簡介
Keystone是Openstack的身份認(rèn)證服務(wù)，作為Openstack的基礎(chǔ)支持服務(wù)，keystone提供下面
幾種功能：
- 管理用戶及其權(quán)限
- 維護(hù)Openstack Services的Endpoint
- Authentication（認(rèn)證）和Authorization（鑒權(quán)）
Keystone的主要概念
-
User
User 指代任何使用 OpenStack 的實(shí)體，可以是真正的用戶，其他系統(tǒng)或者服務(wù)。
-
Credentials
Credentials 是 User 用來證明自己身份的信息，可以是：
- 用戶名/密碼
- Token
- API Key
- 其他高級(jí)方式
-
Authentication
確認(rèn)用戶身份的過程。User 訪問 OpenStack 時(shí)向 Keystone 提交用戶名和密碼形式的
Credentials，Keystone 驗(yàn)證通過后會(huì)給 User 簽發(fā)一個(gè) Token 作為后續(xù)訪問的
Credential。 -
Token
Token 是由數(shù)字和字母組成的字符串，User 成功 Authentication 后 Keystone 生成
Token 并分配給 User。- Token 用做訪問 Service 的 Credential
- Service 會(huì)通過 Keystone 驗(yàn)證 Token 的有效性
- Token 的有效期默認(rèn)是 24 小時(shí)
-
Project
Project 用于將 OpenStack 的資源（計(jì)算、存儲(chǔ)和網(wǎng)絡(luò)）進(jìn)行分組和隔離。
根據(jù) OpenStack 服務(wù)的對(duì)象不同，Project 可以是一個(gè)客戶（公有云，也叫租戶）、部門
或者項(xiàng)目組（私有云）。 -
Service
OpenStack 的 Service 包括 Compute (Nova)、Block Storage (Cinder)、
Object Storage (Swift)、Image Service (Glance) 、Networking Service
(Neutron) 等。
每個(gè) Service 都會(huì)提供若干個(gè) Endpoint，User 通過 Endpoint 訪問資源和執(zhí)行操作。 -
Endpoint
Endpoint是一個(gè)網(wǎng)絡(luò)上可訪問服務(wù)的地址，通常是一個(gè)URL。Service通過Endpoint暴露自
己的API。
[root@openstack-controller keystone]# source /home/fbo/tools/admin-openrc.sh
[root@openstack-controller keystone]# openstack catalog list
+----------+----------+----------------------------------------------------------------------------------+
| Name | Type | Endpoints |
+----------+----------+----------------------------------------------------------------------------------+
| neutron | network | RegionOne |
| | | admin: http://openstack-controller:9696 |
| | | RegionOne |
| | | public: http://openstack-controller:9696 |
| | | RegionOne |
| | | internal: http://openstack-controller:9696 |
| | | |
| nova | compute | RegionOne |
| | | public: http://openstack-controller:8774/v2/471592a4281e4223b2ad578b5c9b8442 |
| | | RegionOne |
| | | internal: http://openstack-controller:8774/v2/471592a4281e4223b2ad578b5c9b8442 |
| | | RegionOne |
| | | admin: http://openstack-controller:8774/v2/471592a4281e4223b2ad578b5c9b8442 |
| | | |
| keystone | identity | RegionOne |
| | | internal: http://openstack-controller:5000/v2.0 |
| | | RegionOne |
| | | admin: http://openstack-controller:35357/v2.0 |
| | | RegionOne |
| | | public: http://openstack-controller:5000/v2.0 |
| | | |
| cinder | volume | RegionOne |
| | | admin: http://openstack-controller:8776/v1/471592a4281e4223b2ad578b5c9b8442 |
| | | RegionOne |
| | | public: http://openstack-controller:8776/v1/471592a4281e4223b2ad578b5c9b8442 |
| | | RegionOne |
| | | internal: http://openstack-controller:8776/v1/471592a4281e4223b2ad578b5c9b8442 |
| | | |
| cinderv2 | volumev2 | RegionOne |
| | | admin: http://openstack-controller:8776/v2/471592a4281e4223b2ad578b5c9b8442 |
| | | RegionOne |
| | | internal: http://openstack-controller:8776/v2/471592a4281e4223b2ad578b5c9b8442 |
| | | RegionOne |
| | | public: http://openstack-controller:8776/v2/471592a4281e4223b2ad578b5c9b8442 |
| | | |
| glance | image | RegionOne |
| | | admin: http://openstack-controller:9292 |
| | | RegionOne |
| | | public: http://openstack-controller:9292 |
| | | RegionOne |
| | | internal: http://openstack-controller:9292 |
| | | |
+----------+----------+----------------------------------------------------------------------------------+
