基于keystone认证的Swift的安装与配置

一、概要

OpenStackObject Storage（Swift）是OpenStack开源云计算项目的子项目之一。Swift使用普通的服务器来构建冗余的、可扩展的分布式对象存储集群，存储容量可达PB级。Swift的是用Python开发，前身是Rackspace Cloud Files项目，随着Rackspace加入到OpenStack社区，Racksapce也将Cloud Files的代码贡献给了社区，并逐渐形成现在Swift。Swift最新的发型版本为essex 1.4.6。

二、术语

node- a host machine running one or more Swift services

Proxynode - node that runs Proxy services; also runs keystoneAuth

Storagenode - node that runs Account, Container, and Object services

ring- a set of mappings of Swift data to physical devices

三、系统架构

四、测试环境

本次测试将Auth和Proxy安装在1台服务器，3个Storage节点做测试。单机安装请参照官方SAIO安装方式。Auth使用keystone。

版本说明：ubuntu-12.04    swift1.9.1

五、初始化设置

1）General Installation Steps for All Nodes

添加cloud archive gpg key:

apt-getinstall ubuntu-cloud-keyring

添加Ubuntu Cloud Archive repository

#vi/etc/apt/sources.list.d/grizzly.list添加如下内容

debhttp://ubuntu-cloud.archive.canonical.com/ubuntu precise-updates/grizzly main

#apt-get update && apt-get upgrade

2）GeneralInstallation Steps for All Swift Nodes（include proxy）

安装swift及依赖包

#apt-getinstall -y swift openssh-server rsync memcached python-netifaces python-xattrpython-memcache

创建Swift配置目录

# mkdir-p /etc/swift

创建Swift配置文件，并同步到all Swift nodes

#vi/etc/swift/swift.conf    内容如下：

[swift-hash]
swift_hash_path_suffix = Gdr8ny7YyWqy2

修改Swift目录权限

#chown-R swift:swift /etc/swift/

3）时间同步

Swiftproxy Node做ntp服务器，Swift Storage Node与它做同步

安装ntp

#apt-getinstall -y ntp

配置ntp

# sed -i's/server0.ubuntu.pool.ntp.org/#server 0.ubuntu.pool.ntp.org/'/etc/ntp.conf

# sed -i's/server1.ubuntu.pool.ntp.org/#server 1.ubuntu.pool.ntp.org/'/etc/ntp.conf

# sed -i's/server2.ubuntu.pool.ntp.org/#server 2.ubuntu.pool.ntp.org/'/etc/ntp.conf

# sed -i's/server3.ubuntu.pool.ntp.org/#server 3.ubuntu.pool.ntp.org/'/etc/ntp.conf

# sed -i 's/server ntp.ubuntu.com/#server ntp.ubuntu.com/'/etc/ntp.conf

# sed -i '/ntp.ubuntu.com/a\serverswift-proxy' /etc/ntp.conf

4）修改hosts文件

#vi/etc/hosts添加如下行：

172.26.188.226  swift-proxy
172.26.188.227  swift1
172.26.188.228  swift2
172.26.188.229  swift3

六、Keystone 安装（安装在proxy节点）

官方文档

http://docs.openstack.org/trunk/openstack-compute/install/apt/content/keystone-concepts.html

安装Keystone

#apt-getinstall -y keystone python-keyring

配置keystone

#/etc/keystone/default_catalog.templates添加如下内容

catalog.RegionOne.object_store.name = Swift Service
catalog.RegionOne.object_store.publicURL = http://172.26.188.226:8080/v1/AUTH_$(tenant_id)s
catalog.RegionOne.object_store.adminURL = http://172.26.188.226:8080/
catalog.RegionOne.object_store.internalURL = http://172.26.188.226:8080/v1/AUTH_$(tenant_id)s

生成随机token：

#opensslrand -hex 10

修改keystone配置如下

#vi/etc/keystone/keystone.conf

admin_token =8a1438899a78df19bb3f

verbose = True

log_config =/etc/keystone/logging.conf

connection =mysql://keystone:keystone@172.26.188.226/keystone

# idle_timeout =200

增加如下行：

idle_timeout =200

min_pool_size =5

max_pool_size =10

pool_timeout =200

[ssl]

enable = False

       ####token_format = UUID

安装mysql python-mysqldb

apt-get install mysql python-mysqldb

修改/etc/mysql/my.cnf

bind-address= 0.0.0.0

#mysql

mysql>CREATEDATABASE keystone;

mysql>GRANTALL ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone';

mysql>GRANTALL ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'keystone';

mysql>quit;

keystone默认使用PKI tokens

#keystone-manage pki_setup

#sudo chown -R keystone:keystone/etc/keystone/* /var/log/keystone/keystone.log

# servicekeystone restart

#keystone-manage db_sync

创建初始tenants、users、roles：

下载脚本:

