OpenStack之keystone

一、什么是OpenStack

   OpenStack是一種云操作系統，它控制著一個數據中心里大量的計算、存儲和網絡資源。管理員在一個web界面內通過儀表盤方便地管理,控制,授權用戶，以提供各種資源。

二、云服務分類

可分為IAAS, PAAS, SAAS等

IAAS：Infrastructure as a Service (操作系統級別，OpenStack, Cloudstack)

PAAS：Platform as a service (web，DB等已部署的應用，面向專業用戶，如Docker)

SAAS：Software-as-a-Service (應用面向用戶)

FWaas, DBaaS, LBaas, …

三、OpenStack術語

（1）卷和分布式存儲

卷(cinder)：提供永久存儲；

分布式存儲(swift)：提供虛擬機模板；

（2）服務和項目對應關系

一個服務名稱對應一個項目名稱。

重點測試如下項目：

服務                                                  項目

OpenStack Identity Service       — keystone

OpenStack Image Service         — glance

OpenStack Compute Service    — nova

OpenStack Networking Service — neutron

（3）Openstack項目分工

Compute: 項目Nova，主要職責包括啟動、調度VMs; 

Networking：項目Neutron,網絡組件，插件化設計，支持眾多流行的網絡管理插件；

Object Storage: 項目swift；分布式存儲；

Block Storage：項目為Cinder，為VMs提供持久的塊存儲能力；

Identity: 代碼為Keystone；為Openstack中的所有服務提供了認證、授權以及端點編錄目錄；

Image: 項目Glance，用于存儲和檢索磁盤映像文件；

Dashboard: 項目為Horizon，WebGUI，web管理各項目服務; 

Telemetry: 項目為Ceilometer，用于實現監控和計量服務的實現；

Orachestration: 項目為Heat，用于多項目聯動；

Database：項目為Trove，提供DBaaS服務；

Data processing：項目為sahara，在OpenStack中實現Hadoop的管理；   

服務一般有決策者和執行者，各服務信息通過mysql存儲。

（4）存儲和卷

云環境下硬盤提供方式：文件模擬硬盤、物理磁盤分區；

磁盤映像文件：每次啟動磁盤映像文件是從指定存儲下載到虛擬機啟動節點；每次關閉虛擬機，映像文件會在各節點銷毀；

卷是永久存儲的一種方式，各節點一般通過iscsi連接；

四、controller node各服務配置總結

安裝分兩個步驟：

步驟一：預安裝

創建數據庫、授權–>運行環境變量–>創建管理用戶及服務體–>創建API服務端點(public, internal, admin)

步驟二：安裝及配置組件：

[database]連接方式–>rabbitmq、keystone認證–>配置支持的特性–>數據庫同步–>開機啟動及運行服務

 五、實驗

我們的實驗的目標是搭建一套openstack云操作系統，實驗對象為兩節點，分別配置controller node和compute node。openstack配置量極大，我們將分幾次實驗來搭建整套操作系統。這次的實驗的目標是在controller node和compute node上配置預安裝環境和設置Identity(kestone)服務。

1. 預安裝工作

（1）配置/etc/hosts

192.168.10.11 controller

192.168.10.12 compute1

192.168.10.13 compute2

192.168.10.14 block

（2）配置ntp服務，使用輕量級ntp服務chrony

在controller上配置/etc/chrony.conf

允許內網地址

allow 192.168.10/24

添加開機啟動和啟動服務

# systemctl enable chronyd

# systemctl start chronyd

在compute上修改server配置

server controller iburst

測試：

[root@controller ~]# chronyc sources

210 Number of sources = 4

MS Name/IP address         Stratum Poll Reach LastRx Last sample

===============================================================================

^+ 161.53.131.133                2   6   377    29    +22ms[  +22ms] +/-  233ms

^+ ntp2.flashdance.cx            2   6   313    32  +4258us[+4258us] +/-  578ms

^+ ntp3.flashdance.cx            2   6   377    31  +1233us[+1233us] +/-  200ms

^* ntp2.itcompliance.dk          2   6   377    33   +947us[+4528us] +/-  167ms

[root@compute ~]# chronyc sources

210 Number of sources = 1

MS Name/IP address         Stratum Poll Reach LastRx Last sample

===============================================================================

^* controller                    3   6    77    23   +886us[+2718us] +/-  169ms

（3）. 配置openstack yum源/etc/yum.repos.d/openstack.repo

[openstack]

name=openstack mitaka

baseurl=http://mirrors.aliyun.com/centos/7.2.1511/cloud/x86_64/openstack-mitaka/

enabled=1

gpgcheck=0

（4） 安裝軟件

#  yum install mariadb mariadb-server python2-PyMySQL

（5）創建及配置 /etc/my.cnf.d/openstack.cnf

[mysqld]

default-storage-engine = innodb

innodb_file_per_table

max_connections = 4096

collation-server = utf8_general_ci
character-set-server = utf8

skip_name_resolve
（6）啟動服務

# systemctl enable mariadb.service
# systemctl start mariadb.service

（7）安裝rabbitmq-server

# yum install rabbitmq-server

# systemctl enable rabbitmq-server.service

# systemctl start rabbitmq-server.service
# rabbitmqctl add_user openstack openstack

# rabbitmqctl set_user_tags openstack administrator

# rabbitmqctl set_permissions openstack ".*" ".*" ".*"

（8）安裝memcached

# yum install memcached python-memcached

#systemctl enable memcached.service

#systemctl start memcached.service

（9） 關閉iptables, selinux

編輯/etc/sysconfig/selinux，修改SELINUX參數的值為disable

立即生效：

# getenforce

# setenforce  0

（10）設置主機名為controller、compute1

# hostnamectl set-hostname controller

# hostnamectl set-hostname compute1

2. 安裝Identity(keystone)

