認証管理担当 KeyStone インストール手順を記載します。
Github から stable/diablo のコードを取得します。
$ cd /usr/local/src
$ sudo git clone https://github.com/openstack/keystone.git -b stable/diablo
$ cd keystone
$ git branch
* stable/diablo
keystone/tools/pip-requires には KeyStone と依存関係があるものが列挙されれています。
KeyStone 本体のインストール前にこれらをインストールします。(Ubuntu パッケージでインストールしても OK)
$ sudo -i
# pip install -r /usr/local/src/keystone/tools/pip-requires
(こけたらバージョンのせいかも)
全てのパッケージがインストールされたことを確認し、KeyStone のインストールを行います。
# cd /usr/local/src/keystone
# python setup.py build
# python setup.py install --record installfile.txt
KeyStone 用のユーザと必要(そうな)ディレクトリを作成します。
# mkdir /etc/keystone /var/lib/keystone /var/log/keystone
# useradd -r -d /var/lib/keystone -s /bin/bash keystone
(本番環境構築時は -r だけではなく UID, GID を指定した方が良い)
# cat << _EOF_ > /etc/init/keystone.conf
description "Keystone API server"
author "Soren Hansen <soren@linux2go.dk>"
start on (local-filesystems and net-device-up IFACE!=lo)
stop on runlevel [016]
respawn
exec su -c "keystone --log-dir=/var/log/keystone --log-file=api.log" keystone
_EOF_
# cd /etc/init.d
# ln -s /lib/init/upstart-job keystone
# cp -p /usr/local/src/keystone/etc/* /etc/keystone/
# chown -R keystone:keystone /etc/keystone /var/lib/keystone /var/log/keystone
ローテート期間や所有者などは別途調整の上、設定を行います。
# cat << _EOF_ > /etc/logrotate.d/keystone
/var/log/keystone/*.log {
daily
missingok
}
_EOF_
# exit
サンプル設定ファイルを修正します。
[DEFAULT]
# Show more verbose log output (sets INFO log level output)
verbose = False
# Show debugging output in logs (sets DEBUG log level output)
debug = False
# Which backend store should Keystone use by default.
# Default: 'sqlite'
# Available choices are 'sqlite' [future will include LDAP, PAM, etc]
default_store = sqlite
# Log to this file. Make sure you do not set the same log
# file for both the API and registry servers!
log_file = keystone.log
# List of backends to be configured
backends = keystone.backends.sqlalchemy
#For LDAP support, add: ,keystone.backends.ldap
# Dictionary Maps every service to a header.Missing services would get header
# X_(SERVICE_NAME) Key => Service Name, Value => Header Name
service-header-mappings = {
'nova' : 'X-Server-Management-Url',
'swift' : 'X-Storage-Url',
'cdn' : 'X-CDN-Management-Url'}
# Address to bind the API server
# TODO Properties defined within app not available via pipeline.
service_host = 0.0.0.0
# Port the bind the API server to
service_port = 5000
# Address to bind the Admin API server
admin_host = 0.0.0.0
# Port the bind the Admin API server to
admin_port = 35357
#Role that allows to perform admin operations.
keystone-admin-role = Admin
#Role that allows to perform service admin operations.
keystone-service-admin-role = KeystoneServiceAdmin
#Tells whether password user need to be hashed in the backend
hash-password = True
[keystone.backends.sqlalchemy]
