openstack实现私有云的搭建
openstack
私有云搭建
实验环境：rhel7.2
禁用或移除所有自动更新的服务，因为它们会影响到您的 OpenStack 环境。
systemctl stop NetworkManager
systemctl disable NetworkManager
独立节点的配置
1.添加网卡
2.更改配置文件
DEVICE="ens9"
ONBOOT=yes
BOOTPROTO=none3.重启服务
vim /boot/grub2/grub.cfg
在内核引导文件中添加这个net.ifnames=0（99行）就可以添加网卡之后默认显示的是eth*
一、网络时间的同步；
物理机同步其他时间，虚拟机同步物理机时间
[root@foundation39 images]# vim /etc/chrony.conf
7 server 172.25.254.251 iburst
24 allow 172.25/16[root@foundation39 images]# chronyc sources -v
210 Number of sources = 1
.-- Source mode '^' = server, '=' = peer, '#' = local clock.
/ .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| / '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
|| .- xxxx [ yyyy ] +/- zzzz
|| Reachability register (octal) -. | xxxx = adjusted offset,
|| Log2(Polling interval) --. | | yyyy = measured offset,
|| \ | | zzzz = estimated error.
|| | | \
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 172.25.254.251 3 6 7 1 -81us[ +27.0s] +/- 30ms虚拟机同步物理机时间：
[root@open1 yum.repos.d]# vim /etc/chrony.conf
3 server 172.25.39.250 iburst[root@open1 yum.repos.d]# systemctl restart chronyd
[root@open1 yum.repos.d]# chronyc sources -v——同步成功
210 Number of sources = 1
.-- Source mode '^' = server, '=' = peer, '#' = local clock.
/ .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| / '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
|| .- xxxx [ yyyy ] +/- zzzz
|| Reachability register (octal) -. | xxxx = adjusted offset,
|| Log2(Polling interval) --. | | yyyy = measured offset,
|| \ | | zzzz = estimated error.
|| | | \
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 172.25.39.250 4 6 17 32 -1473ns[ -27us] +/- 32ms二、yum源的配置
（将openstack的包放到yum仓库中【/var/www/html】）
[root@open1 yum.repos.d]# vim yum.repo
事先准备好自己所要的包，放到http的默认发布目录下：
[openstack]
name=mitaka
baseurl=http://172.25.39.250/mitaka
gpgcheck=0
enabled=1三、openstack环境的部署
控制节点的部署：
1）openstack包的安装
所有节点上执行这些程序
yum upgrade—在主机上升级包(如果更新了一个新内核，重启主机来使用新内核)
yum install python-openstackclient -y—安装 OpenStack 客户端
2)SQL数据库
大多数 OpenStack 服务使用 SQL 数据库来存储信息。 典型地，数据库运行在控制节点上。
yum install mariadb mariadb-server python2-PyMySQL—安装软件包
创建并编辑 /etc/my.cnf.d/openstack.cnf，然后完成如下动作：
在[mysqld]部分，设置 bind-address值为控制节点的管理网络IP地址以使得其它节点可以通过管理网络访问数据库：
在[mysqld]部分，设置如下键值来启用一起有用的选项和 UTF-8 字符集：
[root@open1 yum.repos.d]# vim /etc/my.cnf.d/openstack.cnf
[mysqld]
bind-address = 172.25.39.1
default-storage-engine = innodb-指定存储引擎
innodb_file_per_table----独立表空间
max_connections = 4096----最大连接数
collation-server = utf8_general_ci
character-set-server = utf8启动数据库服务，并将其配置为开机自启
[root@open1 yum.repos.d]# systemctl enable mariadb.service
Created symlink from /etc/systemd/system/multi-user.target.wants/mariadb.service to /usr/lib/systemd/system/mariadb.service.
[root@open1 yum.repos.d]# systemctl start mariadb.service
初始化：
[root@open1 yum.repos.d]# mysql_secure_installation
NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!
In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.
Enter current password for root (enter for none):
OK, successfully used password, moving on...
Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.
Set root password? [Y/n]
New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
... Success!
By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them. This is intended only for testing, and to make the installation
go a bit smoother. You should remove them before moving into a
production environment.
Remove anonymous users? [Y/n]
... Success!
Normally, root should only be allowed to connect from 'localhost'. This
ensures that someone cannot guess at the root password from the network.
Disallow root login remotely? [Y/n]
... Success!
By default, MariaDB comes with a database named 'test' that anyone can
access. This is also intended only for testing, and should be removed
before moving into a production environment.
Remove test database and access to it? [Y/n]
- Dropping test database...
... Success!
- Removing privileges on test database...
... Success!
Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.
Reload privilege tables now? [Y/n]
... Success!
Cleaning up...
All done! If you've completed all of the above steps, your MariaDB
installation should now be secure.
