Openstack 实战讲解之-----------03-控制节点服务配置
设置时间同步： 对于openstack来说，时间同步非常重要，所以一定要保证所有服务的时间一直，下面对世界做同步： 1 2 3 4 timedatectllist-timezones| grep Shanghai查看时区 timedatectl set -timezoneAsia /Shanghai 设置时区 timedatectl set - local -rtc yes 把boolean替换成 yes 则表示使用本地时间，替换成no则表示是UTC时间 ntpdatetime1.aliyun.com同步时间 启动数据库服务 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 [root@linux-node1~] #systemctlenablemariadb.service设置开机自启动 Created symlink from /etc/systemd/system/multi-user .target.wants /mariadb .serviceto /usr/lib/systemd/system/mariadb .service. [root@linux-node1~] #systemctlstartmariadb.service启动数据库 [root@linux-node1~] #mysql_secure_installation初始化并设置密码 NOTE:RUNNINGALLPARTSOFTHISSCRIPTISRECOMMENDEDFORALLMariaDB SERVERSINPRODUCTIONUSE!PLEASEREADEACHSTEPCAREFULLY! InordertologintoMariaDBtosecureit,we'llneedthecurrent password for therootuser.Ifyou'vejustinstalledMariaDB,and youhaven't set therootpasswordyet,thepasswordwillbeblank, soyoushouldjustpressenterhere. Entercurrentpassword for root(enter for none): OK,successfullyusedpassword,movingon... SettingtherootpasswordensuresthatnobodycanlogintotheMariaDB rootuserwithouttheproperauthorisation. Setrootpassword?[Y /n ]y Newpassword: Re-enternewpassword: Passwordupdatedsuccessfully! Reloadingprivilegetables.. ...Success! Bydefault,aMariaDBinstallationhasananonymoususer,allowinganyone tologintoMariaDBwithouthavingtohaveauseraccountcreated for them.Thisisintendedonly for testing,andto make theinstallation goabitsmoother.Youshouldremovethembeforemovingintoa productionenvironment. Removeanonymous users ?[Y /n ]y ...Success! Normally,rootshouldonlybeallowedtoconnectfrom 'localhost' .This ensuresthatsomeonecannotguessattherootpasswordfromthenetwork. Disallowrootloginremotely?[Y /n ]y ...Success! Bydefault,MariaDBcomeswithadatabasenamed 'test' thatanyonecan access.Thisisalsointendedonly for testing,andshouldberemoved beforemovingintoaproductionenvironment. Remove test databaseandaccesstoit?[Y /n ]y -Dropping test database... ...Success! -Removingprivilegeson test database... ...Success! Reloadingtheprivilegetableswillensurethatallchangesmadesofar willtakeeffectimmediately. Reloadprivilegetablesnow?[Y /n ]y ...Success! Cleaningup... All done !Ifyou'vecompletedalloftheabovesteps,yourMariaDB installationshouldnowbesecure. Thanks for usingMariaDB! 配置rabbitMQ消息队列 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 [root@linux-node1~] #systemctlenablerabbitmq-server.service#设置开机启动 Created symlink from /etc/systemd/system/multi-user .target.wants /rabbitmq-server .serviceto /usr/lib/systemd/system/rabbitmq-server .service. [root@linux-node1~] #systemctlstartrabbitmq-server.service#启动消息队列 [root@linux-node1~] #rabbitmqctladd_useropenstackopenstack#给消息队列增加openstack用户和密码 Creatinguser "openstack" ... [root@linux-node1~] #rabbitmqctlset_permissionsopenstack".*"".*"".*"#给openstack设置消息队列的权限 Settingpermissions for user "openstack" in vhost "/" ... [root@linux-node1~] #rabbitmq-pluginslist#查看消息队列插件 Configured:E=explicitlyenabled;e=implicitlyenabled |Status:*=runningonrabbit@linux-node1 |/ []amqp_client3.6.5 []cowboy1.0.3 []cowlib1.0.1 []mochiweb2.13.1 []rabbitmq_amqp1_03.6.5 []rabbitmq_auth_backend_ldap3.6.5 []rabbitmq_auth_mechanism_ssl3.6.5 []rabbitmq_consistent_hash_exchange3.6.5 []rabbitmq_event_exchange3.6.5 []rabbitmq_federation3.6.5 []rabbitmq_federation_management3.6.5 []rabbitmq_jms_topic_exchange3.6.5 []rabbitmq_management3.6.5 []rabbitmq_management_agent3.6.5 []rabbitmq_management_visualiser3.6.5 []rabbitmq_mqtt3.6.5 []rabbitmq_recent_history_exchange1.2.1 []rabbitmq_sharding0.1.0 []rabbitmq_shovel3.6.5 []rabbitmq_shovel_management3.6.5 []rabbitmq_stomp3.6.5 []rabbitmq_top3.6.5 []rabbitmq_tracing3.6.5 []rabbitmq_trust_store3.6.5 []rabbitmq_web_dispatch3.6.5 []rabbitmq_web_stomp3.6.5 []rabbitmq_web_stomp_examples3.6.5 []sockjs0.3.4 []webmachine1.10.3 [root@linux-node1~] #rabbitmq-pluginsenablerabbitmq_management#加载消息队列的管理插件 Thefollowingpluginshavebeenenabled: mochiweb webmachine rabbitmq_web_dispatch amqp_client rabbitmq_management_agent rabbitmq_management Applyingpluginconfigurationtorabbit@linux-node1...started6plugins. [root@linux-node1~] #systemctlrestartrabbitmq-server.service#重启消息队列服务 消息队列服务验证 1 2 3 4 [root@linux-node1~] #lsof-i:15672 COMMANDPIDUSERFDTYPEDEVICESIZE /OFF NODENAME beam.smp6370rabbitmq53uIPv4373570t0TCP*:15672(LISTEN) 在浏览器中输入：192.168.56.11：15672，使用guest账号和guest密码登录 keystone认证服务 Keystone在N版已经是V3版本。在Keystone中主要涉及以下几个概念： User：使用服务的用户，可以是人，服务或者系统，只要是使用了openstack服务的对象都可以称为用户 project（tenant）租户，可以理解为一个人，项目或者组织拥有的资源的合集。在一个租户中可以拥有很多个用户，这些用户可以根据权限的划分使用租户中的资源 Role：角色，用于分配操作的权限。角色可以被指定给用户，使得该用户获得角色对应的操作权限 Token：认证成功后，keystone会生成一串比特值或者字符串，用来作为访问资源的令牌，token中有可访问资源的范围和有效时间 Keystone V3 API 新特性 Keystone V3 做出了许多变化和改进，我们选取其中较为重要的进行阐述： 将 Tenant 改称为 Project 引入 Domain 的概念 引入 Group 的概念 将 Tenant 改为 Project 并在其上添加 Domain 的概念，这更加符合现实世界和云服务的映射。 V3 利用 Domain 实现真正的多租户（multi-tenancy）架构，Domain 担任 Project 的高层容器。云服务的客户是 Domain 的所有者，他们可以在自己的 Domain 中创建多个 Projects、Users、Groups 和 Roles。通过引入 Domain，云服务客户可以对其拥有的多个 Project 进行统一管理，而不必再向过去那样对每一个 Project 进行单独管理。 Group 是一组 Users 的容器，可以向 Group 中添加用户，并直接给 Group 分配角色，那么在这个 Group 中的所有用户就都拥有了 Group 所拥有的角色权限。通过引入 Group 的概念，Keystone V3 实现了对用户组的管理，达到了同时管理一组用户权限的目的。这与 V2 中直接向 User/Project 指定 Role 不同，使得对云服务进行管理更加便捷。 图 . Domain、Group、Project、User 和 Role 的关系图（引用网上） 创建库及用户 在数据库中创建库和用户（这里为了方便会把后面用到cinder，glance ，neutron，等服务的账号一并创建到数据库中 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 CREATEDATABASEkeystone; GRANTALLPRIVILEGESONkeystone.*TO 'keystone' @ 'localhost' IDENTIFIEDBY 'keystone' ; GRANTALLPRIVILEGESONkeystone.*TO 'keystone' @ '%' IDENTIFIEDBY 'keystone' ; CREATEDATABASEglance; GRANTALLPRIVILEGESONglance.*TO 'glance' @ 'localhost' IDENTIFIEDBY 'glance' ; GRANTALLPRIVILEGESONglance.*TO 'glance' @ '%' IDENTIFIEDBY 'glance' ; CREATEDATABASEnova; GRANTALLPRIVILEGESONnova.*TO 'nova' @ 'localhost' IDENTIFIEDBY 'nova' ; GRANTALLPRIVILEGESONnova.*TO 'nova' @ '%' IDENTIFIEDBY 'nova' ; CREATEDATABASEnova_api; GRANTALLPRIVILEGESONnova_api.*TO 'nova' @ 'localhost' IDENTIFIEDBY 'nova' ; GRANTALLPRIVILEGESONnova_api.*TO 'nova' @ '%' IDENTIFIEDBY 'nova' ; CREATEDATABASEneutron; GRANTALLPRIVILEGESONneutron.*TO 'neutron' @ 'localhost' IDENTIFIEDBY 'neutron' ; GRANTALLPRIVILEGESONneutron.*TO 'neutron' @ '%' IDENTIFIEDBY 'neutron' ; CREATEDATABASEcinder; GRANTALLPRIVILEGESONcinder.*TO 'cinder' @ 'localhost' IDENTIFIEDBY 'cinder' ; GRANTALLPRIVILEGESONcinder.*TO 'cinder' @ '%' IDENTIFIEDBY 'cinder' ; 执行过程： 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 [root@linux-node1~] #mysql-uroot-p Enterpassword: #用初始化时候设置的密码 MariaDB[(none)]>GRANTALLPRIVILEGESONkeystone.*TO 'keystone' @ '%' IDENTIFIEDBY 'keystone' ; QueryOK,0rowsaffected(0.00sec) MariaDB[(none)]>CREATEDATABASEglance; QueryOK,1rowaffected(0.00sec) MariaDB[(none)]>GRANTALLPRIVILEGESONglance.