基于keystone认证的Swift的安装与配置
一、概要
成都创新互联是一家集网站建设,柳南企业网站建设,柳南品牌网站建设,网站定制,柳南网站建设报价,网络营销,网络优化,柳南网站推广为一体的创新建站企业，帮助传统企业提升企业形象加强企业竞争力。可充分满足这一群体相比中小企业更为丰富、高端、多元的互联网需求。同时我们时刻保持专业、时尚、前沿，时刻以成就客户成长自我，坚持不断学习、思考、沉淀、净化自己，让我们为更多的企业打造出实用型网站。
OpenStackObject Storage（Swift）是OpenStack开源云计算项目的子项目之一。Swift使用普通的服务器来构建冗余的、可扩展的分布式对象存储集群，存储容量可达PB级。Swift的是用Python开发，前身是Rackspace Cloud Files项目，随着Rackspace加入到OpenStack社区，Racksapce也将Cloud Files的代码贡献给了社区，并逐渐形成现在Swift。Swift最新的发型版本为essex 1.4.6。
二、术语
node- a host machine running one or more Swift services
Proxynode - node that runs Proxy services; also runs keystoneAuth
Storagenode - node that runs Account, Container, and Object services
ring- a set of mappings of Swift data to physical devices
三、系统架构
四、测试环境
本次测试将Auth和Proxy安装在1台服务器，3个Storage节点做测试。单机安装请参照官方SAIO安装方式。Auth使用keystone。
版本说明：ubuntu-12.04 swift1.9.1
| hostname | ip | remarks |
| swift-proxy | 172.26.188.226 | proxy and auth server |
| swift1 | 172.26.188.227 | storage node |
| swift2 | 172.26.188.228 | storage node |
| swift3 | 172.26.188.229 | storage node |
五、初始化设置
1）General Installation Steps for All Nodes
添加cloud archive gpg key:
apt-getinstall ubuntu-cloud-keyring
添加Ubuntu Cloud Archive repository
#vi/etc/apt/sources.list.d/grizzly.list添加如下内容
debhttp://ubuntu-cloud.archive.canonical.com/ubuntu precise-updates/grizzly main
#apt-get update && apt-get upgrade
2）GeneralInstallation Steps for All Swift Nodes（include proxy）
安装swift及依赖包
#apt-getinstall -y swift openssh-server rsync memcached python-netifaces python-xattrpython-memcache
创建Swift配置目录
# mkdir-p /etc/swift
创建Swift配置文件，并同步到all Swift nodes
#vi/etc/swift/swift.conf 内容如下：
[swift-hash] swift_hash_path_suffix = Gdr8ny7YyWqy2
修改Swift目录权限
#chown-R swift:swift /etc/swift/
3）时间同步
Swiftproxy Node做ntp服务器，Swift Storage Node与它做同步
安装ntp
#apt-getinstall -y ntp
配置ntp
# sed -i's/server0.ubuntu.pool.ntp.org/#server 0.ubuntu.pool.ntp.org/'/etc/ntp.conf
# sed -i's/server1.ubuntu.pool.ntp.org/#server 1.ubuntu.pool.ntp.org/'/etc/ntp.conf
# sed -i's/server2.ubuntu.pool.ntp.org/#server 2.ubuntu.pool.ntp.org/'/etc/ntp.conf
# sed -i's/server3.ubuntu.pool.ntp.org/#server 3.ubuntu.pool.ntp.org/'/etc/ntp.conf
# sed -i 's/server ntp.ubuntu.com/#server ntp.ubuntu.com/'/etc/ntp.conf
# sed -i '/ntp.ubuntu.com/a\serverswift-proxy' /etc/ntp.conf
4）修改hosts文件
#vi/etc/hosts添加如下行：
172.26.188.226 swift-proxy 172.26.188.227 swift1 172.26.188.228 swift2 172.26.188.229 swift3
六、Keystone安装（安装在proxy节点）
官方文档
http://docs.openstack.org/trunk/openstack-compute/install/apt/content/keystone-concepts.html
安装Keystone
#apt-getinstall -y keystone python-keyring
配置keystone
#/etc/keystone/default_catalog.templates添加如下内容
catalog.RegionOne.object_store.name = Swift Service catalog.RegionOne.object_store.publicURL = http://172.26.188.226:8080/v1/AUTH_$(tenant_id)s catalog.RegionOne.object_store.adminURL = http://172.26.188.226:8080/ catalog.RegionOne.object_store.internalURL = http://172.26.188.226:8080/v1/AUTH_$(tenant_id)s
