OpenStack 安装和使用（一）

Permissive

# killall dnsmasq; for svc in api objectstore compute network volume scheduler cert; do systemctl stop openstack-nova-$svc.service; done

# for svc in api objectstore compute network volume scheduler cert; do systemctl status openstack-nova-$svc.service; done

增加鉴权设置到profile文件，以后命令行就不用老是输入：–os_username=admin –os_password=123456 –os_tenant=hanborq –os_auth_url=http://127.0.0.1:5000/v2.0 这些参数。

# keystone-manage db_sync

查看log位置：

# vi /var/log/keystone/keystone.log

建立租户：

这里token为上面keystone.conf配置文件里面的admin_token，这里的endpoint地址为刚安装的keystone地址和keystone.conf配置文件的admin_port，如果这两项已经放入~/.bash_profile，则这里可以不需要。

版本固定为v2.0，租户名字为hanborq。

# keystone –token  c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0/ tenant-create –name hanborq –description “HanBorq Tenant” –enabled true

+————-+———————————-+
|   Property  |              Value               |
+————-+———————————-+
| description | HanBorq Tenant                   |
| enabled     | True                             |
| id          | 94d38db32a7d4107beeed36d9e98bf06 |
| name        | hanborq                          |
+————-+———————————-+

建立用户：

这里的tenant_id为上面建立的tenant的id，用户名为admin，口令为123456。

# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 user-create –tenant_id 94d38db32a7d4107beeed36d9e98bf06 –name admin –pass 123456 –enabled true

+———-+————————————————————————————————————————-+
| Property |                                                          Value                                                          |
+———-+————————————————————————————————————————-+
| email    | None                                                                                                                    |
| enabled  | True                                                                                                                    |
| id       | cd5e2e764fc7420dad016f9af7be7123                                                                                        |
| name     | admin                                                                                                                   |
| password | $6$rounds=40000$tfY5suG0ySPZ05RL$Kz7SUdAFhQOX8YYs01pGyznHS85wBcdm/a4DVKRQ6VEDZdZATGiB94/BKUedHa51mZ8wbF3VF3/VLt0QSTwc11 |
| tenantId | 94d38db32a7d4107beeed36d9e98bf06                                                                                        |
+———-+————————————————————————————————————————-+

建立角色：

角色名字为admin。

# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 role-create –name admin

+———-+———————————-+

角色名字为member。

# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 role-create –name member

+———-+———————————-+
| Property |              Value               |
+———-+———————————-+
| id       | aee579c6430c46d9861c5b684d42ebb7 |
| name     | member                           |
+———-+———————————-+

把admin角色授予hanborq租户的admin用户：

# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 user-role-add –user cd5e2e764fc7420dad016f9af7be7123 –tenant_id 94d38db32a7d4107beeed36d9e98bf06 –role 428438feb3eb4946907b519383f38ceb

建立服务租户：

# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 tenant-create –name service –description “Service Tenant” –enabled true

+————-+———————————-+
|   Property  |              Value               |
+————-+———————————-+
| description | Service Tenant                   |
| enabled     | True                             |
| id          | d9eb763b350b4ff681be7f2bf95d65d5 |
| name        | service                          |
+————-+———————————-+

建立Glance用户：

# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 user-create –tenant_id d9eb763b350b4ff681be7f2bf95d65d5 –name glance –pass glance –enabled true

+———-+————————————————————————————————————————-+
| Property |                                                          Value                                                          |
+———-+————————————————————————————————————————-+
| email    | None                                                                                                                    |
| enabled  | True                                                                                                                    |
| id       | 1c8074ce6b13400bbeb6efaa4e11910d                                                                                        |
| name     | glance                                                                                                                  |
| password | $6$rounds=40000$I7EGyqt4HaDxdWRM$7gPPkF5XCDNz4aucLXwAUzz9ipzRM9JgtwsCPLeUqFilfeFper/kjhV3XWWvnmUzSTqnv/C.WbbMkgSEapViy. |
| tenantId | d9eb763b350b4ff681be7f2bf95d65d5                                                                                        |
+———-+————————————————————————————————————————-+

把admin角色授予service租户的glance用户：

# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 user-role-add –user 1c8074ce6b13400bbeb6efaa4e11910d –tenant_id d9eb763b350b4ff681be7f2bf95d65d5 –role 428438feb3eb4946907b519383f38ceb

建立nova用户：

# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 user-create –tenant_id d9eb763b350b4ff681be7f2bf95d65d5 –name nova –pass nova –enabled true

