OpenStack 源码系列之 Keystone：服务启动

在 O 版本的 OpenStack 中，利用了 uWSGI 服务器作为 Apache 服务器和 Keystone 服务之间的桥梁。关于 uWSGI 与 CGI、FastCGI、WSGI 之间的区别，可参考博文网关协议学习：CGI、FastCGI、WSGI。

对于 Keystone 服务启动，源码的 DOC 目录下就有一个文件（doc/source/apache-httpd.rst）说明如何启动 Keystone 服务：

1
2
3
4
5
6
7
8
9
10
11
Now configure and start the uwsgi services. Copy the
`httpd/keystone-uwsgi-admin.ini` and `httpd/keystone-uwsgi-public.ini` files to
`/etc/keystone`. Update the files to match your system configuration (for
example, you'll want to set the number of processes and threads for the public
and admin servers).

Start up the keystone servers using uwsgi::

    $ sudo pip install uwsgi
    $ uwsgi /etc/keystone/keystone-uwsgi-admin.ini
    $ uwsgi /etc/keystone/keystone-uwsgi-public.ini

需要注意的是，uWSGI 服务器并不直接向外提供服务，而是由 Apache 或 Nginx 这种专门服务器向外接收请求，然后转发给 uWSGI 服务器。

从上边说明，我们也可以看到，Keystone 服务是分成 admin 和 public 两种的。下边我们以 admin 为例来进行说明。首先，先看一下 keystone-uwsgi-admin.ini 的内容：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
[uwsgi]
wsgi-file = /usr/local/bin/keystone-wsgi-admin	# 服务入口

# Versions of mod_proxy_uwsgi>=2.0.6 should use a UNIX socket, see
# http://uwsgi-docs.readthedocs.org/en/latest/Apache.html#mod-proxy-uwsgi
uwsgi-socket = 127.0.0.1:35358

# Override the default size for headers from the 4k default.
buffer-size = 65535

# This is running standalone
master = true

enable-threads = true

# Tune this to your environment.
processes = 4

# uwsgi recommends this to prevent thundering herd on accept.
thunder-lock = true

plugins = python

# This ensures that file descriptors aren't shared between keystone processes.
lazy-apps = true

从上边配置文件我们可以看到服务的启动入口在 keystone-wsgi-admin。那这个入口在哪里呢？请看 setup.cfg 文件：

1
2
3
4
[entry_points]
wsgi_scripts =
    keystone-wsgi-admin = keystone.server.wsgi:initialize_admin_application
    keystone-wsgi-public = keystone.server.wsgi:initialize_public_application

接下来我们就来看看这个入口函数：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
# keystone/server/wsgi.py

def initialize_admin_application():
    return initialize_application(name='admin',
                                  config_files=_get_config_files())

def initialize_application(name,
                           post_log_configured_function=lambda: None,
                           config_files=None):
    possible_topdir = os.path.normpath(os.path.join(
                                       os.path.abspath(__file__),
                                       os.pardir,
                                       os.pardir,
                                       os.pardir))

    dev_conf = os.path.join(possible_topdir,
                            'etc',
                            'keystone.conf')
    if not config_files:
        config_files = None
        if os.path.exists(dev_conf):
            config_files = [dev_conf]

    common.configure(config_files=config_files)

    # Log the options used when starting if we're in debug mode...
    if CONF.debug:
        CONF.log_opt_values(log.getLogger(CONF.prog), log.DEBUG)

    post_log_configured_function()

    def loadapp():
        return keystone_service.loadapp(
            'config:%s' % find_paste_config(), name)

    # 重点
    _unused, application = common.setup_backends(
        startup_application_fn=loadapp)

    # setup OSprofiler notifier and enable the profiling if that is configured
    # in Keystone configuration file.
    profiler.setup(name)

    return application

上边的代码逻辑很清晰，所以这里我们就不做过多解释，重点说一下 setup_backends 这个函数。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# keystone/server/wsgi.py

def initialize_application(name,
                           post_log_configured_function=lambda: None,
                           config_files=None):
    ......

    def loadapp():
        return keystone_service.loadapp(
            'config:%s' % find_paste_config(), name)

    # 重点
    _unused, application = common.setup_backends(
        startup_application_fn=loadapp)


# keystone/server/common.py

def setup_backends(load_extra_backends_fn=lambda: {},
                   startup_application_fn=lambda: None):
    drivers = backends.load_backends()
    drivers.update(load_extra_backends_fn())
    res = startup_application_fn()
    drivers.update(dependency.resolve_future_dependencies())
    return drivers, res


# keystone/server/backends.py

def load_backends():

    # Configure and build the cache
    cache.configure_cache()
    cache.configure_cache(region=catalog.COMPUTED_CATALOG_REGION)
    cache.configure_cache(region=assignment.COMPUTED_ASSIGNMENTS_REGION)
    cache.configure_cache(region=revoke.REVOKE_REGION)
    cache.configure_cache(region=token.provider.TOKENS_REGION)
    cache.configure_cache(region=identity.ID_MAPPING_REGION)
    cache.configure_invalidation_region()

    # Ensure that the identity driver is created before the assignment manager
    # and that the assignment driver is created before the resource manager.
    # The default resource driver depends on assignment, which in turn
    # depends on identity - hence we need to ensure the chain is available.
    # TODO(morganfainberg): In "O" release move _IDENTITY_API to be directly
    # instantiated in the DRIVERS dict once assignment driver being selected
    # based upon [identity]/driver is removed.
    _IDENTITY_API = identity.Manager()
    _ASSIGNMENT_API = assignment.Manager()

    DRIVERS = dict(
        assignment_api=_ASSIGNMENT_API,
        catalog_api=catalog.Manager(),
        credential_api=credential.Manager(),
        credential_provider_api=credential.provider.Manager(),
        domain_config_api=resource.DomainConfigManager(),
        endpoint_policy_api=endpoint_policy.Manager(),
        federation_api=federation.Manager(),
        id_generator_api=identity.generator.Manager(),
        id_mapping_api=identity.MappingManager(),
        identity_api=_IDENTITY_API,
        shadow_users_api=identity.ShadowUsersManager(),
        oauth_api=oauth1.Manager(),
        policy_api=policy.Manager(),
        resource_api=resource.Manager(),
        revoke_api=revoke.Manager(),
        role_api=assignment.RoleManager(),
        token_api=token.persistence.Manager(),
        trust_api=trust.Manager(),
        token_provider_api=token.provider.Manager())

    auth.core.load_auth_methods()

    return DRIVERS

可以看出，setup_backends 主要做了两件事：

  1. 利用 PasteDeploy 加载基于 keystone-paste.ini 配置文件的 WSGI 应用
  2. 加载（实例化）各个模块的 Driver（实际就是各模块的 API）

到此，一个服务就启动完毕了。

最后，我们可以看一下效果（keystone-pu 和 keystone-ad 分别是 keystone-public 和 keystone-admin 的缩写）：

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true

谢宏峰，毕业于暨南大学（2009 - 2013）、中国科学院（2013 - 2016），现就职于深信服科技，从事 OpenStack 开发。