3-OpenStack认证服务Keystone
1. keystone简介
Keystone (OpenStack Identity Service)是OpenStack中的一个独立的提供安全认证的模块 , 主要负责openstack用户的身份认证、令牌管理、提供访问资源的服务目录、以及基于用户角色的访问控制。
Keystone类似一个服务总线 , 或者说是整 个Openstack框架的注册表,其他服务通过keystone来注册其服务的Endpoint (服务访问的URL) , 任何服务之间相互的调用 , 需要经过Keystone的身 份验证 , 来获得目标服务的Endpoint来找到目标服务。
Keystone服务在Openstack架构中的位置 :
2.Keystone作用
在Openstack中 , Ketstone负责用户认证和服务目录两大功能的实现 , 相当于一个注册中心 , 主要有以下功能 :
用户与认证 , 包括用户权限与用户行为跟踪。
身份认证 : 负责令牌的发放和校验
用户授权 : 授权用户有指定的可执行动作的范围
用户管理 : 管理用户的账户
服务目录 , 即提供一个服务目录 , 包括所有的服务项和相关
API的端点。服务目录 : 提供可用服务的
API端点位置
SOA相关知识。
3. Keystone基本架构
4. Keystone的管理对象
Keystone服务贯穿整个架构 , 在进行身份认证服务的整个流程中 , 有几个重要的概念。
Domain: 域 ,keystone中资源(project、user、group) 的持有者
用户 (
user) : 指的是使用openstack架构的用户。用户组(
Group) : 可以把多个用户作为一个整体进行角色管理证书 (
credentials) : 用于确认用户身份的凭证 , 证明自己是自己 , 包括用户的用户名和密码 , 或是用户名和API密钥 , 或者身份管理服务提供的认证令牌。认证 (
authentication) : 确定用户身份的过程。项目 (
project) : 可以理解为一个人 , 或服务所拥有的资源的集合。角色 (
role) : 用于划分权限 , 通过给user指定role, 使user获得role对应操作权限委托(
Trust) : 把自己拥有的角色临时授权给别人服务 (
service) :openstack架构的组件服务 , 如nova、neutron、cinder、swift、glance等。令牌 (
token) : 由字符串表示 , 作为访问资源的凭证 , 是用户的身份/权限证明文件 ;token决定了用户的权限范围 , 在指定的权限内进行操作 ; 也包括令牌的有效期 , 在指定的时间范围内用户才有这些权限。端点 (
endpoint) : 一个可以通过网络来访问和定位某个openstack service的地址 , 即用户创建一个项目过程中需要的各个服务资源的位置区域(
Region): 在Keystone里基本代表一个数据中心访问控制策略(
Policy) : 定义接口访问控制规则Assignment: 一个(actor,target,role) 三元组叫一个assignment, 其中actor包括user、group;target包括domain、project。每个assignment代表一次赋权操作令牌(
Token): 令牌 , 用户访问服务的凭证 , 代表着用户的账户信息 , 一般需要包含user信息、scope信息(project、domain或者trust) 、role信息。分别为PKI、UUID、PKIZ、Fernet几种类型。
4.1 Keystone对象模型
user|project|domain|role|assignment
assignment:user,group,project,domain,role绑定关系
Region|service|endpoint
Region|service|endpoint关系
4.2 虚拟机创建流程
4.3 工作流程
用户通过命令行或者
horizon控制面板的方式登录openstack, 凭借自己的证书 (credentials) 给keystone验证。Keystone对用户的证书验证 , 验证通过则会发布一个令牌 (token) 和用户所需服务的位置点 (endpoint) 给用户。用户得到了位置点 (
endpoint) 之后 , 携带自己的令牌 , 向nova发起请求 , 请求创建虚拟机。nova会拿着用户的token向keystone进行认证 , 看是否允许用户执行这样的操作。keystone认证通过之后 , 返回给nova,nova即开始执行创建虚拟机的请求。首先需要镜像资源 ,nova带着令牌 (token) 和所需要的镜像名向glance提出镜像资源的请求。glance会拿着token去向keystone进行认证 , 看是否允许提供镜像服务。keystone认证成功后 , 返回给glance。glance向nova提供镜像服务。创建虚拟机还需要网络服务 ,
nova携带token向neutron发送网络服务的请求neutron拿着nova给的token向keystone进行认证 , 看是否允许向其提供网络服务。keystone认证成功后 , 返回给nuetron。nuetron则给nova提供网络规划服务。nova获取了镜像和网络之后 , 开始创建虚拟机 , 通过hypervisior可调用底层硬件资源进行创建。创建完成返回给用户 , 成功执行了用户的请求。
5. Token
Token是什么？用户向
Keystone提供一组有效的用户信息 ,Keystone向用户返回一个token。token包含这个用户的信息 , 用户的角色信息 (role) ,token的作用域 (scope) ,token的有效期 (expiration) 。使用这个
token可以访问其他的openstack服务。
为什么使用
Token？使用
token访问api服务比用户名+密码访问更方便。Token具有有效期 , 在客户端缓存token比缓存用户名密码更安全。
Token在Openstack中的应用
USER向Keystone组件申请Token。USER创建虚拟机 ( 找nova-api创建 ) ,Head中携带Token。nova-api检验Token是否有效 ( 找Keystone校验 ) 。Token通过接口透传 , 进入到nova-compute( ？horizen中携带token的vnc界面 ) 。nova-compute进行网口相关操作 ( 找neutron-server) ,Head中携带Token。校验
Token是否有效 ( 找Keystone) 。
创建Token
Token交互
用户从
Keystone申请token用户使用
token访问服务被访问组件验证
token用户得到返回消息
Token的生成和验证
UUID Token: 每次验证需要访问Keyston服务端。PKI Token:Token验证在客户端即可完成。
Token的验证流程
6. 安装keystone
6.1 数据库配置
创建数据库
[root@node02 ~]# mysql Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 11 Server version: 10.5.22-MariaDB MariaDB Server Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> CREATE DATABASE keystone; Query OK, 1 row affected (0.001 sec) MariaDB [(none)]> SHOW DATABASES; +--------------------+ | Database | +--------------------+ | information_schema | | keystone | | mysql | | performance_schema | +--------------------+ 4 rows in set (0.002 sec) 创建
keystone用户并授权请允许从任何主机链接数据库MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone123'; Query OK, 0 rows affected (0.006 sec) MariaDB [(none)]> flush privileges; Query OK, 0 rows affected (0.004 sec) 验证 : 在