生成随机token：
#opensslrand -hex 10
修改keystone配置如下
#vi/etc/keystone/keystone.conf
admin_token =8a1438899a78df19bb3f
verbose = True
log_config =/etc/keystone/logging.conf
connection =MySQL://keystone:keystone@172.26.188.226/keystone
# idle_timeout =200
增加如下行：
idle_timeout =200
min_pool_size =5
max_pool_size =10
pool_timeout =200
[ssl]
enable = False
####token_format = UUID
安装mysql python-mysqldb
apt-get installmysql python-mysqldb
修改/etc/mysql/my.cnf
bind-address= 0.0.0.0
#mysql
mysql>CREATEDATABASE keystone;
mysql>GRANTALL ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone';
mysql>GRANTALL ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'keystone';
mysql>quit;
keystone默认使用PKI tokens
#keystone-manage pki_setup
#sudo chown -R keystone:keystone/etc/keystone/* /var/log/keystone/keystone.log
# servicekeystone restart
#keystone-manage db_sync
创建初始tenants、users、roles：
下载脚本:
#wgethttps://raw.github.com/EmilienM/openstack-folsom-guide/master/scripts/keystone-data.sh
修改admin密码（你将要设置的admin密码）及token（与keystone.conf中一样）后执行导入数据
创建services、endpoints
wget https://raw.github.com/EmilienM/openstack-folsom-guide/master/scripts/keystone-endpoints.sh
修改脚本中以下内容：
# MySQL definitions
MYSQL_USER=keystone
MYSQL_DATABASE=keystone
MYSQL_HOST=172.26.188.226
MYSQL_PASSWORD=keystone
# Keystone definitions
KEYSTONE_REGION=RegionOne
SERVICE_TOKEN= 8a1438899a78df19bb3f
SERVICE_ENDPOINT="http://172.26.188.226:35319/v2.0"
# other definitions
MASTER="172.26.188.226"
SWIFT_MASTER="172.26.188.226"
为便于运行客户端命令创建以下文件并运行：（创建认证文件并加载该文件，便于运行commands命令）
#vi /etc/profile
export SERVICE_TOKEN= 8a1438899a78df19bb3f
export SERVICE_ENDPOINT=http://172.26.188.226:35319/v2.0
export OS_USERNAME=swift
export OS_PASSWORD=swift
export OS_TENANT_NAME=admin
export OS_AUTH_STRATEGY=keystone
export OS_AUTH_URL=http:// 172.26.188.226:5000/v2.0
查看keystone设置:
# keystone user-list
# keystone user-role-list
# keystone role-list
# keystone service-list
# keystone tenant-list
# keystone endpoint-list
# keystone user-role-list --user swift--tenant services
新建test1、test2用户权限为Member
#keystone user-create --name test1 --passadmin --emailtest1@test.com
#keystone user-create --name test2 --pass admin --emailtest1@test.com
# keystone user-role-add --user test1 --tenant services --roleMember
# keystone user-role-add --user test2 --tenant services --role Member
七、SwiftProxy Node安装
安装Storage proxy node packages
# apt-getinstall -y swift-proxy memcached python-keystoneclient python-swiftclientswift-plugin-s3
修改memcached配置
#sed -i '/-l/s/127.0.0.1/172.26.188.226/g' /etc/memcached.conf
# servicememcached restart
创建swift配置目录（如果不存在）
#mkdir/etc/swift/
#chown -Rswift:swift /etc/swift/
#chown -Rswift:swift /var/cache/swift/
创建证书 //否则不支持https（这里我没用https，所以可以不做）
