分享

Swift和Keystone整合单机安装

pig2 发表于 2015-2-21 10:55:17 [显示全部楼层] 回帖奖励 阅读模式 关闭右栏 0 19801

问题导读


1.swift与keystone如何整合安装?
2.如何配置Swift代理服务器?
3.如何配置Swift账户服务器?







一般网上搜索到的资料都是介绍整个Openstack的安装过程的,通常都是长篇累牍,非常复杂。因为个人的虚拟机环境,没有太高调配置,不可能完整运行Openstack的各种服务,只想体验一下Swift,于是试着只安装Swift和Keystone。对于Openstack支持最好的也就算是Ubuntu发行版了,甚至在较新的13.0版以上都直接集成了。
因为只安装单机版本的Swift和Keystone,因此不需要双网卡,所有业务和控制都走一个网络即可。网络规划简单。
首先,下载安装Ubuntu,这里选择12.04 LTS版本。安装软件包:
  1. 通用工具:sudo apt-get install openssh-server
  2. Keystone:sudo apt-get install keystone python-keystone python-keystoneclient
  3. Swift:sudo apt-get install swift swift-proxy swift-account swift-container swift-object
复制代码

ssh server是为了远程登录使用,在Windows下使用终端工具登录便于与Linux系统交互。Keystone 安装完成后即可正常运行,不需要作任何配置。默认情况下,Keystone使用SQLite来存储数据。执行如下命令同步Keystone的数据库:
  1. sudo service keystone restart
  2. sudo keystone-manage db_sync
复制代码

Swift安装和配置过程稍微复杂一些。首先要为Swift准备存储节点。Swift的三个Ring使用的是XFS的文件系统,因此需要为其新增一块虚拟硬盘,这里在一块硬盘上面模拟4个虚拟节点,来模拟Swfit环。
在虚拟机管理界面上面为系统添加一块硬盘,重启系统后,可以看到该硬盘已经被系统识别。本系统上面的硬盘设备名为:/dev/sdb,使用fdisk /dev/sdb为该硬盘创建分区,先建扩展分区,再建一个主分区。然后再给该分区创建文件系统,使用mkfs.xfs命令创建xfs文件系统。这些操作可以单独再网络上搜索到详尽的指导,这里不再详述。创建好系统后,将该XFS格式的文件系统mount到系统目录下,这里mount到/swift目录。然后使用mount命令,可以看到系统已经多了一个XFS的分区:/dev/sdb5 on /swift type xfs (rw)。最好能把该分区信息写到fstab中,这样系统启动时即会挂载该分区。
在/swfit目录下新建四个子目录:
  1. root@u1:/swift# ls -l
  2. 总用量 0
  3. drwxr-xr-x 3 swift swift 31 3月 18 21:35 node1
  4. drwxr-xr-x 3 swift swift 31 3月 18 21:35 node2
  5. drwxr-xr-x 3 swift swift 31 3月 18 21:35 node3
  6. drwxr-xr-x 3 swift swift 31 3月 18 21:35 node4
  7. root@u1:/swift#
复制代码

指导手册中也有介绍采用回环文件作为存储空间的方法,需要的可以自己操作。
建立运行环境:
  1. for i in {1..4}; do sudo ln -s /swift/node$i /srv/node$i; done;
  2. sudo mkdir -p /etc/swift/account-server /etc/swift/container-server /etc/swift/object-server /srv/node1/device /srv/node2/device /srv/node3/device /srv/node4/device
  3. sudo mkdir /run/swift
复制代码

