目录一、openstack安装环境部署1. 配置网络接口2. 网络时间协议3. 安装open stack库4. 配置sql数据库5. 配置消息序列6.配置Memcached服务二、身份认证服务1. 安装和配置OpenStack身份认证服务2. 创建服务实体和API端点3. 创建域、项目、用户和角色4. 验证操作5. 创建 OpenStack 客户端环境脚本一、openstack安装环境部署OpenStack 是一个开源的云计算管理平台用于构建和管理公有云及私有云环境。它由一系列相互协作的服务组件组成涵盖计算、网络、存储、镜像、身份认证等多个方面能够将物理服务器、存储和网络资源抽象为统一的资源池并通过 API 对外提供按需分配的自助服务。本文以 Mitaka 版本为例详细介绍在控制节点上部署 OpenStack 基础环境以及身份认证服务Keystone的完整过程。整个部署流程分为两大部分第一部分是基础环境部署涵盖网络接口配置、时间同步、软件仓库配置、数据库、消息队列和缓存服务这些是后续所有组件正常运行的前提第二部分是身份认证服务的安装与配置包括数据库初始化、组件安装、服务实体创建以及客户端环境脚本的编写为整个云平台提供统一的身份认证与授权能力。1. 配置网络接口在部署 OpenStack 之前需要先规划好控制节点的网络。控制节点通常需要配置两块网卡eth0 用于管理网络负责各组件之间的内部通信eth1 用于外部网络或数据网络承载虚拟机实例的流量。下面以 eth0 配置静态 IP 地址 192.168.223.161 为例进行说明。配置静态 IP 可以避免因 DHCP 分配导致地址变化从而保证控制节点在集群中的地址稳定可靠。添加一块网卡eth1 # vim /etc/sysconfig/network-scripts/ifcfg-eth0 TYPEEthernet BOOTPROTOnone NAMEeth0 DEVICEeth0 ONBOOTyes IPADDR192.168.223.161 PREFIX24 GATEWAY192.168.223.2 DNS1114.114.114.114 [rootcontroller ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth1 TYPEEthernet BOOTPROTOnone NAMEeth1 DEVICEeth1 ONBOOTyes systemctl disable NetWorkManger systemctl restart network2. 网络时间协议OpenStack 各组件之间需要保持时间一致否则会导致令牌验证失败等问题。因此需要配置 NTP 服务确保控制节点和计算节点的时间同步。时间同步是分布式系统稳定运行的基础若节点间时间偏差过大Keystone 签发的令牌可能因时间戳校验不通过而失效进而影响整个平台的正常访问。同时为了方便节点间通信还需要在 /etc/hosts 文件中配置主机名解析使各节点可以通过主机名互相访问避免依赖易变的 IP 地址。[rootcontroller ~]# hostnamectl set-hostname controller [rootserver1 ~]# vim /etc/hosts 192.168.223.161 controller 192.168.223.162 compute1 192.168.223.163 block1 [rootcontroller ~]# timedatectl Local time: Mon 2026-08-24 19:55:59 CST Universal time: Mon 2026-08-24 11:55:59 UTC RTC time: Mon 2026-08-24 11:55:59 Time zone: Asia/Shanghai (CST, 0800) NTP enabled: yes NTP synchronized: yes RTC in local TZ: no DST active: n/a3. 安装open stack库OpenStack 的软件包通常通过 yum 仓库进行安装。这里使用本地 Mitaka 版本的软件仓库将安装包解压到 /opt 目录后配置本地 yum 源然后通过 yum 命令安装 OpenStack 客户端工具。使用本地仓库可以避免在安装过程中因网络波动导致下载失败同时也能加快软件包的安装速度适合在离线或内网环境中部署。[rootcontroller ~]# tar xf mitaka.tar -C /opt/ [rootcontroller ~]# cd /opt/ [rootcontroller opt]# ls mitaka [rootcontroller ~]# vim /etc/yum.repos.d/openstack.repo [openstack] namemitaka baseurlfile:///opt/mitaka gpgcheck0 [rootcontroller ~]# yum upgrade reboot[rootcontroller ~]# yum install python-openstackclient4. 配置sql数据库OpenStack 的各个服务组件都需要将数据持久化存储到数据库中。这里使用 MariaDB 作为后端数据库并针对 OpenStack 的需求进行参数优化包括绑定地址、默认存储引擎、最大连接数以及字符集等。其中绑定地址设置为控制节点的管理 IP便于其他节点访问默认存储引擎选用 InnoDB以支持事务和行级锁最大连接数调高到 4096以应对多组件并发访问的压力字符集统一使用 utf8避免中文等字符出现乱码。[rootcontroller ~]# yum install mariadb mariadb-server python2-PyMySQL [rootcontroller ~]# vim /etc/my.cnf.d/openstack.cnf [mysqld] bind-address 192.168.223.161 default-storage-engine innodb innodb_file_per_table max_connections 4096 collation-server utf8_general_ci character-set-server utf8 [rootcontroller ~]# systemctl enable --now mariadb.service [rootcontroller ~]# mysql_secure_installation [rootcontroller ~]# mysql -p Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 10 Server version: 10.1.20-MariaDB MariaDB Server Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others. Type help; or \h for help. Type \c to clear the current input statement. MariaDB [(none)] show databases; -------------------- | Database | -------------------- | information_schema | | mysql | | performance_schema | -------------------- 3 rows in set (0.00 sec)5. 配置消息序列消息队列是 OpenStack 各组件之间进行异步通信的核心中间件承担着服务间消息传递与任务调度的关键职责。所有服务keystone、glance、nova、neutron都通过 RabbitMQ 收发消息实现组件间的解耦与协作。当某个组件需要调用其他组件的功能时只需将请求以消息的形式发送到对应的队列中由目标组件异步消费处理从而避免组件之间直接耦合带来的性能瓶颈和故障扩散风险。这种基于消息队列的通信机制不仅提升了整个平台的并发处理能力也为后续的分布式扩展和故障隔离提供了有力支撑。[rootcontroller ~]# yum install rabbitmq-server [rootcontroller ~]# systemctl enable --now rabbitmq-server.service [rootcontroller ~]# rabbitmqctl add_user openstack openstack Creating user openstack ... [rootcontroller ~]# rabbitmqctl set_permissions openstack . . .