node01上使用keystone用户连接数据库 , 看看是否能够正常连接？[root@node01 ~]# dnf install mariadb -y [root@node01 ~]# mysql -ukeystone -pkeystone123 -hnode02 Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 12 Server version: 10.5.22-MariaDB MariaDB Server Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> show databases; +--------------------+ | Database | +--------------------+ | information_schema | | keystone | +--------------------+ 2 rows in set (0.002 sec) 能够从别的主机用
keystone账号连接到mysql, 并看到我们刚才创建的数据库 , 说明我们创建的keystone账号没有问题 ;
6.2 安装配置组件
在控制节点中安装软件包 , 安装
openstack-keystone、httpd和mod_wsgi#centos7以下版本命令 [root@node01 ~]# dnf install openstack-keystone httpd mod_wsgi -y #centos8及以上版本命令 [root@node01 ~]# dnf install openstack-keystone httpd python3-mod_wsgi编辑文件
/etc/keystone/keystone.conf并完成如下动作：在
[database]部分 , 配置数据库访问：vim /etc/keystone/keystone.confkeystone123为数据库密码 ,openstack-vip.net为VIP地址的域名解析[database] # ... connection = mysql+pymysql://keystone:keystone123@openstack-vip.net/keystone连接数据库前边的
mysql+pymysql://这一段不用变 , 默认格式就是这个 , 双斜线后面的是keystone用户 , 冒号后面是对应keystone用户的密码 ;@后面是数据库服务器地址 ; 斜线后面是指连接那个数据库 ; 我这里是因为配置了主机名解析 , 所以数据库服务器我用主机名代替了 ;[token]配置段配置provider = fernet[token] provider = fernet在控制端初始化
keystone的数据库：[root@node01 ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone以上命令会通过我们刚才配置的连接数据库的地址 , 通过
keystone连接到数据库中创建一堆表 ;验证 : 在
node02上验证 , 看看keystone库中是否多了很多表？[root@node01 ~]# mysql -ukeystone -pkeystone123 -hnode02 Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 15 Server version: 10.5.22-MariaDB MariaDB Server Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> show databases; +--------------------+ | Database | +--------------------+ | information_schema | | keystone | +--------------------+ 2 rows in set (0.002 sec) MariaDB [(none)]> use keystone Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Database changed MariaDB [keystone]> show tables; +------------------------------------+ | Tables_in_keystone | +------------------------------------+ | access_rule | | access_token | | alembic_version | | application_credential | | application_credential_access_rule | | application_credential_role | | assignment | | config_register | | consumer | | credential | | endpoint | | endpoint_group | | expiring_user_group_membership | | federated_user | | federation_protocol | | group | | id_mapping | | identity_provider | | idp_remote_ids | | implied_role | | limit | | local_user | | mapping | | nonlocal_user | | password | | policy | | policy_association | | project | | project_endpoint | | project_endpoint_group | | project_option | | project_tag | | region | | registered_limit | | request_token | | revocation_event | | role | | role_option | | sensitive_config | | service | | service_provider | | system_assignment | | token | | trust | | trust_role | | user | | user_group_membership | | user_option | | whitelisted_config | +------------------------------------+ 49 rows in set (0.002 sec) MariaDB [keystone]> 初始化
Fernet key[root@node01 ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone 2024-09-15 14:49:12.057 40952 INFO keystone.common.utils [-] /etc/keystone/fernet-keys/ does not appear to exist; attempting to create it 2024-09-15 14:49:12.058 40952 INFO keystone.common.fernet_utils [-] Created a new temporary key: /etc/keystone/fernet-keys/0.tmp 2024-09-15 14:49:12.059 40952 INFO keystone.common.fernet_utils [-] Become a valid new key: /etc/keystone/fernet-keys/0 2024-09-15 14:49:12.059 40952 INFO keystone.common.fernet_utils [-] Starting key rotation with 1 key files: ['/etc/keystone/fernet-keys/0'] 2024-09-15 14:49:12.059 40952 INFO keystone.common.fernet_utils [-] Created a new