pada part3 ini kita akan membahas keystone sebagai identity service yang berfungsi untuk authentikasi ke semua service di openstack.
semua konfigurasi identity service ini ada di controller node
[CONTROLLER NODE]
sebelum kita mengkonfigurasi identity service kita harus membuat database terlebih dahulu
- Membuat database keystone
login ke database server mariadb mengunakan root
1 2 3 4 5 6 7 8 9 |
root@controller:~# mysql -u root -p Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 44 Server version: 10.0.27-MariaDB-0ubuntu0.16.04.1 Ubuntu 16.04 Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. |
setelah itu buat database dengan nama “keystone”
1 2 |
MariaDB [(none)]> create database keystone; Query OK, 1 row affected (0.00 sec) |
kemudian memberikan hak akses ke database keystone
1 2 3 4 5 |
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'password_anda'; Query OK, 0 rows affected (0.00 sec) MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'password_anda'; Query OK, 0 rows affected (0.01 sec) |
setelah itu keluar dari mariadb server, dan install komponen identitiy servicenya
- Install Keystone
1 |
root@controller:~# apt install keystone |
edit file /etc/keystone/keystone.conf
- setting [database] untuk mengatur akses ke database
1 2 3 4 |
[database] ..... mysql+pymysql://keystone:password_keystone@controller/keystone |
- setting bagian [token] dan konfig provider menjadi fernet
1 2 3 |
[token] ... provider = fernet |
kemudian jalankan perintah dibawah ini untuk mengisi database keystone ke mariadb
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
root@controller:~# su -s /bin/sh -c "keystone-manage db_sync" keystone 2016-10-20 14:24:30.202 12378 INFO migrate.versioning.api [-] 66 -> 67... 2016-10-20 14:24:41.782 12378 INFO migrate.versioning.api [-] done 2016-10-20 14:24:41.783 12378 INFO migrate.versioning.api [-] 67 -> 68... 2016-10-20 14:24:41.813 12378 INFO migrate.versioning.api [-] done 2016-10-20 14:24:41.814 12378 INFO migrate.versioning.api [-] 68 -> 69... 2016-10-20 14:24:41.844 12378 INFO migrate.versioning.api [-] done 2016-10-20 14:24:41.844 12378 INFO migrate.versioning.api [-] 69 -> 70... 2016-10-20 14:24:41.875 12378 INFO migrate.versioning.api [-] done 2016-10-20 14:24:41.875 12378 INFO migrate.versioning.api [-] 70 -> 71... 2016-10-20 14:24:41.905 12378 INFO migrate.versioning.api [-] done 2016-10-20 14:24:41.906 12378 INFO migrate.versioning.api [-] 71 -> 72... 2016-10-20 14:24:41.936 12378 INFO migrate.versioning.api [-] done 2016-10-20 14:24:41.937 12378 INFO migrate.versioning.api [-] 72 -> 73... 2016-10-20 14:24:42.992 12378 INFO migrate.versioning.api [-] done 2016-10-20 14:24:42.992 12378 INFO migrate.versioning.api [-] 73 -> 74... ......... |
- Menginisialisasi fernet repository
1 2 |
root@controller:~# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone root@controller:~# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone |
Hasil outputnya seperti ini
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
root@controller:~# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone 2016-10-20 14:29:06.092 12438 INFO keystone.common.fernet_utils [-] key_repository does not appear to exist; attempting to create it 2016-10-20 14:29:06.093 12438 INFO keystone.common.fernet_utils [-] Created a new key: /etc/keystone/fernet-keys/0 2016-10-20 14:29:06.094 12438 INFO keystone.common.fernet_utils [-] Starting key rotation with 1 key files: ['/etc/keystone/fernet-keys/0'] 2016-10-20 14:29:06.095 12438 INFO keystone.common.fernet_utils [-] Current primary key is: 0 2016-10-20 14:29:06.096 12438 INFO keystone.common.fernet_utils [-] Next primary key will be: 1 2016-10-20 14:29:06.096 12438 INFO