Thanks for using MariaDB![root@open1 yum.repos.d]# mysql -pwestos
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 10
Server version: 10.1.20-MariaDB MariaDB Server
Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> CREATE DATABASE keystone;（认证服务、先决条件）
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \
-> IDENTIFIED BY 'westos';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'westos';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> CREATE DATABASE nova_api;(计算服务、先决条件)
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> CREATE DATABASE nova;
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'localhost' \
-> IDENTIFIED BY 'westos';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'%' IDENTIFIED BY 'westos';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' IDENTIFIED BY 'westos';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'localhost' IDENTIFIED BY 'westos';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> CREATE DATABASE neutron;（Networking 服务、安装和配置计算节点）
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' \
-> IDENTIFIED BY 'westos';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'westos';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> CREATE DATABASE glance;(Networking 服务、先决条件）
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost' \
-> IDENTIFIED BY 'westos';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%' \
-> IDENTIFIED BY 'westos';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| keystone |
| mysql |
| neutron |
| nova |
| nova_api |
| glance |
| performance_schema |
+--------------------+
7 rows in set (0.00 sec)
MariaDB [(none)]> 3）消息队列
OpenStack 使用 message queue 协调操作和各服务的状态信息。消息队列服务一般运行在控制节点上。OpenStack支持好几种消息队列服务包括 RabbitMQ, Qpid, 和 ZeroMQ。
yum install rabbitmq-server
systemctl enable rabbitmq-server.service
systemctl start rabbitmq-server.service
添加 openstack 用户：
rabbitmqctl add_user openstack westos
给openstack用户配置写和读权限：
rabbitmqctl set_permissions openstack ".*" ".*" ".*"[root@open1 network-scripts]# rabbitmq-plugins enable rabbitmq_management--------管理工具的开启
The following plugins have been enabled:
mochiweb
webmachine
rabbitmq_web_dispatch
amqp_client
rabbitmq_management_agent
rabbitmq_management
Applying plugin configuration to rabbit@open1... started 6 plugins
根据上述显示，与之依赖的也会被打开netstat -antlp（发现15672打开）
tcp 0 0 0.0.0.0:15672 0.0.0.0:* LISTEN 2293/beam
这个时候在浏览器，会出现RabbitMQ界面
http://172.25.39.1:15672/
登陆：用户、密码均为guest
[root@open1 network-scripts]# cat /etc/hosts—一定要解析
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.39.1 open1
172.25.39.2 open2
用户的查看: rabbitmqctl list_users
[root@open1 network-scripts]# rabbitmqctl list_users
Listing users ...
openstack []
guest [administrator]openstack的权限的查看
[root@open1 network-scripts]# rabbitmqctl list_user_permissions openstack
Listing permissions for user "openstack" ...
/ .* .* .*用户的认证
[root@open1 network-scripts]# rabbitmqctl authenticate_user openstack openstack
Authenticating user "openstack" ...
Error: failed to authenticate user "openstack"
[root@open1 network-scripts]# rabbitmqctl authenticate_user openstack westos
Authenticating user "openstack" ...
Success4）memcached
认证服务认证缓存使用Memcached缓存令牌。缓存服务memecached运行在控制节点。
yum install memcached python-memcached
systemctl enable memcached.service
systemctl start memcached.service
[root@open1 network-scripts]# netstat -antlp
tcp 0 0 127.0.0.1:11211 0.0.0.0:* LISTEN 3847/memcached
监听地址的更改：
vim /etc/sysconfig/memcached
1 PORT="11211"
2 USER="memcached"
3 MAXCONN="1024"
4 CACHESIZE="64"
5 OPTIONS="-l 127.0.0.1,::1,172.25.39.1"这个时候就会发现监听了设置ip的主机
[root@open1 network-scripts]# netstat -antlp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:25672 0.0.0.0:* LISTEN 2293/beam
tcp 0 0 172.25.39.1:3306 0.0.0.0:* LISTEN 1024/mysqld
tcp 0 0 172.25.39.1:11211 0.0.0.0:* LISTEN 3890/memcached
tcp 0 0 127.0.0.1:11211 0.0.0.0:* LISTEN 3890/memcached 四、认证服务(提供用户认证和服务目录，服务目录记录了所有云计算的api端口)
OpenStack:term:Identity service为认证管理，授权管理和服务目录服务管理提供单点整合。
身份认证服务提供服务的目录和他们的位置。每个你添加到OpenStack环境中的服务在目录中需要一个 service 实体和一些 API endpoints 。
安全并配置组件
[root@open1 network-scripts]# yum install openstack-keystone httpd mod_wsgi -y
[root@open1 network-scripts]# openssl rand -hex 10---生成admin token
e185f1e79b487c6eb9aa（m版的api默认放到memcache，可以定义过期自动删除的token）[root@open1 conf.d]# vim /etc/keystone/keystone.conf
在[DEFAULT]部分，定义初始管理令牌的值：
3 admin_token = e185f1e79b487c6eb9aa
在[database]部分，配置数据库访问
528 [database]
529 connection = mysql+pymysql://keystone:westos@172.25.39.1/keys tone
在[token]部分，配置Fernet UUID令牌的提供者。
1986 [token]
1987 provider = fernet
初始化身份认证服务的数据库(同步数据库)：
