O Keystone é um projeto que provê serviços de "Identidade", "Token", "Catalog" and "Policy" para os componentes do OpenStack. O pacote keystone foi instalado no servidor educloud02.
Este software é feito em python, e por sua vez instala a dependencia keystone-python, uma biblioteca em python para uso do próprio keystone.
Os arquivos de configuração do keystone ficam em /etc/keystone e hoje ele está utilizando como um backend para armazenar os usuários uma base sqlite3, mas ele também permite que seja utilizado uma base LDAP.
Além do daemon (servidor) foi instalado o cliente (também feito em python) python-keystoneclient.
# apt-get install keystone
Delete the keystone.db file created in the /var/lib/keystone directory.
# rm /var/lib/keystone/keystone.db
Install mysql:
# apt-get install python-mysqldb mysql-server
Use sed to edit /etc/mysql/my.cnf to change bind-address from localhost
(127.0.0.1) to any (0.0.0.0) and restart the mysql service, as root:
# sed -i 's/127.0.0.1/0.0.0.0/g' /etc/mysql/my.cnf # service mysql restart
To configure the MySQL database, create the keystone database.
# mysql -u root -p mysql> CREATE DATABASE keystone; mysql> GRANT ALL ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystonepass'; mysql> FLUSH PRIVILEGES; mysql> quit;
Edit keystone.conf to use mysql:
[sql] connection = mysql://keystone:keystonepass@192.168.69.1/keystone
Change in keystone.conf the ADMIN_TOKEN:
admin_token = 012345SECRET99TOKEN012345
Restarte o keystone e inicialize o banco:
# service keystone restart # keystone-manage db_sync
Crie o arquivo /root/openstackrc, com o seguinte conteudo:
export SERVICE_ENDPOINT=http://192.168.69.1:35357/v2.0/ export SERVICE_TOKEN=012345SECRET99TOKEN012345
Estas variaveis de ambiente sao uteis para evitar ficar passando as opcoes --token e --endpoint para os utilitarios de linha de comando.
Carrege o arquivo:
# source /root/openstackrc
Crie os tenants openstackDemo e service:
# keystone tenant-create --name openstackDemo --description "Default Tenant" --enabled true # keystone tenant-create --name service --description "Service Tenant" --enabled true
Crie o user admin, substitua o tenant_id pelo tentant_id do openstackDemo, criado no item anterior:
# keystone user-create --tenant_id 9c401c9d2b9d41bcabda6919d4aec63a --name admin --pass adminpass --enabled true
Crie os roles admin e user:
# keystone role-create --name admin # keystone role-create --name user
Adicione o user admin ao role admin, fazendo as devidas substituicoes:
# keystone user-role-add --user [admin_user_id] --tenant_id [openstackDemo_tenant_id] --role [admin_role]
Crie um usuario para cada servico, e substitua o tenant_id pelo id do tenant service:
# keystone user-create --tenant_id 92920816c7704a8a95c916d34dc7a05c --name glance --pass glancepass --enabled true # keystone user-create --tenant_id 92920816c7704a8a95c916d34dc7a05c --name nova --pass novapass --enabled true # keystone user-create --tenant_id 92920816c7704a8a95c916d34dc7a05c --name swift --pass swiftpass --enabled true
Adicione os users acima ao role admin, fazendo as devidas substituicoes:
# keystone user-role-add --user [glance_user_id] --tenant_id [service_tenant_id] --role [admin_role] # keystone user-role-add --user [nova_user_id] --tenant_id [service_tenant_id] --role [admin_role] # keystone user-role-add --user [swift_user_id] --tenant_id [service_tenant_id] --role [admin_role]
Ate agora, apenas criamos: tenants, users e roles. O Keystone tambem gerencia os servicos e seus endpoins. Desta forma os componentes do openstack consulta o keystone onde determinado servico encontra-se.