将如下命令写入系统启动脚本中:
  1. mkdir /run/swift
  2. chown swift:swift /run/swift
复制代码

使用Rsync来维护对象副本,许多swift服务都使用它保持对象一致性及进行更新操作。
编辑 /etc/default/rsync文件:Set RSYNC_ENABLE=true
然后编辑 /etc/rsyncd.conf配置文件,如下所示:
  1. # General stuff
  2. uid = swift
  3. gid = swift
  4. log file = /var/log/rsyncd.log
  5. pid file = /run/rsyncd.pid
  6. address = 127.0.0.1
  7. # Account Server replication settings
  8. [account6012]
  9. max connections = 25
  10. path = /srv/node1/
  11. read only = false
  12. lock file = /run/lock/account6012.lock
  13. [account6022]
  14. max connections = 25
  15. path = /srv/node2/
  16. read only = false
  17. lock file = /run/lock/account6022.lock
  18. [account6032]
  19. max connections = 25
  20. path = /srv/node3/
  21. read only = false
  22. lock file = /run/lock/account6032.lock
  23. [account6042]
  24. max connections = 25
  25. path = /srv/node4/
  26. read only = false
  27. lock file = /run/lock/account6042.lock
  28. # Container server replication settings
  29. [container6011]
  30. max connections = 25
  31. path = /srv/node1/
  32. read only = false
  33. lock file = /run/lock/container6011.lock
  34. [container6021]
  35. max connections = 25
  36. path = /srv/node2/
  37. read only = false
  38. lock file = /run/lock/container6021.lock
  39. [container6031]
  40. max connections = 25
  41. path = /srv/node3/
  42. read only = false
  43. lock file = /run/lock/container6031.lock
  44. [container6041]
  45. max connections = 25
  46. path = /srv/node4/
  47. read only = false
  48. lock file = /run/lock/container6041.lock
  49. # Object Server replication settings
  50. [object6010]
  51. max connections = 25
  52. path = /srv/node1/
  53. read only = false
  54. lock file = /run/lock/object6010.lock
  55. [object6020]
  56. max connections = 25
  57. path = /srv/node2/
  58. read only = false
  59. lock file = /run/lock/object6020.lock
  60. [object6030]
  61. max connections = 25
  62. path = /srv/node3/
  63. read only = false
  64. lock file = /run/lock/object6030.lock
  65. [object6040]
  66. max connections = 25
  67. path = /srv/node4/
  68. read only = false
  69. lock file = /run/lock/object6040.lock
复制代码

最后重新启动服务完成rsync配置:
sudo service rsync restart
创建并编辑 /etc/swift/swift.conf文件,并写入如下配置:
  1. [swift-hash]
  2. # random unique string that can never change (DO NOT LOSE). I’m using 03c9f48da2229770.
  3. # od -t x8 -N 8 -A n <; /dev/random
  4. # The above command can be used to generate random a string.
  5. swift_hash_path_suffix = 03c9f48da2229770
复制代码

配置Swift代理服务器
代理服务器是swift的门卫,它的职责是检测合法性。它将审查:一、请求是否伪造,二、请求使用资源的用户身份。具体操作由keystone之类的认证服务器来协助完成。
创建并编辑 /etc/swift/proxy-server.conf并增加如下内容:
  1. [DEFAULT]
  2. bind_port = 8080
  3. user = swift
  4. swift_dir = /etc/swift
  5. [pipeline:main]
  6. # Order of execution of modules defined below
  7. pipeline = catch_errors healthcheck cache authtoken keystone proxy-server
  8. [app:proxy-server]
  9. use = egg:swift#proxy
  10. allow_account_management = true
  11. account_autocreate = true
  12. set log_name = swift-proxy
  13. set log_facility = LOG_LOCAL0
  14. set log_level = INFO
  15. set access_log_name = swift-proxy
  16. set access_log_facility = SYSLOG
  17. set access_log_level = INFO
  18. set log_headers = True
  19. account_autocreate = True
  20. [filter:healthcheck]
  21. use = egg:swift#healthcheck
  22. [filter:catch_errors]
  23. use = egg:swift#catch_errors
  24. [filter:cache]
  25. use = egg:swift#memcache
  26. set log_name = cache
  27. [filter:authtoken]
  28. paste.filter_factory = keystone.middleware.auth_token:filter_factory
  29. auth_protocol = http
  30. auth_host = 127.0.0.1
  31. auth_port = 35357
  32. auth_token = admin
  33. service_protocol = http
  34. service_host = 127.0.0.1
  35. service_port = 5000
  36. admin_token = admin
  37. admin_tenant_name = service
  38. admin_user = swift
  39. admin_password = swift
  40. delay_auth_decision = 0
  41. [filter:keystone]
  42. paste.filter_factory = keystone.middleware.swift_auth:filter_factory
  43. operator_roles = admin, swiftoperator
  44. is_admin = true
复制代码

