OpenStack、keystone组件

一、部署OpenStack

1、环境

OS：CentOS6.5 X86_64

各节点时间同步、能基于主机名通信，清空iptables，关闭SElinux，禁用WorkManager服务

各节点的主机/etc/hosts文件配置:

cat /etc/hosts127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4::1         localhost localhost.localdomain localhost6 localhost6.localdomain6192.168.10.1 Node1 node1 controller www.node1.com192.168.10.2 Node2 node2 compute    www.node2.com192.168.10.3 Node3 node3 network    www.node3.com192.168.10.4 Node4 node4            www.node4.com

2、配置Controller Node（Node1）的网络

1）所有192.168.10.0段的数据包的源地址改成172.16.11.210

[root@Node1 ~]# iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -j SNAT --to-source 172.16.11.210[root@Node1 ~]# service iptables save

2）打开内核的路由（网卡间转发）功能

要实现nat，要将文件/proc/sys/net/ipv4/ip_forward内的值改为1，（默认是0）

[root@Node1 ~]# vi /etc/sysctl.conf [root@Node1 ~]# sysctl -pnet.ipv4.ip_forward = 1net.ipv4.conf.default.rp_filter = 1net.ipv4.conf.default.accept_source_route = 0kernel.sysrq = 0kernel.core_uses_pid = 1net.ipv4.tcp_syncookies = 1error: "net.bridge.bridge-nf-call-ip6tables" is an unknown keyerror: "net.bridge.bridge-nf-call-iptables" is an unknown keyerror: "net.bridge.bridge-nf-call-arptables" is an unknown keykernel.msgmnb = 65536kernel.msgmax = 65536kernel.shmmax = 68719476736kernel.shmall = 4294967296

3）配置yum源

[root@Node1 yum.repos.d]# cat CentOS-OpenStack-icehouse.repo# CentOS-OpenStack-icehouse.repo#[centos-openstack-icehouse]name=CentOS-$releasever - OpenStack icehousebaseurl=https://repos.fedorapeople.org/repos/openstack/EOL/openstack-icehouse/epel-6/  #为什么现在这个博客很容易吞链接啊，一没注意链接就发不出来 gpgcheck=0enabled=1

二、Identity（Keystone）组件

1、Identity主要有两个功能

用户管理：认证和授权

认证方式有两种：

token：持有授权字符串

帐号和密码：

服务目录：所有可用服务的信息库，包含其API endpoint（访问端口）路径

2、常用术语

user：一个user可以关联至多个tenant（租户）

Tenant：租户，一个tenant对应一个project，或一个组织

Role：角色

Token：令牌

Service：服务

Endpoint：服务的访问入口

3、在Controller Node上安装keystone组件

[root@Node1 ~]# yum install openstack-keystone python-keystoneclient[root@Node1 ~]# yum install openstack-utils[root@Node1 yum.repos.d]# rpm -ql openstack-utils/usr/bin/openstack-config/usr/bin/openstack-db/usr/bin/openstack-service/usr/bin/openstack-status/usr/share/doc/openstack-utils-2014.1

4、安装数据库，授权keystone能够远程连入mysqld，并初始化数据库

1）安装OpenStack优化的Mariabd数据库并初始化

[root@Node1 ~]# yum install mariadb-galera-server -y

修改配置文件/etc/keystone/keystone.conf配置文件:

定义客户端如何连接到keystone服务器

默认配置：

#connection=mysql://keystone:keystone@localhost/keystone

mysql协议 用户名 密码 主机 数据库

授权keystone连接mysqld:

mysql> CREATE DATABASE keystone;mysql> GRANT ALL ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone';Query OK, 0 rows affected (0.00 sec)mysql> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'KEYSTONE_DBPASS';mysql> FLUSH PRIVILEGES;Query OK, 0 rows affected (0.00 sec)