temporary key: /etc/keystone/fernet-keys/0.tmp 2024-09-15 14:49:12.059 40952 INFO keystone.common.fernet_utils [-] Current primary key is: 0 2024-09-15 14:49:12.059 40952 INFO keystone.common.fernet_utils [-] Next primary key will be: 1 2024-09-15 14:49:12.059 40952 INFO keystone.common.fernet_utils [-] Promoted key 0 to be the primary: 1 2024-09-15 14:49:12.060 40952 INFO keystone.common.fernet_utils [-] Become a valid new key: /etc/keystone/fernet-keys/0 [root@node01 ~]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone 2024-09-15 14:49:26.421 40954 INFO keystone.common.utils [-] /etc/keystone/credential-keys/ does not appear to exist; attempting to create it 2024-09-15 14:49:26.422 40954 INFO keystone.common.fernet_utils [-] Created a new temporary key: /etc/keystone/credential-keys/0.tmp 2024-09-15 14:49:26.422 40954 INFO keystone.common.fernet_utils [-] Become a valid new key: /etc/keystone/credential-keys/0 2024-09-15 14:49:26.422 40954 INFO keystone.common.fernet_utils [-] Starting key rotation with 1 key files: ['/etc/keystone/credential-keys/0'] 2024-09-15 14:49:26.423 40954 INFO keystone.common.fernet_utils [-] Created a new temporary key: /etc/keystone/credential-keys/0.tmp 2024-09-15 14:49:26.423 40954 INFO keystone.common.fernet_utils [-] Current primary key is: 0 2024-09-15 14:49:26.423 40954 INFO keystone.common.fernet_utils [-] Next primary key will be: 1 2024-09-15 14:49:26.423 40954 INFO keystone.common.fernet_utils [-] Promoted key 0 to be the primary: 1 2024-09-15 14:49:26.423 40954 INFO keystone.common.fernet_utils [-] Become a valid new key: /etc/keystone/credential-keys/0提示：以上命令会在
/etc/keystone/fernet-keys/目录下生成两个key文件 ;[root@node01 ~]# ll /etc/keystone/fernet-keys/ total 8 -rw------- 1 keystone keystone 44 Sep 15 14:49 0 -rw------- 1 keystone keystone 44 Sep 15 14:49 1随机生成
10进制数字 , 绕过keystone管理员密码验证 , 直接拥有管理员权限。[root@node01 ~]# openssl rand -hex 10 e1cf389264501c270fef引导服务 , 这里使用的
ADMIN_PASS使用上面生成的随机密码。controller为控制器访问域名keystone-manage bootstrap --bootstrap-password ADMIN_PASS \ --bootstrap-admin-url http://controller:5000/v3/ \ --bootstrap-internal-url http://controller:5000/v3/ \ --bootstrap-public-url http://controller:5000/v3/ \ --bootstrap-region-id RegionOne实际命令使用如下
[root@node01 ~]# keystone-manage bootstrap --bootstrap-password e1cf389264501c270fef \ --bootstrap-admin-url http://openstack-vip.net:5000/v3/ \ --bootstrap-internal-url http://openstack-vip.net:5000/v3/ \ --bootstrap-public-url http://openstack-vip.net:5000/v3/ \ --bootstrap-region-id RegionOne 2024-09-15 15:05:00.026 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created domain default 2024-09-15 15:05:00.133 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created project admin 2024-09-15 15:05:00.178 40980 WARNING keystone.common.password_hashing [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Truncating password to algorithm specific maximum length 72 characters.: keystone.exception.UserNotFound: Could not find user: admin. 2024-09-15 15:05:00.598 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created user admin 2024-09-15 15:05:00.621 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created role reader 2024-09-15 15:05:00.654 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created role member 2024-09-15 15:05:00.694 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created implied role where b2513b9860e24bcca2e40171101040af implies 05faf76692994c71a8b5a03efe3d527a 2024-09-15 15:05:00.717 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created role manager 2024-09-15 15:05:00.752 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created implied role where b14c0e49e1814002a787f695f88952ba