配置OpenStack各组件使用SSL通信

OpenStack 版本：Liberty
下面的配置针对的是allinone的部署方式，但是同理的可以应用到多节点的部署。

第1章 配置keystone组件使用SSL

制作三个密钥证书文件，略
ca.pem
signing_cert.pem
signing_key.pem
将得到的三个文件放到/tmp/pems/目录下。
1.1 指定ssl使用的密钥和证书
(1) 拷贝pem文件到keystone的ssl目录

cp /tmp/pems/ca.pem /etc/keystone/ssl/certs/
cp /tmp/pems/signing_cert.pem /etc/keystone/ssl/certs/
cp /tmp/pems/signing_key.pem /etc/keystone/ssl/private/
chown keystone:keystone /etc/keystone/ssl –R

(2) 修改keystone的配置文件

[eventlet_server_ssl]
enable = true
certfile = /etc/keystone/ssl/certs/signing_cert.pem
keyfile = /etc/keystone/ssl/private/signing_key.pem
ca_certs = /etc/keystone/ssl/certs/ca.pem

1.2 更新keystone组件的endpoint
(1) 创建新的endpoint

keystone endpoint-create \
--service keystone \
--region RegionOne \
--publicurl https://vim.example.com:5000/v2.0 \
--internalurl https://vim.example.com:5000/v2.0 \
--adminurl https://vim.example.com:35357/v2.0

(2) 增加hosts记录
vi /etc/hosts

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
10.167.14.164 vim.example.com

(3) 修改环境变量文件
vi /root/keystonerc_admin

unset OS_SERVICE_TOKEN
export OS_USERNAME=admin
export OS_PASSWORD=root
export OS_AUTH_URL=https://vim.example.com:5000/v2.0  #修改ip为域名，http为https
export OS_CACERT=/etc/keystone/ssl/certs/ca.pem          # 追加该环境变量
export PS1='[\u@\h \W(keystone_admin)]\$ '

export OS_TENANT_NAME=admin
export OS_REGION_NAME=RegionOne

(4) 删除旧的endpoint

keystone endpoint-list

如果该命令执行失败，重启服务后，使用新的环境变量 source /root/keystonerc_admin

keystone endpoint-delete $endpoint_id

$endpoint_id : 旧的keystone endpoint id

(5) 重启keystone服务

service openstack-keystone restart

(6) 确认新的环境变量和新的endpoint可以使用

source /root/keystonerc_admin
keystone endpoint-list

第2章 配置nova组件使用SSL

2.1 配置使用SSL访问keystone

(1) 配置nova.conf，修改keystone认证方式

vi /etc/nova/nova.conf

[keystone_authtoken]
auth_uri=https://vim.example.com:5000/v2.0
cafile=/etc/nova/ssl/ca.pem
insecure=true
auth_host=vim.example.com
auth_protocol=https
identity_uri=https://vim.example.com:35357

(2) 拷贝pem文件到nova的ssl目录

mkdir /etc/nova/ssl
cp /tmp/pems/* /etc/nova/ssl
chown nova:nova /etc/nova/ssl -R

(3) 重启nova服务

service openstack-nova-api restart
service openstack-nova-compute restart
service openstack-nova-scheduler restart
service openstack-nova-cert restart
service openstack-nova-conductor restart
service openstack-nova-consoleauth restart

(4) 测试keystone认证

nova --insecure hypervisor-list

2.2 指定nova使用的密钥和证书
(1) 修改nova的配置文件

vi /etc/nova/nova.conf

enabled_ssl_apis = osapi_compute
ssl_cert_file=/etc/nova/ssl/signing_cert.pem
ssl_key_file=/etc/nova/ssl/signing_key.pem

2.3 更新nova组件的endpoint
(1) 创建新的endpoint

keystone endpoint-create --service nova --region RegionOne \
--publicurl "https://vim.example.com:8774/v2/%(tenant_id)s" \
--internalurl "https://vim.example.com:8774/v2/%(tenant_id)s" \
--adminurl "https://vim.example.com:8774/v2/%(tenant_id)s"

(2) 删除旧的endpoint

keystone endpoint-list
keystone endpoint-delete $endpoint_id

$endpoint_id : 旧的nova endpoint id

(3) 重启nova服务

service openstack-nova-api restart
service openstack-nova-compute restart
service openstack-nova-scheduler restart
service openstack-nova-cert restart
service openstack-nova-conductor restart
service openstack-nova-consoleauth restart

(4) 测试nova服务

nova --insecure hypervisor-list

2.4 配置nova以SSL方式访问其他组件
vi /etc/nova/nova.conf

[cinder]
endpoint_template=https://vim.example.com:8776/v2/%(project_id)s
cafile=/etc/nova/ssl/ca.pem

[glance]
protocol=https
api_servers=https://vim.example.com:9292
api_insecure=true