keystone.common.fernet_utils [-] Promoted key 0 to be the primary: 1 2016-10-20 14:29:06.097 12438 INFO keystone.common.fernet_utils [-] Created a new key: /etc/keystone/fernet-keys/0 root@controller:~# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone 2016-10-20 14:29:39.616 12451 INFO keystone.common.fernet_utils [-] key_repository does not appear to exist; attempting to create it 2016-10-20 14:29:39.617 12451 INFO keystone.common.fernet_utils [-] Created a new key: /etc/keystone/credential-keys/0 2016-10-20 14:29:39.618 12451 INFO keystone.common.fernet_utils [-] Starting key rotation with 1 key files: ['/etc/keystone/credential-keys/0'] 2016-10-20 14:29:39.619 12451 INFO keystone.common.fernet_utils [-] Current primary key is: 0 2016-10-20 14:29:39.619 12451 INFO keystone.common.fernet_utils [-] Next primary key will be: 1 2016-10-20 14:29:39.620 12451 INFO keystone.common.fernet_utils [-] Promoted key 0 to be the primary: 1 2016-10-20 14:29:39.620 12451 INFO keystone.common.fernet_utils [-] Created a new key: /etc/keystone/credential-keys/0 |
- menambahkan bootstrap pada identity service
1 |
root@controller:~# keystone-manage bootstrap --bootstrap-password password_anda --bootstrap-admin-url http://controller:35357/v3/ --bootstrap-internal-url http://controller:35357/v3/ --bootstrap-public-url http://controller:5000/v3/ --bootstrap-region-id RegionOne |
kemudian setelah itu konfigurasi Apache HTTP Server
- Edit file /etc/apache2/apache2.conf dan menambahkan ServerName controller
1 2 3 4 |
root@controller:~# nano /etc/apache2/apache2.conf ..... #tambahkan pada baris paling bawah ServerName controller |
- Kemudian Restart service apache dan mengahpus default SQlite database
1 2 3 |
root@controller:~# /etc/init.d/apache2 restart [ ok ] Restarting apache2 (via systemctl): apache2.service. root@controller:~# rm -f /var/lib/keystone/keystone.db |
- kemudian config akun administrative dengan memberikan inisial terlebih dahulu
1 2 3 4 5 6 7 |
root@controller:~# export OS_USERNAME=admin root@controller:~# export OS_PASSWORD=password_anda root@controller:~# export OS_PROJECT_NAME=admin root@controller:~# export OS_USER_DOMAIN_NAME=default root@controller:~# export OS_PROJECT_DOMAIN_NAME=default root@controller:~# export OS_AUTH_URL=http://controller:35357/v3 root@controller:~# export OS_IDENTITY_API_VERSION=3 |
setelah kita mengexport akun administrative diatas, maka kita akan membuat domain, project, user dan role
- Membuat Domain , Project, User dan Role
pada identity service setiap user akan melaukan authentikasi untuk mengakses domain, project dan hak akses terhadap suatu resource pada openstack.
- Membuat Service Project
1 2 3 4 5 6 7 8 9 10 11 12 |
root@controller:~# openstack project create --domain default --description "Service Project" service +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | Service Project | | domain_id | default | | enabled | True | | id | e0371aed80924f7dbd8f351edd5eac5a | | is_domain | False | | name | service | | parent_id | default | +-------------+----------------------------------+ |
- Membuat Demo Project
demo project ini digunakan untuk kepentingan demo sehingga akan dibatasi hak aksesnya dalam mengakses resources datacenter.
1 2 3 4 5 6 7 8 9 10 11 12 |
root@controller:~# openstack project create --domain default --description "Demo Project" demo +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | Demo Project | | domain_id | default | | enabled | True | | id | 1125b49b9ae3486c8bde6db8ee79ba26 | | is_domain | False | | name | demo | | parent_id | default | +-------------+----------------------------------+ |
jangan ulangi langkah ini saat menambah penguna tambahan pada pada project ini.