implies b2513b9860e24bcca2e40171101040af 2024-09-15 15:05:00.773 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created role admin 2024-09-15 15:05:00.804 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created implied role where 7f69cadf5b0e4a5ab75042ec0dbd50cd implies b14c0e49e1814002a787f695f88952ba 2024-09-15 15:05:00.835 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created role service 2024-09-15 15:05:00.884 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Granted role admin on project admin to user admin. 2024-09-15 15:05:00.908 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Granted role admin on the system to user admin. 2024-09-15 15:05:00.934 40980 WARNING py.warnings [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] /usr/lib/python3.9/site-packages/pycadf/identifier.py:71: UserWarning: Invalid uuid: RegionOne. To ensure interoperability, identifiers should be a valid uuid. warnings.warn(('Invalid uuid: %s. To ensure interoperability, ' 2024-09-15 15:05:00.944 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created region RegionOne 2024-09-15 15:05:01.009 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created public endpoint http://openstack-vip.net:5000/v3/ 2024-09-15 15:05:01.043 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created internal endpoint http://openstack-vip.net:5000/v3/ 2024-09-15 15:05:01.076 40980 INFO keystone.cmd.bootstrap [None req-bf6c40d0-5cb8-4300-af05-210c506ad29f - - - - - -] Created admin endpoint http://openstack-vip.net:5000/v3/配置
Apache HTTP服务器编辑
/etc/httpd/conf/httpd.conf文件 , 并配置ServerName选项以引用控制节点:[root@node01 ~]# vi /etc/httpd/conf/httpd.conf ServerName openstack-vip.net:80以上主要修改了
httpd的servername监听地址 , 其实这里不修改也行 , 不影响 ; 重要的是下面的配置 ;把
/usr/share/keystone/wsgi-keystone.conf连接至/etc/httpd/conf.d/下[root@node01 ~]# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/ [root@node01 ~]# ll /etc/httpd/conf.d/ total 16 -rw-r--r-- 1 root root 2916 Aug 9 00:30 autoindex.conf -rw-r--r-- 1 root root 400 Aug 9 00:30 README -rw-r--r-- 1 root root 1252 Aug 9 00:28 userdir.conf -rw-r--r-- 1 root root 653 Aug 9 00:28 welcome.conf lrwxrwxrwx 1 root root 38 Sep 15 15:14 wsgi-keystone.conf -> /usr/share/keystone/wsgi-keystone.conf以上操作就是把
httpd代理keystone的配置导入到httpd中 , 默认安装keystone以后就会有一个这样的配置文件 ; 我们只需要把这个配置文件软连接到httpd的配置目录下即可 ;启动
httpd, 并设置为开机启动[root@node01 ~]# systemctl enable --now httpd Created symlink /etc/systemd/system/multi-user.target.wants/httpd.service → /usr/lib/systemd/system/httpd.service. [root@node01 ~]# ss -tnlp State Recv-Q Send-Q Local Address:Port Peer Address:Port Process LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=957,fd=3)) LISTEN 0 511 *:5000 *:* users:(("httpd",pid=41092,fd=6),("httpd",pid=41091,fd=6),("httpd",pid=41090,fd=6),("httpd",pid=41082,fd=6)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=957,fd=4)) LISTEN 0 511 *:80 *:* users:(("httpd",pid=41092,fd=4),("httpd",pid=41091,fd=4),("httpd",pid=41090,fd=4),("httpd",pid=41082,fd=4)) [root@node01 ~]# systemctl status httpd ● httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; preset: disabled) Active: active (running) since Sun 2024-09-15 15:17:04 CST; 16s ago Docs: man:httpd.service(8) Main PID: 41082 (httpd) Status: "Total requests: 0; Idle/Busy workers 100/0;Requests/sec: 0; Bytes served/sec: 0 B/sec" Tasks: 197 (limit: 177683) Memory: 73.6M CPU: 504ms CGroup: /system.slice/httpd.service ├─41082 /usr/sbin/httpd -DFOREGROUND ├─41084 /usr/sbin/httpd -DFOREGROUND ├─41085 "(wsgi:keystone-" -DFOREGROUND ├─41086 "(wsgi:keystone-" -DFOREGROUND ├─41087 "(wsgi:keystone-" -DFOREGROUND ├─41088 "(wsgi:keystone-" -DFOREGROUND ├─41089 "(wsgi:keystone-" -DFOREGROUND ├─41090 /usr/sbin/httpd -DFOREGROUND ├─41091 /usr/sbin/httpd -DFOREGROUND └─41092 /usr/sbin/httpd -DFOREGROUND Sep 15 15:17:04 node01 systemd[1]: Starting The Apache HTTP Server... Sep 15 15:17:04 node01 httpd[41082]: Server configured, listening on: port 5000, port 80 Sep 15 15:17:04 node01 systemd[1]: Started The Apache HTTP Server.如果能够看到
