OpenStack
实例创建过程图
1 登录界面或命令行通过RESTful API向keystone获取认证信息。
2 keystone通过用户请求认证信息，并生成auth-token返回给对应的认证请求。
3 界面或命令行通过RESTful API向nova-api发送一个boot instance的请求（携带auth-token）。
4 nova-api接受请求后向keystone发送认证请求，查看token是否为有效用户和token。
5 keystone验证token是否有效，如有效则返回有效的认证和对应的角色（注：有些操作需要有角色权限才能操作）。
6 通过认证后nova-api和数据库通讯。
7 初始化新建虚拟机的数据库记录。
8 nova-api通过rpc.call向nova-scheduler请求是否有创建虚拟机的资源(Host ID)。
9 nova-scheduler进程侦听消息队列，获取nova-api的请求。
10 nova-scheduler通过查询nova数据库中计算资源的情况，并通过调度算法计算符合虚拟机创建需要的主机。
11 对于有符合虚拟机创建的主机，nova-scheduler更新数据库中虚拟机对应的物理主机信息。
12 nova-scheduler通过rpc.cast向nova-compute发送对应的创建虚拟机请求的消息。
13 nova-compute会从对应的消息队列中获取创建虚拟机请求的消息。
14 nova-compute通过rpc.call向nova-conductor请求获取虚拟机消息。（Flavor）
15 nova-conductor从消息队队列中拿到nova-compute请求消息。
16 nova-conductor根据消息查询虚拟机对应的信息。
17 nova-conductor从数据库中获得虚拟机对应信息。
18 nova-conductor把虚拟机信息通过消息的方式发送到消息队列中。
19 nova-compute从对应的消息队列中获取虚拟机信息消息。
20 nova-compute通过keystone的RESTfull API拿到认证的token，并通过HTTP请求glance-api获取创建虚拟机所需要镜。
21 glance-api向keystone认证token是否有效，并返回验证结果。
22 token验证通过，nova-compute获得虚拟机镜像信息(URL)。
23 nova-compute通过keystone的RESTfull API拿到认证k的token，并通过HTTP请求neutron-server获取创建虚拟机所需要的网络信息。
24 neutron-server向keystone认证token是否有效，并返回验证结果。
25 token验证通过，nova-compute获得虚拟机网络信息。
26 nova-compute通过keystone的RESTfull API拿到认证的token，并通过HTTP请求cinder-api获取创建虚拟机所需要的持久化存储信息。
27 cinder-api向keystone认证token是否有效，并返回验证结果。
28 token验证通过，nova-compute获得虚拟机持久化存储信息。
29 nova-compute根据instance的信息调用配置的虚拟化驱动来创建虚拟机。
环境准备
系统版本:CentOS7-VMware Worktation
CPU:4
MEM: 8
Disk: 60G
内核升级
# rpm -Uvh http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm
安装完成后检查 /boot/grub2/grub.cfg 中对应内核 menuentry 中是否包含 initrd16 配置，如果没有，再安装一次！
# yum --enablerepo=elrepo-kernel install -y kernel-lt
设置开机从新内核启动
# grub2-set-default 0
重启机器
# init 6
安装内核源文件（在升级完内核并重启机器后执行，也可以不用执行这一步。可选）:
yum --enablerepo=elrepo-kernel install kernel-lt-devel-$(uname -r) kernel-lt-headers-$(uname -r)
# uname -r
Linux openstack 5.4.129-1.el7.elrepo.x86_64 #1 SMP Tue Jun 29 10:28:41 EDT 2021 x86_64 x86_64 x86_64 GNU/Linux
vim /etc/hosts
[root@openstack ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.50.10 controller
# cat /proc/cpuinfo | grep ^process | wc -l
[root@openstack /]# free -h
total used free shared buff/cache available
Mem: 7.8G 154M 6.1G 17M 1.5G 7.3G
Swap: 0B 0B 0B
[root@openstack /]#
Chrony
时间同步
# yum install -y chrony && systemctl start chronyd && systemctl enable chronyd
# chronyc sources
[root@openstack ~]# chronyc sources
210 Number of sources = 4
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 139.199.214.202 2 6 37 51 +113us[ +776us] +/- 44ms
^- ntp6.flashdance.cx 2 6 37 51 -6731us[-6731us] +/- 189ms
^? time.cloudflare.com 3 7 1 109 -123us[ +721us] +/- 111ms
^- stratum2-1.ntp.led01.ru.> 2 6 37 51 +48ms[ +48ms] +/- 117ms
防火墙
systemctl stop firewalld && systemctl disable firewalld
yum install -y iptables-service && iptables -F
iptables-save
Selinux
setenforce 0
vim /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
网络工具包下载
curl -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
yum install wget vim net-tools -y
安装Queens版yum源
# yum install centos-release-openstack-queens -y
# cat > /etc/yum.repos.d/Openstack-queens.repo << EOF
[centos-openstack-queens]
name=CentOS-7 - OpenStack queens
baseurl=https://mirrors.aliyun.com/$contentdir/$releasever/cloud/$basearch/openstack-queens/
gpgcheck=0
enabled=1
EOF
# yum clean all
# yum upgrade
# yum makecache
# yum install python-openstackclient openstack-utils -y
安装openstackclient 如果使用selinux 的话则安装selinux
# yum -y install openstack-selinux
Mariadb
数据库
安装
# yum install mariadb mariadb-server -y
# mv /etc/my.cnf /etc/my.cnf.bak
配置
vim /etc/my.cnf
[mysqld]
bind-address = controller
default-storage-engine = innodb
innodb_file_per_table = on
max_connections = 4096
collation-server = utf8_general_ci
character-set-server = utf8
启动和自启
# systemctl start mariadb
# systemctl enable mariadb
RabbitMQ
消息队列服务
安装
# yum install -y epel-release
# yum install -y rabbitmq-server
启动并设置自启
# systemctl start rabbitmq-server
# systemctl enable rabbitmq-server
rabbitmqctl cluster_status
[root@openstack ~]# rabbitmqctl cluster_status
Cluster status of node rabbit@openstack
[{nodes,[{disc,[rabbit@openstack]}]},
{running_nodes,[rabbit@openstack]},
{cluster_name,<<"rabbit@openstack">>},
{partitions,[]},
{alarms,[{rabbit@openstack,[]}]}]
用户添加
添加OpenStack用户密码为RABBIT_PASS
[root@openstack ~]# rabbitmqctl add_user openstack RABBIT_PASS
Creating user "openstack"
授权
设置新建账号的状态
[root@openstack ~]# rabbitmqctl set_user_tags openstack administrator
Setting tags for user "openstack" to [administrator]
设置新账号权限
[root@openstack ~]# rabbitmqctl set_permissions openstack ".*" ".*" ".*"
Setting permissions for user "openstack" in vhost "/"
查看账号
[root@openstack ~]# rabbitmqctl list_users
Listing users
openstack [administrator]
guest [administrator]
[root@openstack ~]#
web插件
安装web管理插件
# rabbitmq-plugins enable rabbitmq_management
访问http://127.0.0.1:15672
memcached
数据缓存服务
安装
# yum install memcached python-memcached -y
配置
# sed -i 's/\(OPTIONS=\).*/\1"-l 0.0.0.0\"/' /etc/sysconfig/memcached
PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="64"
OPTIONS="-l 0.0.0.0"
启动以及自启
# systemctl start memcached
# systemctl enable memcached
Etcd
键值存储,用语分布式秘钥锁定,存储配置,跟踪服务实时性
安装
yum install etcd -y
配置
mv /etc/etcd/etcd.conf /etc/etcd/etcd.conf.bak
vim /etc/etcd/etcd.conf
#[Member]
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="http://192.168.50.10:2380"
ETCD_LISTEN_CLIENT_URLS="http://192.168.50.10:2379"
ETCD_NAME="controller"
#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="http://192.168.50.10:2380"
ETCD_ADVERTISE_CLIENT_URLS="http://192.168.50.10:2379"
ETCD_INITIAL_CLUSTER="controller=http://192.168.50.10:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster-01"
ETCD_INITIAL_CLUSTER_STATE="new"
启动和自启
# systemctl start etcd
# systemctl enable etcd
认证keyston服务
OpenStack认证服务提供单一的集成点，用于管理身份验证、授权和服务目录。
认证服务通常是用户与之交互的第一个服务。一旦经过身份验证，最终用户可以使用其身份来访问其他OpenStack服务
数据库授权
# mysql -e "CREATE DATABASE keystone;"
# mysql -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'ks_dbpass';"
# mysql -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'ks_dbpass';"
# mysql -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'controller' IDENTIFIED BY 'ks_dbpass';"
# mysql -e "FLUSH PRIVILEGES;"
安装
# yum install -y openstack-keystone httpd mod_wsgi mod_ssl
配置
mv /etc/keystone/keystone.conf /etc/keystone/keystone.conf.bak
openstack-config --set /etc/keystone/keystone.conf database connection mysql+pymysql://keystone:ks_dbpass@controller/keystone
openstack-config --set /etc/keystone/keystone.conf token provider fernet
openstack-config --set /etc/keystone/keystone.conf cache backend oslo_cache.memcache_pool
openstack-config --set /etc/keystone/keystone.conf cache enabled true
openstack-config --set /etc/keystone/keystone.conf cache memcache_server controller:11211
同步认证服务数据库
# su -s /bin/sh -c "keystone-manage db_sync" keystone
mysql -ukeystone -pks_dbpass -hcontroller keystone -e "show tables;"
+-----------------------------+
| Tables_in_keystone |
+-----------------------------+
| access_token |
| application_credential |
| application_credential_role |
| assignment |
| config_register |
| consumer |
| credential |
| endpoint |
| endpoint_group |
| federated_user |
| federation_protocol |
| group |
| id_mapping |
| identity_provider |
| idp_remote_ids |
| implied_role |
| limit |
| local_user |
| mapping |
| migrate_version |
| nonlocal_user |
| password |
| policy |
| policy_association |
| project |
| project_endpoint |
| project_endpoint_group |
| project_tag |
| region |
| registered_limit |
| request_token |
| revocation_event |
| role |
| sensitive_config |
| service |
| service_provider |
| system_assignment |
| token |
| trust |
| trust_role |
| user |
| user_group_membership |
| user_option |
| whitelisted_config |
+-----------------------------+
初始化fernet秘钥
# su -s /bin/sh -c "keystone-manage db_sync" keystone
# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
服务创建
[root@controller ~]# cat env.sh
export OS_TOKEN=ADMIN_TOKEN
export OS_URL=http://controller:35357/v3
export OS_IDENTITY_API_VERSION=3
[root@controller ~]#
openstack service create --name keystone --description "OpenStack Identity" identity
认证引导
初始化admin用户（管理用户）与密码，3种api端点，服务实体可用区等
# keystone-manage bootstrap --bootstrap-password ADMIN_PASS \
--bootstrap-admin-url http://controller:35357/v3/ \
--bootstrap-internal-url http://controller:5000/v3/ \
--bootstrap-public-url http://controller:5000/v3/ \
--bootstrap-region-id RegionOne
或者
# openstack endpoint create --region RegionOne identity internal http://controller:5000/v3
# openstack endpoint create --region RegionOne identity public http://controller:5000/v3
# openstack endpoint create --region RegionOne identity admin http://controller:35757/v3
创建域、项目、用户、角色，并关联
openstack domain create --description "Default Domain" default && \
openstack project create --domain default --description "Admin Project" admin && \
openstack user create --domain default --password 6dB8o1OMk3BbIkx3 admin && \
openstack role create admin && \
openstack role add --project admin --user admin admin
配置apache
# sed -i "s/#ServerName ${HOSTNAME}/" /etc/httpd/conf/httpd.conf
# sed -i 's/\(ServerName\).*/\1 controller/' /etc/httpd/conf/httpd.conf
# sed -i 's/\(ServerName\).*/\1 controller/' /etc/httpd/conf/httpd.conf
# cp /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/
# vim /etc/httpd/conf.d/wsgi-keystone.conf
Listen 5000
Listen 35357
<VirtualHost *:5000>
WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-public
WSGIScriptAlias / /usr/bin/keystone-wsgi-public
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
LimitRequestBody 114688
<IfVersion >= 2.4>
ErrorLogFormat "%{cu}t %M"
</IfVersion>
ErrorLog /var/log/httpd/keystone.log
CustomLog /var/log/httpd/keystone_access.log combined
<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
Allow from all
</IfVersion>
</Directory>
</VirtualHost>
<VirtualHost *:35357>
WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-admin
WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
LimitRequestBody 114688
<IfVersion >= 2.4>
ErrorLogFormat "%{cu}t %M"
</IfVersion>
ErrorLog /var/log/httpd/keystone.log
CustomLog /var/log/httpd/keystone_access.log combined
<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
Allow from all
</IfVersion>
</Directory>
</VirtualHost>
Alias /identity /usr/bin/keystone-wsgi-public
<Location /identity>
SetHandler wsgi-script
Options +ExecCGI
WSGIProcessGroup keystone-public
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
</Location>
Alias /identity_admin /usr/bin/keystone-wsgi-admin
<Location /identity_admin>
SetHandler wsgi-script
Options +ExecCGI
WSGIProcessGroup keystone-admin
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
</Location>
或者
# sed -i "s/*:5000/controller:5000/g" /etc/httpd/conf.d/wsgi-keystone.conf
# sed -i "s/*:35357/controller:35357/g" /etc/httpd/conf.d/wsgi-keystone.conf
启动和自启
# systemctl start httpd
# systemctl enable httpd
创建 openstack 环境变量脚本
vim admin
export OS_USERNAME=admin
export OS_PASSWORD=ADMIN_PASS
export OS_PROJECT_NAME=admin
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
从安全角度考虑，一般不对client暴露admin-api，这里admin-api与public-api共用1个vip地址