keystone-manage初始化数据库：

[root@Node1 ~]# keystone-manage --helpusage: keystone-manage [db_sync|db_version|pki_setup|ssl_setup|token_flush]optional arguments:  -h, --help            show this help message and exit  --config-dir DIR      Path to a config directory to pull *.conf files from.                        This file set is sorted, so as to provide a                        predictable parse order if individual options are                        over-ridden. The set is parsed after the file(s)                        specified via previous --config-file, arguments hence                        over-ridden options in the directory take precedence.  --config-file PATH    Path to a config file to use. Multiple config files                        can be specified, with values in later files taking                        precedence. The default files used are: None  --debug, -d           Print debugging output (set logging level to DEBUG                        instead of default WARNING level).  --log-config-append PATH, --log_config PATH                        The name of logging configuration file. It does not                        disable existing loggers, but just appends specified                        logging configuration to any other existing logging                        options. Please see the Python logging module                        documentation for details on logging configuration                        files.  --log-date-format DATE_FORMAT                        Format string for %(asctime)s in log records. Default:                        None  --log-dir LOG_DIR, --logdir LOG_DIR                        (Optional) The base directory used for relative --log-                        file paths  --log-file PATH, --logfile PATH                        (Optional) Name of log file to output to. If no                        default is set, logging will go to stdout.  --log-format FORMAT   DEPRECATED. A logging.Formatter log message format                        string which may use any of the available                        logging.LogRecord attributes. This option is                        deprecated. Please use logging_context_format_string                        and logging_default_format_string instead.  --nodebug             The inverse of --debug  --nostandard-threads  The inverse of --standard-threads  --nouse-syslog        The inverse of --use-syslog  --nouse-syslog-rfc-format                        The inverse of --use-syslog-rfc-format  --noverbose           The inverse of --verbose  --pydev-debug-host PYDEV_DEBUG_HOST                        Host to connect to for remote debugger.  --pydev-debug-port PYDEV_DEBUG_PORT                        Port to connect to for remote debugger.  --standard-threads    Do not monkey-patch threading system modules.  --syslog-log-facility SYSLOG_LOG_FACILITY                        Syslog facility to receive log lines  --use-syslog          Use syslog for logging. Existing syslog format is                        DEPRECATED during I, and then will be changed in J to                        honor RFC5424  --use-syslog-rfc-format                        (Optional) Use syslog rfc5424 format for logging. If                        enabled, will add APP-NAME (RFC5424) before the MSG                        part of the syslog message. The old format without                        APP-NAME is deprecated in I, and will be removed in J.  --verbose, -v         Print more verbose output (set logging level to INFO                        instead of default WARNING level).  --version             show program's version number and exitCommands:  {token_flush,db_version,pki_setup,ssl_setup,db_sync}                        Available commands    db_sync             Sync the database.    db_version          Print the current migration version of the database.    pki_setup           Set up Key pairs and certificates for token signing                        and verification.    ssl_setup           Create key pairs and certificates for HTTPS                        connections.    token_flush         Flush expired tokens from the backend.

# su -s /bin/sh -c "keystone-manage db_sync" keystonemysql> use keystoneReading table information for completion of table and column namesYou can turn off this feature to get a quicker startup with -ADatabase changedmysql> show tables;+-----------------------+| Tables_in_keystone    |+-----------------------+| assignment            || credential            || domain                || endpoint              || group                 || migrate_version       || policy                || project               || region                || role                  || service               || token                 || trust                 || trust_role            || user                  || user_group_membership |+-----------------------+16 rows in set (0.00 sec)

2）编辑/etc/keystone/keystone.conf配置文件

设置token：

[root@Node1 ~]# ADMIN_TOKEN=$(openssl rand -hex 10)  #随机设置几个字符串也是可以的[root@Node1 ~]# echo $ADMIN_TOKEN8dc775e8139f48a8de39[root@Node1 ~]# echo $ADMIN_TOKEN > admin_token.rc   #保存起来，以便以后用到[root@Node1 ~]# vi /etc/keystone/keystone.conf  #admin_token=ADMIN                   #找到这行，并复制admin_token=8dc775e8139f48a8de39     #用字符串代替ADMIN

设置本地PKI:

[root@Node1 ~]# keystone-manage pki_setup --keystone-user keystone --keystone-group keystone[root@Node1 ~]# chown -R keystone:keystone /etc/keystone/ssl[root@Node1 ~]# chmod -R o-rwx /etc/keystone/ssl