5000端口正常监听 , 说明我们导入的配置没有问题 ;通过设置适当的环境变量来配置管理帐户：
export OS_USERNAME=admin export OS_PASSWORD=ADMIN_PASS export OS_PROJECT_NAME=admin export OS_USER_DOMAIN_NAME=Default export OS_PROJECT_DOMAIN_NAME=Default export OS_AUTH_URL=http://controller:5000/v3 export OS_IDENTITY_API_VERSION=3此处显示的这些值是从
keystone-manage bootstrap创建的默认值。keystone-manage bootstrap命令中的密码用于取代上面的ADMIN_PASS这里直接创建一个脚本文件
keystone_admin.rc, 用于导入对应变量[root@node01 ~]# cat keystone_admin.rc export OS_USERNAME=admin export OS_PASSWORD=e1cf389264501c270fef export OS_PROJECT_NAME=admin export OS_USER_DOMAIN_NAME=Default export OS_PROJECT_DOMAIN_NAME=Default export OS_AUTH_URL=http://openstack-vip.net:5000/v3 export OS_IDENTITY_API_VERSION=3 [root@node01 ~]# echo $OS_USERNAME admin这里由于配置了高可用的域名, 需要额外在高可用节点上添加
haproxy配置[root@ha1 ~]# cat /etc/haproxy/haproxy.cfg ... listen openstack_keystone_port bind 192.168.71.250:5000 mode tcp log global server 192.168.71.11 192.168.71.11:5000 check inter 3000 fall 3 rise 5
6.3 在控制端创建域、项目、用户和角色
6.3.1 默认配置
这一步在最新的openstack中默认已经自动配置完成
在控制端创建
domain域, 创建default域[root@node01 ~]# openstack domain create --description "Default Domain" default +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | Default Domain | | enabled | True | | id | 47c0915c914c49bb8670703e4315a80f | | name | default | | tags | [] | +-------------+----------------------------------+删除默认域的命令 , 创建好就不要删除了
[root@node01 ~]# openstack domain delete 47c0915c914c49bb8670703e4315a80f创建一个
admin的项目 并把域指向default[root@node01 ~]# openstack project create --domain default --description "Admin Project" admin +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | Admin Project | | domain_id | 47c0915c914c49bb8670703e4315a80f | | enabled | True | | id | b4e56eeb160948c581e98d685133d19a | | is_domain | False | | name | admin | | parent_id | 47c0915c914c49bb8670703e4315a80f | | tags | [] | +-------------+----------------------------------+创建
admin用户并设置密码为admin[root@node01 ~]# openstack user create --domain default --password-prompt admin User Password: Repeat User Password: +---------------------+----------------------------------+ | Field | Value | +---------------------+----------------------------------+ | domain_id | 47c0915c914c49bb8670703e4315a80f | | enabled | True | | id | a105f256dc9f42438212e9d96d46b60d | | name | admin | | options | {} | | password_expires_at | None | +---------------------+----------------------------------+查看此时创建的用户名 , 可以看到账号是
admin[root@node01 ~]# openstack user list +----------------------------------+-------+ | ID | Name | +----------------------------------+-------+ | a105f256dc9f42438212e9d96d46b60d | admin | +----------------------------------+-------+创建
admin角色[root@node01 ~]# openstack role create admin +-----------+----------------------------------+ | Field | Value | +-----------+----------------------------------+ | domain_id | None | | id | 7f1f7aa119034c2fbd15b46b90632d18 | | name | admin | +-----------+----------------------------------+给
admin用户授权 , 将admin用户授予admin项目的admin角色[root@node01 ~]# openstack role add --project admin --user admin admin
6.3.2 测试
创建一个用于测试的
demo项目[root@node01 ~]# openstack project create --domain default --description "Demo Project" demo +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | Demo Project | | domain_id | default | | enabled | True | | id | a183bc3c4a4d4c83b78cf56b38804882 | | is_domain | False | | name | demo | | options | {} | | parent_id | default | | tags | [] | +-------------+----------------------------------+创建