export OS_AUTH_URL=http://controller:35357/v3
验证
[root@openstack ~]# source admin
[root@openstack ~]# openstack token issue
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires | 2021-07-07T11:17:08+0000 |
| id | gAAAAABg5X8kWPxGogHlQwBYIHbx1RBAsbFaqGcqYps0gi9mvGoqCyBVB6eCSKxQZv5b8l9f716YOEbGLFw8u9PH6ms19WrDwTSc2ZhI1bPJn_xgjnKTBVJA5vTdKq4C6yj2zl7CrXqLpqqFb6rNJYmR3dv3RgMmLuJ6ugLWIulrMr-Jza90fNU |
| project_id | aeff6707b2c14a3bb580d10b0cc8913e |
| user_id | 27983f2d62b24446b52d63b3d4c99765 |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
创建domain, projects, users, 与roles
后面每搭建一个新的服务都需要在keystone中执行四种操作：1.建项目 2.建用户 3.建角色 4.做关联。
后面所有的服务公用一个项目service，都是管理员角色admin
那么后面的服务只需要创建用户，关联角色
domain
[root@openstack ~]# openstack domain create --description "Domain" example
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Domain |
| enabled | True |
| id | 02b73689a69b4b9cb051e775fae4982a |
| name | example |
| tags | [] |
+-------------+----------------------------------+
[root@openstack ~]# openstack domain list
+----------------------------------+---------+---------+--------------------+
| ID | Name | Enabled | Description |
+----------------------------------+---------+---------+--------------------+
| 02b73689a69b4b9cb051e775fae4982a | example | True | Domain |
| default | Default | True | The default domain |
+----------------------------------+---------+---------+--------------------+
[root@openstack ~]#
projects
创建服务项目，此文档使用一个服务项目，其中包含您添加到环境中的每项服务的唯一用户。
[root@openstack ~]# openstack project create --domain default --description "Service Project" service
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Service Project |
| domain_id | default |
| enabled | True |
| id | fcb58e2cecb84feb83b79696c30d15d1 |
| is_domain | False |
| name | service |
| parent_id | default |
| tags | [] |
+-------------+----------------------------------+
[root@openstack ~]#
创建平台demo项目，普通（非管理员）任务应该使用非特权项目和用户。作为示例，这里创建演示项目和用户。创建演示项目：
openstack project create --domain default --description "Demo Project" demo
Users
user属于某个domain
创建demo用户 (密码：demo)
openstack user create --domain default --password-prompt demo(密码隐藏)
openstack user create --domain default --password demo demo
roles
创建用户角色(区别于admin用户)：
openstack role create user
权限
将用户角色添加到demo项目和用户：
openstack role add --project demo --user demo user
验证
[root@openstack ~]# openstack user list --long
+----------------------------------+-------+---------+---------+-------------+-------+---------+
| ID | Name | Project | Domain | Description | Email | Enabled |
+----------------------------------+-------+---------+---------+-------------+-------+---------+
| 27983f2d62b24446b52d63b3d4c99765 | admin | | default | | | True |
+----------------------------------+-------+---------+---------+-------------+-------+---------+
[root@openstack ~]# openstack role list
+----------------------------------+-------+
| ID | Name |
+----------------------------------+-------+
| a3c9cc5c86154c2a827c617abb0a0e85 | admin |
+----------------------------------+-------+
[root@openstack ~]#
[root@openstack ~]# openstack role assignment list
+----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+
| Role | User | Group | Project | Domain | Inherited |
+----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+
| a3c9cc5c86154c2a827c617abb0a0e85 | 27983f2d62b24446b52d63b3d4c99765 | | aeff6707b2c14a3bb580d10b0cc8913e | | False |
| a3c9cc5c86154c2a827c617abb0a0e85 | 27983f2d62b24446b52d63b3d4c99765 | | | | False |
+----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+
[root@openstack ~]#
镜像Glance服务
控制节点上安装和配置镜像服务- 为了简单起见，该配置将镜像存储在本地文件系统上。
数据库授权
# mysql -e "CREATE DATABASE glance;"
# mysql -e "GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost' IDENTIFIED BY 'gc_dbpass';"
# mysql -e "GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%' IDENTIFIED BY 'gc_dbpass';"
# mysql -e "FLUSH PRIVILEGES;"
安装
# yum install openstack-glance python-glance python-glanceclient -y
# source admin
创建service项目
创建1个project，glance/nova/neutron等服务加入到此project;
此步骤在上面已经创建,次出省略
service项目在”default” domain中
创建glance用户
[root@openstack ~]# openstack user create --domain default --password gc_pass glance
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | aed595d223c846d39352b53fa71db002 |
| name | glance |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
[root@openstack ~]#
glance用户授权
为glance用户赋予admin权限
# openstack role add --project service --user glance admin
创建glance服务实体
服务实体类型”image”
[root@openstack ~]# openstack service create --name glance --description "OpenStack Image" image
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Image |
| enabled | True |
| id | b8929d647a2849e8971d8aa804c02e71 |
| name | glance |
| type | image |
+-------------+----------------------------------+
[root@openstack ~]#
创建glance-api
接受镜像API调用以进行镜像发现，检索和存储。
注意
--region与初始化admin用户时生成的region一致；
api地址统一采用vip，如果public/internal/admin分别使用不同的vip，请注意区分；
服务类型为image
public api
[root@openstack ~]# openstack endpoint create --region RegionOne image public http://controller:9292
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 5002ef695ad8487ca87a14d5321b16fc |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | b8929d647a2849e8971d8aa804c02e71 |
| service_name | glance |
| service_type | image |
| url | http://controller:9292 |
+--------------+----------------------------------+
internal api
[root@openstack ~]# openstack endpoint create --region RegionOne image internal http://controller:9292
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | f2863a9fe04942db965fc503e0311444 |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | b8929d647a2849e8971d8aa804c02e71 |
| service_name | glance |
| service_type | image |
| url | http://controller:9292 |
+--------------+----------------------------------+
[root@openstack ~]#
admin api
[root@openstack ~]# openstack endpoint create --region RegionOne image admin http://controller:9292
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 98b6dd0fed764c6389a0e1248ab86a66 |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | b8929d647a2849e8971d8aa804c02e71 |
| service_name | glance |
| service_type | image |
| url | http://controller:9292 |
+--------------+----------------------------------+
[root@openstack ~]#
配置
glance-api
[root@openstack ~]# egrep -v "^$|^#" /etc/glance/glance-api.conf
[DEFAULT]
[cors]
[database]
[glance_store]
[image_format]
[keystone_authtoken]
[matchmaker_redis]
[oslo_concurrency]
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_messaging_zmq]
[oslo_middleware]
[oslo_policy]
[paste_deploy]
[profiler]
[store_type_location_strategy]
[task]
[taskflow_executor]
[root@openstack ~]# mv /etc/glance/glance-api.conf{,_original}
[root@openstack ~]#
vim /etc/glance/glance-api.conf
注意”bind_host”参数，根据节点修改；
注意glance-api.conf文件的权限：root:glance
[root@openstack ~]# openstack-config --set /etc/glance/glance-api.conf DEFAULT bind_host 192.168.50.10
[root@openstack ~]# openstack-config --set /etc/glance/glance-api.conf database connection mysql+pymysql://glance:gc_dbpass@controller/glance
[root@openstack ~]# openstack-config --set /etc/glance/glance-api.conf glance_store sotre file,http
[root@openstack ~]# openstack-config --set /etc/glance/glance-api.conf glance_store filesystem_store_datadir /data/glance/images/
[root@openstack ~]# openstack-config --set /etc/glance/glance-api.conf keystone_authtoken auth_url http://controller:35357
[root@openstack ~]# openstack-config --set /etc/glance/glance-api.conf keystone_authtoken memcached_servers controller:11211
[root@openstack ~]# openstack-config --set /etc/glance/glance-api.conf keystone_authtoken auth_type password
[root@openstack ~]# openstack-config --set /etc/glance/glance-api.conf keystone_authtoken project_domain_name default
[root@openstack ~]# openstack-config --set /etc/glance/glance-api.conf keystone_authtoken user_domain_name default
[root@openstack ~]# openstack-config --set /etc/glance/glance-api.conf keystone_authtoken project_name service
[root@openstack ~]# openstack-config --set /etc/glance/glance-api.conf keystone_authtoken username glance
[root@openstack ~]# openstack-config --set /etc/glance/glance-api.conf keystone_authtoken password gc_pass
[root@openstack ~]# openstack-config --set /etc/glance/glance-api.conf paste_deploy flavor keystone
[root@openstack ~]# chown -R root.glance /etc/glance/glance-api.conf
创建存储目录并赋予权限
/var/lib/glance/images是默认的存储目录
# mkdir -p /data/glance/images
# chown glance:nobody /data/glance/images
glance-registry
[root@openstack ~]# egrep -v "^$|^#" /etc/glance/glance-registry.conf
[DEFAULT]
[database]
[keystone_authtoken]
[matchmaker_redis]
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_messaging_zmq]
[oslo_policy]
[paste_deploy]
[profiler]
[root@openstack ~]# mv /etc/glance/glance-registry.conf{,_original}
[root@openstack ~]# openstack-config --set /etc/glance/glance-registry.conf DEFAULT bind_host 192.168.50.10
[root@openstack ~]# openstack-config --set /etc/glance/glance-registry.conf database connection mysql+pymysql://glance:gc_dbpass@controller/glance
[root@openstack ~]# openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken auth_url http://controller:35757
[root@openstack ~]# openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken memcache_servers controller:11211
[root@openstack ~]# openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken auth_type password
[root@openstack ~]# openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken project_domain_name default
[root@openstack ~]# openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken user_domain_name default
[root@openstack ~]# openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken project_name service
[root@openstack ~]# openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken username glance
[root@openstack ~]# openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken password gc_pass
[root@openstack ~]# openstack-config --set /etc/glance/glance-registry.conf paste_deploy flavor keystone
同步glance数据库
[root@openstack ~]# su -s /bin/sh -c "glance-manage db_sync" glance
/usr/lib/python2.7/site-packages/oslo_db/sqlalchemy/enginefacade.py:1336: OsloDBDeprecationWarning: EngineFacade is deprecated; please use oslo_db.sqlalchemy.enginefacade
expire_on_commit=expire_on_commit, _conf=conf)
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
INFO [alembic.runtime.migration] Running upgrade -> liberty, liberty initial
INFO [alembic.runtime.migration] Running upgrade liberty -> mitaka01, add index on created_at and updated_at columns of 'images' table
INFO [alembic.runtime.migration] Running upgrade mitaka01 -> mitaka02, update metadef os_nova_server
INFO [alembic.runtime.migration] Running upgrade mitaka02 -> ocata_expand01, add visibility to images
INFO [alembic.runtime.migration] Running upgrade ocata_expand01 -> pike_expand01, empty expand for symmetry with pike_contract01
INFO [alembic.runtime.migration] Running upgrade pike_expand01 -> queens_expand01
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
Upgraded database to: queens_expand01, current revision(s): queens_expand01
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
Database migration is up to date. No migration needed.