配置Swift账户服务器
默认swift容器服务配置文件为 /etc/swift/account-server.conf:
  1. [DEFAULT]
  2. bind_ip = 0.0.0.0
  3. workers = 2
  4. [pipeline:main]
  5. pipeline = account-server
  6. [app:account-server]
  7. use = egg:swift#account
  8. [account-replicator]
  9. [account-auditor]
  10. [account-reaper]
复制代码

所有的account server配置文件都在 /etc/swift/account-server目录中。与 /srv里的设备相对应,我们创建1.conf、2.conf等等文件,并将它们放到/etc/swift/account-server/下。以下是/etc/swift/account-server/1.conf配置文件的内容:
  1. [DEFAULT]
  2. devices = /srv/node1
  3. mount_check = false
  4. bind_port = 6012
  5. user = swift
  6. log_facility = LOG_LOCAL2
  7. [pipeline:main]
  8. pipeline = account-server
  9. [app:account-server]
  10. use = egg:swift#account
  11. [account-replicator]
  12. vm_test_mode = no
  13. [account-auditor]
  14. [account-reaper]
复制代码

对其它设备也是如此,比如/srv/node2、/srv/node3、/srv/node4等,我们分别创建2.conf,3.conf和4.conf与之对应。现在利用1.conf进行复制生成其余文件,并一一设置唯一的绑定端口及本地日志值:
  1. sudo cp /etc/swift/account-server/1.conf /etc/swift/account-server/2.conf
  2. sudo cp /etc/swift/account-server/1.conf /etc/swift/account-server/3.conf
  3. sudo cp /etc/swift/account-server/1.conf /etc/swift/account-server/4.conf
复制代码

注意:拷贝完成后,修改其中的设备地址和日志标志符。
配置Swift容器服务器
默认swift容器服务配置文件为 /etc/swift/container-server.conf:
  1. [DEFAULT]
  2. bind_ip = 0.0.0.0
  3. workers = 2
  4. [pipeline:main]
  5. pipeline = container-server
  6. [app:container-server]
  7. use = egg:swift#container
  8. [container-replicator]
  9. [container-updater]
  10. [container-auditor]
  11. [container-sync]
复制代码

与account-server类似,我们同样创建 /etc/swift/container-server/1.conf等等文件与 /srv设备匹配,这是1.conf文件内容:
  1. [DEFAULT]
  2. devices = /srv/node1
  3. mount_check = false
  4. bind_port = 6011
  5. user = swift
  6. log_facility = LOG_LOCAL2
  7. [pipeline:main]
  8. pipeline = container-server
  9. [app:container-server]
  10. use = egg:swift#container
  11. [container-replicator]
  12. vm_test_mode = no
  13. [container-updater]
复制代码

同Account一样,需要为每一个设备准备一份配置。
配置Swift对象服务器,默认swift容器服务配置文件为 /etc/swift/object-server.conf:
  1. [DEFAULT]
  2. bind_ip = 0.0.0.0
  3. workers = 2
  4. [pipeline:main]
  5. pipeline = object-server
  6. [app:object-server]
  7. use = egg:swift#object
  8. [object-replicator]
  9. [object-updater]
  10. [object-auditor]
复制代码

与account-server和container-server一样,我们同样创建 /etc/swift/object-server/1.conf等等文件与 /srv设备匹配,这是1.conf文件内容:
  1. [DEFAULT]
  2. devices = /srv/node1
  3. mount_check = false
  4. bind_port = 6010
  5. user = swift
  6. log_facility = LOG_LOCAL2
  7. [pipeline:main]
  8. pipeline = object-server
  9. [app:object-server]
  10. use = egg:swift#object
  11. [object-replicator]
  12. vm_test_mode = no
  13. [object-updater]
  14. [object-auditor]
复制代码

配置Swift Ring服务器
Ring是swift的一个极为重要的组件,它维护着对象的真实物理位置信息,对象的副本及多种设备。创建与对象服务、容器服务和账户服务相对应的ring-builder文件:
  1. pushd /etc/swift
  2. sudo swift-ring-builder object.builder create 18 3 1
  3. sudo swift-ring-builder container.builder create 18 3 1
  4. sudo swift-ring-builder account.builder create 18 3 1
复制代码