#wget https://raw.github.com/EmilienM/openstack-folsom-guide/master/scripts/keystone-data.sh

修改admin密码（你将要设置的admin密码）及token（与keystone.conf中一样）后执行导入数据

创建services、endpoints

wget https://raw.github.com/EmilienM/openstack-folsom-guide/master/scripts/keystone-endpoints.sh

修改脚本中以下内容：

           # MySQL definitions

MYSQL_USER=keystone

MYSQL_DATABASE=keystone

MYSQL_HOST=172.26.188.226

MYSQL_PASSWORD=keystone

# Keystone definitions

KEYSTONE_REGION=RegionOne

SERVICE_TOKEN= 8a1438899a78df19bb3f

SERVICE_ENDPOINT="http://172.26.188.226:35319/v2.0"

# other definitions

MASTER="172.26.188.226"

SWIFT_MASTER="172.26.188.226"

为便于运行客户端命令创建以下文件并运行：（创建认证文件并加载该文件，便于运行commands命令）

#vi /etc/profile

     export SERVICE_TOKEN= 8a1438899a78df19bb3f

export SERVICE_ENDPOINT=http://172.26.188.226:35319/v2.0

export OS_USERNAME=swift

export OS_PASSWORD=swift

export OS_TENANT_NAME=admin

export OS_AUTH_STRATEGY=keystone

export OS_AUTH_URL=http:// 172.26.188.226:5000/v2.0

查看keystone设置:

           # keystone user-list

# keystone user-role-list

# keystone role-list

# keystone service-list

# keystone tenant-list

# keystone endpoint-list

           # keystone user-role-list --user swift--tenant services

新建test1、test2用户权限为Member

         #keystone user-create --name test1 --passadmin --email test1@test.com

#keystone user-create --name test2 --pass admin --email test1@test.com

# keystone user-role-add --user test1 --tenant services --roleMember

# keystone user-role-add --user test2 --tenant services --role Member

七、SwiftProxy Node安装

安装Storage proxy node packages

      # apt-getinstall -y swift-proxy memcached python-keystoneclient python-swiftclientswift-plugin-s3

修改memcached配置

     #sed -i '/-l/s/127.0.0.1/172.26.188.226/g' /etc/memcached.conf

# servicememcached restart

创建swift配置目录（如果不存在）

#mkdir/etc/swift/

#chown -Rswift:swift /etc/swift/

#chown -Rswift:swift /var/cache/swift/

创建证书        //否则不支持https（这里我没用https，所以可以不做）

#cd /etc/swift

#openssl req -new -x509 -nodes -out cert.crt -keyoutcert.key

创建/etc/swift/proxy-server.conf配置文件

#vi/etc/swift/proxy-server.conf

[DEFAULT]
#cert_file = /etc/swift/cert.crt
#key_file = /etc/swift/cert.key
bind_port = 8080
workers = 8
user = swift
[pipeline:main]
pipeline = catch_errors healthcheck cache authtoken keystoneauth proxy-logging proxy-server
[app:proxy-server]
use = egg:swift#proxy
allow_account_management = true
account_autocreate = true
[filter:proxy-logging]
use = egg:swift#proxy_logging
[filter:keystoneauth]
use = egg:swift#keystoneauth
operator_roles = Member,admin, swiftoperator
[filter:authtoken]
paste.filter_factory = keystoneclient.middleware.auth_token:filter_factory
signing_dir = /var/cache/swift
auth_host = 172.26.188.226
auth_port = 35319
auth_protocol = http
auth_uri = http://172.26.188.226:5000
admin_tenant_name = services
admin_user = swift
admin_password = 111111
delay_auth_decision = 10
cache = swift.cache
 [filter:cache]
use = egg:swift#memcache
memcache_servers = 172.26.188.226:11211,172.26.188.227:11211,172.26.188.228:11211
                                                                                                                                                                                                                                                                                                                                                    
[filter:catch_errors]
use = egg:swift#catch_errors
[filter:healthcheck]
use = egg:swift#healthcheck

创建ring

#cd /etc/swift

swift-ring-builder account.builder create 18 3 1

swift-ring-builder container.builder create 18 3 1

swift-ring-builder object.builder create 18 3 1

参数详细信息请参见官方ring部分，以下供参考。

18:用于指定分区数。分区数目为2的幂次，如18，则分区数是2的18次方。

3：文件副本数目

1：分区移动的最小时间间隔，单位是小时。

给每个node添加ring

swift-ring-builder account.builder add z1-172.26.188.227:6002/loop100

swift-ring-builder container.builder add z1-172.26.188.227:6001/loop100

swift-ring-builder object.builder add z1-172.26.188.227:6000/loop100

swift-ring-builder account.builder add z2-172.26.188.228:6002/loop100

swift-ring-builder container.builder add z2-172.26.188.228:6001/loop100

swift-ring-builder object.builder add z2-172.26.188.228:6000/loop100

swift-ring-builder account.builder add z3-172.26.188.229:6002/loop100

swift-ring-builder container.builder add z3-172.26.188.229:6001/loop100

swift-ring-builder object.builder add z3-172.26.188.229:6000/loop100

确认ring内容

swift-ring-builder /etc/swift/account.builder

swift-ring-builder /etc/swift/container.builder

swift-ring-builder /etc/swift/object.builder

Rebalancethe rings

swift-ring-builder account.builder rebalance

swift-ring-builder container.builder rebalance

swift-ring-builder object.builder rebalance

复制account.ring.gz, container.ring.gz, andobject.ring.gz到其他proxy Node及Storage Node