* Setting permissions for user openstack in vhost / ... [rootcontroller ~]# rabbitmq-plugins enable rabbitmq_management The following plugins have been enabled: mochiweb webmachine rabbitmq_web_dispatch amqp_client rabbitmq_management_agent rabbitmq_management Applying plugin configuration to rabbitcontroller... started 6 plugins.浏览器访问 http://192.168.223.161:15672使用默认账号 guest 和密码 guest 登录。登录成功后可以在 RabbitMQ 管理界面中查看消息队列的运行状态、连接信息以及各队列的消费情况便于后续排查 OpenStack 各组件之间的消息通信问题。此外管理界面还提供了队列的实时吞吐量、消息堆积数量以及消费者连接状态等监控指标当某个组件出现消息积压或消费异常时可以快速定位到具体队列并采取相应处理措施。6.配置Memcached服务Memcached 是 OpenStack 中用于缓存令牌和会话信息的分布式内存缓存系统。通过将频繁访问的数据缓存在内存中可以显著减轻数据库的查询压力提升身份认证服务的响应速度。这里安装 memcached 和 python-memcached 客户端库并配置监听端口、最大连接数以及缓存大小等参数。其中监听端口默认使用 11211最大连接数设置为 1024缓存大小设置为 64MB这些参数可根据实际部署规模进行调整。配置完成后通过 netstat 命令确认服务已在 11211 端口正常监听即可供其他组件调用。二、身份认证服务身份认证服务Keystone是 OpenStack 的核心组件之一负责统一管理用户、项目、角色和令牌。在安装 Keystone 之前需要先为其创建独立的数据库并设置访问权限。这里使用 MariaDB 命令行工具登录数据库创建名为 keystone 的数据库并分别授予 keystone 用户从 localhost 和任意主机访问该数据库的权限密码均设置为 keystone。这样既保证了数据库的安全性也便于后续 Keystone 服务在控制节点上正常读写数据。1. 安装和配置OpenStack身份认证服务1.1 创建数据库和管理员令牌[rootcontroller ~]# mysql -p001003 Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 11 Server version: 10.1.20-MariaDB MariaDB Server Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others. Type help; or \h for help. Type \c to clear the current input statement. MariaDB [(none)] CREATE DATABASE keystone; Query OK, 1 row affected (0.00 sec) MariaDB [(none)] GRANT ALL PRIVILEGES ON keystone.* TO keystonelocalhost - IDENTIFIED BY keystone; Query OK, 0 rows affected (0.00 sec) MariaDB [(none)] GRANT ALL PRIVILEGES ON keystone.* TO keystone% - IDENTIFIED BY keystone; Query OK, 0 rows affected (0.00 sec) MariaDB [(none)] ^DBye 生成一个随机值在初始的配置中作为管理员的令牌。 [rootcontroller ~]# openssl rand -hex 10 f3c058f58aa0a10e4132安装 Keystone 组件时需要同时安装 Apache HTTP 服务器和 mod_wsgi 模块因为 Keystone 通过 WSGI 接口运行在 Apache 之上。安装完成后使用 openssl rand -hex 10 生成一个随机管理员令牌该令牌用于后续初始化操作时的身份验证。接着编辑 /etc/keystone/keystone.conf 配置文件在 [DEFAULT] 段设置管理员令牌在 [database] 段配置数据库连接字符串指定使用 PyMySQL 驱动连接 keystone 数据库并在 [token] 段将令牌提供者设置为 fernet以使用 Fernet 格式的令牌进行安全认证。1.2 安装并配置http服务[rootcontroller ~]# yum install openstack-keystone httpd mod_wsgi [rootcontroller ~]# vim /etc/keystone/keystone.conf [DEFAULT] admin_token f3c058f58aa0a10e4132 ··· [database] connection mysqlpymysql://keystone:keystonecontroller/keystone ··· [token] provider fernet1.3 初始化身份认证服务的数据库[rootcontroller ~]# su -s /bin/sh -c keystone-manage db_sync keystone [rootcontroller ~]# mysql -p Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 13 Server version: 10.1.20-MariaDB MariaDB Server Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others. Type help; or \h for help. Type \c to clear the current input statement. MariaDB [(none)] use keystone Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Database changed MariaDB [keystone] show tables; ------------------------ | Tables_in_keystone | ------------------------ | access_token | | assignment | | config_register | | consumer | | credential | | domain | | endpoint | | endpoint_group | | federated_user | | federation_protocol | | group | | id_mapping | | identity_provider | | idp_remote_ids | | implied_role | | local_user | | mapping | | migrate_version | | password | | policy | | policy_association | | project | | project_endpoint | | project_endpoint_group | | region | | request_token | | revocation_event | | role | | sensitive_config | | service | | service_provider | | token | | trust | | trust_role | | user | | user_group_membership | | whitelisted_config | ------------------------ 37 rows in set (0.00 sec)1.4 初始化Fernet keys[rootcontroller ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone1.5 配置 Apache HTTP 服务器[rootcontroller ~]# vim /etc/httpd/conf/httpd.conf [rootcontroller ~]# vim /etc/httpd/conf.d/wsgi-keystone.conf [rootcontroller ~]# systemctl enable --now httpd.service2. 