注意:执行以上命令时需要在 /etc/swift目录下。
命令中的参数指定了分区、副本和小时的数量,用来限制分区多次移动。可以参考man页面中的swift-ring-builder获取更多信息。
现在添加区域以均衡ring服务。命令格式如下:
  1. swift-ring-builder <builder_file> add <zone>-<ip_address>:<port>/<device><weight>
复制代码

执行下列命令:
  1. sudo swift-ring-builder object.builder add z1-127.0.0.1:6010/device 1
  2. sudo swift-ring-builder object.builder add z2-127.0.0.1:6020/device 1
  3. sudo swift-ring-builder object.builder add z3-127.0.0.1:6030/device 1
  4. sudo swift-ring-builder object.builder add z4-127.0.0.1:6040/device 1
  5. sudo swift-ring-builder object.builder rebalance
  6. sudo swift-ring-builder container.builder add z1-127.0.0.1:6011/device 1
  7. sudo swift-ring-builder container.builder add z2-127.0.0.1:6021/device 1
  8. sudo swift-ring-builder container.builder add z3-127.0.0.1:6031/device 1
  9. sudo swift-ring-builder container.builder add z4-127.0.0.1:6041/device 1
  10. sudo swift-ring-builder container.builder rebalance
  11. sudo swift-ring-builder account.builder add z1-127.0.0.1:6012/device 1
  12. sudo swift-ring-builder account.builder add z2-127.0.0.1:6022/device 1
  13. sudo swift-ring-builder account.builder add z3-127.0.0.1:6032/device 1
  14. sudo swift-ring-builder account.builder add z4-127.0.0.1:6042/device 1
  15. sudo swift-ring-builder account.builder rebalance
复制代码

到此,所有的配置也就完成了,注意所有以上涉及修改的文件或者目录,都需要将文件的属主设定为swift和swift用户组。
启动Swift服务,使用以下命令启动swift和REST API:
  1. sudo swift-init main start
  2. sudo swift-init rest start
复制代码

