资讯详情

深入了解 · 专业解读

OpenStack 1

发布时间：2026/8/27 10:37:55
OpenStack 1 开启一台centos7虚拟机内存4GB1.关闭防火墙selinux时间同步2.修改网卡为eth0vim /boot/grub2/grub.cfg在100行末添加 net.ifnames0重启系统3.添加网卡4.更改为静态ip[rootcontroller ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0[rootcontroller ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth1要删掉多的网卡连接ifcfg-ens325.添加解析[rootcontroller ~]# vim /etc/hosts6.配置yum源上传外部的rpm包因为这个版本已经停用[rootcontroller ~]# tar xf mitaka.tar -C /opt/ [rootcontroller ~]# vim /etc/yum.repos.d/openstack.repo[openstack] namemitaka baseurlfile:///opt/mitaka gpgcheck0更新包yum upgrade更新后要重启安装 OpenStack 客户端# yum install python-openstackclient安装数据库[rootcontroller ~]# yum install mariadb mariadb-server python2-PyMySQL[rootcontroller ~]# vim /etc/my.cnf.d/openstack.cnf[mysqld] bind-address 192.168.150.177 default-storage-engine innodb innodb_file_per_table max_connections 4096 collation-server utf8_general_ci character-set-server utf8[rootcontroller ~]# systemctl enable --now mariadb.service为了保证数据库服务的安全性运行mysql_secure_installation脚本。特别需要说明的是为数据库的root用户设置一个适当的密码。# mysql_secure_installationNoSQL 数据库安装MongoDB包# yum install mongodb-server mongodb编辑文件 /etc/mongod.conf 并完成如下动作配置 bind_ip 使用控制节点管理网卡的IP地址。bind_ip 192.168.150.177默认情况下MongoDB会在/var/lib/mongodb/journal 目录下创建几个 1 GB 大小的日志文件。如果你想将每个日志文件大小减小到128MB并且限制日志文件占用的总空间为512MB配置 smallfiles 的值smallfiles true启动并设置开机自启systemctl enable mongod.service systemctl start mongod.service消息队列yum install rabbitmq-server#设置开机自启 [rootcontroller ~]# systemctl enable rabbitmq-server.service Created symlink from /etc/systemd/system/multi-user.target.wants/rabbitmq-server.service to /usr/lib/systemd/system/rabbitmq-server.service. [rootcontroller ~]# systemctl start rabbitmq-server.service #创建用户 [rootcontroller ~]# rabbitmqctl add_user openstack openstack Creating user openstack ... #配置权限 [rootcontroller ~]# rabbitmqctl set_permissions openstack .* .* .* Setting permissions for user openstack in vhost / ...默认用户密码guestMemcached1.安装yum install memcached python-memcached2.启动Memcached服务并且配置它随机启动。# systemctl enable memcached.service # systemctl start memcached.service[rootcontroller ~]# vim /etc/sysconfig/memcached #修改监听端口认证服务完成下面的步骤以创建数据库用数据库连接客户端以 root 用户连接到数据库服务器$ mysql -u root -p创建 keystone 数据库CREATE DATABASE keystone;对keystone数据库授予恰当的权限GRANT ALL PRIVILEGES ON keystone.* TO keystonelocalhost \ IDENTIFIED BY KEYSTONE_DBPASS; GRANT ALL PRIVILEGES ON keystone.* TO keystone% \ IDENTIFIED BY KEYSTONE_DBPASS;用合适的密码替换 KEYSTONE_DBPASS 。退出数据库客户端。生成一个随机值在初始的配置中作为管理员的令牌。[rootcontroller ~]# openssl rand -hex 10 8cd2ca6933557c8b5bc0安全并配置组件运行以下命令来安装包。# yum install openstack-keystone httpd mod_wsgi编辑文件 /etc/keystone/keystone.conf 并完成如下动作在[DEFAULT]部分定义初始管理令牌的值#使用前面步骤生成的随机数替换ADMIN_TOKEN 值 [DEFAULT] ... admin_token ADMIN_TOKEN [database] ... connection mysqlpymysql://keystone:KEYSTONE_DBPASScontroller/keystone #在[token]部分配置Fernet UUID令牌的提供者。 [token] ... provider fernet初始化身份认证服务的数据库# su -s /bin/sh -c keystone-manage db_sync keystone初始化Fernet keys# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone配置 Apache HTTP 服务器vim /etc/httpd/conf/httpd.conf ServerName controller用下面的内容创建文件 /etc/httpd/conf.d/wsgi-keystone.conf。