demo用户并设置密码为demo[root@node01 ~]# openstack user create --domain default --password-prompt demo User Password: Repeat User Password: +---------------------+----------------------------------+ | Field | Value | +---------------------+----------------------------------+ | domain_id | default | | enabled | True | | id | c6bab906341d42b99f0c1c714e45b0b7 | | name | demo | | options | {} | | password_expires_at | None | +---------------------+----------------------------------+创建一个
user角色[root@node01 ~]# openstack role create user +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | None | | domain_id | None | | id | 179722ea544c428daa72f23227955dcd | | name | user | | options | {} | +-------------+----------------------------------+把
demo用户添加到demo项目 , 然后赋予user角色权限[root@node01 ~]# openstack role add --project demo --user demo user [root@node01 ~]#验证：查看现有的用户、项目、角色、域是否是我们创建的
[root@node01 ~]# openstack user list +----------------------------------+-------+ | ID | Name | +----------------------------------+-------+ | dbf5c34d74fc47efad862220f8f84b5f | admin | | c6bab906341d42b99f0c1c714e45b0b7 | demo | +----------------------------------+-------+ [root@node01 ~]# openstack project list +----------------------------------+-------+ | ID | Name | +----------------------------------+-------+ | 9b05bf0c98b24add999507856db2dac5 | admin | | a183bc3c4a4d4c83b78cf56b38804882 | demo | +----------------------------------+-------+ [root@node01 ~]# openstack role list +----------------------------------+---------+ | ID | Name | +----------------------------------+---------+ | 05faf76692994c71a8b5a03efe3d527a | reader | | 179722ea544c428daa72f23227955dcd | user | | 7f69cadf5b0e4a5ab75042ec0dbd50cd | admin | | b14c0e49e1814002a787f695f88952ba | manager | | b2513b9860e24bcca2e40171101040af | member | | c9c6bc5be83e4148a8328262d9e585d1 | service | +----------------------------------+---------+ [root@node01 ~]# openstack domain list +---------+---------+---------+--------------------+ | ID | Name | Enabled | Description | +---------+---------+---------+--------------------+ | default | Default | True | The default domain | +---------+---------+---------+--------------------+ #查看用户对应角色 [root@node01 ~]# openstack role assignment list --user demo +----------------------------------+----------------------------------+-------+----------------------------------+--------+--------+-----------+ | Role | User | Group | Project | Domain | System | Inherited | +----------------------------------+----------------------------------+-------+----------------------------------+--------+--------+-----------+ | 179722ea544c428daa72f23227955dcd | c6bab906341d42b99f0c1c714e45b0b7 | | a183bc3c4a4d4c83b78cf56b38804882 | | | False | +----------------------------------+----------------------------------+-------+----------------------------------+--------+--------+-----------+这里
user里面的demo,project中的demo,role中的user均是手动创建的。其他是openstack自动创建的。
6.4 在控制端注册服务
最新的版本已经将注册服务在安装的过程中通过keystone-manage bootstrap在之前的步骤中已经实现了。这里显示以前版本的配置过程。具体安装流程可以参考官网。
这里之所以写该章节, 主要是为了对照参考
创建一个
service项目，各服务之间与keystone进行访问和认证，service用于给服务创建用户；[root@node01 ~]# openstack project create --domain default service +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | domain_id | default | | enabled | True | | id | aeab9b51961a4a7a9ba5e1d018f30f9d | | is_domain | False | | name | service | | options | {} | | parent_id | default | | tags | [] | +-------------+----------------------------------+创建一个
