openstack Keystone驗證服務集群

#Keystone驗證服務群集

openstack pike 部署 目錄匯總 http://www.cnblogs.com/elvi/p/7613861.html

 

##3.Keystone驗證服務集群

#SQL上創建數據庫並授權

################################################
##以下在所有controller執行

#Keystone安裝
yum install -y openstack-keystone httpd mod_wsgi memcached python-memcached
yum install apr apr-util -y

#memcached啟動
cp /etc/sysconfig/memcached{,.bak}
sed -i 's/127.0.0.1/0.0.0.0/' /etc/sysconfig/memcached
systemctl enable memcached.service
systemctl start memcached.service
netstat -antp|grep 11211

#apache配置(前面已設置)
#cp /etc/httpd/conf/httpd.conf{,.bak}
#echo "ServerName controller1">>/etc/httpd/conf/httpd.conf
ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

#群集設置，修改默認端口5000,35357(默認端口給群集vip使用)
cp /usr/share/keystone/wsgi-keystone.conf{,.bak}
sed -i 's/5000/4999/' /usr/share/keystone/wsgi-keystone.conf
sed -i 's/35357/35356/' /usr/share/keystone/wsgi-keystone.conf

#Apache HTTP 啟動並設置開機自啟動
systemctl enable httpd.service
systemctl restart httpd.service
netstat -antp|egrep 'httpd'
# systemctl disable

#haproxy高可用
echo '
#keystone
listen keystone_admin_cluster
bind controller:35357
#balance  source
option  tcpka
option  httpchk 
option  tcplog
server controller1 controller1:35356 check inter 2000 rise 2 fall 5
server controller2 controller2:35356 check inter 2000 rise 2 fall 5
server controller3 controller3:35356 check inter 2000 rise 2 fall 5

listen keystone_public_cluster
bind controller:5000
#balance  source
option  tcpka
option  httpchk 
option  tcplog
server controller1 controller1:4999 check inter 2000 rise 2 fall 5
server controller2 controller2:4999 check inter 2000 rise 2 fall 5
server controller3 controller3:4999 check inter 2000 rise 2 fall 5
'>>/etc/haproxy/haproxy.cfg
systemctl restart haproxy.service
netstat -antp|egrep 'haproxy|httpd'
#登錄haproxy web查看Keystone狀態全部為down，下面配置后才UP


################################################
##以下在controller1節點執行

#Keystone 配置
cp /etc/keystone/keystone.conf{,.bak}  #備份默認配置
Keys=$(openssl rand -hex 10)  #生成隨機密碼
echo $Keys
echo "kestone  $Keys">/root/openstack.log
echo "
[DEFAULT]
admin_token = $Keys
verbose = true
[database]
connection = mysql+pymysql://keystone:keystone@controller/keystone
[memcache]
servers = controller1:11211,controller2:11211,controller3:11211
[token]
provider = fernet
driver = memcache
# expiration = 86400
# caching = true
# cache_time = 86400
[cache]
enabled = true
backend = oslo_cache.memcache_pool
memcache_servers = controller1:11211,controller2:11211,controller3:11211
">/etc/keystone/keystone.conf

#初始化keystone數據庫 
su -s /bin/sh -c "keystone-manage db_sync" keystone
#檢查表是否創建成功
mysql -h controller -ukeystone -pkeystone -e "use keystone;show tables;"

#初始化Fernet密匙
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

#同步配置到其它節點(用scp會改變屬性)

rsync -avzP -e 'ssh -p 22' /etc/keystone/* controller2:/etc/keystone/
rsync -avzP -e 'ssh -p 22' /etc/keystone/* controller3:/etc/keystone/

#重啟http
systemctl restart httpd.service
ssh controller2 "systemctl restart httpd.service"
ssh controller3 "systemctl restart httpd.service"
# #檢測服務否正常
# curl http://controller3:35356/v3 #查看單個節點
# curl http://controller:35357/v3 #查看群集代理

#設置admin用戶（管理用戶）和密碼,服務實體和API端點
keystone-manage bootstrap --bootstrap-password admin \
--bootstrap-admin-url http://controller:35357/v3/ \
--bootstrap-internal-url http://controller:5000/v3/ \
--bootstrap-public-url http://controller:5000/v3/ \
--bootstrap-region-id RegionOne

#創建 OpenStack 客戶端環境腳本

#admin環境腳本
echo "
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_AUTH_URL=http://controller:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
">./admin-openstack.sh
#測試腳本是否生效
source ./admin-openstack.sh
openstack token issue

#創建service項目,創建glance,nova,neutron用戶，並授權
openstack project create --domain default --description "Service Project" service
openstack user create --domain default --password=glance glance
openstack role add --project service --user glance admin
openstack user create --domain default --password=nova nova
openstack role add --project service --user nova admin
openstack user create --domain default --password=neutron neutron
openstack role add --project service --user neutron admin

#創建demo項目(普通用戶密碼及角色)
openstack project create --domain default --description "Demo Project" demo
openstack user create --domain default --password=demo demo
openstack role create user
openstack role add --project demo --user demo user

#demo環境腳本
echo "
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
">./demo-openstack.sh
#測試腳本是否生效
source ./demo-openstack.sh
openstack token issue