云計算與大數(shù)據(jù)技術(shù)（微課版）-實驗指導(dǎo)書 實驗8-2安裝和部署Keystone身份服務(wù)

實驗2.安裝和部署Keystone身份服務(wù)一、實驗?zāi)康恼莆誒penStack身份服務(wù)的手動安裝和配置方法二、實訓(xùn)內(nèi)容.創(chuàng)建Keystone數(shù)據(jù)庫.安裝和配置Keystone及相關(guān)組件.配置ApacheHTTP服務(wù)器并完成Keystone安裝.為后續(xù)的服務(wù)創(chuàng)建統(tǒng)一的服務(wù)項目service.創(chuàng)建測試用的普通云用戶demo,并賦予其member.為admin和demo用戶分別創(chuàng)建Openstack客戶端環(huán)境腳本三、實驗步驟.創(chuàng)建Keystone數(shù)據(jù)庫(1)以root用戶身份通過數(shù)據(jù)庫訪問客戶端連接到數(shù)據(jù)庫服務(wù)器。mysql-uroot-p(2)創(chuàng)建Keystone數(shù)據(jù)庫(名為"keystone")。MariaDB[(none)]>CREATEDATABASEkeystone;(3)對Keystone數(shù)據(jù)庫授予合適的賬戶訪問權(quán)限。MariaDB|(none)]>GRANTALLPRIVILEGESONkeystone.*TOVkeystone^localhosfIDENTIFIEDBY,KEYSTONE_DBPASSMariaDB[(none)]>GRANTALLPRIVILEGESONkeystone.*TO'keystone'@'%'\IDENTIFIEDBYfKEYSTONE_DBPASS(4)退出數(shù)據(jù)庫訪問客戶端。exit.安裝和配置Keystone及相關(guān)組件(1)安裝所需的軟件包。yum-yinstallopenstack-keystonehttpdmodwsgi(2)編輯/etc/keystone/keystone.conf配置文件。在［database］節(jié)中配置數(shù)據(jù)庫訪問連接。crudini-set/etc/keystone/keystone.confdatabaseconnectionmysql+pymysql://keystone:keystone\@controller/keystone在［token］節(jié)中配置Fernet為令牌提供者。crudini-set/etc/keystone/keystone.conftokenproviderfernet(3)初始化Keystone數(shù)據(jù)庫。su-s/bin/sh-cnkeystone-managedb_syncHkeystone(4)初始化Fernet密鑰庫以生成令牌。keystone-managefernetsetup-keystone-userkeystone-keystone-groupkeystonekeystone-managecredential_setup-keystone-userkeystone-keystone-groupkeystone(5)對Keystone服務(wù)執(zhí)行初始化操作。keystone-managebootstrap-bootstrap-passwordADMINPASS\—bootstrap-admin-url1:5000/v3/\-bootstrap-internal-urlhttp://1:5000/v3/\—bootstrap-public-urlhttp://controller:5000/v3/\-bootstrap-region-idRegionOne3.配置ApacheHTTP服務(wù)器(1)編^/etc/httpd/conf/httpd.conf配置文件。ServerNamecontroller或者sed-ins/A#ServerName.*/ServerNamecontroller/0/etc/httpd/conf/httpd.conf(2)創(chuàng)建至U/usr/share/keystone/wsgi-keystone.conf文件的鏈接文件。In-s/usr/share/keystone/wsgi-keystone.conf/etc/httpd/conf.d/.完成Keystone安裝(1)啟動ApacheHTTP服務(wù)并將其配置為開機自動啟動。systemctlenablehttpd.servicesystemctlstarthttpd.service(2)導(dǎo)出環(huán)境變量來配置云管理員賬戶。設(shè)置適當(dāng)?shù)沫h(huán)境變量來配置管理帳戶，密碼為上面設(shè)置的引導(dǎo)身份密碼,controller執(zhí)行在控制節(jié)點上#云管理員賬戶#云管理員賬戶#密碼#項目名#域名#認(rèn)證URL#指定版本信息exportOS_PASSWORD=ADMIN_PASSexportOS_PROJECT_NAME=adminexportOS_USER_DOMAIN_NAME=DefaultexportOS_PROJECT_DOMAIN_NAME=DefaultexportOS_AUTH_URL=http://controlIer:5000/v3exportOSJDENTITY^API_VERSION=3(3)驗證Keystone安裝。|root@controller?]#openstackservicelist[root@controller~]#curlhttp://controller:5000/v3yum-yinstallcurl.創(chuàng)建域、項目、用戶和角色(1)創(chuàng)建域。(2)創(chuàng)建項目。創(chuàng)建OpenStack服務(wù)共用的“service”項目。openstackprojectcreate-domaindefault-descriptionnServiceProject"service(3)創(chuàng)建用戶。創(chuàng)建demo項目oopenstackprojectcreate-domaindefault-description“DemoProject11demo創(chuàng)建demo用戶oopenstackusercreate-domaindefault-password-promptdemo輸入兩次密碼：DEMO_PASS(4)創(chuàng)建角色。創(chuàng)建一個名為"demo”的角色。openstackrolecreatedemo將member角色添加到demo項目和demo用戶。openstackroleadd-projectdemo-userdemomember.驗證Keystone服務(wù)的安裝[root(3controller?]#openstack--os-auth-urlhttp://controller:5000/v3--os-project-domain-nameDefault--os-user-domain-nameDefault--os-project-nameadmin--os-usernameadmintokenissuePassword:Password:Field|Value|expires|2020-10-19T13:45:53+0000I|idIgAAAAABfjYqBWKU3puH60ER5192gHQVJzLXiyw5vstSYw-9bpyll.wck2LdCST-W9wtUpodGyBpiXlqE_LfvZ39n3eJapBfzJyTp378XWNDtk0ROlnZttb6G3Xj2JkCcbsVWkAFwXQu3NnvQQ-6yrD3LHuTg9XGZ5mJSRTtrogqTM6uC6wJ59pk|-|projectid|29981a2ab4184a6c9bb6275b7bel7f02I|userid|c4c59774db88403182105adaca4calla.創(chuàng)建OpenStack客戶端環(huán)境腳本(1)創(chuàng)建腳本。在/root目錄下創(chuàng)建admin-openrc文件，并輸入下面內(nèi)容admin-openrc文件作為admin云管理員的客戶端環(huán)境腳本。exportOS_PROJECT_DOMAIN_NAME=DefaultexportOS^USER_DOMAIN_NAME=DefaultexportOS_PROJECT_NAME=adminexportOS_USERNAME=adminexportOS_PASSWORD=ADMIN_PASSexportOS_AUTHJURL=http://controlIer:5000/v3exportOSJDENTITY_API_VERSION=3exportOS_IMAGE_API_VERSION=2.創(chuàng)建OpenStack客戶端環(huán)境腳本(1)創(chuàng)建腳本。/root目錄下，為demo用戶創(chuàng)建一個demo-openrc腳本文件。exportOS_USERDOMAIN_NAME=DefaultexportOS_PROJECT_NAME=demoexportOS_USERNAME=demoexportOS_PASSWORD=DEMO_PASSexportOS_AUTH_URL=http://controller:5000/v3exportOSJDENTITY_API_VERSION=3exportOS_IMAGE_API_VERSION=2(2)使用腳本。[root(acontroller~]#.admin-openrc[root(acontroller*]#openstacktokenissue|Field|Value++|expires|2020-10-19T13:49:54+0000I|id|gAAAAABfjYtyBVwQ2B5JCRwvzicTIUM66rSugAqIH6nVbkqMXrbGzsMNxvzx9r