Crie os servicos:
# keystone service-create --name keystone --type identity --description "Keystone Identity Service" # keystone service-create --name nova --type compute --description "Nova Compute Service" # keystone service-create --name volume --type volume --description "Nova Volume Service" # keystone service-create --name glance --type image --description "Glance Image Service" # keystone service-create --name swift --type object-storage --description "Object Storage Service"
Crie os endpoints para os respectivos servicos:
# keystone endpoint-create --region RegionOne --service_id [keystone_service_id] --publicurl http://192.168.69.1:5000/v2.0 --internalurl http://192.168.69.1:5000/v2.0 --adminurl http://192.168.69.1:35357/v2.0 # keystone endpoint-create --region RegionOne --service_id [compute_service_id] --publicurl 'http://192.168.69.1:8774/v2/%(tenant_id)s' --internalurl 'http://192.168.69.1:8774/v2/%(tenant_id)s' --adminurl 'http://192.168.69.1:8774/v2/%(tenant_id)s' # keystone endpoint-create --region RegionOne --service_id [volume_service_id] --publicurl 'http://192.168.69.1:8776/v1/%(tenant_id)s' --internalurl 'http://192.168.69.1:8776/v1/%(tenant_id)s' --adminurl 'http://192.168.69.1:8776/v1/%(tenant_id)s' # keystone endpoint-create --region RegionOne --service_id [glance_service_id] --publicurl http://192.168.69.1:9292/v1 --internalurl http://192.168.69.1:9292/v1 --adminurl http://192.168.69.1:9292/v1 # keystone endpoint-create --region RegionOne --service_id [swift_service_id] --publicurl 'http://192.168.69.1:8888/v1/AUTH_%(tenant_id)s' --adminurl 'http://192.168.69.1:8888/' --internalurl 'http://192.168.69.1:8888/v1/AUTH_%(tenant_id)s'
# sudo apt-get install curl openssl
Faca uma requisicao REST para a API do keystone usando o curl:
# curl -d '{"auth": {"tenantName": "openstackDemo", "passwordCredentials": {"username": "admin", "password": "adminpass"}}}' -H "Content-type: application/json" http://192.168.69.1:35357/v2.0/tokens | python -mjson.tool
O retorno deve conter todos os servicos, endpoins e um token que expira em 24 horas:
{
"access": {
"serviceCatalog": [
{
"endpoints": [
{
"adminURL": "http://192.168.69.1:8776/v1/9c401c9d2b9d41bcabda6919d4aec63a",
"internalURL": "http://192.168.69.1:8776/v1/9c401c9d2b9d41bcabda6919d4aec63a",
"publicURL": "http://192.168.69.1:8776/v1/9c401c9d2b9d41bcabda6919d4aec63a",
"region": "RegionOne"
}
],
"endpoints_links": [],
"name": "volume",
"type": "volume"
},
{
"endpoints": [
{
"adminURL": "http://192.168.69.1:9292/v1",
"internalURL": "http://192.168.69.1:9292/v1",
"publicURL": "http://192.168.69.1:9292/v1",
"region": "RegionOne"
}
],
"endpoints_links": [],
"name": "glance",
"type": "image"
},
{
"endpoints": [
{
"adminURL": "http://192.168.69.1:8774/v2/9c401c9d2b9d41bcabda6919d4aec63a",
"internalURL": "http://192.168.69.1:8774/v2/9c401c9d2b9d41bcabda6919d4aec63a",
"publicURL": "http://192.168.69.1:8774/v2/9c401c9d2b9d41bcabda6919d4aec63a",
"region": "RegionOne"
}
],
"endpoints_links": [],
"name": "nova",
"type": "compute"
},
{
"endpoints": [
{
"adminURL": "http://192.168.69.1:35357/v2.0",
"internalURL": "http://192.168.69.1:5000/v2.0",
"publicURL": "http://192.168.69.1:5000/v2.0",
"region": "RegionOne"
}
],
"endpoints_links": [],
"name": "keystone",
"type": "identity"
},
{
"endpoints": [
{
"adminURL": "http://192.168.69.1:8888/",
"internalURL": "http://192.168.69.1:8888/v1/AUTH_9c401c9d2b9d41bcabda6919d4aec63a",
"publicURL": "http://192.168.69.1:8888/v1/AUTH_9c401c9d2b9d41bcabda6919d4aec63a",
"region": "RegionOne"
}
],
"endpoints_links": [],
"name": "swift",
"type": "object-storage"
}
],
"token": {
"expires": "2012-06-08T15:31:46Z",
"id": "05b818ff23564d5599c97ea5e1df7bbe",
"tenant": {
"description": "Default Tenant",
"enabled": true,
"id": "9c401c9d2b9d41bcabda6919d4aec63a",
"name": "openstackDemo"
}
},
"user": {
"id": "1fcfbe778fc3428aa30db782056b34d7",
"name": "admin",
"roles": [
{
"id": "a2d6da77c0a54105aab94484e0d2088b",
"name": "admin"
}
],
"roles_links": [],
"username": "admin"
}
}
}
Voce pode tambem listar usuarios, roles, tenants e services:
# keystone user-list # keystone role-list # keystone tenant-list # keystone service-list