kemudian setelah itu kita akan membuat user demo
- Membuat User Demo
1 2 3 4 5 6 7 8 9 10 11 12 |
root@controller:~# openstack user create --domain default --password-prompt demo User Password:demo123 Repeat User Password:demo123 +---------------------+----------------------------------+ | Field | Value | +---------------------+----------------------------------+ | domain_id | default | | enabled | True | | id | a200a96a2eee4563871136312ec7805e | | name | demo | | password_expires_at | None | +---------------------+----------------------------------+ |
- membuat user role
1 2 3 4 5 6 7 8 |
root@controller:~# openstack role create user +-----------+----------------------------------+ | Field | Value | +-----------+----------------------------------+ | domain_id | None | | id | 90a6b4cef83d41c7b0aeef9e7d91e7bd | | name | user | +-----------+----------------------------------+ |
- Tambahkan user role kepada project dan user demo
1 |
root@controller:~# openstack role add --project demo --user demo user |
pada bagian ini tidak muncul output
seletah itu kita akan melakukan verifikasi operation yang telah kita lakukan tadi
- Verifikasi Operation
masih di controller node ya, jgn pindah-pindah 😛
- untuk alasan keamanan, nonaktifkan sementara mekanisme token authentikasi
edit file /etc/keystone/keystone-paste.ini dan hapus admin_token_auth pada bagian [pipeline:public_api], [pipeline:admin_api], dan [pipeline:api_v3]
- kemudian unset variable temporary OS_URL
1 |
root@controller:~# unset OS_URL |
- Memberikan autentikasi token ke user admin
1 2 3 4 5 6 7 8 9 10 11 |
root@controller:~# openstack --os-auth-url http://controller:35357/v3 --os-project-domain-name default --os-user-domain-name default --os-project-name admin --os-username admin token issue +------------+-----------------------------------------------------------------+ | Field | Value | +------------+-----------------------------------------------------------------+ | expires | 2016-10-20 09:17:19+00:00 | | id | gAAAAABYCH2PrtYD12TZl3VtcugEbdPdRkY0zaym9GNMTmJOsktLmGZDUDGkKNz | | | 4Kbr7pHiMzuhahWbQiJKBwCRkxPgkLtdCdLyokjWtyTE_Curb5CsU4vX8E- | | | Erc2lPTv6MJjRdaO7WBn0m1YStI_fEhAGmnBoHV_I-3NcWdseViP7M0_xKy88 | | project_id | 75daa68a789a42aea06a375d8b9b0bdc | | user_id | b8a969c536204e2f90c9a8afea80265c | +------------+-----------------------------------------------------------------+ |
mungkin jika anda menjalan perintah itu akan meminta password maka isikan password untuk admin, namun saya tidak membarikan password karena pada bagian sebelumnya sudah mengexport OS_PASSWORD
- Memberikan autentikasi token ke user demo
1 2 3 4 5 6 7 8 9 10 11 12 |
root@controller:~# openstack --os-auth-url http://controller:5000/v3 --os-project-domain-name default --os-user-domain-name default --os-project-name demo --os-username demo token issue Password:demo123 +------------+-----------------------------------------------------------------+ | Field | Value | +------------+-----------------------------------------------------------------+ | expires | 2016-10-20 09:25:42+00:00 | | id | gAAAAABYCH-GjIoDVyynqfwJfIYmWt5WwRUUhR3fg3-23OpfKlkNVgo2KLOpEAA | | | Z04oVz0Q6jrEi8GRGMM716oBKzNCnzU8VXK2KmzHedDybE-wwAz4tFhPnLcIjnr | | | oaKElYgmi6D8N6yPZaNyAK9bzw_O3cWeDkRLoxDFQcOgIUqYGHfM01hSU | | project_id | 1125b49b9ae3486c8bde6db8ee79ba26 | | user_id | a200a96a2eee4563871136312ec7805e | +------------+-----------------------------------------------------------------+ |
kemudian setelah itu kita akan membuat script openstack pada evironment client.
- Membuat script admin-openrc
1 2 3 4 5 6 7 8 9 10 |
root@controller:~# nano admin-openrc export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=admin export OS_USERNAME=admin export OS_PASSWORD=password_admin export OS_AUTH_URL=http://controller:35357/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 |
- Membuat script demo-openrc
1 2 3 4 5 6 7 8 9 10 |
root@controller:~# nano demo-openrc export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=demo export OS_USERNAME=demo export OS_PASSWORD=password_demo export OS_AUTH_URL=http://controller:5000/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 |
setelah itu kita akan menjalan script yang sudah kita buat tadi dengan menjalankan perintah openstack token issue
1 2 3 4 5 6 7 8 9 10 11 12 |
root@controller:~# . admin-openrc root@controller:~# openstack token issue +------------+-----------------------------------------------------------------+ | Field | Value | +------------+-----------------------------------------------------------------+ | expires | 2016-10-20 09:34:28+00:00 | | id | gAAAAABYCIGU905qUq9_MK4vymk3162PO8Ave7pYbZP5j9hRH9Y3wN5ez52YUlP | | | nNN157QVxJm6Jvg3Q8r8ctz-Mof_9nIUQN984r2SpWLePrp5Jc-ggdysG7U0CuT | | | XfCullYBhEEXYN44cU3uQsiA5x7PSWC6C5UYGALblHOVpxQjStwppdh3Y | | project_id | 75daa68a789a42aea06a375d8b9b0bdc | | user_id | b8a969c536204e2f90c9a8afea80265c | +------------+-----------------------------------------------------------------+ |
dengan memanfaatkan script tersebut maka, kita tidak usah mengexport satu persatu script.
cukup sekian dulu untuk installasi openstack newton part3 ini nanti kita akan lanjutkan pada part4 pembahasan image service
wassalam
System Engineer
Komentar