[neutron]
url=https://vim.example.com:9696
admin_auth_url=https://vim.example.com:5000/v2.0
cafile=/etc/nova/ssl/ca.pem
insecure=true

第3章 配置glance组件使用SSL

3.1 配置使用SSL访问keystone

(1) 配置glance,修改keystone认证方式

vi /etc/glance/glance-api.conf

[keystone_authtoken]
auth_uri=https://vim.example.com:5000/v2.0
cafile=/etc/glance/ssl/ca.pem
insecure=true
auth_host= vim.example.com
auth_protocol=https
identity_uri=https://vim.example.com:35357

vi /etc/glance/glance-registry.conf

[keystone_authtoken]
auth_uri=https:/vim.example.com:5000/v2.0
cafile=/etc/glance/ssl/ca.pem
insecure=true
auth_host= vim.example.com
auth_protocol=https
identity_uri=https://vim.example.com:35357

vi /etc/glance/glance-cache.conf

[DEFAULT]
auth_url=https://vim.example.com:5000/v2.0

(2) 拷贝pem文件到glance的ssl目录

mkdir /etc/glance/ssl
cp /tmp/pems/* /etc/glance/ssl
chown glance:glance /etc/glance/ssl -R

(3) 重启glance服务

service openstack-glance-api restart
service openstack-glance-registry restart

(4) 测试keystone认证

nova image-list

3.2 指定glance使用的密钥和证书
(1) 修改glance的配置文件
vi /etc/glance/glance-api.conf

[DEFAULT]
cert_file=/etc/glance/ssl/signing_cert.pem
key_file=/etc/glance/ssl/signing_key.pem
registry_client_protocol=https
registry_client_ca_file=/etc/glance/ssl/ca.pem

vi /etc/glance/glance-registry.conf

[DEFAULT]
cert_file=/etc/glance/ssl/signing_cert.pem
key_file=/etc/glance/ssl/signing_key.pem

3.3 更新glance组件的endpoint
(1) 创建新的endpoint

keystone endpoint-create --service glance --region RegionOne \
--publicurl "https://vim.example.com:9292" \
--internalurl "https://vim.example.com:9292" \
--adminurl "https://vim.example.com:9292"

(2) 删除旧的endpoint

keystone endpoint-list
keystone endpoint-delete $endpoint_id

$endpoint_id : 旧的glance endpoint id

(3) 重启glance服务

service openstack-glance-api restart
service openstack-glance-registry restart

(4) 测试glance服务

nova image-list

3.4 配置glance以SSL方式访问其他组件
vi /etc/glance/glance-api.conf

[glance_store]
cinder_endpoint_template=https://vim.example.com:8776/v2/%(project_id)s

vi /etc/glance/glance-registry.conf

[glance_store]
cinder_endpoint_template=https://vim.example.com:8776/v2/%(project_id)s

第4章 配置cinder组件使用SSL

4.1 配置使用SSL访问keystone

(1) 配置cinder配置文件

vi /etc/cinder/api-paste.ini

auth_uri=https://vim.example.com:5000/v2.0
identity_uri=https://vim.example.com:35357

vi /etc/cinder/ cinder.conf

[keystone_authtoken]
auth_uri = https://vim.example.com:5000
auth_url = https://vim.example.com:35357
cafile=/etc/cinder/ssl/ca.pem
insecure = true
auth_host = vim.example.com
auth_protocol = https
identity_uri=https://vim.example.com:35357

(2) 拷贝pem文件到cinder的ssl目录

mkdir /etc/cinder/ssl
cp /tmp/pems/* /etc/cinder/ssl
chown cinder:cinder /etc/cinder/ssl -R

(3) 重启cinder服务

service openstack-cinder-api restart
service openstack-cinder-scheduler restart
service openstack-cinder-volume restart
service openstack-cinder-backup restart

(4) 测试keystone认证

nova list

4.2 指定cinder使用的密钥和证书
(1) 修改cinder的配置文件
vi /etc/cinder/cinder.conf

[DEFAULT]
ssl_cert_file=/etc/cinder/ssl/signing_cert.pem
ssl_key_file=/etc/cinder/ssl/signing_key.pem

4.3 更新cinder组件的endpoint
(1) 创建新的endpoint

keystone endpoint-create --service cinderv2 --region RegionOne \
--publicurl "https://vim.example.com:8776/v2/%(tenant_id)s" \
--internalurl "https://vim.example.com:8776/v2/%(tenant_id)s" \
--adminurl "https://vim.example.com:8776/v2/%(tenant_id)s"

keystone endpoint-create --service cinder --region RegionOne \
--publicurl "https://vim.example.com:8776/v1/%(tenant_id)s" \
--internalurl "https://vim.example.com:8776/v1/%(tenant_id)s" \
--adminurl "https://vim.example.com:8776/v1/%(tenant_id)s"

