执行范围
仅控制节点（controller / 11.0.1.30）
Keystone 是 OpenStack 的身份认证中心，所有服务 API 调用均须先通过 Keystone 获取 Token。
1. 创建数据库
mysql -uroot -p000000 -e "CREATE DATABASE IF NOT EXISTS keystone;"mysql -uroot -p000000 -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY '000000';"mysql -uroot -p000000 -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY '000000';"2. 安装软件包
yum install -y openstack-keystone httpd mod_wsgi3. 配置 /etc/keystone/keystone.conf
crudini --set /etc/keystone/keystone.conf database connection mysql+pymysql://keystone:000000@controller/keystonecrudini --set /etc/keystone/keystone.conf token provider fernet4. 初始化数据库与 Fernet 密钥
su -s /bin/sh -c "keystone-manage db_sync" keystonekeystone-manage fernet_setup --keystone-user keystone --keystone-group keystonekeystone-manage credential_setup --keystone-user keystone --keystone-group keystone5. Bootstrap 引导
keystone-manage bootstrap --bootstrap-password 000000 \ --bootstrap-admin-url http://controller:5000/v3/ \ --bootstrap-internal-url http://controller:5000/v3/ \ --bootstrap-public-url http://controller:5000/v3/ \ --bootstrap-region-id RegionOne6. 配置 Apache
sed -i 's/#ServerName www.example.com:80/ServerName controller/g' /etc/httpd/conf/httpd.confln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/systemctl enable httpd.servicesystemctl restart httpd.service7. 创建域、项目与用户
先设置 admin 认证环境：
export OS_USERNAME=adminexport OS_PASSWORD=000000export OS_PROJECT_NAME=adminexport OS_USER_DOMAIN_NAME=Defaultexport OS_PROJECT_DOMAIN_NAME=Defaultexport OS_AUTH_URL=http://controller:5000/v3export OS_IDENTITY_API_VERSION=3创建资源：
openstack domain create --description "Default Domain" defaultopenstack project create --domain default --description "Admin project" myadminopenstack user create --domain default --password 000000 myadminopenstack role add --project myadmin --user myadmin admin
# 切换为 myadmin 上下文export OS_USERNAME=myadminexport OS_PROJECT_NAME=myadminexport OS_USER_DOMAIN_NAME=defaultexport OS_PROJECT_DOMAIN_NAME=default
openstack project delete adminopenstack project set --name admin --domain default --description "Admin Project" --enable myadminexport OS_PROJECT_NAME=admin
openstack user delete adminopenstack user set --name admin --domain default --project admin --project-domain default \ --password 000000 --enable myadmin
# 恢复 admin 用户上下文export OS_USERNAME=adminexport OS_USER_DOMAIN_NAME=defaultexport OS_PROJECT_DOMAIN_NAME=default
openstack role add --project admin --user admin admin
openstack project create --domain default --description "Service Project" serviceopenstack project create --domain default --description "Demo Project" demoopenstack user create --domain default --password 000000 demoopenstack role create useropenstack role add --project demo --user demo user8. 生成 openrc 文件
/etc/keystone/admin-openrc.sh：
export OS_PROJECT_DOMAIN_NAME=defaultexport OS_USER_DOMAIN_NAME=defaultexport OS_PROJECT_NAME=adminexport OS_USERNAME=adminexport OS_PASSWORD=000000export OS_AUTH_URL=http://controller:5000/v3export OS_IDENTITY_API_VERSION=3export OS_IMAGE_API_VERSION=2/etc/keystone/demo-openrc.sh：
export OS_PROJECT_DOMAIN_NAME=defaultexport OS_USER_DOMAIN_NAME=defaultexport OS_PROJECT_NAME=demoexport OS_USERNAME=demoexport OS_PASSWORD=000000export OS_AUTH_URL=http://controller:5000/v3export OS_IDENTITY_API_VERSION=3export OS_IMAGE_API_VERSION=29. 验收
systemctl is-active httpdcurl -s http://controller:5000/v3
source /etc/keystone/admin-openrc.shopenstack token issueopenstack user list # 包含 admin此后所有
openstack命令须先执行：source /etc/keystone/admin-openrc.sh
下一步：Glance 安装