# SQLAlchemy connection string for the reference implementation registry
# server. Any valid SQLAlchemy connection string is fine.
# See: http://bit.ly/ideIpI
sql_connection = sqlite:///keystone.db
backend_entities = ['UserRoleAssociation', 'Endpoints', 'Role', 'Tenant',
'User', 'Credentials', 'EndpointTemplates', 'Token',
'Service']
# Period in seconds after which SQLAlchemy should reestablish its connection
# to the database.
sql_idle_timeout = 30
[pipeline:admin]
pipeline =
urlrewritefilter
admin_api
[pipeline:keystone-legacy-auth]
pipeline =
urlrewritefilter
legacy_auth
RAX-KEY-extension
service_api
[app:service_api]
paste.app_factory = keystone.server:service_app_factory
[app:admin_api]
paste.app_factory = keystone.server:admin_app_factory
[filter:urlrewritefilter]
paste.filter_factory = keystone.middleware.url:filter_factory
[filter:legacy_auth]
paste.filter_factory = keystone.frontends.legacy_token_auth:filter_factory
[filter:RAX-KEY-extension]
paste.filter_factory = keystone.contrib.extensions.service.raxkey.frontend:filter_factory
[filter:debug]
paste.filter_factory = keystone.common.wsgi:debug_filter_factory
パラメータ | 解説 | 今回設定する値 |
---|---|---|
verbose | ログを出力設定 | False |
debug | デバッグログ出力設定 | False |
log_file | keystone-manage を実行した際に出力されるログ | /var/log/keystone/keystone-manage.log |
default_store | 何なのかよくわかりまてん。 | sqlite |
service_host | APIサーバーをバインドするアドレス | 192.168.0.2 |
admin_host | Admin APIサーバーをバインドするアドレス | 192.168.0.2 |
keystone-admin-role | KeystoneAdmin の名前 | Admin |
keystone-service-admin-role | KeystoneServiceAdmin の名前 | KeystoneServiceAdmin |
hash-password | パスワードのハッシュ化 | True |
sql_connection | データベース 接続文字列 | mysql://keystone:y7u8i9YUI@localhost/keystone |
KeyStone 管理コマンドによるユーザ等の作成を行います。
テナント作成
$ sudo keystone-manage tenant add adminTenant
$ sudo keystone-manage tenant add demoTenant
ユーザ作成
$ sudo keystone-manage user add admin y7u8i9YUI
$ sudo keystone-manage user add demo y7u8i9YUI
ロール作成
$ sudo keystone-manage role add Admin
$ sudo keystone-manage role add Member
$ sudo keystone-manage role add KeystoneAdmin
$ sudo keystone-manage role add KeystoneServiceAdmin
ロールとユーザの紐付け & テナント
※ テナントなしの場合は全体なの・・・か?
$ sudo keystone-manage role grant Admin admin adminTenant
$ sudo keystone-manage role grant Admin admin demoTenant
$ sudo keystone-manage role grant Admin admin
$ sudo keystone-manage role grant KeystoneAdmin admin
$ sudo keystone-manage role grant KeystoneServiceAdmin admin
$ sudo keystone-manage role grant Member demo demoTenant
連携するサービスの登録
$ sudo keystone-manage service add nova compute "Nova Compute Service"
$ sudo keystone-manage service add glance image "Glance Image Service"
$ sudo keystone-manage service add keystone identity "Keystone Identity Service"
サービスと連携する際に利用するエンドポイントを作成
$ sudo keystone-manage endpointTemplates add RegionOne nova http://192.168.0.2:8774/v1.1/%tenant_id% http://192.168.0.2:8774/v1.1/%tenant_id% http://192.168.0.2:8774/v1.1/%tenant_id% 1 1
$ sudo keystone-manage endpointTemplates add RegionOne glance http://192.168.0.2:9292/v1 http://192.168.0.2:9292/v1 http://192.168.0.2:9292/v1 1 1
$ sudo keystone-manage endpointTemplates add RegionOne keystone http://192.168.0.2:5000/v2.0 http://192.168.0.2:35357/v2.0 http://192.168.0.2:5000/v2.0 1 1
Token を有効期限付きで作成
$ sudo keystone-manage token add 999888777666 admin adminTenant 2015-02-05T00:00
(Optional) euca2ools を使用する時に設定
$ sudo keystone-manage credentials add admin EC2 'admin' y7u8i9YUI adminTenant
はいごめんなさい。もっと詳しく書きます。
$ curl -d '{"auth": {"tenantName": "adminTenant", "passwordCredentials":{"username": "admin", "password": "y7u8i9YUI"}}}' -H "Content-type:application/json" http://192.168.0.2:35357/v2.0/tokens | python -mjson.tool