstack role add --project demo --user demo user
5、验证操作在controller执行 5.1取消环境变量
unset OS_AUTH_URL OS_PASSWORD 5.2admin用户返回的认证token
unset OS_AUTH_URL OS_PASSWORD
penstack --os-auth-url http://controller:35357/v3 \--os-project-domain-name Default --os-user-domain-name Default \--os-project-name admin --os-username admin token issue 5.3demo用户返回的认证token
openstack --os-auth-url http://controller:5000/v3 \--os-project-domain-name Default --os-user-domain-name Default \--os-project-name demo --os-username demo token issue 5.4创建openstack 客户端环境脚本
#创建admin-openrc脚本export OS_PROJECT_DOMAIN_NAMEDefault
export OS_USER_DOMAIN_NAMEDefault
export OS_PROJECT_NAMEadmin
export OS_USERNAMEadmin
export OS_PASSWORD000000
export OS_AUTH_URLhttp://controller:5000/v3
export OS_IDENTITY_API_VERSION3
export OS_IMAGE_API_VERSION2
创建demo-openrc脚本export OS_PROJECT_DOMAIN_NAMEDefault
export OS_USER_DOMAIN_NAMEDefault
export OS_PROJECT_NAMEdemo
export OS_USERNAMEdemo
export OS_PASSWORD000000
export OS_AUTH_URLhttp://controller:5000/v3
export OS_IDENTITY_API_VERSION3
export OS_IMAGE_API_VERSION2 5.5使用脚本,返回认证token
[rootcontroller ~]# openstack token issue
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| Field | Value |
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| expires | 2023-02-08T16:49:180000 |
| id | gAAAAABj48R-5UKgioRRedEM1uDIImmqKdI00OnFYE2yy-7vzw8MpO2NZgpfbEvk90Sq4SqMN2aK4PRXT5TLExWMVbZacpJHHcr0gPLQ_B1cMj0TgDqHtZ9Tohngxh6ImnFZ7VA-sUu2n4oWZjSmFOySWgDCBdYJ8MJaIPCsxlnCf8riQFQiRQI |
| project_id | 4c7bdbb75b9e481db886549f7d2711be |
| user_id | 41944ebcbb2541acbc31bfd591107fff |
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------到这里keystone部署完成 OpenStack简介 | 常见的基础组件
OpenStack手动分布式部署环境准备【Queens版】
