openstack安装（2）——keystone
发表于 14:26|
作者刘亚平
摘要：keystone是openstack中用于身份验证的项目，任何服务请求需要经过它的验证获得服务的endpoint。具体作用请看相关官方文档。这里我使用的是mysql来存储keystone的数据。
keystone是openstack中用于身份验证的项目，任何服务请求需要经过它的验证获得服务的endpoint。具体作用请看相关官方文档。这里我使用的是mysql来存储keystone的数据。
Host:keystone
ip:192.168.0.106
mysql, keystone
&1)安装数据库
sudoapt-get install mysql-server mysql-client python-mysqldb
& & 进/etc/f里，将bind-address=127.0.0.1改成 0.0.0.0。这样远程主机就可以连接上这个mysql。
& & 重启mysql服务。sudo service mysql restart
2）安装keystone
&O &安装软件
sudoapt-get install keystone
创建keystone数据库，并创建用户以及分配权限。
grant all on keystone.* to 'keystone'@'%' identified by 'keystonepwd';
&O &配置keystone
配置keystone，修改/etc/keystone/keystone.conf文件：
#connection = sqlite:////var/lib/keystone/keystone.db
connection = mysql://keystone:keystonepwd@192.168.0.106/keystone
这里注意一下该文件里的这部份信息，记住admin_token参数，以后会用的上，这个参数是用来访问keystone服务的。默认是ADMIN，也可以改成别的。
public_port = 5000
admin_port = 35357
admin_token = ADMIN
compute_port = 8774
verbose = True
debug = True
log_config =/etc/keystone/logging.conf
重启keystone服务
sudoservice keystone restart
同步数据库，
sudokeystone-manage db_sync
然后去数据库里看，
+------------------------+
|Tables_in_keystone & & |
+------------------------+
|ec2_credential & & & & |
|endpoint & & & & & & & |
|metadata & & & & & & & |
|migrate_version & & & &|
|role & & & & & & & & & |
|service & & & & & & & &|
|tenant & & & & & & & & |
|token & & & & & & & & &|
|user & & & & & & & & & |
|user_tenant_membership |
+------------------------+
2、使用keystone
导入环境变量，当然也可以在每次执行keystone命令时加上这方面的参数，keystone 命令格式参见它的help
export SERVICE_TOKEN=ADMIN
exportSERVICE_ENDPOINT=http://192.168.0.106:3
添加tenant：
keystonetenant-create --name adminTenant --description &Admin Tenant&--enabled true
keystone@keystone:~$keystone tenant-list
+----------------------------------+-------------+---------+
| & & & & & & & &id & & & & & & & &| & & name & | enabled |
+----------------------------------+-------------+---------+
|72a95ab302cc42d59e6f414769dcfec7 | adminTenant | True & &|
+----------------------------------+-------------+---------+
添加user：
keystoneuser-create --tenant_id 72a95ab302cc42d59e6f414769dcfec7 --name admin --passopenstack --enabled true
keystone@keystone:~$ keystone user-list
+----------------------------------+---------+-------+-------+
| & & & & & & & &id & & & & & & & &| enabled | email | &name |
+----------------------------------+---------+-------+-------+
|4fd5ba059aff63b | True & | None &| admin |
+----------------------------------+---------+-------+-------+
keystonerole-create --name adminRole
keystone@keystone:~$ keystone role-list
+----------------------------------+-----------+
| & & & & & & & &id & & & & & & & &| & &name &|
+----------------------------------+-----------+
|675b96a12defe | adminRole |
+----------------------------------+-----------+
将这三者关联
keystoneuser-role-add --user 4fd5ba059aff63b --tenant_id72a95ab302cc42d59e6f414769dcfec7 --role 675b96a12defe
这样就ok了。测试一下，用curl工具测试。
& & & &sudo apt-get install curl
& & & &我们先输入一个错误的密码试试
curl-d '{&auth&: {&tenantName&: &adminTenant&,&passwordCredentials&:{&username&: &admin&,&password&: &wrong&}}}' -H&Content-type: application/json& http://192.168.0.106:3/tokens| python -mjson.tool
& & & &返回结果
& & &error&:{
& & & & &code&:401,&
& & & & &message&:&Invalid user / password&,&
& & & & &title&:&Not Authorized&
& & 如果用户名/密码都正确的话
curl -d'{&auth&: {&tenantName&: &adminTenant&,&passwordCredentials&:{&username&: &admin&,&password&: &openstack&}}}' -H &Content-type:application/json& http://192.168.0.106:3/tokens | python-mjson.tool
& & 就会返回很多信息，如token、user等，内容太多了，这里我就不贴了。
原文链接：
推荐阅读相关主题：
网友评论有（0）
CSDN官方微信
扫描二维码,向CSDN吐槽
微信号：CSDNnews