keystone认证服务[root@node01 ~]# openstack service create --name keystone --description "OpenStack Identity" identity +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | OpenStack Identity | | enabled | True | | id | a32cffed26924a87b21b4e86e00c63b4 | | name | keystone | | type | identity | +-------------+----------------------------------+查看当前服务列表
[root@node01 ~]# openstack service list +----------------------------------+----------+----------+ | ID | Name | Type | +----------------------------------+----------+----------+ | a32cffed26924a87b21b4e86e00c63b4 | keystone | identity | +----------------------------------+----------+----------+创建
endpoint（注册服务）创建公共端
[root@node01 ~]# openstack endpoint create --region RegionOne identity public http://controller:5000/v3 +--------------+----------------------------------+ | Field | Value | +--------------+----------------------------------+ | enabled | True | | id | 5293ad18db674ea1b01d8f401cb2cf14 | | interface | public | | region | RegionOne | | region_id | RegionOne | | service_id | a32cffed26924a87b21b4e86e00c63b4 | | service_name | keystone | | service_type | identity | | url | http://controller:5000/v3 | +--------------+----------------------------------+创建私有端
[root@node01 ~]# openstack endpoint create --region RegionOne identity internal http://controller:5000/v3 +--------------+----------------------------------+ | Field | Value | +--------------+----------------------------------+ | enabled | True | | id | 6593f8d808094b01a6311828f2ef72bd | | interface | internal | | region | RegionOne | | region_id | RegionOne | | service_id | a32cffed26924a87b21b4e86e00c63b4 | | service_name | keystone | | service_type | identity | | url | http://controller:5000/v3 | +--------------+----------------------------------+创建管理端
[root@node01 ~]# openstack endpoint create --region RegionOne identity admin http://controller:5000/v3 +--------------+----------------------------------+ | Field | Value | +--------------+----------------------------------+ | enabled | True | | id | 3bd05493999b462eb4b4af8d5e5c1fa9 | | interface | admin | | region | RegionOne | | region_id | RegionOne | | service_id | a32cffed26924a87b21b4e86e00c63b4 | | service_name | keystone | | service_type | identity | | url | http://controller:5000/v3 | +--------------+----------------------------------+ [root@node01 ~]#
看看
endpoint列表是否都已经有我们刚才创建的三个端点？[root@node01 ~]# openstack endpoint list +----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------+ | ID | Region | Service Name | Service Type | Enabled | Interface | URL | +----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------+ | 3bd05493999b462eb4b4af8d5e5c1fa9 | RegionOne | keystone | identity | True | admin | http://controller:5000/v3 | | 5293ad18db674ea1b01d8f401cb2cf14 | RegionOne | keystone | identity | True | public | http://controller:5000/v3 | | 6593f8d808094b01a6311828f2ef72bd | RegionOne | keystone | identity | True | internal | http://controller:5000/v3 | +----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------+实际上新版本的
endpoint如下[root@node01 ~]# openstack endpoint list +----------------------------------+-----------+--------------+--------------+---------+-----------+-----------------------------------+ | ID | Region | Service Name | Service Type | Enabled | Interface | URL | +----------------------------------+-----------+--------------+--------------+---------+-----------+-----------------------------------+ | 2d2d670d66a043b0816bfe8e763652de | RegionOne | keystone | identity | True | internal | http://openstack-vip.net:5000/v3/ | | bbb2a4b96e3b4d469ec5951bf6ba1319 | RegionOne | keystone | identity | True | public | http://openstack-vip.net:5000/v3/ | | c407e7ff5b294f0e9550d1cdca601162 | RegionOne | keystone | identity | True | admin | http://openstack-vip.net:5000/v3/ | +----------------------------------+-----------+--------------+--------------+---------+-----------+-----------------------------------+