Listen 5000 Listen 35357 VirtualHost *:5000 WSGIDaemonProcess keystone-public processes5 threads1 userkeystone groupkeystone display-name%{GROUP} WSGIProcessGroup keystone-public WSGIScriptAlias / /usr/bin/keystone-wsgi-public WSGIApplicationGroup %{GLOBAL} WSGIPassAuthorization On ErrorLogFormat %{cu}t %M ErrorLog /var/log/httpd/keystone-error.log CustomLog /var/log/httpd/keystone-access.log combined lt;Directory /usr/bingt; Require all granted lt;/Directorygt; /VirtualHost VirtualHost *:35357 WSGIDaemonProcess keystone-admin processes5 threads1 userkeystone groupkeystone display-name%{GROUP} WSGIProcessGroup keystone-admin WSGIScriptAlias / /usr/bin/keystone-wsgi-admin WSGIApplicationGroup %{GLOBAL} WSGIPassAuthorization On ErrorLogFormat %{cu}t %M ErrorLog /var/log/httpd/keystone-error.log CustomLog /var/log/httpd/keystone-access.log combined lt;Directory /usr/bingt; Require all granted lt;/Directorygt; /VirtualHost配置开机自启systemctl enable --now httpd.service创建服务实体和API端点配置认证令牌$ export OS_TOKENADMIN_TOKEN将ADMIN_TOKEN替换为你在 keystone-install 章节中生成的认证令牌。例如$ export OS_TOKEN294a4c8a8a475f9b9836配置端点URL$ export OS_URLhttp://controller:35357/v3配置认证 API 版本$ export OS_IDENTITY_API_VERSION3在你的 OpenStack 环境中认证服务管理服务目录。服务使用这个目录来决定您的环境中可用的服务。创建服务实体和身份认证服务$ openstack service create \ --name keystone --description OpenStack Identity identity ----------------------------------------------- | Field | Value | ----------------------------------------------- | description | OpenStack Identity | | enabled | True | | id | 4ddaae90388b4ebc9d252ec2252d8d10 | | name | keystone | | type | identity | -----------------------------------------------创建认证服务的 API 端点$ openstack endpoint create --region RegionOne \ identity public http://controller:5000/v3 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | 30fff543e7dc4b7d9a0fb13791b78bf4 | | interface | public | | region | RegionOne | | region_id | RegionOne | | service_id | 8c8c0927262a45ad9066cfe70d46892c | | service_name | keystone | | service_type | identity | | url | http://controller:5000/v3 | ------------------------------------------------ $ openstack endpoint create --region RegionOne identity internal http://controller:5000/v3 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | 57cfa543e7dc4b712c0ab137911bc4fe | | interface | internal | | region | RegionOne | | region_id | RegionOne | | service_id | 6f8de927262ac12f6066cfe70d99ac51 | | service_name | keystone | | service_type | identity | | url | http://controller:5000/v3 | ------------------------------------------------ $ openstack endpoint create --region RegionOne identity admin http://controller:35357/v3 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | 78c3dfa3e7dc44c98ab1b1379122ecb1 | | interface | admin | | region | RegionOne | | region_id | RegionOne | | service_id | 34ab3d27262ac449cba6cfe704dbc11f | | service_name | keystone | | service_type | identity | | url | http://controller:35357/v3 | ------------------------------------------------创建域、项目、用户和角色openstack domain create --description Default Domain default #创建 admin 项目 openstack project create --domain default \ --description Admin Project admin #创建 admin 用户 openstack user create --domain default \ --password admin admin #创建 admin 角色 openstack role create admin #添加admin 角色到 admin 项目和用户上 openstack role add --project admin --user admin admin创建service项目 openstack project create --domain default \ --description Service Project service常规非管理任务应该使用无特权的项目和用户创建demo 项目$ openstack project create --domain default \ --description Demo Project demo ----------------------------------------------- | Field | Value | ----------------------------------------------- | description | Demo Project | | domain_id | e0353a670a9e496da891347c589539e9 | | enabled | True | | id | ed0b60bf607743088218b0a533d5943f | | is_domain | False | | name | demo | | parent_id | None | -----------------------------------------------当为这个项目创建额外用户时不要重复这一步。