(2) 删除旧的endpoint

keystone endpoint-list
keystone endpoint-delete $endpoint_id

$endpoint_id : 旧的cinder endpoint id

(3) 重启cinder服务

service openstack-cinder-api restart
service openstack-cinder-scheduler restart
service openstack-cinder-volume restart
service openstack-cinder-backup restart

(4) 测试cinder服务

nova list

4.4 配置cinder以SSL方式访问其他组件
vi /etc/cinder/cinder.conf

[DEFAULT]
glance_host = vim.example.com
glance_api_servers = https://vim.example.com:9292
glance_api_insecure = true
glance_ca_certificates_file = /etc/cinder/ssl/ca.pem

nova_endpoint_template = https://vim.example.com:8774/v2/%(project_id)s
nova_ca_certificates_file = /etc/cinder/ssl/ca.pem
nova_api_insecure = true

第5章 配置neutron组件使用SSL

5.1 配置使用SSL访问keystone

(1) 修改neutron配置文件

vi /etc/neutron/api-paste.ini

identity_uri=https://vim.example.com:35357
auth_uri=https://vim.example.com:5000/v2.0

vi /etc/neutron/metadata_agent.ini

auth_url = https://vim.example.com:5000/v2.0

vi /etc/neutron/neutron.conf

[keystone_authtoken]
auth_uri = https://vim.example.com:5000/v2.0
identity_uri = https://vim.example.com:35357
cafile=/etc/neutron/ssl/ca.pem
insecure=true
auth_host=vim.example.com
auth_protocol=https

(2) 拷贝pem文件到neutron的ssl目录

mkdir /etc/neutron/ssl
cp /tmp/pems/* /etc/neutron/ssl
chown neutron:neutron /etc/neutron/ssl -R

(3) 重启neutron服务

service neutron-server restart
service neutron-dhcp-agent restart
service neutron-l3-agent restart
service neutron-metadata-agent restart
service neutron-lbaas-agent restart
service neutron-openvswitch-agent restart
service neutron-metering-agent restart

(4) 测试keystone认证

nova net-list

5.2 指定neutron使用的密钥和证书
(1) 修改neutron的配置文件
vi /etc/neutron/neutron.conf

[DEFAULT]
use_ssl = True
ssl_cert_file = /etc/neutron/ssl/signing_cert.pem
ssl_key_file = /etc/neutron/ssl/signing_key.pem

5.3 更新neutron组件的endpoint
(1) 创建新的endpoint

keystone endpoint-create --service neutron --region RegionOne \
--publicurl "https://vim.example.com:9696" \
--internalurl "https://vim.example.com:9696" \
--adminurl "https://vim.example.com:9696" 

(2) 删除旧的endpoint

keystone endpoint-list
keystone endpoint-delete $endpoint_id

$endpoint_id : 旧的neutron endpoint id

(3) 重启neutron服务

service neutron-server restart
service neutron-dhcp-agent restart
service neutron-l3-agent restart
service neutron-metadata-agent restart
service neutron-lbaas-agent restart
service neutron-openvswitch-agent restart
service neutron-metering-agent restart

(4) 测试neutron服务

nova net-list

5.4 配置neutron以SSL方式访问其他组件
vi /etc/neutron/neutron.conf

[DEFAULT]
nova_url = https://vim.example.com:8774/v2
nova_admin_auth_url =https://vim.example.com:5000/v2.0

[nova]
cafile = /etc/neutron/ssl/ca.pem

第6章 配置ceilometer组件使用SSL

6.1 配置使用SSL访问keystone

(1) 修改ceilometer配置

vi /etc/ceilometer/ceilometer.conf

[keystone_authtoken]
auth_uri = https://vim.example.com:5000/v2.0
cafile=/etc/ceilometer/ssl/ca.pem
insecure = true
auth_host = vim.example.com
auth_protocol = https 
identity_uri = https://vim.example.com:35357

[service_credentials] 
os_auth_url = https://vim.example.com:5000/v2.0

(2) 拷贝pem文件到ceilometer的ssl目录

mkdir /etc/ceilometer/ssl
cp /tmp/pems/* /etc/ceilometer/ssl
chown ceilometer:ceilometer /etc/ceilometer/ssl -R

(3) 重启ceilometer服务

service openstack-ceilometer-api restart
service openstack-ceilometer-central restart
service openstack-ceilometer-compute restart
service openstack-ceilometer-collector restart
service openstack-ceilometer-alarm-notifier restart
service openstack-ceilometer-alarm-evaluator restart
service openstack-ceilometer-notification restart

第7章 配置dashboard组件使用SSL

7.1 配置使用SSL访问keystone

(1) 修改horizon配置

vi /etc/openstack-dashboard/local_settings

OPENSTACK_KEYSTONE_URL = "https://vim.example.com:5000/v2.0"
OPENSTACK_SSL_NO_VERIFY = True
OPENSTACK_SSL_CACERT = '/etc/keystone/ssl/certs/ca.pem'

(2) 重启httpd服务

service httpd restart