相关热门文章1650-2 Keystone Electronics | 硬件，紧固件，配件 | DigiKey
Keystone Electronics
Digi-Key 零件编号
36-1650-2-ND
可立即发货
厂方库存 : 8,300
制造商零件编号
Round Standoff Threaded #4-40 Brass 0.250" (6.35mm) 1/4"
对无铅要求的达标情况 / 对限制有害物质指令(RoHS)规范的达标情况
无铅 / 符合限制有害物质指令(RoHS)规范要求
湿气敏感性等级（MSL）
制造商标准提前期
RoHS指令信息
ROUND STANDOFF 4-40 BRASS 3/16"
ROUND STANDOFF 4-40 BRASS 1/4"
ANT FLEX CIRC PCB W/CABLE 100MM
CONN MOD PLUG 8P8C UNSHIELDED
CONN MOD COUPLER 8P8C TO 8P8C
1650-2K-ND
如果所需数量大于此处所列数量，请提交
Copyright & , Digi-Key Electronics.保留所有权利。701 Brooks Avenue South,Thief River Falls, MN 56701 USAkeystone command line utility (pending deprecation) & python-keystoneclient 2.2.0 documentation
keystone command line utility (pending deprecation)
keystone [options] &command& [command-options]
keystone help
keystone help &command&
DESCRIPTION
The keystone command line utility is pending deprecation. The
used instead. The keystone command line utility only supports V2
of the Identity API whereas the OSC program supports both V2 and V3.
The keystone command line utility interacts with services providing
OpenStack Identity API (e.g. Keystone).
To communicate with the API, you will need to be authenticated - and the
keystone provides multiple options for this.
While bootstrapping Keystone the authentication is accomplished with a
shared secret token and the location of the Identity API endpoint. The
shared secret token is configured in keystone.conf as “admin_token”.
You can specify those values on the command line with --os-token
and --os-endpoint, or set them in environment variables:
OS_SERVICE_TOKEN
Your Keystone administrative token
OS_SERVICE_ENDPOINT
Your Identity API endpoint
The command line options will override any environment variables set.
If you already have accounts, you can use your OpenStack username and
password. You can do this with the --os-username,
--os-password.
Keystone allows a user to be associated with one or more projects which are
historically called tenants.
To specify the project for which you want to
authorize against, you may optionally specify a --os-tenant-id or
--os-tenant-name.
Instead of using options, it is easier to just set them as environment
variables:
OS_USERNAME
Your Keystone username.
OS_PASSWORD
Your Keystone password.
OS_TENANT_NAME
Name of Keystone project.
OS_TENANT_ID
ID of Keystone Tenant.
OS_AUTH_URL
The OpenStack API server URL.
OS_IDENTITY_API_VERSION
The OpenStack Identity API version.
The location for the CA truststore (PEM formatted) for this client.
The location for the keystore (PEM formatted) containing the public
key of this client.
This keystore can also optionally contain the
private key of this client.
The location for the keystore (PEM formatted) containing the private
key of this client.
This value can be empty if the private key is
included in the OS_CERT file.
For example, in Bash you’d use:
export OS_USERNAME=yourname
export OS_PASSWORD=yadayadayada
export OS_TENANT_NAME=myproject
export OS_AUTH_URL=http(s)://:/
export OS_IDENTITY_API_VERSION=2.0
export OS_CACERT=/etc/keystone/yourca.pem
export OS_CERT=/etc/keystone/yourpublickey.pem
export OS_KEY=/etc/keystone/yourprivatekey.pem
To get a list of available commands and options run:
keystone help
To get usage and options of a command:
keystone help &command&
Get information about endpoint-create command:
keystone help endpoint-create
View endpoints of OpenStack services:
keystone catalog
Create a ‘service’ project:
keystone tenant-create --name=service
Create service user for nova:
keystone user-create --name=nova \
--tenant_id=&project ID& \
View roles:
keystone role-list
Keystone client is hosted in Launchpad so you can view current bugs at
Navigation}