#cd /etc/swift
#openssl req -new -x509 -nodes -out cert.crt -keyoutcert.key
创建/etc/swift/proxy-server.conf配置文件
#vi/etc/swift/proxy-server.conf
[DEFAULT]
#cert_file = /etc/swift/cert.crt
#key_file = /etc/swift/cert.key
bind_port = 8080
workers = 8
user = swift
[pipeline:main]
pipeline = catch_errors healthcheck cache authtoken keystoneauth proxy-logging proxy-server
[app:proxy-server]
use = egg:swift#proxy
allow_account_management = true
account_autocreate = true
[filter:proxy-logging]
use = egg:swift#proxy_logging
[filter:keystoneauth]
use = egg:swift#keystoneauth
operator_roles = Member,admin, swiftoperator
[filter:authtoken]
paste.filter_factory = keystoneclient.middleware.auth_token:filter_factory
signing_dir = /var/cache/swift
auth_host = 172.26.188.226
auth_port = 35319
auth_protocol = http
auth_uri = http://172.26.188.226:5000
admin_tenant_name = services
admin_user = swift
admin_password = 111111
delay_auth_decision = 10
cache = swift.cache
[filter:cache]
use = egg:swift#memcache
memcache_servers = 172.26.188.226:11211,172.26.188.227:11211,172.26.188.228:11211
[filter:catch_errors]
use = egg:swift#catch_errors
[filter:healthcheck]
use = egg:swift#healthcheck创建ring
#cd /etc/swift
swift-ring-builder account.builder create 18 3 1
swift-ring-builder container.builder create 18 3 1
swift-ring-builder object.builder create 18 3 1
参数详细信息请参见官方ring部分，以下供参考。
18:用于指定分区数。分区数目为2的幂次，如18，则分区数是2的18次方。
3：文件副本数目
1：分区移动的最小时间间隔，单位是小时。
给每个node添加ring
swift-ring-builder account.builder add z1-172.26.188.227:6002/loop100
swift-ring-builder container.builder add z1-172.26.188.227:6001/loop100
swift-ring-builder object.builder add z1-172.26.188.227:6000/loop100
swift-ring-builder account.builder add z2-172.26.188.228:6002/loop100
swift-ring-builder container.builder add z2-172.26.188.228:6001/loop100
swift-ring-builder object.builder add z2-172.26.188.228:6000/loop100
swift-ring-builder account.builder add z3-172.26.188.229:6002/loop100
swift-ring-builder container.builder add z3-172.26.188.229:6001/loop100
swift-ring-builder object.builder add z3-172.26.188.229:6000/loop100
确认ring内容
swift-ring-builder /etc/swift/account.builder
swift-ring-builder /etc/swift/container.builder
swift-ring-builder /etc/swift/object.builder
Rebalancethe rings
swift-ring-builder account.builder rebalance
swift-ring-builder container.builder rebalance
swift-ring-builder object.builder rebalance
复制account.ring.gz, container.ring.gz, andobject.ring.gz到其他proxy Node及Storage Node
# scp *.ring.gz swift1:/etc/swift
# scp *.ring.gz swift2:/etc/swift
# scp *.ring.gz swift3:/etc/swift
所有node检查/etc/swift权限，owner修改为swift
#chown -R swift:swift /etc/swift/
启动proxy
#swift-init proxy start
测试认证
验证整个存储架构是否成功
#swift -V 2.0 -A http://172.26.188.226:5000/v2.0 -U admin-K admin stat
#swift -V 2.0 -A http://172.26.188.226:5000/v2.0-U swift:service -K admin stat