创建服务实体和API端点服务实体 (service)代表一个 OpenStack 组件例如 glance、nova、neutron在 keystone 里登记这是一个什么服务。API 端点 (endpoint)服务的访问地址分public、internal、admin三种外部用户、内部组件、管理员分别调用。用 Keystone 引导令牌登录不填账号密码在 OpenStack 数据库登记 keystone 身份服务分别创建对外、内部、管理员三套 API 访问端点public/internal/admin完成 Keystone 基础元数据注册为后面建域、项目、用户做准备。[rootcontroller ~]# export OS_TOKENf3c058f58aa0a10e4132 [rootcontroller ~]# export OS_URLhttp://controller:35357/v3 [rootcontroller ~]# export OS_IDENTITY_API_VERSION3 [rootcontroller ~]# openstack service create \ --name keystone --description OpenStack Identity identity ----------------------------------------------- | Field | Value | ----------------------------------------------- | description | OpenStack Identity | | enabled | True | | id | 806c1610b2be4a1bb5eb526cfd19f43c | | name | keystone | | type | identity | ----------------------------------------------- [rootcontroller ~]# openstack endpoint create --region RegionOne \ identity public http://controller:5000/v3 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | 3fa998ceb6824240a8acbe031c0d3dc3 | | interface | public | | region | RegionOne | | region_id | RegionOne | | service_id | 806c1610b2be4a1bb5eb526cfd19f43c | | service_name | keystone | | service_type | identity | | url | http://controller:5000/v3 | ------------------------------------------------ [rootcontroller ~]# openstack endpoint create --region RegionOne \ identity internal http://controller:5000/v3 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | ea71e6674c2843e18055658da3bad17c | | interface | internal | | region | RegionOne | | region_id | RegionOne | | service_id | 806c1610b2be4a1bb5eb526cfd19f43c | | service_name | keystone | | service_type | identity | | url | http://controller:5000/v3 | ------------------------------------------------ [rootcontroller ~]# openstack endpoint create --region RegionOne \ identity admin http://controller:35357/v3 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | 6511e92b4b8343d6b00e45d52ce0c5f5 | | interface | admin | | region | RegionOne | | region_id | RegionOne | | service_id | 806c1610b2be4a1bb5eb526cfd19f43c | | service_name | keystone | | service_type | identity | | url | http://controller:35357/v3 | ------------------------------------------------3. 创建域、项目、用户和角色[rootcontroller ~]# openstack domain create --description Default Domain default ----------------------------------------------- | Field | Value | ----------------------------------------------- | description | Default Domain | | enabled | True | | id | 30e46230611e4fb7b152e1adf37f3200 | | name | default | -----------------------------------------------[rootcontroller ~]# openstack project create --domain default \ --description Admin Project admin ----------------------------------------------- | Field | Value | ----------------------------------------------- | description | Admin Project | | domain_id | 30e46230611e4fb7b152e1adf37f3200 | | enabled | True | | id | ec476ad6630045538f632b5b8c3f39fc | | is_domain | False | | name | admin | | parent_id | 30e46230611e4fb7b152e1adf37f3200 | ----------------------------------------------- [rootcontroller ~]# openstack user create --domain default --password admin admin --------------------------------------------- | Field | Value | --------------------------------------------- | domain_id | 30e46230611e4fb7b152e1adf37f3200 | | enabled | True | | id | ddebb4574530468e93314de917a89b14 | | name | admin | ---------------------------------------------[rootcontroller ~]# openstack role create admin --------------------------------------------- | Field | Value | --------------------------------------------- | domain_id | None | | id | 8f9436781000465da644ba4d7da7a07b | | name | admin | --------------------------------------------- [rootcontroller ~]# openstack role add --project admin --user admin admin[rootcontroller ~]# openstack project create --domain default \ --description Service Project service ----------------------------------------------- | Field | Value | ----------------------------------------------- | description | Service Project | | domain_id | 30e46230611e4fb7b152e1adf37f3200 | | enabled | True | | id | 6b6c01d41c3945df925064bbb534305b | | is_domain | False | | name | service | | parent_id | 30e46230611e4fb7b152e1adf37f3200 | -----------------------------------------------[rootcontroller ~]# openstack project create --domain default \ --description Demo Project demo ----------------------------------------------- | Field | Value | ----------------------------------------------- | description | Demo Project | | domain_id | 30e46230611e4fb7b152e1adf37f3200 | | enabled | True | | id | 6cb4b07252954ae48eeb6dea47df7acc | | is_domain | False | | name | demo | | parent_id | 30e46230611e4fb7b152e1adf37f3200 | ----------------------------------------------- [rootcontroller ~]# openstack user create --domain default \ --password demo demo --------------------------------------------- | Field | Value | --------------------------------------------- | domain_id | 30e46230611e4fb7b152e1adf37f3200 | | enabled | True | | id | 095770ae8de1491aa1d822bc3c302769 | | name | demo | ---------------------------------------------[rootcontroller ~]# openstack role create user --------------------------------------------- | Field | Value | --------------------------------------------- | domain_id | None | | id | 8119492d08b74e6bbfa11893ab1ff51c | | name | user | --------------------------------------------- [rootcontroller ~]# openstack role add --project demo --user demo user4. 验证操作[rootcontroller ~]# unset OS_TOKEN OS_URL [rootcontroller ~]# openstack --os-auth-url http://controller:35357/v3 \ --os-project-domain-name default --os-user-domain-name default \ --os-project-name admin --os-username admin token issue Password: ------------------------------------------------------------------------------------------------------------------------------ | Field | Value | ------------------------------------------------------------------------------------------------------------------------------ | expires | 2026-08-24T15:51:16.669318Z | | id | gAAAAABqjFpkJNimE8zvrr6hyrhJfrdXYeDgcufdRsNZV1eE_-Li4WuEJEuXd6UEBDilMDWm-P9_3BQyl746HfmX- | | | j8cYEo3Eajssr5HYMj6-0urYckg_mDfa7KkGKnaSSlATsmN_3iMADsYBtgYZ9zrOuz49bHR7L4-fGddt_Z2R84J0RCCnV4 | | project_id | ec476ad6630045538f632b5b8c3f39fc | | user_id | ddebb4574530468e93314de917a89b14 | ------------------------------------------------------------------------------------------------------------------------------[rootcontroller ~]# openstack --os-auth-url http://controller:5000/v3 \ --os-project-domain-name default --os-user-domain-name default \ --os-project-name demo --os-username demo token issue Password: ------------------------------------------------------------------------------------------------------------------------------ | Field | Value | ------------------------------------------------------------------------------------------------------------------------------ | expires | 2026-08-24T15:51:44.218246Z | | id | gAAAAABqjFqAGnPat0dHcdV9pRgALliy0BzHgV9fxWmfnX4B07i8lCFqiSLD9t31CEKA6Oi5RM0cDJcKHZrHBbQvQGjzvSejENDIO82q2Mkzc- | | | CYAxFC9sPUrk5mTzuXnNqD1R2KlWGlgw_U0_PRSHZ_DBY5E7MQMhPbxXR_Umu69Coxup8Trrw | | project_id | 6cb4b07252954ae48eeb6dea47df7acc | | user_id | 095770ae8de1491aa1d822bc3c302769 | ------------------------------------------------------------------------------------------------------------------------------5. 