启动keystone：

[root@Node1 ~]#  service openstack-keystone startStarting keystone:                                         [  OK  ][root@Node1 ~]# chkconfig openstack-keystone on

设置环境变量:

[root@Node1 ~]# export OS_SERVICE_TOKEN=$ADMIN_TOKEN   #方便客户端使用[root@Node1 ~]# export OS_SERVICE_ENDPOINT=http://192.168.10.1:35357/v2.0

5、keystone客户端使用

1）创建用户，角色，租户

[root@Node1 ~]# keystone --help/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)usage: keystone [--version] [--timeout ]                [--os-username ]                [--os-password ]                [--os-tenant-name ]                [--os-tenant-id ] [--os-auth-url ]                [--os-region-name ]                [--os-identity-api-version ]                [--os-token ]                [--os-endpoint ]                [--os-cacert ] [--insecure]                [--os-cert ] [--os-key ] [--os-cache]                [--force-new-token] [--stale-duration ]                 ...Pending deprecation: Command-line interface to the OpenStack Identity API.This CLI is pending deprecation in favor of python-openstackclient. For aPython library, continue using python-keystoneclient.Positional arguments:      catalog             List service catalog, possibly filtered by service.    ec2-credentials-create                        Create EC2-compatible credentials for user per tenant.    ec2-credentials-delete                        Delete EC2-compatible credentials.    ec2-credentials-get                        Display EC2-compatible credentials.    ec2-credentials-list                        List EC2-compatible credentials for a user.    endpoint-create     Create a new endpoint associated with a service.    endpoint-delete     Delete a service endpoint.    endpoint-get        Find endpoint filtered by a specific attribute or                        service type.    endpoint-list       List configured service endpoints.    password-update     Update own password.    role-create         Create new role.    role-delete         Delete role.    role-get            Display role details.    role-list           List all roles.    service-create      Add service to Service Catalog.    service-delete      Delete service from Service Catalog.    service-get         Display service from Service Catalog.    service-list        List all services in Service Catalog.    tenant-create       Create new tenant.    tenant-delete       Delete tenant.    tenant-get          Display tenant details.    tenant-list         List all tenants.    tenant-update       Update tenant name, description, enabled status.    token-get           Display the current user token.    user-create         Create new user    user-delete         Delete user.    user-get            Display user details.    user-list           List users.    user-password-update                        Update user password.    user-role-add       Add role to user.    user-role-list      List roles granted to a user.    user-role-remove    Remove role from user.    user-update         Update user's name, email, and enabled status.    discover            Discover Keystone servers, supported API versions and                        extensions.    bootstrap           Grants a new role to a new user on a new tenant, after                        creating each.    bash-completion     Prints all of the commands and options to stdout.    help                Display help about this program or one of its                        subcommands.Optional arguments:  --version             Shows the client version and exits.  --timeout    Set request timeout (in seconds).  --os-username                         Name used for authentication with the OpenStack                        Identity service. Defaults to env[OS_USERNAME].  --os-password                         Password used for authentication with the OpenStack                        Identity service. Defaults to env[OS_PASSWORD].  --os-tenant-name                         Tenant to request authorization on. Defaults to                        env[OS_TENANT_NAME].  --os-tenant-id                         Tenant to request authorization on. Defaults to                        env[OS_TENANT_ID].  --os-auth-url                         Specify the Identity endpoint to use for                        authentication. Defaults to env[OS_AUTH_URL].  --os-region-name                         Specify the region to use. Defaults to                        env[OS_REGION_NAME].  --os-identity-api-version                         Specify Identity API version to use. Defaults to                        env[OS_IDENTITY_API_VERSION] or 2.0.  --os-token                         Specify an existing token to use instead of retrieving                        one via authentication (e.g. with username &                        password). Defaults to env[OS_SERVICE_TOKEN].  --os-endpoint                         Specify an endpoint to use instead of retrieving one                        from the service catalog (via authentication).                        Defaults to env[OS_SERVICE_ENDPOINT].  --os-cacert                         Specify a CA bundle file to use in verifying a TLS                        (https) server certificate. Defaults to                        env[OS_CACERT].  --insecure            Explicitly allow keystoneclient to perform "insecure"                        TLS (https) requests. The server's certificate will                        not be verified against any certificate authorities.                        This option should be used with caution.  --os-cert                         Defaults to env[OS_CERT].  --os-key         Defaults to env[OS_KEY].  --os-cache            Use the auth token cache. Defaults to env[OS_CACHE].  --force-new-token     If the keyring is available and in use, token will                        always be stored and fetched from the keyring until                        the token has expired. Use this option to request a                        new token and replace the existing one in the keyring.  --stale-duration                         Stale duration (in seconds) used to determine whether                        a token has expired when retrieving it from keyring.                        This is useful in mitigating process or network                        delays. Default is 30 seconds.See "keystone help COMMAND" for help on a specific command.