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
INFO [alembic.runtime.migration] Running upgrade mitaka02 -> ocata_contract01, remove is_public from images
INFO [alembic.runtime.migration] Running upgrade ocata_contract01 -> pike_contract01, drop glare artifacts tables
INFO [alembic.runtime.migration] Running upgrade pike_contract01 -> queens_contract01
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
Upgraded database to: queens_contract01, current revision(s): queens_contract01
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
Database is synced successfully.
[root@openstack ~]#
启动和自启
[root@openstack ~]# systemctl restart openstack-glance-registry openstack-glance-api
[root@openstack ~]# systemctl enable openstack-glance-registry openstack-glance-api
Created symlink from /etc/systemd/system/multi-user.target.wants/openstack-glance-registry.service to /usr/lib/systemd/system/openstack-glance-registry.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/openstack-glance-api.service to /usr/lib/systemd/system/openstack-glance-api.service.
[root@openstack ~]# systemctl status openstack-glance-registry openstack-glance-api
● openstack-glance-registry.service - OpenStack Image Service (code-named Glance) Registry server
Loaded: loaded (/usr/lib/systemd/system/openstack-glance-registry.service; enabled; vendor preset: disabled)
Active: active (running) since Wed 2021-07-07 19:27:43 CST; 1s ago
Main PID: 78511 (glance-registry)
CGroup: /system.slice/openstack-glance-registry.service
└─78511 /usr/bin/python2 /usr/bin/glance-registry
Jul 07 19:27:45 openstack glance-registry[78511]: /usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py:22: DeprecationWarning: Parameters to load are deprecated. Call ....separately.
Jul 07 19:27:45 openstack glance-registry[78511]: return pkg_resources.EntryPoint.parse("x=" + s).load(False)
Jul 07 19:27:45 openstack glance-registry[78511]: /usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py:22: DeprecationWarning: Parameters to load are deprecated. Call ....separately.
Jul 07 19:27:45 openstack glance-registry[78511]: return pkg_resources.EntryPoint.parse("x=" + s).load(False)
Jul 07 19:27:45 openstack glance-registry[78511]: /usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py:22: DeprecationWarning: Parameters to load are deprecated. Call ....separately.
Jul 07 19:27:45 openstack glance-registry[78511]: return pkg_resources.EntryPoint.parse("x=" + s).load(False)
Jul 07 19:27:45 openstack glance-registry[78511]: /usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py:22: DeprecationWarning: Parameters to load are deprecated. Call ....separately.
Jul 07 19:27:45 openstack glance-registry[78511]: return pkg_resources.EntryPoint.parse("x=" + s).load(False)
Jul 07 19:27:45 openstack glance-registry[78511]: /usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py:22: DeprecationWarning: Parameters to load are deprecated. Call ....separately.
Jul 07 19:27:45 openstack glance-registry[78511]: return pkg_resources.EntryPoint.parse("x=" + s).load(False)
● openstack-glance-api.service - OpenStack Image Service (code-named Glance) API server
Loaded: loaded (/usr/lib/systemd/system/openstack-glance-api.service; enabled; vendor preset: disabled)
Active: active (running) since Wed 2021-07-07 19:27:43 CST; 1s ago
Main PID: 78512 (glance-api)
CGroup: /system.slice/openstack-glance-api.service
└─78512 /usr/bin/python2 /usr/bin/glance-api
Jul 07 19:27:45 openstack glance-api[78512]: /usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py:22: DeprecationWarning: Parameters to load are deprecated. Call .reso... separately.
Jul 07 19:27:45 openstack glance-api[78512]: return pkg_resources.EntryPoint.parse("x=" + s).load(False)
Jul 07 19:27:45 openstack glance-api[78512]: /usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py:22: DeprecationWarning: Parameters to load are deprecated. Call .reso... separately.
Jul 07 19:27:45 openstack glance-api[78512]: return pkg_resources.EntryPoint.parse("x=" + s).load(False)
Jul 07 19:27:45 openstack glance-api[78512]: /usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py:22: DeprecationWarning: Parameters to load are deprecated. Call .reso... separately.
Jul 07 19:27:45 openstack glance-api[78512]: return pkg_resources.EntryPoint.parse("x=" + s).load(False)
Jul 07 19:27:45 openstack glance-api[78512]: /usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py:22: DeprecationWarning: Parameters to load are deprecated. Call .reso... separately.
Jul 07 19:27:45 openstack glance-api[78512]: return pkg_resources.EntryPoint.parse("x=" + s).load(False)
Jul 07 19:27:45 openstack glance-api[78512]: /usr/lib/python2.7/site-packages/paste/deploy/loadwsgi.py:22: DeprecationWarning: Parameters to load are deprecated. Call .reso... separately.
Jul 07 19:27:45 openstack glance-api[78512]: return pkg_resources.EntryPoint.parse("x=" + s).load(False)
Hint: Some lines were ellipsized, use -l to show in full.
[root@openstack ~]#
验证
[root@openstack ~]# wget http://download.cirros-cloud.net/0.4.0/cirros-0.4.0-x86_64-disk.img
[root@openstack ~]# openstack image create "cirros" --file cirros-0.4.0-x86_64-disk.img --disk-format qcow2 --container-format bare --public
+------------------+------------------------------------------------------+
| Field | Value |
+------------------+------------------------------------------------------+
| checksum | 443b7623e27ecf03dc9e01ee93f67afe |
| container_format | bare |
| created_at | 2021-07-07T12:10:03Z |
| disk_format | qcow2 |
| file | /v2/images/b1ae125d-e88d-49db-b40b-08830777bfc3/file |
| id | b1ae125d-e88d-49db-b40b-08830777bfc3 |
| min_disk | 0 |
| min_ram | 0 |
| name | cirros |
| owner | aeff6707b2c14a3bb580d10b0cc8913e |
| protected | False |
| schema | /v2/schemas/image |
| size | 12716032 |
| status | active |
| tags | |
| updated_at | 2021-07-07T12:10:04Z |
| virtual_size | None |
| visibility | public |
+------------------+------------------------------------------------------+
[root@openstack ~]#
[root@openstack ~]# openstack image list
+--------------------------------------+--------+--------+
| ID | Name | Status |
+--------------------------------------+--------+--------+
| b1ae125d-e88d-49db-b40b-08830777bfc3 | cirros | active |
+--------------------------------------+--------+--------+
[root@openstack ~]#
计算服务Nova
数据库授权
[root@openstack ~]# mysql -e "create database nova_api;"
[root@openstack ~]# mysql -e "create database nova;"
[root@openstack ~]# mysql -e "create database nova_cell0;"
[root@openstack ~]# mysql -e "GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'localhost' IDENTIFIED BY 'nv_dbpass';"
[root@openstack ~]# mysql -e "GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'%' IDENTIFIED BY 'nv_dbpass';"
[root@openstack ~]# mysql -e "GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'$IP' IDENTIFIED BY 'nv_dbpass';"
[root@openstack ~]# mysql -e "GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'localhost' IDENTIFIED BY 'nv_dbpass';"
[root@openstack ~]# mysql -e "GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' IDENTIFIED BY 'nv_dbpass';"
[root@openstack ~]# mysql -e "GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'$IP' IDENTIFIED BY 'nv_dbpass';"
[root@openstack ~]# mysql -e "GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'localhost' IDENTIFIED BY 'nv_dbpass';"
[root@openstack ~]# mysql -e "GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'%' IDENTIFIED BY 'nv_dbpass';"
[root@openstack ~]# mysql -e "GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'$IP' IDENTIFIED BY 'nv_dbpass';"
[root@openstack ~]# mysql -e "GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'controller' IDENTIFIED BY 'nv_dbpass';"
[root@openstack ~]# mysql -e "GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'controller' IDENTIFIED BY 'nv_dbpass';"
[root@openstack ~]# mysql -e "GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'controller' IDENTIFIED BY 'nv_dbpass';"
验证
[root@openstack ~]# mysql -unova -pnv_dbpass -e "show databases;"
+--------------------+
| Database |
+--------------------+
| information_schema |
| nova |
| nova_api |
| nova_cell0 |
| test |
+--------------------+
[root@openstack ~]#
创建nova/placement用户
service项目已在glance章节创建；
nova/placement用户在”default” domain中
[root@openstack ~]# openstack user create --domain default --password nova nova
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | a5dc2570b61646c4a160a388120c200e |
| name | nova |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
[root@openstack ~]# openstack user create --domain default --password placement placement
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | f809da9059ce4fbabe1bea2a0e9f609b |
| name | placement |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
[root@openstack ~]#
用户授权
为nova/placement用户授予admin 权限
[root@openstack ~]# openstack role add --project service --user nova admin
[root@openstack ~]#
[root@openstack ~]# openstack role add --project service --user placement admin
[root@openstack ~]#
创建目录并授权
# mkdir /data/nova
# chown -R nova.nobody /data/nova
创建nova服务实体
nova服务实体类型"compute"
placement 服务实体类型为"placement"
[root@openstack ~]# openstack service create --name nova --description "OpenStack Compute" compute
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Compute |
| enabled | True |
| id | 7a699559558e47189caf3cde31f79775 |
| name | nova |
| type | compute |
+-------------+----------------------------------+
[root@openstack ~]#
[root@openstack ~]# openstack service create --name placement --description "Placement API" placement
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Placement API |
| enabled | True |
| id | 62e9ef92c8da477ea0748d9030c5e151 |
| name | placement |
| type | placement |
+-------------+----------------------------------+
[root@openstack ~]#
创建compute API 服务端点
注意--region与初始化admin用户时生成的region一致；
api地址统一采用vip，如果public/internal/admin分别使用不同的vip，请注意区分；
nova-api 服务类型为compute，placement-api服务类型为placement；
public api
[root@openstack ~]# openstack endpoint create --region RegionOne compute public http://controller:8774/v2.1
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 823126df08de42008172ae2c4aa477df |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 7a699559558e47189caf3cde31f79775 |
| service_name | nova |
| service_type | compute |
| url | http://controller:8774/v2.1 |
+--------------+----------------------------------+
[root@openstack ~]# openstack endpoint create --region RegionOne placement public http://controller:8778