创建demo 用户$ openstack user create --domain default \ --password demo demo --------------------------------------------- | Field | Value | --------------------------------------------- | domain_id | e0353a670a9e496da891347c589539e9 | | enabled | True | | id | 58126687cbcc4888bfa9ab73a2256f27 | | name | demo | ---------------------------------------------创建 user 角色$ openstack role create user --------------------------------------------- | Field | Value | --------------------------------------------- | domain_id | None | | id | 997ce8d05fc143ac97d83fdfb5998552 | | name | user | ---------------------------------------------添加 user角色到 demo 项目和用户$ openstack role add --project demo --user demo user这个命令执行后没有输出。验证操作因为安全性的原因关闭临时认证令牌机制编辑 /etc/keystone/keystone-paste.ini 文件从[pipeline:public_api][pipeline:admin_api]和[pipeline:api_v3]部分删除admin_token_auth 。重置OS_TOKEN和OS_URL 环境变量$ unset OS_TOKEN OS_URL作为 admin 用户请求认证令牌$ openstack --os-auth-url http://controller:35357/v3 \ --os-project-domain-name default --os-user-domain-name default \ --os-project-name admin --os-username admin token issue Password: ----------------------------------------------------------------------------- | Field | Value | ----------------------------------------------------------------------------- | expires | 2016-02-12T20:14:07.056119Z | | id | gAAAAABWvi7_B8kKQD9wdXac8MoZiQldmjEO643d-e_j-XXq9AmIegIbA7UHGPv | | | atnN21qtOMjCFWX7BReJEQnVOAj3nclRQgAYRsfSU_MrsuWb4EDtnjU7HEpoBb4 | | | o6ozsA_NmFWEpLeKy0uNn_WeKbAhYygrsmQGA49dclHVnz-OMVLiyM9ws | | project_id | 343d245e850143a096806dfaefa9afdc | | user_id | ac3377633149401296f6c0d92d79dc16 | -----------------------------------------------------------------------------这个命令使用admin用户的密码。作为demo 用户请求认证令牌$ openstack --os-auth-url http://controller:5000/v3 \ --os-project-domain-name default --os-user-domain-name default \ --os-project-name demo --os-username demo token issue Password: ----------------------------------------------------------------------------- | Field | Value | ----------------------------------------------------------------------------- | expires | 2016-02-12T20:15:39.014479Z | | id | gAAAAABWvi9bsh7vkiby5BpCCnc-JkbGhm9wH3fabS_cY7uabOubesi-Me6IGWW | | | yQqNegDDZ5jw7grI26vvgy1J5nCVwZ_zFRqPiz_qhbq29mgbQLglbkq6FQvzBRQ | | | JcOzq3uwhzNxszJWmzGC7rJE_H0A_a3UFhqv8M4zMRYSbS2YF0MyFmp_U | | project_id | ed0b60bf607743088218b0a533d5943f | | user_id | 58126687cbcc4888bfa9ab73a2256f27 | -----------------------------------------------------------------------------创建 OpenStack 客户端环境脚本创建脚本创建 admin 和 demo项目和用户创建客户端环境变量脚本。本指南的接下来的部分会引用这些脚本为客户端操作加载合适的的凭证。编辑文件 admin-openrc 并添加如下内容export OS_PROJECT_DOMAIN_NAMEdefault export OS_USER_DOMAIN_NAMEdefault export OS_PROJECT_NAMEadmin export OS_USERNAMEadmin export OS_PASSWORDADMIN_PASS export OS_AUTH_URLhttp://controller:35357/v3 export OS_IDENTITY_API_VERSION3 export OS_IMAGE_API_VERSION2将 ADMIN_PASS 替换为你在认证服务中为 admin 用户选择的密码。编辑文件 demo-openrc 并添加如下内容export OS_PROJECT_DOMAIN_NAMEdefault export OS_USER_DOMAIN_NAMEdefault export OS_PROJECT_NAMEdemo export OS_USERNAMEdemo export OS_PASSWORDDEMO_PASS export OS_AUTH_URLhttp://controller:5000/v3 export OS_IDENTITY_API_VERSION3 export OS_IMAGE_API_VERSION2将 DEMO_PASS 替换为你在认证服务中为 demo 用户选择的密码。给脚本加权限chmod x admin_openrc demo-openrc使用脚本使用特定租户和用户运行客户端你可以在运行之前简单地加载相关客户端脚本。例如1.加载admin-openrc文件来身份认证服务的环境变量位置和admin项目和用户证书source admin-openrc2 请求认证令牌:$ openstack token issue ----------------------------------------------------------------------------- | Field | Value | ----------------------------------------------------------------------------- | expires | 2016-02-12T20:44:35.659723Z | | id | gAAAAABWvjYj-Zjfg8WXFaQnUd1DMYTBVrKw4h3fIagi5NoEmh21U72SrRv2trl | | | JWFYhLi2_uPR31Igf6A8mH2Rw9kv_bxNo1jbLNPLGzW_u5FC7InFqx0yYtTwa1e | | | eq2b0f6-18KZyQhs7F3teAta143kJEWuNEYET-y7u29y0be1_64KYkM7E | | project_id | 343d245e850143a096806dfaefa9afdc | | user_id | ac3377633149401296f6c0d92d79dc16 | -----------------------------------------------------------------------------镜像服务创建数据库mysql -u root -p CREATE DATABASE glance; GRANT ALL PRIVILEGES ON glance.