（1） To create the database, complete the following actions:

• Use the database access client to connect to the database server as the root user:

    $ mysql -u root -p
Create the keystone database:
    mysql> CREATE DATABASE keystone;
Grant proper access to the keystone database:
    mysql> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \
    IDENTIFIED BY 'keystone';
    mysql> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \
    IDENTIFIED BY 'keystone';
檢查：
SHOW GRANTS FOR  'keystone'@'localhost';
SHOW GRANTS FOR  'keystone'@'%';

（2）安裝及配置
1) 安裝組件
# yum install openstack-keystone httpd mod_wsgi
# yum install python-openstackclient
2)配置 /etc/keystone/keystone.conf
[DEFAULT]

admin_token = f63285a166ca96ee181c

[database]
…
connection = mysql+pymysql://keystone:keystone@controller/keystone
#connection = 連接方式://用戶名:密碼@主機名/數據庫
[token]
…
provider = fernet
3)同步 Identity service數據庫
# su -s /bin/sh -c "keystone-manage db_sync" keystone
4) 初始化Fernet key 倉庫
# keystone-manage fernet_setup –keystone-user keystone –keystone-group keystone
5) 配置 Apache HTTP 服務
Edit the /etc/httpd/conf/httpd.conf
    ServerName controller
Create the /etc/httpd/conf.d/keystone.conf:

Listen 5000

Listen 35357

<VirtualHost *:5000>

    WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}

    WSGIProcessGroup keystone-public

    WSGIScriptAlias / /usr/bin/keystone-wsgi-public

    WSGIApplicationGroup %{GLOBAL}

    WSGIPassAuthorization On

    ErrorLogFormat "%{cu}t %M"

    ErrorLog /var/log/httpd/keystone-error.log

    CustomLog /var/log/httpd/keystone-access.log combined

    <Directory /usr/bin>

        Require all granted

    </Directory>

</VirtualHost>

<VirtualHost *:35357>

    WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}

    WSGIProcessGroup keystone-admin

    WSGIScriptAlias / /usr/bin/keystone-wsgi-admin

    WSGIApplicationGroup %{GLOBAL}

    WSGIPassAuthorization On

    ErrorLogFormat "%{cu}t %M"

    ErrorLog /var/log/httpd/keystone-error.log

    CustomLog /var/log/httpd/keystone-access.log combined

    <Directory /usr/bin>

        Require all granted

    </Directory>

</VirtualHost>

# systemctl enable httpd

# systemctl start httpd

6) 配置service entity 和API endpoints

The Identity service provides a catalog of services and their locations. Each service that you add to your

OpenStack environment

$ export OS_TOKEN=f63285a166ca96ee181c

$ export OS_URL=http://controller:35357/v3

$ export OS_IDENTITY_API_VERSION=3

    Create the service entity for the Identity service:

$ openstack service create \

  –name keystone –description "OpenStack Identity" identity

[root@localhost ~]# openstack service create \

>   –name keystone –description "OpenStack Identity" identity

+————-+———————————-+

| Field       | Value                            |
+————-+———————————-+
| description | OpenStack Identity               |
| enabled     | True                             |
| id          | 28324912b51c42ea868623bf1c918875 |
| name        | keystone                         |
| type        | identity                         |
+————-+———————————-+

    Create the Identity service API endpoints:

$ openstack endpoint create –region RegionOne \

  identity public http://controller:5000/v3

[root@localhost ~]# openstack endpoint create –region RegionOne \
>   identity public http://controller:5000/v3
+————–+———————————-+
| Field        | Value                            |
+————–+———————————-+
| enabled      | True                             |
| id           | f896e8b118fb4b83b177662afec6ee71 |
| interface    | public                           |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 28324912b51c42ea868623bf1c918875 |
| service_name | keystone                         |
| service_type | identity                         |
| url          | http://controller:5000/v3        |
+————–+———————————-+

$ openstack endpoint create –region RegionOne \

  identity internal http://controller:5000/v3

[root@localhost ~]# openstack endpoint create –region RegionOne \
>   identity internal http://controller:5000/v3
+————–+———————————-+
| Field        | Value                            |
+————–+———————————-+
| enabled      | True                             |
| id           | 1949e1778ffa4d589a7b707e832d9c86 |
| interface    | internal                         |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 28324912b51c42ea868623bf1c918875 |
| service_name | keystone                         |
| service_type | identity                         |
| url          | http://controller:5000/v3        |
+————–+———————————-+

$ openstack endpoint create –region RegionOne \

  identity admin http://controller:35357/v3  

[root@localhost ~]# openstack endpoint create –region RegionOne \

>   identity admin http://controller:35357/v3  

+————–+———————————-+

| Field        | Value                            |

+————–+———————————-+

| enabled      | True                             |

| id           | eb3dcf9db6cb439cbff45a9c5cdb884e |

| interface    | admin                            |

| region       | RegionOne                        |

| region_id    | RegionOne                        |

| service_id   | 28324912b51c42ea868623bf1c918875 |

| service_name | keystone                         |

| service_type | identity                         |

| url          | http://controller:35357/v3       |

+————–+———————————-+

7) The Identity service provides authentication services for each OpenStack service.