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | eb60d94930164aef8bec3941a0973ed2 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 62e9ef92c8da477ea0748d9030c5e151 |
| service_name | placement |
| service_type | placement |
| url | http://controller:8778 |
+--------------+----------------------------------+
[root@openstack ~]#
internal api
[root@openstack ~]# openstack endpoint create --region RegionOne compute internal http://controller:8774/v2.1
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 64a1ed188be0469babb7604cf231af73 |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 7a699559558e47189caf3cde31f79775 |
| service_name | nova |
| service_type | compute |
| url | http://controller:8774/v2.1 |
+--------------+----------------------------------+
[root@openstack ~]# openstack endpoint create --region RegionOne placement internal http://controller:8778
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 48fd73b94c294fe89c63cce763152895 |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 62e9ef92c8da477ea0748d9030c5e151 |
| service_name | placement |
| service_type | placement |
| url | http://controller:8778 |
+--------------+----------------------------------+
[root@openstack ~]#
admin api
[root@openstack ~]# openstack endpoint create --region RegionOne compute admin http://controller:8774/v2.1
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 2501514eff88463da406646dcf49823d |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 7a699559558e47189caf3cde31f79775 |
| service_name | nova |
| service_type | compute |
| url | http://controller:8774/v2.1 |
+--------------+----------------------------------+
[root@openstack ~]# openstack endpoint create --region RegionOne placement admin http://controller:8778
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 421a0b244a48489891f1879e227e746e |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 62e9ef92c8da477ea0748d9030c5e151 |
| service_name | placement |
| service_type | placement |
| url | http://controller:8778 |
+--------------+----------------------------------+
[root@openstack ~]#
安装
# yum install openstack-nova-api \
openstack-nova-conductor \
openstack-nova-console \
openstack-nova-novncproxy \
openstack-nova-scheduler \
openstack-nova-placement-api -y
配置
nova.conf
注意”my_ip”参数，根据节点修改；
注意nova.conf文件的权限：root:nova
[root@openstack ~]# egrep -v '^#|^$' /etc/nova/nova.conf
[DEFAULT]
[api]
[api_database]
[barbican]
[cache]
[cells]
[cinder]
[compute]
[conductor]
[console]
[consoleauth]
[cors]
[crypto]
[database]
[devices]
[ephemeral_storage_encryption]
[filter_scheduler]
[glance]
[guestfs]
[healthcheck]
[hyperv]
[ironic]
[key_manager]
[keystone]
[keystone_authtoken]
[libvirt]
[matchmaker_redis]
[metrics]
[mks]
[neutron]
[notifications]
[osapi_v21]
[oslo_concurrency]
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_messaging_zmq]
[oslo_middleware]
[oslo_policy]
[pci]
[placement]
[quota]
[rdp]
[remote_debug]
[scheduler]
[serial_console]
[service_user]
[spice]
[upgrade_levels]
[vault]
[vendordata_dynamic_auth]
[vmware]
[vnc]
[workarounds]
[wsgi]
[xenserver]
[xvp]
[root@openstack ~]# mv /etc/nova/nova.conf{,_original}
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf DEFAULT my_ip 192.168.50.10
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf DEFAULT vif_plugging_timeout 10
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf DEFAULT vif_plugging_is_fatal False
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf DEFAULT state_path /data/nova
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf DEFAULT instances_path /data/nova/instances
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf DEFAULT use_neutron True
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf DEFAULT firewall_diriver nova.virt.firewall.NoopFirewallDriver
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf DEFAULT enabled_apis osapi_compute,metadata
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf DEFAULT osapi_compute_listen_port 8774
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf DEFAULT osapi_compute_listen \$my_ip
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf DEFAULT metadata_listen \$my_ip
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf DEFAULT metadata_listen_port 8775
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf DEFAULT transport_url rabbit://openstack:RABBIT_PASS@controller
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf API auth_strategy keystone
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf api_database connection mysql+pymysql://nova:nv_dbpass@controller/nova_api
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf cache backend oslo_cache.memcache_pool
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf cache enabled True
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf cache memcache_servers controller:11211
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf database connection mysql+pymysql://nova:nv_dbpass@controller/nova
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf glance api_servers http://controller:9292
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf keystone_authtoken auth_uri http://controller:5000
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf keystone_authtoken auth_url http://controller:35357
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf keystone_authtoken memcached_servers controller:11211
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf keystone_authtoken auth_type password
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf keystone_authtoken project_domain_name default
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf keystone_authtoken user_domain_name default
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf keystone_authtoken project_name service
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf keystone_authtoken username nova
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf keystone_authtoken password nova
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf libvirt virt_type qemu
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf libvirt cpu_mode none
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron url http://controller:9696
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron auth_url http://controller:35357
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron auth_type password
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron project_domain_name default
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron user_domain_name default
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron region_name RegionOne
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron project_name service
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron username neutron
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron password neutron
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron service_metadata_proxy true
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron metadata_proxy_shared_secret METADATA_SECRET
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf oslo_concurrency lock_path /data/nova/tmp
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf placement region_name RegionOne
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf placement project_domain_name Default
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf placement project_name service
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf placement auth_type password
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf placement user_domain_name Default
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf placement auth_url http://controller:35357/v3
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf placement username placement
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf placement password placement
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf scheduler discover_hosts_in_cells_interval 30
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf vnc enabled true
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf vnc server_listen \$my_ip
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf vnc server_proxyclient_address \$my_ip
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf vnc novncproxy_base_url http://\$my_ip:6080/vnc_auto.html
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf vnc novncproxy_host \$my_ip
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf vnc novncproxy_port 6080
placement.conf
egrep -v '^#|^$' /etc/httpd/conf.d/00-nova-placement-api.conf
Listen 8778
<VirtualHost *:8778>
WSGIProcessGroup nova-placement-api
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
WSGIDaemonProcess nova-placement-api processes=3 threads=1 user=nova group=nova
WSGIScriptAlias / /usr/bin/nova-placement-api
<IfVersion >= 2.4>
ErrorLogFormat "%M"
</IfVersion>
ErrorLog /var/log/nova/nova-placement-api.log
#SSLEngine On
#SSLCertificateFile ...
#SSLCertificateKeyFile ...
</VirtualHost>
Alias /nova-placement-api /usr/bin/nova-placement-api
<Location /nova-placement-api>
SetHandler wsgi-script
Options +ExecCGI
WSGIProcessGroup nova-placement-api
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
</Location>
[root@openstack ~]#cp /etc/httpd/conf.d/00-nova-placement-api.conf /etc/httpd/conf.d/00-nova-placement-api.conf.bak
[root@openstack ~]# sed -i "s/*:8778/controller:8778/g" /etc/httpd/conf.d/00-nova-placement-api.conf
[root@openstack ~]# sed -i "s/Listen\ 8778/Listen\ controller:8778/g" /etc/httpd/conf.d/00-nova-placement-api.conf
[root@openstack ~]#
添加配置
#Placement API
<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
Allow from all
</IfVersion>
</Directory>
同步nova相关数据库
# 同步nova-api数据库
[root@openstack ~]# su -s /bin/sh -c "nova-manage api_db sync" nova
# 注册cell0数据库
[root@openstack ~]# su -s /bin/sh -c "nova-manage cell_v2 map_cell0" nova
#创建cell1 cell
[root@openstack ~]# su -s /bin/sh -c "nova-manage cell_v2 create_cell --name=cell1 --verbose" nova
6a16fa6f-5542-411b-ab4e-b42f9bcfc06c
# 同步nova数据库；
[root@openstack ~]# su -s /bin/sh -c "nova-manage db sync" nova
/usr/lib/python2.7/site-packages/pymysql/cursors.py:170: Warning: (1831, u'Duplicate index `block_device_mapping_instance_uuid_virtual_name_device_name_idx`. This is deprecated and will be disallowed in a future release.')
result = self._query(query)
/usr/lib/python2.7/site-packages/pymysql/cursors.py:170: Warning: (1831, u'Duplicate index `uniq_instances0uuid`. This is deprecated and will be disallowed in a future release.')