-
Role
Keystone借助Role實(shí)現(xiàn)Authorization。
- keystone定義Role
[root@openstack-controller keystone]# openstack role list +----------------------------------+--------------+ | ID | Name | +----------------------------------+--------------+ | 268b282d5d4c44fd9f4ef6f4d3538ac2 | compute-user | | 36b27d9db66b4d2799770d59d25610ff | user | | ea7ae29ac10344f5b2f432246a78b26a | admin | +----------------------------------+--------------+- Service決定每個(gè)Role能做什么事情。
Service通過
/etc/[SERVICE_CODENAME]/policy.json文件對(duì)Role進(jìn)行訪問控制，
例如，下面的/etc/cinder/policy.json的配置就沒有限制用戶創(chuàng)建卷：[root@openstack-controller keystone]# grep volume:create /etc/cinder/policy.json "volume:create": "",Openstack默認(rèn)只區(qū)分admin用戶和非admin用戶，如果想實(shí)現(xiàn)細(xì)粒度授權(quán)的話，可以定制修
改policy.json文件。
Keystone使用示例
[root@openstack-controller keystone]# openstack user create --password-prompt --email alice@example alice
User Password:
Repeat User Password:
+-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | default |
| email | alice@example |
| enabled | True |
| id | 02a0447e04bf420db7c0d5aec6308ebe |
| name | alice |
+-----------+----------------------------------+
[root@openstack-controller keystone]# openstack project create acme --domain default
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | |
| domain_id | default |
| enabled | True |
| id | bc657759d86f4296a317d738fed09710 |
| is_domain | False |
| name | acme |
| parent_id | None |
+-------------+----------------------------------+
[root@openstack-controller keystone]# openstack domain list
+---------+---------+---------+----------------------------------------------------------------------+
| ID | Name | Enabled | Description |
+---------+---------+---------+----------------------------------------------------------------------+
| default | Default | True | Owns users and tenants (i.e. projects) available on Identity API v2. |
+---------+---------+---------+----------------------------------------------------------------------+
[root@openstack-controller keystone]# openstack --os-identity-api-version=3 domain create emea
+---------+----------------------------------+
| Field | Value |
+---------+----------------------------------+
| enabled | True |
| id | e0d06f7bf37147088e888c1198e547ee |
| name | emea |
+---------+----------------------------------+
[root@openstack-controller keystone]# openstack domain list
+----------------------------------+---------+---------+----------------------------------------------------------------------+
| ID | Name | Enabled | Description |
+----------------------------------+---------+---------+----------------------------------------------------------------------+
| default | Default | True | Owns users and tenants (i.e. projects) available on Identity API v2. |
| e0d06f7bf37147088e888c1198e547ee | emea | True | |
+----------------------------------+---------+---------+----------------------------------------------------------------------+
[root@openstack-controller keystone]# openstack role create compute-user
+-------+----------------------------------+
| Field | Value |
+-------+----------------------------------+
| id | 268b282d5d4c44fd9f4ef6f4d3538ac2 |
| name | compute-user |
+-------+----------------------------------+
[root@openstack-controller keystone]# openstack role add --project acme --user alice compute-user