测试上传文件到container
#swift -V 2.0 -A http://172.26.188.226:5000/v2.0-U admin -K admin upload myfiles cert.key
curl测试
curl-d '{"auth": {"tenantName": "admin","passwordCredentials":{"username": "admin","password": "admin"}}}' -H "Content-type:application/json" http://172.26.188.226:35319/v2.0/tokens | python-mjson.tool
curl-s -d"{\"auth\":{\"passwordCredentials\":{\"username\": \"swift\", \"password\":\"admin\"}, \"tenantName\": \"services\"}}"-H "Content-type: application/json" http://172.26.188.226:35319/v2.0/tokens
八、SwiftStorage Node安装步骤
安装Storage node packages
#apt-get install-y swift-account swift-container swift-object xfsprogs parted
准备磁盘
选取某一个磁盘分区做存储，本例使用loop.硬盘小于2T可以使用fdisk
#parted /dev/sdb mklabel gpt
#parted /dev/sdb mkpart primary 0% 100%
#mkfs.xfs -isize=1024 /loop
#mkdir –p /srv/node/loop
#echo "/loop/srv/node/loop xfs noatime,nodiratime,nobarrier,logbufs=8 0 0" >>/etc/fstab
#mount /srv/node/loop
#chown -Rswift:swift /srv/node
以上若有多块硬盘，需重复执行，可以使用一下循环。
for i in b cd;do
parted /dev/sd${i}mklabel gpt
parted/dev/sd${i} mkpart primary 0% 100%
mkfs.xfs -i size=1024 /dev/sd${i}1
mkdir -p/srv/node/sd${i}1
echo"/dev/sd${i}1 /srv/node/sd${i}1 xfs noatime,nodiratime,nobarrier,logbufs=80 0" >> /etc/fstab
mount /srv/node/sd${i}1
chown -R swift:swift/srv/node/sd${i}
done
配置rsync
#vi /etc/rsyncd.conf
uid = swift
gid = swift
log file = /var/log/rsyncd.log
pid file = /var/run/rsyncd.pid
address = [STORAGE_NET_IP] //修改为你的ip
[account]
max connections = 2
path = /srv/node/
read only = false
lock file = /var/lock/account.lock
[container]
max connections = 2
path = /srv/node/
read only = false
lock file = /var/lock/container.lock
[object]
max connections = 2
path = /srv/node/
read only = false
lock file = /var/lock/object.lock
#sed -i '/RSYNC_ENABLE/ s/false/true/g' /etc/default/rsync
#service rsync start
配置memcached
#sed-i '/-l/ s/127.0.0.1/[STORAGE_NET_IP]/g'/etc/memcached.conf//STORAGE_NET_IP修改为你的ip
# service memcached restart
修改Swift Storage Node配置
#vi /etc/swift/account-server.conf
[DEFAULT]
bind_ip = [STORAGE_NET_IP] //修改为你的ip
workers = 2
[pipeline:main]
pipeline = account-server
[app:account-server]
use = egg:swift#account
[account-replicator]
[account-auditor]
[account-reaper]
#vi /etc/swift/container-server.conf
[DEFAULT]
bind_ip = [STORAGE_NET_IP]
workers = 2
[pipeline:main]
pipeline = container-server
[app:container-server]
use = egg:swift#container
[container-replicator]
[container-updater]
[container-auditor]
#vi /etc/swift/object-server.conf
[DEFAULT]
bind_ip = [STORAGE_NET_IP]
workers = 2
[pipeline:main]
pipeline = object-server
[app:object-server]
use = egg:swift#object
[object-replicator]
[object-updater]
[object-auditor]
[object-expirer]
启动storage services //没有ring files，启动会有错误。
swift-init all start
网站题目：基于keystone认证的Swift的安装与配置
新闻来源：http://pwwzsj.com/article/ipdodo.html