result = self._query(query
测试
[root@openstack ~]# nova-manage cell_v2 list_cells
+-------+--------------------------------------+------------------------------------+-------------------------------------------------+
| Name | UUID | Transport URL | Database Connection |
+-------+--------------------------------------+------------------------------------+-------------------------------------------------+
| cell0 | 00000000-0000-0000-0000-000000000000 | none:/ | mysql+pymysql://nova:****@controller/nova_cell0 |
| cell1 | 6a16fa6f-5542-411b-ab4e-b42f9bcfc06c | rabbit://openstack:****@controller | mysql+pymysql://nova:****@controller/nova |
+-------+--------------------------------------+------------------------------------+-------------------------------------------------+
[root@openstack ~]#
启动和自启
[root@openstack ~]# systemctl enable openstack-nova-api.service \
openstack-nova-scheduler.service \
openstack-nova-conductor.service
openstack-nova-novncproxy.service
[root@openstack ~]# systemctl restart openstack-nova-api.service \
openstack-nova-consoleauth.service \
openstack-nova-scheduler.service \
openstack-nova-conductor.service \
openstack-nova-novncproxy.service
[root@openstack ~]# systemctl status openstack-nova-api.service \
openstack-nova-consoleauth.service \
openstack-nova-scheduler.service \
openstack-nova-conductor.service \
openstack-nova-novncproxy.service
验证
[root@openstack ~]# openstack compute service list
+----+------------------+-----------+----------+---------+-------+----------------------------+
| ID | Binary | Host | Zone | Status | State | Updated At |
+----+------------------+-----------+----------+---------+-------+----------------------------+
| 1 | nova-conductor | openstack | internal | enabled | up | 2021-07-07T15:43:01.000000 |
| 5 | nova-scheduler | openstack | internal | enabled | up | 2021-07-07T15:43:08.000000 |
| 6 | nova-consoleauth | openstack | internal | enabled | up | 2021-07-07T15:43:08.000000 |
+----+------------------+-----------+----------+---------+-------+----------------------------+
[root@openstack ~]#
[root@openstack ~]# nova-status upgrade check
+--------------------------------------------------------------------+
| Upgrade Check Results |
+--------------------------------------------------------------------+
| Check: Cells v2 |
| Result: Success |
| Details: No host mappings or compute nodes were found. Remember to |
| run command 'nova-manage cell_v2 discover_hosts' when new |
| compute hosts are deployed. |
+--------------------------------------------------------------------+
| Check: Placement API |
| Result: Success |
| Details: None |
+--------------------------------------------------------------------+
| Check: Resource Providers |
| Result: Success |
| Details: There are no compute resource providers in the Placement |
| service nor are there compute nodes in the database. |
| Remember to configure new compute nodes to report into the |
| Placement service. See |
| https://docs.openstack.org/nova/latest/user/placement.html |
| for more details. |
+--------------------------------------------------------------------+
| Check: Ironic Flavor Migration |
| Result: Success |
| Details: None |
+--------------------------------------------------------------------+
| Check: API Service Version |
| Result: Success |
| Details: None |
+--------------------------------------------------------------------+
[root@openstack ~]#
Nova计算节点
# yum install python-openstackclient openstack-utils openstack-selinux -y
# yum install openstack-nova-compute -y
配置
nova.conf
注意nova.conf文件的权限：root:nova}
egrep -v "^$|^#" /etc/nova/nova.conf
配置内容见上文
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf api_database auth_url http://controller:35357
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf api_database connection mysql+pymysql://nova:nv_dbpass@controller/nova_api
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf api_database memcache_servers controller:11211
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf api_database auth_type password
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf api_database project_domain_name default
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf api_database user_domain_name default
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf api_database project_name srevice
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf api_database username nova
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf api_database password nova
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf libvirt virt_type kvm
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf libvirt inject_password true
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf libvirt inject_key true
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf libvirt inject_partition -1
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf libvirt vif_driver nova.virt.libvirt.vif.LibvirtGenericVIFDriver
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf libvirt cpu_mode host-passthrough
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf libvirt hw_machine_type 'x86_64=pc-i440fx-rhel7.2.0'
启动和自启
# systemctl enable libvirtd.service openstack-nova-compute.service
# systemctl restart libvirtd.service openstack-nova-compute.service
# systemctl status libvirtd.service openstack-nova-compute.service
向cell数据库添加计算节点
确认数据库中含有主机
[root@openstack ~]# openstack compute service list --service nova-compute
+----+--------------+-----------+------+---------+-------+----------------------------+
| ID | Binary | Host | Zone | Status | State | Updated At |
+----+--------------+-----------+------+---------+-------+----------------------------+
| 7 | nova-compute | openstack | nova | enabled | up | 2021-07-07T16:45:42.000000 |
+----+--------------+-----------+------+---------+-------+----------------------------+
[root@openstack ~]#
手工发现计算节点主机，即添加到cell数据库
[root@openstack ~]# su -s /bin/sh -c "nova-manage cell_v2 discover_hosts --verbose" nova
Found 2 cell mappings.
Skipping cell0 since it does not contain hosts.
Getting computes from cell 'cell1': 6a16fa6f-5542-411b-ab4e-b42f9bcfc06c
Found 0 unmapped computes in cell: 6a16fa6f-5542-411b-ab4e-b42f9bcfc06c
[root@openstack ~]#
自动发现计算节点
为避免新加入计算节点时，手动执行注册操作”nova-manage cell_v2 discover_hosts”，可设置控制节点定时自动发现主机；
涉及控制节点nova.conf文件的[scheduler]字段；
如下设置自动发现时间为5min，可根据实际环境调节
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf scheduler discover_hosts_in_cells_interval 300重启nova服务，配置生效
# systemctl restart openstack-nova-api.service
# systemctl status openstack-nova-api.service
### 验证
[root@openstack ~]# openstack compute service list
+----+------------------+-----------+----------+---------+-------+----------------------------+
| ID | Binary | Host | Zone | Status | State | Updated At |
+----+------------------+-----------+----------+---------+-------+----------------------------+
| 1 | nova-conductor | openstack | internal | enabled | up | 2021-07-07T18:31:26.000000 |
| 5 | nova-scheduler | openstack | internal | enabled | up | 2021-07-07T18:31:23.000000 |
| 6 | nova-consoleauth | openstack | internal | enabled | up | 2021-07-07T18:31:24.000000 |
| 7 | nova-compute | openstack | nova | enabled | up | 2021-07-07T18:31:24.000000 |
+----+------------------+-----------+----------+---------+-------+----------------------------+
[root@openstack ~]#
Neutron控制网络
数据库授权
# mysql -e "CREATE DATABASE neutron;"
# mysql -e "GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'nt_dbpass';"
# mysql -e "GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'controller' IDENTIFIED BY 'nt_dbpass';"
创建neutron 用户
[root@openstack ~]# openstack user create --domain default --password neutron neutron
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | 250f3d6d35474dd79282ae74556444ed |
| name | neutron |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
[root@openstack ~]#
用户授权
[root@openstack ~]# openstack role add --project service --user neutron admin
创建neutron服务实体
neutron服务实体类型”network”
[root@openstack ~]# openstack service create --name neutron --description "OpenStack Networking" network
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Networking |
| enabled | True |
| id | 93799fa1a27f4a4bb67f276be3b1c7a7 |
| name | neutron |
| type | network |
+-------------+----------------------------------+
[root@openstack ~]#
创建neutron API服务端点
# Public api
[root@openstack ~]# openstack endpoint create --region RegionOne network public http://controller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 499de0b5d6f34d21be230fb5ba658cf2 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 93799fa1a27f4a4bb67f276be3b1c7a7 |
| service_name | neutron |
| service_type | network |
| url | http://controller:9696 |
+--------------+----------------------------------+
# internal api
[root@openstack ~]# openstack endpoint create --region RegionOne network internal http://controller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | f5b1301adbb9403b8e632d805ef18ddb |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 93799fa1a27f4a4bb67f276be3b1c7a7 |
| service_name | neutron |
| service_type | network |
| url | http://controller:9696 |
+--------------+----------------------------------+
# admin api
[root@openstack ~]# openstack endpoint create --region RegionOne network admin http://controller:9696
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 657f3d8868cd4d3da8c85c029d744b95 |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 93799fa1a27f4a4bb67f276be3b1c7a7 |
| service_name | neutron |
| service_type | network |
| url | http://controller:9696 |
+--------------+----------------------------------+
安装neutron
# yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge python-neutronclient ebtables ipset -y
配置
官网地址
参考地址
neutron.conf
[root@openstack ~]# egrep -v '^#|^$' /etc/neutron/neutron.conf
[DEFAULT]
[agent]
[cors]
[database]
[keystone_authtoken]
[matchmaker_redis]
[nova]
[oslo_concurrency]
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_messaging_zmq]
[oslo_middleware]
[oslo_policy]
[quotas]
[ssl]
[root@openstack ~]# mv /etc/neutron/neutron.conf /etc/neutron/neutron.conf{.origin}
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT bind_host 192.168.50.10
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT core_plugin ml2
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT service_plugins router
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT allow_overlapping_ips True
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT transport_url rabbit://openstack:RABBIT_PASS@controller:5672
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT auth_strategy keystone
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_status_changes true
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_data_changes true
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT rpc_response_timeout 180
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf database connection mysql+pymysql://neutron:nt_dbpass@controller/neutron
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_uri http://controller:5000
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_url http://controller:35357
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken memcached_servers controller:11211
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_type password
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_domain_name default
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken user_domain_name default
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_name service
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken username neutron
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken password neutron
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf nova auth_uri http://controller:5000
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf nova auth_url http://controller:35357
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf nova auth_type password
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf nova project_domain_name default
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf nova user_domain_name default
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf nova project_name service
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf nova region_name RegionOne
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf nova username nova
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf nova password nova
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf oslo_concurrency lock_path /data/neutron/tmp
[root@openstack ~]#
m12.conf.ini
[root@openstack ~]# egrep -v '^#|^$' /etc/neutron/plugins/ml2/ml2_conf.ini
[DEFAULT]
[l2pop]
[ml2]
[ml2_type_flat]
[ml2_type_geneve]
[ml2_type_gre]
[ml2_type_vlan]
[ml2_type_vxlan]
[securitygroup]
[root@openstack ~]# mv /etc/neutron/plugins/ml2/ml2_conf.ini{,_original}
[root@openstack ~]#
root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 type_drivers flat,vlan,vxlan
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types vxlan,vlan,flat
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 mechanism_drivers linuxbridge,l2population
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 extension_drivers port_security,qos
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_flat flat_networks provider
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vxlan vni_ranges 1:1000
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vlan network_vlan_ranges vlan:1000:3999
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini securitygroup enable_ipset true
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini securitygroup firewall_driver neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
linuxbridge_agent.ini
[root@openstack ~]# egrep -v '^#|^$' /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[DEFAULT]
[agent]
[linux_bridge]
[network_log]
[securitygroup]
[vxlan]
[root@openstack ~]# mv /etc/neutron/plugins/ml2/linuxbridge_agent.ini{,_original}
[root@openstack ~]#
注意: provider: {{网卡设备名称}}
获取方法: ifconfig查看
或者
ifconfig |egrep '^e' |awk -F ":" '{print $1}' |head -n 1
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini linux_bridge physical_interface_mappings provider:ens33
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan enable_vxlan true
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup enable_security_group true
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup forewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup forewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
开启转发
[root@openstack ~]# echo "net.bridge.bridge-nf-call-iptables=1" >> /etc/sysctl.conf
[root@openstack ~]# echo "net.bridge.bridge-nf-call-ip6tables=1" >> /etc/sysctl.conf
[root@openstack ~]# sysctl -p
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
[root@openstack ~]#
l3_agent
[root@openstack ~]# egrep -v '^#|^$' /etc/neutron/l3_agent.ini
[DEFAULT]
[agent]
[ovs]
[root@openstack ~]# mv /etc/neutron/l3_agent.ini{,original}
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/l3_agent.ini DEFAULT interface_driver linuxbridge
[root@openstack ~]#
dhcp_agent.ini
[root@openstack ~]# egrep -v '^#|^$' /etc/neutron/dhcp_agent.ini
[DEFAULT]
[agent]
[ovs]
[root@openstack ~]# mv /etc/neutron/dhcp_agent.ini{,original}
[root@openstack ~]# openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT interface_driver linuxbridge
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT dhcp_driver neutron.agent.linux.dhcp.Dnsmasq
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT enable_isolated_metadata true
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT enable_metadata_network true
[root@openstack ~]#
metadata_agent.ini
[root@openstack ~]# egrep -v '^#|^$' /etc/neutron/metadata_agent.ini
[DEFAULT]
[agent]
[cache]
[root@openstack ~]# mv /etc/neutron/metadata_agent.ini{,origin}
适当替换METADATA_SECRET
[root@openstack ~]# openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT nova_metadata_host controller
[root@openstack ~]# openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT metadata_proxy_shared_secret METADATA_SECRET
[root@openstack ~]#
nova.conf
计算服务使用此网络
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron url http://controller:9696
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron auth_url http://controller:35357
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron auth_type password
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron project_domain_name default
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron user_domain_name default
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron region_name RegionOne
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron project_name service
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron username neutron
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron password neutron
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron service_metadata_proxy true
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron metadata_proxy_shared_secret METADATA_SECRET
创建ml2插件的软链接
[root@openstack ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
[root@openstack ~]# su -s /bin/sh -c "neutron-db-manage \
--config-file /etc/neutron/neutron.conf \
--config-file /etc/neutron/plugins/ml2/ml2_conf.ini \
upgrade head" neutron
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
Running upgrade for neutron ...