*TO 'glance' @ 'localhost' IDENTIFIEDBY 'glance' ; QueryOK,0rowsaffected(0.00sec) MariaDB[(none)]>GRANTALLPRIVILEGESONglance.*TO 'glance' @ '%' IDENTIFIEDBY 'glance' ; QueryOK,0rowsaffected(0.00sec) MariaDB[(none)]>CREATEDATABASEnova; QueryOK,1rowaffected(0.00sec) MariaDB[(none)]>GRANTALLPRIVILEGESONnova.*TO 'nova' @ 'localhost' IDENTIFIEDBY 'nova' ; QueryOK,0rowsaffected(0.00sec) MariaDB[(none)]>GRANTALLPRIVILEGESONnova.*TO 'nova' @ '%' IDENTIFIEDBY 'nova' ; QueryOK,0rowsaffected(0.00sec) MariaDB[(none)]>CREATEDATABASEnova_api; QueryOK,1rowaffected(0.00sec) MariaDB[(none)]>GRANTALLPRIVILEGESONnova_api.*TO 'nova' @ 'localhost' IDENTIFIEDBY 'nova' ; QueryOK,0rowsaffected(0.00sec) MariaDB[(none)]>GRANTALLPRIVILEGESONnova_api.*TO 'nova' @ '%' IDENTIFIEDBY 'nova' ; QueryOK,0rowsaffected(0.00sec) MariaDB[(none)]>CREATEDATABASEneutron; QueryOK,1rowaffected(0.00sec) MariaDB[(none)]>GRANTALLPRIVILEGESONneutron.*TO 'neutron' @ 'localhost' IDENTIFIEDBY 'neutron' ; QueryOK,0rowsaffected(0.00sec) MariaDB[(none)]>GRANTALLPRIVILEGESONneutron.*TO 'neutron' @ '%' IDENTIFIEDBY 'neutron' ; QueryOK,0rowsaffected(0.00sec) MariaDB[(none)]>CREATEDATABASEcinder; QueryOK,1rowaffected(0.00sec) MariaDB[(none)]>GRANTALLPRIVILEGESONcinder.*TO 'cinder' @ 'localhost' IDENTIFIEDBY 'cinder' ; QueryOK,0rowsaffected(0.00sec) MariaDB[(none)]>GRANTALLPRIVILEGESONcinder.*TO 'cinder' @ '%' IDENTIFIEDBY 'cinder' ; QueryOK,0rowsaffected(0.00sec) MariaDB[(none)]>showdatabases; +--------------------+ |Database| +--------------------+ |cinder| |glance| |information_schema| |keystone| |mysql| |neutron| |nova| |nova_api| |performance_schema| +--------------------+ 9rows in set (0.00sec) keystone配置文件 1 2 3 4 5 [root@linux-node1~] #grep-n'^[a-z]'/etc/keystone/keystone.conf 640:connection=mysql+pymysql: //keystone :keystone@192.168.56.11 /keystone 1472:servers=192.168.56.11:11211 #memcache服务地址 2655:provider=fernet #配置令牌 2665:driver=memcache #选择driver为memcache默认是sql 初始化数据库，memcache配置 1 su -s /bin/sh -c "keystone-managedb_sync" keystone 验证初始化是否成功： 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 [root@linux-node1~] #mysql-h192.168.56.11-ukeystone-pkeystone-e"usekeystone;showtables;" +------------------------+ |Tables_in_keystone| +------------------------+ |access_token| |assignment| |config_register| |consumer| |credential| |endpoint| |endpoint_group| |federated_user| |federation_protocol| |group| |id_mapping| |identity_provider| |idp_remote_ids| |implied_role| |local_user| |mapping| |migrate_version| |nonlocal_user| |password| |policy| |policy_association| |project| |project_endpoint| |project_endpoint_group| |region| |request_token| |revocation_event| |role| |sensitive_config| |service| |service_provider| |token| |trust| |trust_role| |user| |user_group_membership| |whitelisted_config| +------------------------+ 安装memcached 1 2 3 4 5 6 7 8 yuminstallmemcachedpython-memcached vim /etc/sysconfig/memcached [root@linux-node1~] #cat/etc/sysconfig/memcached PORT= "11211" USER= "memcached" MAXCONN= "1024" CACHESIZE= "64" OPTIONS= "-l192.168.56.11,::1" 通过keystone-manage生成token认证必要的信息： 1 2 3 4 5 6 7 [root@linux-node1keystone] #keystone-managefernet_setup--keystone-userkeystone--keystone-groupkeystone [root@linux-node1keystone] #keystone-managecredential_setup--keystone-userkeystone--keystone-groupkeystone [root@linux-node1keystone] #keystone-managebootstrap--bootstrap-passwordadmin\ >--bootstrap-admin-urlhttp: //192 .168.56.11:35357 /v3/ \ >--bootstrap-internal-urlhttp: //192 .168.56.11:35357 /v3/ \ >--bootstrap-public-urlhttp: //192 .168.56.11:5000 /v3/ \ >--bootstrap-region- id RegionOne 配置apache服务 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 [root@linux-node1keystone] #vim/etc/httpd/conf/httpd.conf#编辑配置文件， 95ServerName192.168.56.11:80 配置软连接 [root@linux-node1keystone] #ln-s/usr/share/keystone/wsgi-keystone.conf/etc/httpd/conf.d/ 启动服务： [root@linux-node1keystone] #systemctlenablehttpd.service Created symlink from /etc/systemd/system/multi-user .target.wants /httpd .serviceto /usr/lib/systemd/system/httpd .service. [root@linux-node1keystone] #systemctlstarthttpd.service [root@linux-node1keystone] # [root@linux-node1keystone] #lsof-i:80 COMMANDPIDUSERFDTYPEDEVICESIZE /OFF NODENAME httpd22891root4uIPv6591570t0TCP*:http(LISTEN) httpd22902apache4uIPv6591570t0TCP*:http(LISTEN) httpd22906apache4uIPv6591570t0TCP*:http(LISTEN) httpd22907apache4uIPv6591570t0TCP*:http(LISTEN) httpd22908apache4uIPv6591570t0TCP*:http(LISTEN) httpd22909apache4uIPv6591570t0TCP*:http(LISTEN) 配置环境变量： export OS_USERNAME=admin export OS_PASSWORD=admin export OS_PROJECT_NAME=admin export OS_USER_DOMAIN_NAME=Default export OS_PROJECT_DOMAIN_NAME=Default export OS_AUTH_URL=http: //192 .168.56.11:35357 /v3 export OS_IDENTITY_API_VERSION=3 安装openstack客户端，如果不安装是没有openstack命令的 yum install -ypython-openstackclient 安装完毕执行以下命令验证： [root@linux-node1keystone] #openstackuserlist#查看用户列表 +----------------------------------+-------+ |ID|Name| +----------------------------------+-------+ |b84c1614b79b40278e02bd6ed034cc6f|admin| +----------------------------------+-------+ [root@linux-node1keystone] #openstackrolelist#查看权限列表 +----------------------------------+-------+ |ID|Name| +----------------------------------+-------+ |9b0ba78cf70048efa8659220a3cebd06|admin| +----------------------------------+-------+ [root@linux-node1keystone] #openstackprojectlist#查看项目列表 +----------------------------------+-------+ |ID|Name| +----------------------------------+-------+ |7ae0fb7deb5342d885a07c2c890a1ff4|admin| +----------------------------------+-------+ [root@linux-node1keystone] #openstackendpointlist#查看端点列表 +---------------+-----------+--------------+--------------+---------+-----------+------------------+ |ID|Region|ServiceName|ServiceType|Enabled|Interface|URL| +---------------+-----------+--------------+--------------+---------+-----------+------------------+ |65f66a71d4624|RegionOne|keystone|identity|True|internal|http: //192 .168.5| |2a0a80a0de1b6||||||6.11:35357 /v3/ | |503929||||||| |71f801be8bc54|RegionOne|keystone|identity|True|admin|http: //192 .168.5| |7aca380c81b79||||||6.11:35357 /v3/ | |6b240a||||||| |b1caff56f31f4|RegionOne|keystone|identity|True|public|http: //192 .168.5| |dfabe5a8418c6||||||6.11:5000 /v3/ | |5e2839||||||| +---------------+-----------+--------------+--------------+---------+-----------+------------------+ 创建项目： 1 2 3 4 5 6 7 8 9 10 11 12 [root@linux-node1keystone] #openstackprojectcreate--domaindefault--description"ServiceProject"service +-------------+----------------------------------+ |Field|Value| +-------------+----------------------------------+ |description|ServiceProject| |domain_id|default| |enabled|True| | id |7f240473406147b99463f32b876bf69d| |is_domain|False| |name|service| |parent_id|default| +-------------+----------------------------------+ 这里生成的结果除了id和我不一样，其他的差不多一样 查看是否创建成功 1 2 3 4 5 6 7 [root@linux-node1keystone] #openstackprojectlist +----------------------------------+---------+ |ID|Name| +----------------------------------+---------+ |7ae0fb7deb5342d885a07c2c890a1ff4|admin| |7f240473406147b99463f32b876bf69d|service| +----------------------------------+---------+ 创建demo项目： 1 2 3 4 5 6 7 8 9 10 11 12 [root@linux-node1keystone] #openstackprojectcreate--domaindefault--description"DemoProject"demo +-------------+----------------------------------+ |Field|Value| +-------------+----------------------------------+ |description|DemoProject| |domain_id|default| |enabled|True| | id |9b913d25891849baa55b21d837e9b63d| |is_domain|False| |name|demo| |parent_id|default| +-------------+----------------------------------+ 验证是否创建成功： 1 2 3 4 5 6 7 8 [root@linux-node1keystone] #openstackprojectlist +----------------------------------+---------+ |ID|Name| +----------------------------------+---------+ |7ae0fb7deb5342d885a07c2c890a1ff4|admin| |7f240473406147b99463f32b876bf69d|service| |9b913d25891849baa55b21d837e9b63d|demo| +----------------------------------+---------+ 创建用户 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 [root@linux-node1keystone] #openstackusercreate--domaindefault--password-promptdemo UserPassword: RepeatUserPassword: +---------------------+----------------------------------+ |Field|Value| +---------------------+----------------------------------+ |domain_id|default| |enabled|True| | id |f0c69bad72b54e0daef92c2295425932| |name|demo| |password_expires_at|None| +---------------------+----------------------------------+ [root@linux-node1keystone] #openstackuserlist +----------------------------------+-------+ |ID|Name| +----------------------------------+-------+ |b84c1614b79b40278e02bd6ed034cc6f|admin| |f0c69bad72b54e0daef92c2295425932|demo| +----------------------------------+-------+ 创建role权限： 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 [root@linux-node1keystone] #openstackrolecreateuser +-----------+----------------------------------+ |Field|Value| +-----------+----------------------------------+ |domain_id|None| | id |f53267146a6449b797393f7fc5d23e10| |name|user| +-----------+----------------------------------+ [root@linux-node1keystone] #openstackrolelist +----------------------------------+-------+ |ID|Name| +----------------------------------+-------+ |9b0ba78cf70048efa8659220a3cebd06|admin| |f53267146a6449b797393f7fc5d23e10|user| +----------------------------------+-------+ 把用户添加到项目中，并赋予权限 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 [root@linux-node1keystone] #openstackroleadd--projectdemo--userdemouser#把demo用户加到demo项目中并赋予user权限 这里我把以后各个服务用户赋予不同role规则： [root@linux-node1keystone] #openstackusercreate--domaindefault--password-promptglance UserPassword: RepeatUserPassword: +---------------------+----------------------------------+ |Field|Value| +---------------------+----------------------------------+ |domain_id|default| |enabled|True| | id |8dc6f28207b64e6d845a444a2ba18205| |name|glance| |password_expires_at|None| +---------------------+----------------------------------+ [root@linux-node1keystone] #openstackroleadd--projectservice--userglanceadmin [root@linux-node1keystone] #openstackusercreate--domaindefault--password-promptnova