[root@Node1 ~]# keystone help  user-create /usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)usage: keystone user-create --name  [--tenant ]                            [--pass []] [--email ]                            [--enabled ]Create new userArguments:  --name     New user name (must be unique).  --tenant , --tenant-id                         New user default tenant.  --pass []       New user password; required for some auth backends.  --email        New user email address.  --enabled                         Initial user enabled status. Default is true.[root@Node1 ~]# keystone user-create --name=admin --pass=admin    #创建用户和密码/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)   #这个警告信息是gmp包要5以上的版本+----------+----------------------------------+| Property |              Value               |+----------+----------------------------------+|  email   |                                  || enabled  |               True               ||    id    | 2156077a9bc644d597f07719fc67ea56 ||   name   |              admin               || username |              admin               |+----------+----------------------------------+[root@Node1 ~]# keystone user-list/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)+----------------------------------+-------+---------+-------+|                id                |  name | enabled | email |+----------------------------------+-------+---------+-------+| 2156077a9bc644d597f07719fc67ea56 | admin |   True  |       |+----------------------------------+-------+---------+-------+[root@Node1 ~]# keystone role-create --name=admin        #创建角色/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)+----------+----------------------------------+| Property |              Value               |+----------+----------------------------------+|    id    | 908cde894759423780e5787e4e50d7fb ||   name   |              admin               |+----------+----------------------------------+[root@Node1 ~]# keystone role-list/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)+----------------------------------+----------+|                id                |   name   |+----------------------------------+----------+| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ |      #默认的角色| 908cde894759423780e5787e4e50d7fb |  admin   |+----------------------------------+----------+[root@Node1 ~]# keystone tenant-create --name=admin --description="Admin Tenant"    #创建租户/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)+-------------+----------------------------------+|   Property  |              Value               |+-------------+----------------------------------+| description |           Admin Tenant           ||   enabled   |               True               ||      id     | 63607fac42c94ecbb2490eb01b357586 ||     name    |              admin               |+-------------+----------------------------------+[root@Node1 ~]# keystone user-role-add --user admin --role admin --tenant admin  #将用户admin添加到admin角色和admin租户[root@Node1 ~]# keystone user-role-add --user admin --role _member_ --tenant admin #添加到默认的角色[root@Node1 ~]# keystone user-role-list --user admin --tenant admin/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)+----------------------------------+----------+----------------------------------+----------------------------------+|                id                |   name   |             user_id              |            tenant_id             |+----------------------------------+----------+----------------------------------+----------------------------------+| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ | 2156077a9bc644d597f07719fc67ea56 | 63607fac42c94ecbb2490eb01b357586 || 908cde894759423780e5787e4e50d7fb |  admin   | 2156077a9bc644d597f07719fc67ea56 | 63607fac42c94ecbb2490eb01b357586 |+----------------------------------+----------+----------------------------------+----------------------------------+