INFO [alembic.runtime.migration] Context impl MySQLImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
INFO [alembic.runtime.migration] Running upgrade -> kilo, kilo_initial
INFO [alembic.runtime.migration] Running upgrade kilo -> 354db87e3225, nsxv_vdr_metadata.py
INFO [alembic.runtime.migration] Running upgrade 354db87e3225 -> 599c6a226151, neutrodb_ipam
INFO [alembic.runtime.migration] Running upgrade 599c6a226151 -> 52c5312f6baf, Initial operations in support of address scopes
INFO [alembic.runtime.migration] Running upgrade 52c5312f6baf -> 313373c0ffee, Flavor framework
INFO [alembic.runtime.migration] Running upgrade 313373c0ffee -> 8675309a5c4f, network_rbac
INFO [alembic.runtime.migration] Running upgrade 8675309a5c4f -> 45f955889773, quota_usage
INFO [alembic.runtime.migration] Running upgrade 45f955889773 -> 26c371498592, subnetpool hash
INFO [alembic.runtime.migration] Running upgrade 26c371498592 -> 1c844d1677f7, add order to dnsnameservers
INFO [alembic.runtime.migration] Running upgrade 1c844d1677f7 -> 1b4c6e320f79, address scope support in subnetpool
INFO [alembic.runtime.migration] Running upgrade 1b4c6e320f79 -> 48153cb5f051, qos db changes
INFO [alembic.runtime.migration] Running upgrade 48153cb5f051 -> 9859ac9c136, quota_reservations
INFO [alembic.runtime.migration] Running upgrade 9859ac9c136 -> 34af2b5c5a59, Add dns_name to Port
INFO [alembic.runtime.migration] Running upgrade 34af2b5c5a59 -> 59cb5b6cf4d, Add availability zone
INFO [alembic.runtime.migration] Running upgrade 59cb5b6cf4d -> 13cfb89f881a, add is_default to subnetpool
INFO [alembic.runtime.migration] Running upgrade 13cfb89f881a -> 32e5974ada25, Add standard attribute table
INFO [alembic.runtime.migration] Running upgrade 32e5974ada25 -> ec7fcfbf72ee, Add network availability zone
INFO [alembic.runtime.migration] Running upgrade ec7fcfbf72ee -> dce3ec7a25c9, Add router availability zone
INFO [alembic.runtime.migration] Running upgrade dce3ec7a25c9 -> c3a73f615e4, Add ip_version to AddressScope
INFO [alembic.runtime.migration] Running upgrade c3a73f615e4 -> 659bf3d90664, Add tables and attributes to support external DNS integration
...
OK
[root@openstack ~]#启动和自启
[root@openstack ~]# systemctl restart openstack-nova-api.service
[root@openstack ~]# systemctl status openstack-nova-api.service
[root@openstack ~]# systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-l3-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-linuxbridge-agent.service to /usr/lib/systemd/system/neutron-linuxbridge-agent.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-l3-agent.service to /usr/lib/systemd/system/neutron-l3-agent.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-dhcp-agent.service to /usr/lib/systemd/system/neutron-dhcp-agent.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-metadata-agent.service to /usr/lib/systemd/system/neutron-metadata-agent.service.
[root@openstack ~]# systemctl restart neutron-server.service neutron-linuxbridge-agent.service neutron-l3-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
[root@openstack ~]# systemctl status neutron-server.service neutron-linuxbridge-agent.service neutron-l3-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
验证
[root@openstack ~]# openstack network agent list
+--------------------------------------+----------------+-----------+-------------------+-------+-------+------------------------+
| ID | Agent Type | Host | Availability Zone | Alive | State | Binary |
+--------------------------------------+----------------+-----------+-------------------+-------+-------+------------------------+
| 41d48185-a927-4e9c-a191-9404f235ef18 | DHCP agent | openstack | nova | :-) | UP | neutron-dhcp-agent |
| 5e4c86a9-3cce-4fb8-ad03-4d571345f51f | Metadata agent | openstack | None | :-) | UP | neutron-metadata-agent |
| 6f1e7a15-f62a-4740-9254-03ed95a896c2 | L3 agent | openstack | nova | :-) | UP | neutron-l3-agent |
+--------------------------------------+----------------+-----------+-------------------+-------+-------+------------------------+
[root@openstack ~]#
[root@openstack ~]# openstack extension list --network
+----------------------------------------------------------------------------------------------+---------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+
| Name | Alias | Description |
+----------------------------------------------------------------------------------------------+---------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+
| Default Subnetpools | default-subnetpools | Provides ability to mark and use a subnetpool as the default. |
| Availability Zone | availability_zone | The availability zone extension. |
| Network Availability Zone | network_availability_zone | Availability zone support for network. |
| Auto Allocated Topology Services | auto-allocated-topology | Auto Allocated Topology Services. |
| Neutron L3 Configurable external gateway mode | ext-gw-mode | Extension of the router abstraction for specifying whether SNAT should occur on the external gateway |
| Port Binding | binding | Expose port bindings of a virtual port to external application |
| agent | agent | The agent management extension. |
| Subnet Allocation | subnet_allocation | Enables allocation of subnets from a subnet pool |
| L3 Agent Scheduler | l3_agent_scheduler | Schedule routers among l3 agents |
| Tag support | tag | Enables to set tag on resources. |
| Neutron external network | external-net | Adds external network attribute to network resource. |
| Tag support for resources with standard attribute: trunk, policy, security_group, floatingip | standard-attr-tag | Enables to set tag on resources with standard attribute. |
| Neutron Service Flavors | flavors | Flavor specification for Neutron advanced services. |
| Network MTU | net-mtu | Provides MTU attribute for a network resource. |
| Network IP Availability | network-ip-availability | Provides IP availability data for each network and subnet. |
| Quota management support | quotas | Expose functions for quotas management per tenant |
| If-Match constraints based on revision_number | revision-if-match | Extension indicating that If-Match based on revision_number is supported. |
| HA Router extension | l3-ha | Adds HA capability to routers.
|
| Provider Network | provider | Expose mapping of virtual networks to physical networks
|
| Multi Provider Network | multi-provider | Expose mapping of virtual networks to multiple physical networks
|
| Quota details management support | quota_details | Expose functions for quotas usage statistics per project
|
| Address scope | address-scope | Address scopes extension.
|
| Neutron Extra Route | extraroute | Extra routes configuration for L3 router
|
| Network MTU (writable) | net-mtu-writable | Provides a writable MTU attribute for a network resource.
|
| Subnet service types | subnet-service-types | Provides ability to set the subnet service_types field
|
| Resource timestamps | standard-attr-timestamp | Adds created_at and updated_at fields to all Neutron resources that have Neutron standard attributes. |
| Neutron Service Type Management | service-type | API for retrieving service providers for Neutron advanced services
|
| Router Flavor Extension | l3-flavors | Flavor support for routers.
|
| Port Security | port-security | Provides port security
|
| Neutron Extra DHCP options | extra_dhcp_opt | Extra options configuration for DHCP. For example PXE boot options to DHCP clients can be specified (e.g. tftp-server, server-ip-address, bootfile-name) |
| Resource revision numbers | standard-attr-revisions | This extension will display the revision number of neutron resources. |
| Pagination support | pagination | Extension that indicates that pagination is enabled.
|
| Sorting support | sorting | Extension that indicates that sorting is enabled.
|
| security-group | security-group | The security groups extension.
|
| DHCP Agent Scheduler | dhcp_agent_scheduler | Schedule networks among dhcp agents
|
| Router Availability Zone | router_availability_zone | Availability zone support for router.
|
| RBAC Policies | rbac-policies | Allows creation and modification of policies that control tenant access to resources. |
| Tag support for resources: subnet, subnetpool, port, router | tag-ext | Extends tag support to more L2 and L3 resources.
|
| standard-attr-description | standard-attr-description | Extension to add descriptions to standard attributes
|
| IP address substring filtering | ip-substring-filtering | Provides IP address substring filtering when listing ports
|
| Neutron L3 Router | router | Router abstraction for basic L3 forwarding between L2 Neutron networks and access to external networks via a NAT gateway. |
| Allowed Address Pairs | allowed-address-pairs | Provides allowed address pairs
|
| project_id field enabled | project-id | Extension that indicates that project_id field is enabled.
|
| Distributed Virtual Router | dvr | Enables configuration of Distributed Virtual Routers.
|
+----------------------------------------------------------------------------------------------+---------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------+
[root@openstack ~]#
Neutron 计算网络
安装
# yum install openstack-neutron-linuxbridge ebtables ipset -y
配置
neutron.conf
注意neutron.conf文件的权限：root:neutron
[root@openstack ~]# cp /etc/neutron/neutron.conf{,_original}
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT auth_strategy keystone
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf DEFAULT transport_url rabbit://openstack:RABBIT_PASS@controller:5672
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_uri http://controller:5000
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken memcached_servers controller:11211
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_type password
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_domain_name default
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken user_domain_name default
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_name service
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken username neutron
[root@openstack ~]# openstack-config --set /etc/neutron/neutron.conf keystone_authtoken password neutron
linuxbridge_agent.ini
linuxbridge_agent.ini文件的权限：root:neutron
# cp /etc/neutron/plugins/ml2/linuxbridge_agent.ini{,_original}
# egrep -v "^$|^#" /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini linux_bridge physical_interface_mappings vlan:ens33
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini linux_bridge enable_security_group true
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini linux_bridge firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan linux_bridge false
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan local_ip 192.168.50.10
[root@openstack ~]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan l2_population true
[root@openstack ~]#
配置内核参数
“modinfo br_netfilter”查看内核模块信息；
“modprobe br_netfilter”加载内核模块
[root@openstack ~]# echo " \
> net.bridge.bridge-nf-call-iptables = 1
> net.bridge.bridge-nf-call-ip6tables = 1" >> /etc/sysctl.conf
[root@openstack ~]# sysctl -p
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
[root@openstack ~]#
nova.conf
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron url http://controller:9696
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron auth_url http://controller:35357
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron auth_type password
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron project_domain_name default
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron user_domain_name default
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron region_name RegionOne
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron project_name service
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron username neutron
[root@openstack ~]#
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf neutron password neutron
启动服务 (所有compute节点)
nova.conf文件已变更，首先需要重启全部计算节点的nova服务
[root@openstack ~]# systemctl restart openstack-nova-compute.service
[root@openstack ~]#
[root@openstack ~]# systemctl enable neutron-linuxbridge-agent.service
[root@openstack ~]#
[root@openstack ~]# systemctl restart neutron-linuxbridge-agent.service
[root@openstack ~]#
[root@openstack ~]# systemctl status neutron-linuxbridge-agent.service
● neutron-linuxbridge-agent.service - OpenStack Neutron Linux Bridge Agent
Loaded: loaded (/usr/lib/systemd/system/neutron-linuxbridge-agent.service; enabled; vendor preset: disabled)
Active: active (running) since Thu 2021-07-15 11:45:21 CST; 18ms ago
Process: 108388 ExecStartPre=/usr/bin/neutron-enable-bridge-firewall.sh (code=exited, status=0/SUCCESS)
Main PID: 108395 (neutron-linuxbr)
Tasks: 1
CGroup: /system.slice/neutron-linuxbridge-agent.service
└─108395 /usr/bin/python2 /usr/bin/neutron-linuxbridge-agent --config-file /usr/share/neutron/neutron-dist.conf --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins...
