153 lines
5.0 KiB
Bash
Executable File
153 lines
5.0 KiB
Bash
Executable File
#!/bin/bash
|
||
# OpenStack 控制节点(Rocky) KeyStone 服务部署检查脚本
|
||
# 适用于: 3.2 KeyStone服务部署
|
||
|
||
# 学生可见输出：每组一行，失败时列出原因；仅统计实际检查结果。
|
||
RED='\033[0;31m'
|
||
GREEN='\033[0;32m'
|
||
CYAN='\033[0;36m'
|
||
NC='\033[0m'
|
||
PASS_CNT=0
|
||
FAIL_CNT=0
|
||
SECTION_TITLE=''
|
||
SECTION_PASS=0
|
||
SECTION_FAIL=0
|
||
SECTION_DETAILS=()
|
||
|
||
pass() { PASS_CNT=$((PASS_CNT+1)); }
|
||
fail() {
|
||
FAIL_CNT=$((FAIL_CNT+1))
|
||
if [ -n "$SECTION_TITLE" ]; then
|
||
SECTION_DETAILS+=("$1")
|
||
else
|
||
printf '%b[✘ 失败] %s%b\n' "$RED" "$1" "$NC"
|
||
fi
|
||
}
|
||
section_summary() {
|
||
[ -n "$SECTION_TITLE" ] || return 0
|
||
local passed=$((PASS_CNT-SECTION_PASS)) failed=$((FAIL_CNT-SECTION_FAIL)) message
|
||
# 没有实际检查结果的分组不显示，也不记为通过。
|
||
if [ "$failed" -gt 0 ]; then
|
||
printf '%b[✘ 失败] %s：通过 %s，失败 %s%b\n' "$RED" "$SECTION_TITLE" "$passed" "$failed" "$NC"
|
||
for message in "${SECTION_DETAILS[@]}"; do
|
||
printf '%b · %s%b\n' "$RED" "$message" "$NC"
|
||
done
|
||
elif [ "$passed" -gt 0 ]; then
|
||
printf '%b[✔ 通过] %s（%s 项）%b\n' "$GREEN" "$SECTION_TITLE" "$passed" "$NC"
|
||
fi
|
||
}
|
||
info() {
|
||
section_summary
|
||
SECTION_TITLE=$1
|
||
SECTION_PASS=$PASS_CNT
|
||
SECTION_FAIL=$FAIL_CNT
|
||
SECTION_DETAILS=()
|
||
}
|
||
finish() {
|
||
section_summary
|
||
printf '\n检查完毕：通过 %b%s%b 项，失败 %b%s%b 项。\n' \
|
||
"$GREEN" "$PASS_CNT" "$NC" "$RED" "$FAIL_CNT" "$NC"
|
||
if [ "$FAIL_CNT" -gt 0 ]; then
|
||
printf '%b请按失败提示修正后重试。%b\n' "$RED" "$NC"
|
||
exit 1
|
||
fi
|
||
printf '%b本次检查项全部通过。%b\n' "$GREEN" "$NC"
|
||
exit 0
|
||
}
|
||
|
||
printf '%bOpenStack Keystone 身份认证自测%b\n' "$CYAN" "$NC"
|
||
|
||
# 0. 检查是否为 root 用户
|
||
if [ "$EUID" -ne 0 ]; then
|
||
fail "请使用 root 权限执行此脚本"
|
||
exit 1
|
||
fi
|
||
|
||
# 1. 检查数据库配置与授权
|
||
info "MariaDB 数据库创建与授权"
|
||
if mysql -ukeystone -pkeystone -e "SHOW DATABASES;" 2>/dev/null | grep -q "keystone"; then
|
||
pass "keystone 数据库已创建"
|
||
else
|
||
fail "keystone 数据库未创建"
|
||
fi
|
||
|
||
if mysql -ukeystone -pkeystone -e "SHOW DATABASES;" &>/dev/null; then
|
||
pass "keystone 数据库用户授权正确 (可正常登录)"
|
||
|
||
# 顺便检查 DB_SYNC 是否成功
|
||
if [ $(mysql -ukeystone -pkeystone -e "USE keystone; SHOW TABLES;" 2>/dev/null | wc -l) -gt 2 ]; then
|
||
pass "keystone 数据库表结构已成功同步 (db_sync)"