+———-+————————————————————————————————————————-+
| Property |                                                          Value                                                          |
+———-+————————————————————————————————————————-+
| email    | None                                                                                                                    |
| enabled  | True                                                                                                                    |
| id       | 4e8e9fb808b64e3f8a6fc266e7cc6517                                                                                        |
| name     | nova                                                                                                                    |
| password | $6$rounds=40000$clEIMiItgmqk9czI$oFXKlxq0b3oRKGdMv8o0sg2fm9bMk2yMt24NaJ4agcBRdCmRhv3WWkj2WdtswuCHang2qHLuC3tT3d69SRFSR0 |
| tenantId | d9eb763b350b4ff681be7f2bf95d65d5                                                                                        |
+———-+————————————————————————————————————————-+

把admin角色授予service租户的nova用户：

# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 user-role-add –user 4e8e9fb808b64e3f8a6fc266e7cc6517 –tenant_id d9eb763b350b4ff681be7f2bf95d65d5 –role  428438feb3eb4946907b519383f38ceb

建立ec2用户：

# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 user-create –tenant_id d9eb763b350b4ff681be7f2bf95d65d5 –name ec2 –pass ec2 –enabled true

+———-+————————————————————————————————————————-+
| Property |                                                          Value                                                          |
+———-+————————————————————————————————————————-+
| email    | None                                                                                                                    |
| enabled  | True                                                                                                                    |
| id       | b8ac2f679d6545e38b3fb5dcf14ac0c1                                                                                        |
| name     | ec2                                                                                                                     |
| password | $6$rounds=40000$Im..ohGThtaN1rLb$PSaXZSfJWyu5VHXZZ3l1j5uPyrl4wQIqKWBABRAlhR6lDh2qdBB/u3DFa9LjHdVuHetttHEhHu7VgXNevYsYu. |
| tenantId | d9eb763b350b4ff681be7f2bf95d65d5                                                                                        |
+———-+————————————————————————————————————————-+

把admin角色授予service租户的ec2用户：

# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 user-role-add –user b8ac2f679d6545e38b3fb5dcf14ac0c1 –tenant_id d9eb763b350b4ff681be7f2bf95d65d5 –role 428438feb3eb4946907b519383f38ceb

建立用于对象存储的swift用户：

# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 user-create –tenant_id d9eb763b350b4ff681be7f2bf95d65d5 –name swift –pass swift –enabled true

+———-+————————————————————————————————————————-+
| Property |                                                          Value                                                          |
+———-+————————————————————————————————————————-+
| email    | None                                                                                                                    |
| enabled  | True                                                                                                                    |
| id       | 6fceec63405a432a9e3ccbe89a1bbdb4                                                                                        |
| name     | swift                                                                                                                   |
| password | $6$rounds=40000$JJlQ2vmlsbd.OP8d$pbv90hRcQbkJvBz1oI1hZsf01BEaI30M9Ae0jiXBmnFmCb.WOiw9SPXqhk7kuWtb5BV/os9cqdXm6nZA.Ajll. |
| tenantId | d9eb763b350b4ff681be7f2bf95d65d5                                                                                        |
+———-+————————————————————————————————————————-+

把admin角色授予service租户的swift用户：

# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 user-role-add –user 6fceec63405a432a9e3ccbe89a1bbdb4 –tenant_id d9eb763b350b4ff681be7f2bf95d65d5 –role 428438feb3eb4946907b519383f38ceb

# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 role-list
+———————————-+——–+
|                id                |  name  |
+———————————-+——–+
| 428438feb3eb4946907b519383f38ceb | admin  |
| aee579c6430c46d9861c5b684d42ebb7 | member |
+———————————-+——–+
[root@cc ~]#
[root@cc ~]# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 tenant-list
+———————————-+———+———+
|                id                |   name  | enabled |
+———————————-+———+———+
| 94d38db32a7d4107beeed36d9e98bf06 | hanborq | True    |
| d9eb763b350b4ff681be7f2bf95d65d5 | service | True    |
+———————————-+———+———+
[root@cc ~]#
[root@cc ~]# keystone –token c8701a128708a76161e3 –endpoint http://127.0.0.1:35357/v2.0 user-list
+———————————-+———+——-+——–+
|                id                | enabled | email |  name  |
+———————————-+———+——-+——–+
| 1c8074ce6b13400bbeb6efaa4e11910d | True    | None  | glance |
| 4e8e9fb808b64e3f8a6fc266e7cc6517 | True    | None  | nova   |
| 6fceec63405a432a9e3ccbe89a1bbdb4 | True    | None  | swift  |
| b8ac2f679d6545e38b3fb5dcf14ac0c1 | True    | None  | ec2    |
| cd5e2e764fc7420dad016f9af7be7123 | True    | None  | admin  |
+———————————-+———+——-+——–+

增加两行，修改一行：

…

[filter:ec2_extension]
paste.filter_factory = keystone.contrib.ec2:Ec2Extension.factory

…

[pipeline:admin_api]
pipeline = token_auth admin_token_auth xml_body json_body debug ec2_extension s3_extension crud_extension admin_service

…