Jul 15 11:45:21 openstack systemd[1]: Starting OpenStack Neutron Linux Bridge Agent...
Jul 15 11:45:21 openstack neutron-enable-bridge-firewall.sh[108388]: net.bridge.bridge-nf-call-iptables = 1
Jul 15 11:45:21 openstack neutron-enable-bridge-firewall.sh[108388]: net.bridge.bridge-nf-call-ip6tables = 1
Jul 15 11:45:21 openstack systemd[1]: Started OpenStack Neutron Linux Bridge Agent.
[root@openstack ~]#
[root@openstack ~]# systemctl status openstack-nova-compute.service
● openstack-nova-compute.service - OpenStack Nova Compute Server
Loaded: loaded (/usr/lib/systemd/system/openstack-nova-compute.service; enabled; vendor preset: disabled)
Active: active (running) since Thu 2021-07-15 11:45:21 CST; 3s ago
Main PID: 108312 (nova-compute)
Tasks: 22
CGroup: /system.slice/openstack-nova-compute.service
└─108312 /usr/bin/python2 /usr/bin/nova-compute
Jul 15 11:45:17 openstack systemd[1]: Starting OpenStack Nova Compute Server...
Jul 15 11:45:21 openstack systemd[1]: Started OpenStack Nova Compute Server.
[root@openstack ~]#
验证
查看neutron相关的agent;
或：openstack network agent list --agent-type linux-bridge
[root@openstack ~]# openstack network agent list
+--------------------------------------+--------------------+-----------+-------------------+-------+-------+---------------------------+
| ID | Agent Type | Host | Availability Zone | Alive | State | Binary |
+--------------------------------------+--------------------+-----------+-------------------+-------+-------+---------------------------+
| 41d48185-a927-4e9c-a191-9404f235ef18 | DHCP agent | openstack | nova | :-) | UP | neutron-dhcp-agent |
| 5e4c86a9-3cce-4fb8-ad03-4d571345f51f | Metadata agent | openstack | None | :-) | UP | neutron-metadata-agent |
| 6bb44d77-7eed-4842-930f-d640b0a6d046 | Linux bridge agent | openstack | None | :-) | UP | neutron-linuxbridge-agent |
| 6f1e7a15-f62a-4740-9254-03ed95a896c2 | L3 agent | openstack | nova | :-) | UP | neutron-l3-agent |
+--------------------------------------+--------------------+-----------+-------------------+-------+-------+---------------------------+
[root@openstack ~]#
WebUI服务horizon
安装horizon
# yum -y install openstack-dashboard
配置文件
local_settings
# cp /etc/openstack-dashboard/local_settings{,_original}
# vim /etc/openstack-dashboard/local_settings
38 ALLOWED_HOSTS = ['*', 'localhost']
# 强制使用相应版本的api
64 OPENSTACK_API_VERSIONS = {
65 # "data-processing": 1.1,
66 "identity": 3,
67 "image": 2,
68 "volume": 2,
69 # "compute": 2,
70 }
# 在多域模式运行时开启，登陆时除账号/密码外还需要输入域
75 OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True
# 取消注释
97 OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = 'Default'
# 取消158~163行注释，并使用memcached集群
158 CACHES = {
159 'default': {
160 'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
161 'LOCATION': 'controller01:11211,controller02:11211,controller03:11211',
162 },
163 }
# 注释165~169行
165 #CACHES = {
166 # 'default': {
167 # 'BACKEND': 'django.core.cache.backends.locmem.LocMemCache',
168 # },
169 #}
# 监听地址使用vip；
# keystone认证使用v3；
# 设置通过dashboard创建的用户具有”user”角色权限，”user”角色在keystone章节已创建
188 OPENSTACK_HOST = "controller"
189 OPENSTACK_KEYSTONE_URL = "http://%s:5000/v3" % OPENSTACK_HOST
190 OPENSTACK_KEYSTONE_DEFAULT_ROLE = "admin"
# 修改时区
463 TIME_ZONE = "Asia/Shanghai"
openstack-dashboard.conf
[root@openstack ~]# cp /etc/httpd/conf.d/openstack-dashboard.conf{,_original}
[root@openstack ~]# sed -i '3a WSGIApplicationGroup\ %{GLOBAL}' /etc/httpd/conf.d/openstack-dashboard.conf
[root@openstack ~]#
重启apache
openstack-status 检查所有服务状态
[root@openstack ~]# httpd -t
Syntax OK
[root@openstack ~]# systemctl restart httpd
[root@openstack ~]#
http://controller/dashboard
default
admin
ADMIN_PASS
存储服务cinder
数据库授权
[root@openstack ~]# mysql -uroot -e "create database cinder"
[root@openstack ~]# mysql -uroot -e "GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'192.168.50.10' IDENTIFIED BY 'cinder_pass';"
[root@openstack ~]# mysql -uroot -e "GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'localhost' IDENTIFIED BY 'cinder_pass';"
[root@openstack ~]# mysql -uroot -e "FLUSH PRIVILEGES;"
# 验证
[root@openstack ~]# mysql -ucinder -pcinder_pass -e "show databases;"
+--------------------+
| Database |
+--------------------+
| cinder |
| information_schema |
| test |
+--------------------+
[root@openstack ~]#
服务器注册
[root@openstack ~]# openstack service create --name cinderv2 --description "OpenStack Block Storage" volumev2 && \
> openstack service create --name cinderv3 --description "OpenStack Block Storage" volumev3 && \
> openstack endpoint create --region RegionOne volumev2 public http://controller:8776/v2/%\(project_id\)s && \
> openstack endpoint create --region RegionOne volumev2 internal http://controller:8776/v2/%\(project_id\)s && \
> openstack endpoint create --region RegionOne volumev2 admin http://controller:8776/v2/%\(project_id\)s && \
> openstack endpoint create --region RegionOne volumev3 public http://controller:8776/v3/%\(project_id\)s && \
> openstack endpoint create --region RegionOne volumev3 internal http://controller:8776/v3/%\(project_id\)s && \
> openstack endpoint create --region RegionOne volumev3 admin http://controller:8776/v3/%\(project_id\)s
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Block Storage |
| enabled | True |
| id | 8709e50153174b3f9b70065324d76502 |
| name | cinderv2 |
| type | volumev2 |
+-------------+----------------------------------+
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Block Storage |
| enabled | True |
| id | 89b499419bf9465ab43a2e567b67afda |
| name | cinderv3 |
| type | volumev3 |
+-------------+----------------------------------+
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 69a4a557dadd475ebffab70f9c7ea93f |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 8709e50153174b3f9b70065324d76502 |
| service_name | cinderv2 |
| service_type | volumev2 |
| url | http://k3:8776/v2/%(project_id)s |
+--------------+----------------------------------+
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 527a94c6e05346b79371b069aa3e1696 |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 8709e50153174b3f9b70065324d76502 |
| service_name | cinderv2 |
| service_type | volumev2 |
| url | http://k3:8776/v2/%(project_id)s |
+--------------+----------------------------------+
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 4af30116a725478ab7fb3bfa23f0aa87 |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 8709e50153174b3f9b70065324d76502 |
| service_name | cinderv2 |
| service_type | volumev2 |
| url | http://k3:8776/v2/%(project_id)s |
+--------------+----------------------------------+
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 96869bdd2fa740f5bc96126a2a281157 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 89b499419bf9465ab43a2e567b67afda |
| service_name | cinderv3 |
| service_type | volumev3 |
| url | http://k3:8776/v3/%(project_id)s |
+--------------+----------------------------------+
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 9e22ef5577e9429ba5b2c04c16637eca |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 89b499419bf9465ab43a2e567b67afda |
| service_name | cinderv3 |
| service_type | volumev3 |
| url | http://k3:8776/v3/%(project_id)s |
+--------------+----------------------------------+
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | e80824509edf4c9ab2abbb9f05a558ed |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 89b499419bf9465ab43a2e567b67afda |
| service_name | cinderv3 |
| service_type | volumev3 |
| url | http://k3:8776/v3/%(project_id)s |
+--------------+----------------------------------+
[root@openstack ~]#
创建用户以及授权
[root@openstack ~]# openstack user create --domain default --password cinder_pass cinder
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | 623e6b00aca44da4a3083dc6dddc3439 |
| name | cinder |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
[root@openstack ~]# openstack role add --project service --user cinder admin
[root@openstack ~]#
安装
# yum install openstack-cinder -y
配置
[root@openstack ~]# mv /etc/cinder/cinder.conf /etc/cinder/cinder.conf.bak
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf database connection mysql+pymysql://cinder:cinder_pass@controller/cinder
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf DEFAULT transport_url rabbit://openstack:RABBIT_PASS@controller
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf DEFAULT auth_strategy keystone
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf keystone_authtoken auth_uri http://controller:5000
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf keystone_authtoken auth_url http://controller:5000
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf keystone_authtoken memcached_servers controller:11211
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf keystone_authtoken auth_type password
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf keystone_authtoken project_domain_name default
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf keystone_authtoken user_domain_name default
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf keystone_authtoken project_name service
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf keystone_authtoken username cinder
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf keystone_authtoken password cinder_pass
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf DEFAULT my_ip 192.168.50.10
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf oslo_concurrency lock_path /var/lib/cinder/tmp
[root@openstack ~]#
数据同步
[root@openstack ~]# su -s /bin/sh -c "cinder-manage db sync" cinder
Option "logdir" from group "DEFAULT" is deprecated. Use option "log-dir" from group "DEFAULT".
[root@openstack ~]#
服务启动和自启
[root@openstack ~]# systemctl start openstack-cinder-api && \
> systemctl start openstack-cinder-scheduler && \
> systemctl enable openstack-cinder-api openstack-cinder-scheduler
Created symlink from /etc/systemd/system/multi-user.target.wants/openstack-cinder-api.service to /usr/lib/systemd/system/openstack-cinder-api.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/openstack-cinder-scheduler.service to /usr/lib/systemd/system/openstack-cinder-scheduler.service.
[root@openstack ~]#
配置nova
[root@openstack ~]# openstack-config --set /etc/nova/nova.conf cinder os_region_name RegionOne
[root@openstack ~]#
[root@openstack ~]# systemctl restart openstack-nova-api
[root@openstack ~]#
以NFS作为后端存储
在存储节点上(这里是单节点所以是本机)
[root@openstack ~]# yum -y install nfs-utils rpcbind -y
配置nfs 共享目录(此处以/data/nfs/为例子)
本机热添加了一块20G磁盘/dev/sdb
[root@openstack yum.repos.d]# lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 50G 0 disk
├─sda1 8:1 0 1G 0 part /boot
└─sda2 8:2 0 49G 0 part
├─centos-root 253:0 0 44G 0 lvm /
└─centos-swap 253:1 0 5G 0 lvm [SWAP]
sdb 8:16 0 20G 0 disk
sr0 11:0 1 1G 0 rom
[root@openstack yum.repos.d]#
初始化并制作文件系统,方便测试这里直接使用mkfs
[root@openstack ~]# mkfs.ext4 /dev/sdb
mke2fs 1.42.9 (28-Dec-2013)
/dev/sdb is entire device, not just one partition!