到此,所有的Swift配置就已经做完了。
现在Swift已经是可以正常工作的了,但是目前系统里面是没有任何账号和容器的,不能上传对象。
需要使用Keystone的客户端来创建账号。
对于Keystone有几个概念:tenant,user,role,service,endpoint,对于这些概念,可以参考其他文章的介绍。这里tenant对于swift来说是account,只有有了account才能创建container,user是身份,user有用户名和密码,role可以认为是组队概念。endpoint是服务入口,是需要和service以及tenant绑定的。下面在Keystone上面一一创建这些实体:
  1. #创建两个租户,对于Swift也就是两个account
  2. keystone tenant-create --name service
  3. keystone tenant-create --name account2
  4. #创建一个用户,用户名和密码都是swift
  5. keystone user-create --name swift --pass swift --email swift@shentar.me
  6. keystone user-create --name shentar --pass shentar --email shentar@shentar.me
  7. #创建一个角色
  8. keystone role-create --name admin
  9. #创建两个服务,一个是keystone,另外一个是swift。
  10. keystone service-create --name swift --type object-store --description 'OpenStack Storage Service'
  11. keystone service-create --name keystone --type identity --description 'OpenStack Identity Service'
  12. 列举以上各个实体:
  13. root@u1:~# keystone user-list
  14. +----------------------------------+---------+--------------------+---------+
  15. | id | enabled | email | name |
  16. +----------------------------------+---------+--------------------+---------+
  17. | 492e829f4520429b950a3a7fbe4ae6eb | True | swift@shentar.me | swift |
  18. | 914ec3cd303b4571b0dbaea1f9a0546e | True | shentar@shentar.me | shentar |
  19. +----------------------------------+---------+--------------------+---------+
  20. root@u1:~# keystone role-list
  21. +----------------------------------+-------+
  22. | id | name |
  23. +----------------------------------+-------+
  24. | 031e54d7c9d34f0fad667f423387c354 | admin |
  25. +----------------------------------+-------+
  26. root@u1:~# keystone tenant-list
  27. +----------------------------------+----------+---------+
  28. | id | name | enabled |
  29. +----------------------------------+----------+---------+
  30. | 665e59b3d6c240e8a66dbabe3ac2259d | account2 | True |
  31. | d2d8fc718cde4a9e9f6d7175313efad0 | service | True |
  32. +----------------------------------+----------+---------+
  33. root@u1:~# keystone service-list
  34. +----------------------------------+----------+--------------+----------------------------+
  35. | id | name | type | description |
  36. +----------------------------------+----------+--------------+----------------------------+
  37. | 8906dfcdefa14e6388edb0e3ad264b29 | keystone | identity | OpenStack Identity Service |
  38. | d01427a1449d469482798971a88bb92f | swift | object-store | OpenStack Storage Service |
  39. +----------------------------------+----------+--------------+----------------------------+
  40. #为两个服务创建endpoint,注意swift服务的endpoint需要AUTH_34fb2227caae4edcb052ebec7cc78abe以这样的内容作为后缀,其中AUTH_后面的是tenant_id,注意到是下面的id需要以自己系统生成的为准,照搬这里的命令肯定会出错。
  41. keystone endpoint-create --region myregion --service_id 8906dfcdefa14e6388edb0e3ad264b29 --publicurl 'http://192.168.1.109:5000/v2.0' --adminurl 'http://192.168.1.109:35357/v2.0' --internalurl 'http://192.168.1.109:5000/v2.0'
  42. keystone endpoint-create --region myregion --service_id d01427a1449d469482798971a88bb92f --publicurl 'http://192.168.1.109:8080/v1/AUTH_665e59b3d6c240e8a66dbabe3ac2259d' --adminurl 'http://192.168.1.109:8080/v1' --internalurl 'http://192.168.1.109:8080/v1/AUTH_665e59b3d6c240e8a66dbabe3ac2259d'
  43. keystone endpoint-create --region myregion --service_id d01427a1449d469482798971a88bb92f --publicurl 'http://192.168.1.109:8080/v1/AUTH_d2d8fc718cde4a9e9f6d7175313efad0' --adminurl 'http://192.168.1.109:8080/v1' --internalurl 'http://192.168.1.109:8080/v1/AUTH_d2d8fc718cde4a9e9f6d7175313efad0'
  44. #将用户加入到租户中,一个用户只能加入到一个租户中。将swift用户加入到service租户中:
  45. keystone user-role-add --user 492e829f4520429b950a3a7fbe4ae6eb --role 031e54d7c9d34f0fad667f423387c354 --tenant_id d2d8fc718cde4a9e9f6d7175313efad0
  46. #将shentar用户也加入到service租户中:
  47. keystone user-role-add --user 914ec3cd303b4571b0dbaea1f9a0546e --role 031e54d7c9d34f0fad667f423387c354 --tenant_id d2d8fc718cde4a9e9f6d7175313efad0
复制代码

这样就可以使用用户名和密码获取token和访问的url了:
swift -v -V 2.0 -A http://192.168.1.109:5000/v2.0/ -U service:swift -K swift stat
这条命令返回的是swift租户在service租户下的token和访问的url。
同样的
swift -v -V 2.0 -A http://192.168.1.109:5000/v2.0/ -U service:shentar -K shentar stat
返回的是shentar用户的。
接下来就可以使用上面获取到的token和url来发送REST HTTP请求了:
  1. root@u1:~# curl -X PUT
  2. http://192.168.1.109:8080/v1/AUTH_d2d8fc718cde4a9e9f6d7175313efad0/testcontainer -H "X-Auth-Token: 63de715ee3a04b669e021ee3bc333433"
  3. 201 Created
  4. root@u1:~# curl -i -X HEAD http://192.168.1.109:8080/v1/AUTH_d2d8fc718cde4a9e9f6d7175313efad0/ -H "X-Auth-Token: 63de715ee3a04b669e021ee3bc333433"
  5. HTTP/1.1 204 No Content
  6. X-Account-Object-Count: 0
  7. X-Account-Bytes-Used: 0
  8. X-Account-Container-Count: 1
  9. Accept-Ranges: bytes
  10. Content-Length: 0
  11. X-Trans-Id: txbfdff903df11407895042f1ec8e95299
  12. Date: Fri, 21 Mar 2014 16:12:59 GMT
复制代码

到此整个Swift和Keystone也就安装完成了。

没找到任何评论,期待你打破沉寂

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

关闭

推荐上一条 /2 下一条