# scp *.ring.gz swift1:/etc/swift

# scp *.ring.gz swift2:/etc/swift

# scp *.ring.gz swift3:/etc/swift

所有node检查/etc/swift权限，owner修改为swift

#chown -R swift:swift /etc/swift/

启动proxy

#swift-init proxy start

测试认证

验证整个存储架构是否成功

#swift -V 2.0 -A http://172.26.188.226:5000/v2.0 -U admin-K admin stat

#swift -V 2.0 -A http://172.26.188.226:5000/v2.0-U swift:service -K admin stat

测试上传文件到container

#swift -V 2.0 -A http://172.26.188.226:5000/v2.0-U admin -K admin upload myfiles cert.key

curl测试

curl-d '{"auth": {"tenantName": "admin","passwordCredentials":{"username": "admin","password": "admin"}}}' -H "Content-type:application/json" http://172.26.188.226:35319/v2.0/tokens | python-mjson.tool

curl-s -d"{\"auth\":{\"passwordCredentials\":{\"username\": \"swift\", \"password\":\"admin\"}, \"tenantName\": \"services\"}}"-H "Content-type: application/json" http://172.26.188.226:35319/v2.0/tokens

八、SwiftStorage Node安装步骤

安装Storage node packages

#apt-get install-y swift-account swift-container swift-object xfsprogs parted

准备磁盘

选取某一个磁盘分区做存储，本例使用loop.硬盘小于2T可以使用fdisk

#parted /dev/sdb mklabel gpt

#parted /dev/sdb mkpart primary 0% 100%

#mkfs.xfs -isize=1024 /loop

#mkdir –p /srv/node/loop

#echo "/loop/srv/node/loop xfs noatime,nodiratime,nobarrier,logbufs=8 0 0" >>/etc/fstab

#mount /srv/node/loop

#chown -Rswift:swift /srv/node

以上若有多块硬盘，需重复执行，可以使用一下循环。

for i in b cd;do

parted /dev/sd${i}mklabel gpt

parted/dev/sd${i} mkpart primary 0% 100%

      mkfs.xfs -i size=1024 /dev/sd${i}1

mkdir -p/srv/node/sd${i}1

echo"/dev/sd${i}1 /srv/node/sd${i}1 xfs noatime,nodiratime,nobarrier,logbufs=80 0" >> /etc/fstab

      mount /srv/node/sd${i}1

chown -R swift:swift/srv/node/sd${i}

     done

配置rsync

#vi /etc/rsyncd.conf

uid = swift

gid = swift

log file = /var/log/rsyncd.log

pid file = /var/run/rsyncd.pid

address = [STORAGE_NET_IP]                //修改为你的ip

[account]

max connections = 2

path = /srv/node/

read only = false

lock file = /var/lock/account.lock

[container]

max connections = 2

path = /srv/node/

read only = false

lock file = /var/lock/container.lock

[object]

max connections = 2

path = /srv/node/

read only = false

lock file = /var/lock/object.lock

#sed -i '/RSYNC_ENABLE/ s/false/true/g' /etc/default/rsync

#service rsync start

配置memcached

#sed-i '/-l/ s/127.0.0.1/[STORAGE_NET_IP]/g'/etc/memcached.conf//STORAGE_NET_IP修改为你的ip

# service memcached restart

修改Swift Storage Node配置

#vi /etc/swift/account-server.conf

[DEFAULT]

bind_ip = [STORAGE_NET_IP]                //修改为你的ip

workers = 2

[pipeline:main]

pipeline = account-server

[app:account-server]

use = egg:swift#account

[account-replicator]

[account-auditor]

[account-reaper]

#vi /etc/swift/container-server.conf

[DEFAULT]

bind_ip = [STORAGE_NET_IP]

workers = 2

[pipeline:main]

pipeline = container-server

[app:container-server]

use = egg:swift#container

[container-replicator]

[container-updater]

[container-auditor]

#vi /etc/swift/object-server.conf

[DEFAULT]

bind_ip = [STORAGE_NET_IP]

workers = 2

[pipeline:main]

pipeline = object-server

[app:object-server]

use = egg:swift#object

[object-replicator]

[object-updater]

[object-auditor]

[object-expirer]

启动storage services        //没有ring files，启动会有错误。

      swift-init all start