UserPassword: RepeatUserPassword: +---------------------+----------------------------------+ |Field|Value| +---------------------+----------------------------------+ |domain_id|default| |enabled|True| | id |db596da4ed8f47ab9dc7fa77d3bc8c6c| |name|nova| |password_expires_at|None| +---------------------+----------------------------------+ [root@linux-node1keystone] #openstackroleadd--projectservice--usernovaadmin [root@linux-node1keystone] #openstackusercreate--domaindefault--password-promptneutron UserPassword: RepeatUserPassword: +---------------------+----------------------------------+ |Field|Value| +---------------------+----------------------------------+ |domain_id|default| |enabled|True| | id |c0f9c52898ad4d4f88254a01c458eb27| |name|neutron| |password_expires_at|None| +---------------------+----------------------------------+ [root@linux-node1keystone] #openstackroleadd--projectservice--userneutronadmin [root@linux-node1keystone] #openstackusercreate--domaindefault--password-promptcinder UserPassword: RepeatUserPassword: +---------------------+----------------------------------+ |Field|Value| +---------------------+----------------------------------+ |domain_id|default| |enabled|True| | id |e5dbdde24a7340edb8bd3f498f9d28b5| |name|cinder| |password_expires_at|None| +---------------------+----------------------------------+ [root@linux-node1keystone] #openstackroleadd--projectservice--usercinderadmin 验证keystone 验证用户： 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 unset OS_AUTH_URLOS_PASSWORD取消之前的环境变量 [root@linux-node1keystone] #openstack\ >--os-auth-urlhttp: //192 .168.56.11:35357 /v3 \ >--os-project-domain-namedefault\ >--os-user-domain-namedefault\ >--os-project-nameadmin\ >--os-usernameadmintokenissue Password: #输入密码后能出现下面内容说明用户没有问题 +------------+---------------------------------------------------------------------------------------+ |Field|Value| +------------+---------------------------------------------------------------------------------------+ |expires|2016-12-2811:05:46+00:00| | id |gAAAAABYY456xFHiZSMnQ7x88FxUJjuu3uO8xRLh_soTSgyf3KzMv0nY3s4wn1diFlJ7d2qjPub0iftlOKUnZ| ||z9QYPMUGhfxguZhEHWQtufNQNxZD9r8ekluU0XjCdrdnBU-fs3IM6EmJt3O1Sl-| ||Nw4G40uh0xatMkxI6bmrG3fRkCrcLga6Cx4| |project_id|7ae0fb7deb5342d885a07c2c890a1ff4| |user_id|b84c1614b79b40278e02bd6ed034cc6f| +------------+--------------------------------------------------------------------------------------- 创建环境变量脚本： 创建admin变量 1 2 3 4 5 6 7 8 9 [root@linux-node1~] #catadmin-openstack export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=admin export OS_USERNAME=admin export OS_PASSWORD=admin export OS_AUTH_URL=http: //192 .168.56.11:35357 /v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 创建demo变量 1 2 3 4 5 6 7 8 9 [root@linux-node1~] #catdemo-openstack export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=demo export OS_USERNAME=demo export OS_PASSWORD=demo export OS_AUTH_URL=http: //192 .168.56.11:5000 /v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 使环境变量生效： soure demo-openstack Keystone常见错误 1 2 3 4 5 6 401 #验证失败，keystone相关用户账户密码设置错误,时间不同步，或者输入的项目名称不对 403 #可能未初始化OS_token变量，需要使用source命令使其生效，也可能是配置的配置文件未生效，需要重启相关服务 409 #keystone创建用户，用户已存在 500 #服务器内部错误，服务配置有问题，看日志，检查配置 503 #keystone相关账户密码设置有问题，请将相关的glance账户删除，重新创建即可 服务故障 #相关服务没有起来 本文转自 kesungang 51CTO博客，原文链接：http://blog.51cto.com/sgk2011/1887008，如需转载请自行联系原作者