到此keystone服务就配置完了 ; 接下来测试keystone是否可以用来做认证服务
7. keystone安装结果校验
需要新打开一个
shell窗口 , 在没有声明环境变量的情况下执行下面命令[root@node01 ~]# export OS_IDENTITY_API_VERSION=3 [root@node01 ~]# echo $OS_IDENTITY_API_VERSION 3 [root@node01 ~]# cat keystone_admin.rc export OS_USERNAME=admin export OS_PASSWORD=e1cf389264501c270fef export OS_PROJECT_NAME=admin export OS_USER_DOMAIN_NAME=Default export OS_PROJECT_DOMAIN_NAME=Default export OS_AUTH_URL=http://openstack-vip.net:5000/v3 export OS_IDENTITY_API_VERSION=3 [root@node01 ~]# openstack --os-auth-url http://openstack-vip.net:5000/v3 --os-project-domain-name default --os-user-domain-name default --os-project-name admin --os-username admin --os-password e1cf389264501c270fef token issue +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires | 2024-09-15T15:24:02+0000 | | id | gAAAAABm5u4CJHs9SejInGmThRo5c4w2KsfQd6ZXc1puk3QkjT3p6uWaA_du9p8ROIcGkw3jLgezBpzKV4b6MKb_gtZBm3uE4hX93muQKSTrhgQor6WEMa8e58KRSjXlMbyIxO67NfgMIeV_peYKdTd4FjCixD-cOsKDM7l--2HyYc5sJBqYfvU | | project_id | 9b05bf0c98b24add999507856db2dac5 | | user_id | dbf5c34d74fc47efad862220f8f84b5f | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+这里用户名和密码相关信息, 是之前安装步骤中已经配置好的, 这里命令返回一个表 , 记录的有过期时长 ,
id,和项目id和用户id;如果输入密码错误则不会返回这些内容 , 其实这些内容主要用来描述返回给用户token属性 , 我们可以理解它就是返回了这样一个token给我们 ;使用
admin用户环境变量脚本[root@node01 ~]# cat keystone_admin.rc export OS_USERNAME=admin export OS_PASSWORD=e1cf389264501c270fef export OS_PROJECT_NAME=admin export OS_USER_DOMAIN_NAME=Default export OS_PROJECT_DOMAIN_NAME=Default export OS_AUTH_URL=http://openstack-vip.net:5000/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2这里可以额外创建
demo的环境变量脚本[root@node01 ~]# chmod a+x demo.sh [root@node01 ~]# cat demo.sh #!/bin/bash export OS_PROJECT_DOMAIN_NAME=Default export OS_USER_DOMAIN_NAME=Default export OS_PROJECT_NAME=demo export OS_USERNAME=demo export OS_PASSWORD=demo export OS_AUTH_URL=http://openstack-vip.net:5000/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2有了上面两个脚本以后 , 我们就实现要使用那个用户测试 , 直接把对应的用户环境变量导出即可 ;
测试
admin用户的环境变量脚本是否可用？[root@node01 ~]# . keystone_admin.rc [root@node01 ~]# openstack token issue +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires | 2024-09-15T15:32:06+0000 | | id | gAAAAABm5u_mtQ4SXhCp8vTfKlecSP3babiQgBK6OAusY3zu8Y_kZJFQaQyU5tUnqkkOnrScku58w8XU1UqWukn19KDFpKgjP2c1i1gr0j-b4b-3kfH68cLePPMAwROSqQoFE-g4JOBaxbj59GbabLh4PlMwyMSbCOO79BENe8pifXWyA59GTnI | | project_id | 9b05bf0c98b24add999507856db2dac5 | | user_id | dbf5c34d74fc47efad862220f8f84b5f | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+重新开一个终端，导出
admin用户环境变量，然后直接使用openstack token issue命令就能验证admin用户；有了这个环境变量脚本，我们不用输密码和不用写那么长的命令了；验证
demo用户的环境变量脚本[root@node01 ~]# . demo.sh [root@node01 ~]# openstack token issue +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires | 2024-09-15T15:32:59+0000 | | id | gAAAAABm5vAbxRhpadZdA1YsL6_kW4s6D2rOVQYb9M_Bfp29F5XGgEgU0JvJ0EOrsZv3mgEihvl-2TPtc_4EZ3RjMbXa3z6RnHVY-508mJx2mLsAQIb36eFArWoehQAEsphIKDz6YovHaz7tOIQn6-RqFIYVkcJ9HZVFTFPDMd8kj4ZOoQx_bLg | | project_id | a183bc3c4a4d4c83b78cf56b38804882 | | user_id | c6bab906341d42b99f0c1c714e45b0b7 | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+demo用户的环境变量脚本也都能够正常通过验证；到此keystone服务的安装配置测试就完成了；
参考链接
玩转企业云计算平台系列 ( 三 ) : Openstack 身份认证服务 Keystone (qq.com)
云计算OpenStack - Keystone - SkyBiuBiu - 博客园 (cnblogs.com)
云计算管理平台之OpenStack认证服务Keystone - Linux-1874 - 博客园 (cnblogs.com)
Openstack之二：服务认证keystone - 一叶知秋~~ - 博客园 (cnblogs.com)