The authentication service uses a combination of domains, projects (tenants), users, and

roles.

    Create the default domain:

$ openstack domain create –description "Default Domain" default

[root@localhost ~]# openstack domain create –description "Default Domain" default
+————-+———————————-+
| Field       | Value                            |
+————-+———————————-+
| description | Default Domain                   |
| enabled     | True                             |
| id          | 82ffd4c577bd4621967b12dd595b042f |
| name        | default                          |
+————-+———————————-+

    Create the admin project:

$ openstack project create –domain default \
  –description "Admin Project" admin
[root@localhost ~]# openstack project create –domain default \
>   –description "Admin Project" admin
+————-+———————————-+
| Field       | Value                            |
+————-+———————————-+
| description | Admin Project                    |
| domain_id   | 82ffd4c577bd4621967b12dd595b042f |
| enabled     | True                             |
| id          | 1ad1c008ea354c6abed93183b47a9643 |
| is_domain   | False                            |
| name        | admin                            |
| parent_id   | 82ffd4c577bd4621967b12dd595b042f |
+————-+———————————-+    

    Create the admin user:
$ openstack user create –domain default \
  –password-prompt admin

[root@localhost ~]# openstack user create –domain default \
>   –password-prompt adminUser Password: admin
Repeat User Password:admin+———–+———————————-+
| Field     | Value                            |
+———–+———————————-+
| domain_id | 82ffd4c577bd4621967b12dd595b042f |
| enabled   | True                             |
| id        | 1182b6dc17a94bac9e8630f76ec55194 |
| name      | admin                            |
+———–+———————————-+
 Create the admin role:
$ openstack role create admin

[root@localhost ~]#  openstack role create admin
+———–+———————————-+
| Field     | Value                            |
+———–+———————————-+
| domain_id | None                             |
| id        | 71ebf5ea73344c348afe5f7a3490ff04 |
| name      | admin                            |
+———–+———————————-+  
   Add the admin role to the admin project and user:
$ openstack role add –project admin –user admin admin

    Create the service project:

$ openstack project create –domain default \
  –description "Service Project" service

[root@localhost ~]# openstack project create –domain default \
>   –description "Service Project" service
+————-+———————————-+
| Field       | Value                            |
+————-+———————————-+
| description | Service Project                  |
| domain_id   | 82ffd4c577bd4621967b12dd595b042f |
| enabled     | True                             |
| id          | 77ac0350c78d405db0a593ee14fc579c |
| is_domain   | False                            |
| name        | service                          |
| parent_id   | 82ffd4c577bd4621967b12dd595b042f |
+————-+———————————-+

    Create the demo project:

$ openstack project create –domain default \
  –description "Demo Project" demo

[root@localhost ~]#  openstack project create –domain default \
>   –description "Demo Project" demo
+————-+———————————-+
| Field       | Value                            |
+————-+———————————-+
| description | Demo Project                     |
| domain_id   | 82ffd4c577bd4621967b12dd595b042f |
| enabled     | True                             |
| id          | 5cb6675efb81411b919a83a9623cd804 |
| is_domain   | False                            |
| name        | demo                             |
| parent_id   | 82ffd4c577bd4621967b12dd595b042f |
+————-+———————————-+    
    Create the demo user:

$ openstack user create –domain default \
  –password-prompt demo

[root@localhost ~]# openstack user create –domain default   –password-prompt demo
User Password:
Repeat User Password:
+———–+———————————-+
| Field     | Value                            |
+———–+———————————-+
| domain_id | 82ffd4c577bd4621967b12dd595b042f |
| enabled   | True                             |
| id        | 2edf64b6bc4e43c3b5e46914c56bd5bb |
| name      | demo                             |

    Create the user role:
$ openstack role create user  

[root@localhost ~]# openstack role create user
+———–+———————————-+
| Field     | Value                            |
+———–+———————————-+
| domain_id | None                             |
| id        | 1e870f8b258644059e27ebc7c4b08ea4 |
| name      | user                             |
+———–+———————————-+    
    Add the user role to the demo project and user:
$ openstack role add –project demo –user demo use
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=DEMO_PASS
export OS_AUTH_URL=http://controller:5000/v3
export OS_IMAGE_API_VERSION=2

using the script
Load .admin-openrc file to populate environment variables with the
location of the Identity service and the admin project and user credentials:
$ . admin-openrc
Request an authentication token:

[root@localhost ~]# openstack token issue