* TO glancelocalhost \ IDENTIFIED BY GLANCE_DBPASS; GRANT ALL PRIVILEGES ON glance.* TO glance% \ IDENTIFIED BY GLANCE_DBPASS; 用一个合适的密码替换 GLANCE_DBPASS。获得 admin 凭证来获取只有管理员能执行的命令的访问权限source admin-openrc创建服务证书#创建用户 openstack user create --domain default --password glance glance #添加 admin 角色到 glance 用户和 service 项目上 openstack role add --project service --user glance admin #创建glance服务实体 openstack service create --name glance \ --description OpenStack Image image创建镜像服务的 API 端点$ openstack endpoint create --region RegionOne \ image public http://controller:9292 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | 340be3625e9b4239a6415d034e98aace | | interface | public | | region | RegionOne | | region_id | RegionOne | | service_id | 8c2c7f1b9b5049ea9e63757b5533e6d2 | | service_name | glance | | service_type | image | | url | http://controller:9292 | ------------------------------------------------ $ openstack endpoint create --region RegionOne image internal http://controller:9292 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | a6e4b153c2ae4c919eccfdbb7dceb5d2 | | interface | internal | | region | RegionOne | | region_id | RegionOne | | service_id | 8c2c7f1b9b5049ea9e63757b5533e6d2 | | service_name | glance | | service_type | image | | url | http://controller:9292 | ------------------------------------------------ $ openstack endpoint create --region RegionOne image admin http://controller:9292 ------------------------------------------------ | Field | Value | ------------------------------------------------ | enabled | True | | id | 0c37ed58103f4300a84ff125a539032d | | interface | admin | | region | RegionOne | | region_id | RegionOne | | service_id | 8c2c7f1b9b5049ea9e63757b5533e6d2 | | service_name | glance | | service_type | image | | url | http://controller:9292 | ------------------------------------------------安全并配置组件yum install openstack-glancevim /etc/glance/glance-api.conf [database] ... connection mysqlpymysql://glance:GLANCE_DBPASScontroller/glance [keystone_authtoken] ... auth_uri http://controller:5000 auth_url http://controller:35357 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username glance password GLANCE_PASS [paste_deploy] ... flavor keystone #将 GLANCE_PASS 替换为你为认证服务中你为 glance 用户选择的密码。 [glance_store] ... stores file,http default_store file filesystem_store_datadir /var/lib/glance/images/vim /etc/glance/glance-registry.conf [database] ... connection mysqlpymysql://glance:GLANCE_DBPASScontroller/glance #将GLANCE_DBPASS 替换为你为镜像服务选择的密码。 [keystone_authtoken] ... auth_uri http://controller:5000 auth_url http://controller:35357 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username glance password GLANCE_PASS [paste_deploy] ... flavor keystone写入镜像服务数据库su -s /bin/sh -c glance-manage db_sync glance启动# systemctl enable openstack-glance-api.service \ openstack-glance-registry.service # systemctl start openstack-glance-api.service \ openstack-glance-registry.service验证操作在控制节点上执行这些命令source admin-openrc #下载源镜像 wget http://download.cirros-cloud.net/0.3.4/cirros-0.3.4-x86_64-disk.img 使用 QCOW2 磁盘格式 bare 容器格式上传镜像到镜像服务并设置公共可见这样所有的项目都可以访问它 openstack image create cirros \ --file cirros-0.3.4-x86_64-disk.img \ --disk-format qcow2 --container-format bare \ --public 确认镜像的上传并验证属性 openstack image list计算服务安装并配置控制节点创建数据库mysql -u root -p CREATE DATABASE nova_api; CREATE DATABASE nova; GRANT ALL PRIVILEGES ON nova_api.