创建 OpenStack 客户端环境脚本[rootcontroller ~]# vim admin-openrc export OS_PROJECT_DOMAIN_NAMEdefault export OS_USER_DOMAIN_NAMEdefault export OS_PROJECT_NAMEadmin export OS_USERNAMEadmin export OS_PASSWORDadmin export OS_AUTH_URLhttp://controller:35357/v3 export OS_IDENTITY_API_VERSION3 export OS_IMAGE_API_VERSION2[rootcontroller ~]# vim demo-openrc export OS_PROJECT_DOMAIN_NAMEdefault export OS_USER_DOMAIN_NAMEdefault export OS_PROJECT_NAMEdemo export OS_USERNAMEdemo export OS_PASSWORDdemo export OS_AUTH_URLhttp://controller:5000/v3 export OS_IDENTITY_API_VERSION3 export OS_IMAGE_API_VERSION2[rootcontroller ~]# chmod x admin-openrc demo-openrc[rootcontroller ~]# source admin-openrc [rootcontroller ~]# openstack user list ----------------------------------------- | ID | Name | ----------------------------------------- | 095770ae8de1491aa1d822bc3c302769 | demo | | ddebb4574530468e93314de917a89b14 | admin | ----------------------------------------- [rootcontroller ~]# source demo-openrc [rootcontroller ~]# openstack user list You are not authorized to perform the requested action: identity:list_users (HTTP 403) (Request-ID: req-0cbdf311-7100-4b06-8b19-d3cb9d8c5a70)[rootcontroller ~]# source admin-openrc [rootcontroller ~]# openstack user list ----------------------------------------- | ID | Name | ----------------------------------------- | 095770ae8de1491aa1d822bc3c302769 | demo | | ddebb4574530468e93314de917a89b14 | admin | ----------------------------------------- [rootcontroller ~]# openstack role list ----------------------------------------- | ID | Name | ----------------------------------------- | 8119492d08b74e6bbfa11893ab1ff51c | user | | 8f9436781000465da644ba4d7da7a07b | admin | ----------------------------------------- [rootcontroller ~]# openstack service list ------------------------------------------------------ | ID | Name | Type | ------------------------------------------------------ | 806c1610b2be4a1bb5eb526cfd19f43c | keystone | identity | ------------------------------------------------------ [rootcontroller ~]# openstack endpoint list ------------------------------------------------------------------------------------------------------------------------- | ID | Region | Service Name | Service Type | Enabled | Interface | URL | ------------------------------------------------------------------------------------------------------------------------- | 3fa998ceb6824240a8acbe031c0d3dc3 | RegionOne | keystone | identity | True | public | http://controller:5000/v3 | | 6511e92b4b8343d6b00e45d52ce0c5f5 | RegionOne | keystone | identity | True | admin | http://controller:35357/v3 | | ea71e6674c2843e18055658da3bad17c | RegionOne | keystone | identity | True | internal | http://controller:5000/v3 | ------------------------------------------------------------------------------------------------------------------------- [rootcontroller ~]# openstack project list ------------------------------------------- | ID | Name | ------------------------------------------- | 6b6c01d41c3945df925064bbb534305b | service | | 6cb4b07252954ae48eeb6dea47df7acc | demo | | ec476ad6630045538f632b5b8c3f39fc | admin | ------------------------------------------- [rootcontroller ~]# openstack domain list -------------------------------------------------------------------- | ID | Name | Enabled | Description | -------------------------------------------------------------------- | 30e46230611e4fb7b152e1adf37f3200 | default | True | Default Domain | --------------------------------------------------------------------