|
||
else
|
||
fail "keystone 数据库表为空，未执行同步或同步失败"
|
||
fi
|
||
else
|
||
fail "keystone 数据库用户授权失败或密码不匹配"
|
||
fi
|
||
|
||
# 2. 检查软件包安装
|
||
info "依赖软件包安装"
|
||
if rpm -q openstack-keystone httpd mod_wsgi &>/dev/null; then
|
||
pass "相关软件包 (keystone, httpd, mod_wsgi) 已全部安装"
|
||
else
|
||
fail "部分软件包未安装，请检查是否遗漏"
|
||
fi
|
||
|
||
# 3. 检查 KeyStone 配置文件
|
||
info "keystone.conf 配置文件"
|
||
if grep -q "^connection.*=.*mysql+pymysql://keystone:keystone@controller/keystone" /etc/keystone/keystone.conf 2>/dev/null; then
|
||
pass "数据库连接 [database] 配置正确"
|
||
else
|
||
fail "数据库连接 [database] 配置不匹配"
|
||
fi
|
||
|
||
if grep -q "^provider.*=.*fernet" /etc/keystone/keystone.conf 2>/dev/null; then
|
||
pass "令牌 [token] 认证类型已按要求设置为 fernet"
|
||
else
|
||
fail "令牌 [token] 的 provider 未设置为 fernet"
|
||
fi
|
||
|
||
# 4. 检查 Fernet 密钥
|
||
info "Fernet 密钥库初始化"
|
||
if [ "$(ls -A /etc/keystone/fernet-keys 2>/dev/null)" ] && [ "$(ls -A /etc/keystone/credential-keys 2>/dev/null)" ]; then
|
||
pass "Fernet 与 Credential 密钥库已初始化"
|
||
else
|
||
fail "Fernet 密钥目录为空，未执行 fernet_setup"
|
||
fi
|
||
|
||
# 5. 检查 Apache HTTP 状态
|
||
info "Apache (HTTPD) 服务状态"
|
||
if grep -iq "^ServerName controller" /etc/httpd/conf/httpd.conf 2>/dev/null; then
|
||
pass "Apache ServerName 已配置为 controller"
|
||
else
|
||
fail "Apache ServerName 未配置正确"
|
||
fi
|
||
|
||
if [ -L /etc/httpd/conf.d/wsgi-keystone.conf ]; then
|
||
pass "WSGI 虚拟主机链接已创建"
|
||
else
|
||
fail "wsgi-keystone.conf 的软链接不存在"
|
||
fi
|
||
|
||
if systemctl is-active httpd &>/dev/null; then pass "httpd 服务正在运行"; else fail "httpd 服务未运行"; fi
|
||
if systemctl is-enabled httpd &>/dev/null; then pass "httpd 服务已允许开机自启"; else fail "httpd 未设置开机自启"; fi
|
||
|
||
# 导入临时管理员环境变量用于后续 API 测试
|
||
export OS_USERNAME=admin
|
||
export OS_PASSWORD=admin
|
||
export OS_PROJECT_NAME=admin
|
||
export OS_USER_DOMAIN_NAME=Default
|
||
export OS_PROJECT_DOMAIN_NAME=Default
|
||
export OS_AUTH_URL=http://controller:5000/v3
|
||
export OS_IDENTITY_API_VERSION=3
|
||
export NO_PROXY=localhost,127.0.0.1,controller
|
||
|
||
# 6. Admin 身份令牌签发测试 (Bootstrap 验证)
|
||
info "KeyStone Bootstrap 及管理员权限"
|
||
if openstack token issue >/dev/null 2>&1; then
|
||
pass "管理员 (admin) 成功签发 Token (Bootstrap 初始化成功)"
|
||
else
|
||
fail "管理员 (admin) 无法签发 Token，Bootstrap 可能失败或 Apache 未响应"
|
||
fi
|
||
|
||
finish
|