创建一个普通用户：

[root@Node1 ~]# keystone user-create --name demo --pass demo /usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)+----------+----------------------------------+| Property |              Value               |+----------+----------------------------------+|  email   |                                  || enabled  |               True               ||    id    | a3ebced215de4892b9370b4d37eaf9bd ||   name   |               demo               || username |               demo               |+----------+----------------------------------+[root@Node1 ~]# keystone tenant-create --name demo/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)+-------------+----------------------------------+|   Property  |              Value               |+-------------+----------------------------------+| description |                                  ||   enabled   |               True               ||      id     | 0804069a7a454a9a86d4105dd40bed17 ||     name    |               demo               |+-------------+----------------------------------+[root@Node1 ~]# keystone user-role-add --user demo --role _member_ --tenant demo[root@Node1 ~]# keystone user-role-list --tenant=demo --user=demo/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)+----------------------------------+----------+----------------------------------+----------------------------------+|                id                |   name   |             user_id              |            tenant_id             |+----------------------------------+----------+----------------------------------+----------------------------------+| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ | a3ebced215de4892b9370b4d37eaf9bd | 0804069a7a454a9a86d4105dd40bed17 |+----------------------------------+----------+----------------------------------+----------------------------------+

设置一个服务租户：

[root@Node1 ~]# keystone tenant-create --name=service/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)+-------------+----------------------------------+|   Property  |              Value               |+-------------+----------------------------------+| description |                                  ||   enabled   |               True               ||      id     | c536e6faa30b4b3f998e14af70f4f7c2 ||     name    |             service              |+-------------+----------------------------------+

2）创建服务和服务端点（endpoint)

[root@Node1 ~]# keystone help service-create/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)usage: keystone service-create --name  --type                                [--description ]Add service to Service Catalog.Arguments:  --name          Name of new service (must be unique).  --type          Service type (one of: identity, compute, network,                        p_w_picpath, object-store, or other service identifier                        string).  --description                         Description of service.                       [root@Node1 ~]# keystone service-create --name=keystone --type=identity --description="OpenStack Identity"/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)+-------------+----------------------------------+|   Property  |              Value               |+-------------+----------------------------------+| description |        OpenStack Identity        ||   enabled   |               True               ||      id     | 16929dabe6db4044af364ab96867b8b4 ||     name    |             keystone             ||     type    |             identity             |+-------------+----------------------------------+   [root@Node1 ~]# keystone service-list/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)+----------------------------------+----------+----------+--------------------+|                id                |   name   |   type   |    description     |+----------------------------------+----------+----------+--------------------+| 16929dabe6db4044af364ab96867b8b4 | keystone | identity | OpenStack Identity |+----------------------------------+----------+----------+--------------------+

[root@Node1 ~]# keystone endpoint-create \--service-id=$(keystone service-list | awk '/ identity / {print $2}') \--publicurl=http://controller:5000/v2.0 \            #普通用户访问端口--internalurl=http://controller:5000/v2.0 \--adminurl=http://controller:35357/v2.0             #管理用户访问端口  /usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)+-------------+----------------------------------+|   Property  |              Value               |+-------------+----------------------------------+|   adminurl  |  http://192.168.10.1:35357/v2.0  ||      id     | c10e8a817882456497c6acdb3e94e06b || internalurl |  http://192.168.10.1:5000/v2.0   ||  publicurl  |  http://192.168.10.1:5000/v2.0   ||    region   |            regionOne             ||  service_id | 16929dabe6db4044af364ab96867b8b4 |+-------------+----------------------------------+[root@Node1 ~]#

使用用户认证：

[root@Node1 ~]# unset OS_SERVICE_TOKEN OS_SERVICE_ENDPOINT[root@Node1 ~]# keystone --os-username=admin --os-password=admin --os-auth-url=http://192.168.10.1:35357/v2.0 token-get   #这条命令能执行成功说明认证成功[root@Node1 ~]# vi .admin-openrc.sh[root@Node1 ~]# cat .admin-openrc.shexport OS_USERNAME=adminexport OS_PASSWORD=adminexport OS_TENANT_NAME=adminexport OS_AUTH_URL=http://192.168.10.1:35357/v2.0[root@Node1 ~]# . .admin-openrc.sh  [root@Node1 ~]# keystone user-list/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.  _warn("Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)+----------------------------------+-------+---------+-------+|                id                |  name | enabled | email |+----------------------------------+-------+---------+-------+| 2156077a9bc644d597f07719fc67ea56 | admin |   True  |       || a3ebced215de4892b9370b4d37eaf9bd |  demo |   True  |       |+----------------------------------+-------+---------+-------+