##3.Keystone 验证服务
openstack pike 安装 目录汇总 http://www.cnblogs.com/elvi/p/7613861.html
#SQL上创建数据库并授权 #Keystone安装 yum install -y openstack-keystone httpd mod_wsgi memcached python-memcached yum install apr apr-util -y #memcached启动和设置 cp /etc/sysconfig/memcached{,.bak} systemctl enable memcached.service systemctl start memcached.service netstat -antp|grep 11211 #Keystone 配置 cp /etc/keystone/keystone.conf{,.bak} #备份默认配置 Keys=$(openssl rand -hex 10) #生成随机密码 echo $Keys echo "kestone $Keys">>~/openstack.log echo " [DEFAULT] admin_token = $Keys verbose = true [database] connection = mysql+pymysql://keystone:keystone@controller/keystone [token] provider = fernet driver = memcache [memcache] servers = controller:11211 ">/etc/keystone/keystone.conf #初始化身份认证服务的数据库 su -s /bin/sh -c "keystone-manage db_sync" keystone #检查表是否创建成功 mysql -h controller -ukeystone -pkeystone -e "use keystone;show tables;" #初始化密钥存储库 keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone keystone-manage credential_setup --keystone-user keystone --keystone-group keystone #设置admin用户(管理用户)和密码 keystone-manage bootstrap --bootstrap-password admin \ --bootstrap-admin-url http://controller:35357/v3/ \ --bootstrap-internal-url http://controller:5000/v3/ \ --bootstrap-public-url http://controller:5000/v3/ \ --bootstrap-region-id RegionOne #apache配置 cp /etc/httpd/conf/httpd.conf{,.bak} echo "ServerName controller">>/etc/httpd/conf/httpd.conf ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/ #Apache HTTP 启动并设置开机自启动 systemctl enable httpd.service systemctl restart httpd.service netstat -antp|egrep ':5000|:35357|:80' # systemctl disable #创建 OpenStack 客户端环境脚本 #admin环境脚本 echo " export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=admin export OS_USERNAME=admin export OS_PASSWORD=admin export OS_AUTH_URL=http://controller:35357/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 ">./admin-openstack.sh #测试脚本是否生效 source ./admin-openstack.sh openstack token issue #创建service项目,创建glance,nova,neutron用户,并授权 openstack project create --domain default --description "Service Project" service openstack user create --domain default --password=glance glance openstack role add --project service --user glance admin openstack user create --domain default --password=nova nova openstack role add --project service --user nova admin openstack user create --domain default --password=neutron neutron openstack role add --project service --user neutron admin #创建demo项目(普通用户密码及角色) openstack project create --domain default --description "Demo Project" demo openstack user create --domain default --password=demo demo openstack role create user openstack role add --project demo --user demo user #demo环境脚本 echo " export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=demo export OS_USERNAME=demo export OS_PASSWORD=demo export OS_AUTH_URL=http://controller:5000/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 ">./demo-openstack.sh #测试脚本是否生效 source ./demo-openstack.sh openstack token issue