Proceed anyway? (y,n) y
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
1310720 inodes, 5242880 blocks
262144 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=2153775104
160 block groups
32768 blocks per group, 32768 fragments per group
8192 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000
Allocating group tables: done
Writing inode tables: done
Creating journal (32768 blocks):
done
Writing superblocks and filesystem accounting information: done
[root@openstack ~]#
挂载
[root@openstack ~]# mount /dev/sdb /data/nfs/
[root@openstack ~]# df -hT
Filesystem Type Size Used Avail Use% Mounted on
devtmpfs devtmpfs 3.8G 0 3.8G 0% /dev
tmpfs tmpfs 3.9G 0 3.9G 0% /dev/shm
tmpfs tmpfs 3.9G 28M 3.8G 1% /run
tmpfs tmpfs 3.9G 0 3.9G 0% /sys/fs/cgroup
/dev/mapper/centos-root xfs 44G 3.7G 41G 9% /
/dev/sda1 xfs 1014M 228M 787M 23% /boot
tmpfs tmpfs 781M 0 781M 0% /run/user/0
/dev/sdb ext4 20G 45M 19G 1% /data/nfs
[root@openstack ~]#
[root@openstack ~]# cat /etc/exports
/data/nfs *(rw,no_root_squash)
[root@openstack ~]# systemctl restart nfs
[root@openstack ~]# systemctl restart rpcbind
[root@openstack ~]# showmount -e 127.0.0.1
Export list for 127.0.0.1:
/data/nfs *
[root@openstack ~]#
配置cinder
找到NFS 的驱动
[root@openstack drivers]# cd /usr/lib/python2.7/site-packages/cinder/volume/drivers/
[root@openstack drivers]# grep Nfs nfs.py
class NfsDriver(remotefs.RemoteFSSnapDriverDistributed):
super(NfsDriver, self).__init__(*args, **kwargs)
LOG.debug('NfsDriver: conn_info: %s', conn_info)
super(NfsDriver, self).do_setup(context)
raise exception.NfsException(msg)
raise exception.NfsException(msg)
raise exception.NfsException(msg)
raise exception.NfsException(six.text_type(e))
raise exception.NfsNoSharesMounted()
raise exception.NfsNoSuitableShareFound(
raise exception.NfsNoSharesMounted()
super(NfsDriver, self)._update_volume_stats()
return super(NfsDriver, self).create_volume(volume)
return super(NfsDriver, self)._qemu_img_info_base(
[root@openstack drivers]#
# 这里Class定义的类 就是NFS 的驱动名字配置cinder
[root@openstack drivers]# openstack-config --set /etc/cinder/cinder.conf DEFAULT enabled_backends nfs
[root@openstack drivers]# openstack-config --set /etc/cinder/cinder.conf nfs volume_driver cinder.volume.drivers.nfs.NfsDriver
[root@openstack drivers]# openstack-config --set /etc/cinder/cinder.conf nfs nfs_shares_config /etc/cinder/nfs_shares
[root@openstack drivers]# openstack-config --set /etc/cinder/cinder.conf nfs nfs_mount_point_base \$state_path/mnt
[root@openstack drivers]#
创建nfs配置文件
[root@openstack drivers]# vim /etc/cinder/nfs_shares
[root@openstack drivers]# chown root:cinder /etc/cinder/nfs_shares
[root@openstack drivers]# chmod 640 /etc/cinder/nfs_shares
[root@openstack drivers]# ll /etc/cinder/nfs_shares
-rw-r----- 1 root cinder 24 Jul 15 15:35 /etc/cinder/nfs_shares
[root@openstack drivers]# cat /etc/cinder/nfs_shares
192.168.50.10:/data/nfs
[root@openstack drivers]#
重启服务
[root@openstack drivers]# systemctl restart openstack-cinder-volume
检测是否注册成功的cinder服务
[root@openstack ~]# openstack volume service list
+------------------+---------------+------+---------+-------+----------------------------+
| Binary | Host | Zone | Status | State | Updated At |
+------------------+---------------+------+---------+-------+----------------------------+
| cinder-scheduler | openstack | nova | enabled | up | 2021-07-15T08:14:07.000000 |
| cinder-volume | openstack@nfs | nova | enabled | down | 2021-07-15T07:36:56.000000 |
+------------------+---------------+------+---------+-------+----------------------------+
[root@openstack ~]#
创建NFS类型，然后与 openstack@nfs 进行绑定
[root@openstack ~]# cinder type-create NFS
+--------------------------------------+------+-------------+-----------+
| ID | Name | Description | Is_Public |
+--------------------------------------+------+-------------+-----------+
| 891a2f49-82ce-410e-a5e9-99974d250aba | NFS | - | True |
+--------------------------------------+------+-------------+-----------+
[root@openstack ~]#
# 如果又使用LVM又使用NFS的话，那么也创建下接口
[root@openstack ~]# cinder type-create ISCSI
+--------------------------------------+-------+-------------+-----------+
| ID | Name | Description | Is_Public |
+--------------------------------------+-------+-------------+-----------+
| 22add7a6-c849-4ce7-befa-ab1aaa76cc61 | ISCSI | - | True |
+--------------------------------------+-------+-------------+-----------+
[root@openstack ~]#
# 进行绑定，把卷与卷类型进行绑定。
先给NFS volume 节点赋予一个名字
[root@openstack ~]# openstack-config --set /etc/cinder/cinder.conf nfs volume_backend_name NFS-Storage
[root@openstack ~]#
进行绑定
[root@openstack ~]# cinder type-key NFS set volume_backend_name=NFS-Storage
[root@openstack ~]#
参数解释：
type-key 后面写的自己定义的一个名字。
volume_backend_name 就是我们在上面volume节点的cinder.conf通过volume_backend_name设置的名字
然后再web 创建卷就可以了
网络配置
找到 ml2 插件的 flat_network 配置
[root@openstack yum.repos.d]# cat /etc/neutron/plugins/ml2/ml2_conf.ini
[ml2]
type_drivers = flat,vlan,vxlan
tenant_network_types = vxlan,vlan,flat
mechanism_drivers = linuxbridge,l2population
extension_drivers = port_security,qos
[ml2_type_flat]
flat_networks = [root@openstack yum.repos.d]# cat /etc/neutron/plugins/ml2/ml2_conf.ini
[ml2]
type_drivers = flat,vlan,vxlan
tenant_network_types = vxlan,vlan,flat
mechanism_drivers = linuxbridge,l2population
extension_drivers = port_security,qos
[ml2_type_flat]
flat_networks = provider
[ml2_type_vxlan]
vni_ranges = 1:1000
[ml2_type_vlan]
network_vlan_ranges = vlan:1000:3999
[securitygroup]
enable_ipset = true
[firewall_driver]
neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver =
[root@openstack yum.repos.d]#
[ml2_type_vxlan]
vni_ranges = 1:1000
[ml2_type_vlan]
network_vlan_ranges = vlan:1000:3999
[securitygroup]
enable_ipset = true
[securitygroup]
enable_ipset = true
firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver =
[root@openstack yum.repos.d]#
找到linux_bridege physical_interface_mappings 配置
[root@openstack yum.repos.d]# openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini linux_bridge physical_interface_mappings provider:ens33
重启服务
[root@openstack ~]# systemctl restart neutron-server.service neutron-linuxbridge-agent.service neutron-l3-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
[root@openstack ~]# systemctl status neutron-server.service neutron-linuxbridge-agent.service neutron-l3-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
创建外部网络
或者使用命令
# neutron --debug net-create public --shared --router:external --provider:physical_network provider --provider:network_type flat
# neutron subnet-create public 192.168.50.0/24 \
--name public --allocation-pool start=192.168.50.2,end=192.168.50.250 \
--dns-nameserver 192.168.50.10 \
--gateway 192.168.50.1 \
--enable-dhcp
[root@openstack ~]# openstack subnet list
+--------------------------------------+--------+--------------------------------------+-----------------+
| ID | Name | Network | Subnet |
+--------------------------------------+--------+--------------------------------------+-----------------+
| 2dabd21e-33e1-4ffe-b034-7d05c3f9c41f | ex-sub | 45fc11d6-3d7c-4d73-b82c-cbe40ebb9619 | 192.168.50.0/24 |
+--------------------------------------+--------+--------------------------------------+-----------------+
[root@openstack ~]#
查看
创建租户网络
或者使用命令
# neutron net-create ex-sub
# neutron subnet-create ex-sub 10.10.11.0/24 \
--name private \
--dns-nameserver 114.114.114.144 \
--gateway 10.10.11.1 \
--allocation-pool start=10.10.11.2,end=10.10.11.254 \
--enable-dhcp
# 参数说明
# --network 指定网络名称，表示该子网用在哪个网段
# --allocation-pool 指定分配的地址池，start设定起始地址，end设置结束地址
# --dns-nameserver 指定域名服务器，可以用8.8.4.4(google),223.5.5.5(阿里云)等等
# --gateway 指定网关，设定宿主机的网关
创建路由器
在此处将两个网络连接起来
或者命令行
# openstack router create router
[root@openstack ~]# openstack router list
+--------------------------------------+------+--------+-------+-------------+-------+----------------------------------+
| ID | Name | Status | State | Distributed | HA | Project |
+--------------------------------------+------+--------+-------+-------------+-------+----------------------------------+
| 987b29df-c170-4ee3-99e3-181f2cedcea5 | test | ACTIVE | UP | False | False | aeff6707b2c14a3bb580d10b0cc8913e |
+--------------------------------------+------+--------+-------+-------------+-------+----------------------------------+
[root@openstack ~]#
# neutron router-interface-add router private
# neutron router-gateway-set router public
类型创建
# openstack flavor create --id 1 --vcpus 1 --ram 512 --disk 1 t1 && \
openstack flavor create --id 2 --vcpus 1 --ram 1024 --disk 2 t2 && \
openstack flavor create --id 3 --vcpus 1 --ram 1024 --disk 40 t3 && \
openstack flavor create --id 4 --vcpus 1 --ram 4096 --disk 40 t4
[root@openstack ~]# openstack flavor list
+----+------+------+------+-----------+-------+-----------+
| ID | Name | RAM | Disk | Ephemeral | VCPUs | Is Public |
+----+------+------+------+-----------+-------+-----------+
| 1 | t1 | 512 | 1 | 0 | 1 | True |
| 2 | t2 | 1024 | 2 | 0 | 1 | True |
| 3 | t3 | 1024 | 40 | 0 | 1 | True |
| 4 | t4 | 4096 | 40 | 0 | 1 | True |
+----+------+------+------+-----------+-------+-----------+
[root@openstack ~]##
期待你的
分享
点赞
在看
添加博主
微信号｜yfq940-
原文作者：步步运维步步坑；如有侵权，请联系管理员删除。
下一篇：
小白也能学的日志收集系统ELK
请登录后发表评论
登录
全部评论