* TO novalocalhost \ IDENTIFIED BY NOVA_DBPASS; GRANT ALL PRIVILEGES ON nova_api.* TO nova% \ IDENTIFIED BY NOVA_DBPASS; GRANT ALL PRIVILEGES ON nova.* TO novalocalhost \ IDENTIFIED BY NOVA_DBPASS; GRANT ALL PRIVILEGES ON nova.* TO nova% \ IDENTIFIED BY NOVA_DBPASS; #用合适的密码代替 NOVA_DBPASS。 quitsource admin-openrc创建服务证书#创建 nova 用户密码也为nova openstack user create --domain default \ --password nova nova 给 nova 用户添加 admin 角色 openstack role add --project service --user nova admin 创建 nova 服务实体 openstack service create --name nova \ --description OpenStack Compute compute 创建 Compute 服务 API 端点 openstack endpoint create --region RegionOne \ compute public http://controller:8774/v2.1/%\(tenant_id\)s openstack endpoint create --region RegionOne \ compute internal http://controller:8774/v2.1/%\(tenant_id\)s openstack endpoint create --region RegionOne \ compute admin http://controller:8774/v2.1/%\(tenant_id\)s安全并配置组件安装软件包 yum install openstack-nova-api openstack-nova-conductor \ openstack-nova-console openstack-nova-novncproxy \ openstack-nova-schedulervim /etc/nova/nova.conf [DEFAULT] ... enabled_apis osapi_compute,metadata rpc_backend rabbit auth_strategy keystone my_ip 192.168.150.177 use_neutron True firewall_driver nova.virt.firewall.NoopFirewallDriver [api_database] ... connection mysqlpymysql://nova:NOVA_DBPASScontroller/nova_api [database] ... connection mysqlpymysql://nova:NOVA_DBPASScontroller/nova [oslo_messaging_rabbit] ... rabbit_host controller rabbit_userid openstack rabbit_password RABBIT_PASS [keystone_authtoken] ... auth_uri http://controller:5000 auth_url http://controller:35357 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username nova password nova #身份认证服务中设置的nova 用户的密码 [vnc] ... vncserver_listen $my_ip vncserver_proxyclient_address $my_ip [glance] ... api_servers http://controller:9292 [oslo_concurrency] ... lock_path /var/lib/nova/tmp同步Compute 数据库# su -s /bin/sh -c nova-manage api_db sync nova # su -s /bin/sh -c nova-manage db sync nova启动# systemctl enable --now openstack-nova-api.service \ openstack-nova-consoleauth.service openstack-nova-scheduler.service \ openstack-nova-conductor.service openstack-nova-novncproxy.service安装和配置计算节点新加主机作为计算数据库前面配置与第一台主机一样配置yum源[rootcontroller ~]# cd /etc/yum.repos.d/ [rootcontroller yum.repos.d]# scp openstack.repo compute1:/etc/yum.repos.d/ [rootcontroller opt]# scp -r mitaka/ compute1:/opt/yum install openstack-nova-computevim /etc/nova/nova.conf [DEFAULT] ... rpc_backend rabbit auth_strategy keystone my_ip 192.168.150.178 #计算节点上的管理网络接口的IP 地址 use_neutron True firewall_driver nova.virt.firewall.NoopFirewallDriver #在 “RabbitMQ” 中为 “openstack” 选择的密码替换 “RABBIT_PASS”。 [oslo_messaging_rabbit] ... rabbit_host controller rabbit_userid openstack rabbit_password RABBIT_PASS [keystone_authtoken] ... auth_uri http://controller:5000 auth_url http://controller:35357 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username nova password NOVA_PASS [vnc] ... enabled True vncserver_listen 0.0.0.0 vncserver_proxyclient_address $my_ip novncproxy_base_url http://controller:6080/vnc_auto.html [glance] ... api_servers http://controller:9292 [oslo_concurrency] ... lock_path /var/lib/nova/tmp确定您的计算节点是否支持虚拟机的硬件加速。 $ egrep -c (vmx|svm) /proc/cpuinfo 如果这个命令返回了 one or greater 的值那么你的计算节点支持硬件加速且不需要额外的配置。 如果这个命令返回了 zero 值那么你的计算节点不支持硬件加速。你必须配置 libvirt 来使用 QEMU 去代替 KVM 在 /etc/nova/nova.conf 文件的 [libvirt] 区域做出如下的编辑 [libvirt] ... virt_type qemusystemctl enable --now libvirtd.service openstack-nova-compute.service验证操作

相关新闻