[root@open1 conf.d]# su -s /bin/sh -c "keystone-manage db_sync" keystone
（指定shell，用keystone的身份执行指令：keystone-manage db_sync）验证：
[root@open1 conf.d]# mysql -pwestos
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 4
Server version: 10.1.20-MariaDB MariaDB Server
Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> use keystone;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
MariaDB [keystone]> show tables;
+------------------------+
| Tables_in_keystone |
+------------------------+
| access_token |
| assignment |
| config_register |
| consumer |
| credential |
| domain |
| endpoint |
| endpoint_group |
| federated_user |
| federation_protocol |
| group |
| id_mapping |
| identity_provider |
| idp_remote_ids |
| implied_role |
| local_user |
| mapping |
| migrate_version |
| password |
| policy |
| policy_association |
| project |
| project_endpoint |
| project_endpoint_group |
| region |
| request_token |
| revocation_event |
| role |
| sensitive_config |
| service |
| service_provider |
| token |
| trust |
| trust_role |
| user |
| user_group_membership |
| whitelisted_config |
+------------------------+
37 rows in set (0.00 sec)
MariaDB [keystone]> 初始化Fernet keys：
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone五、配置 Apache HTTP 服务器
[root@open1 keystone]# vim /etc/httpd/conf/httpd.conf
97 ServerName 172.25.39.1:80[root@open1 conf.d]# vim /etc/httpd/conf.d/wsgi-keystone.conf
Listen 5000--------5000是public公共端口
Listen 35357---------管理员端口
<VirtualHost *:5000>
WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-public
WSGIScriptAlias / /usr/bin/keystone-wsgi-public
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
ErrorLogFormat "%{cu}t %M"
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
Require all granted
</Directory>
</VirtualHost>
<VirtualHost *:35357>
WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-admin
WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
ErrorLogFormat "%{cu}t %M"
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
Require all granted
</Directory>
</VirtualHost>systemctl enable httpd.service
systemctl start httpd.service
此时发现端口5000和35357打开
[root@open1 conf.d]# netstat -antlp
tcp6 0 0 :::5000 :::* LISTEN 5682/httpd
tcp6 0 0 :::35357 :::* LISTEN 5682/httpd
六、创建服务实体和API端点
[root@open1 keystone]# head keystone.conf
[DEFAULT]
admin_token = e185f1e79b487c6eb9aa
#
# From keystone
#
# A "shared secret" that can be used to bootstrap Keystone. This "token" does
# not represent a user, and carries no explicit authorization. If set to配置认证令牌：
[root@open1 keystone]# export OS_TOKEN=e185f1e79b487c6eb9aa配置端点URL：
[root@open1 keystone]# export OS_URL=http://172.25.39.1:35357/v3配置认证 API 版本：
[root@open1 keystone]# export OS_IDENTITY_API_VERSION=3创建服务实体和身份认证服务
[root@open1 keystone]# openstack service create \
> --name keystone --description "OpenStack Identity" identity
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Identity |
| enabled | True |
| id | dc180da37ec3499ead33bc46bba8c493 |
| name | keystone |
| type | identity |
+-------------+----------------------------------+
[root@open1 keystone]# openstack service list
+----------------------------------+----------+----------+
| ID | Name | Type |
+----------------------------------+----------+----------+
| dc180da37ec3499ead33bc46bba8c493 | keystone | identity |
+----------------------------------+----------+----------+创建认证服务的 API 端点：
[root@open1 keystone]# openstack endpoint create --region RegionOne \
> identity public http://172.25.39.1:5000/v3
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 9e5fc0e3c7114a23b8dce6bac93cebb7 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | dc180da37ec3499ead33bc46bba8c493 |
| service_name | keystone |
| service_type | identity |
| url | http://172.25.39.1:5000/v3 |
+--------------+----------------------------------+
[root@open1 keystone]# openstack endpoint create --region RegionOne identity internal http://172.25.39.1:5000/v3
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 891cc508dbc14b9c818a5de6e70185b6 |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | dc180da37ec3499ead33bc46bba8c493 |
| service_name | keystone |
| service_type | identity |
| url | http://172.25.39.1:5000/v3 |
+--------------+----------------------------------+
[root@open1 keystone]# openstack endpoint create --region RegionOne \
> identity admin http://172.25.39.1:5000/v3
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 951113d2355848e89d1e3bbcf730e6b3 |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | dc180da37ec3499ead33bc46bba8c493 |
| service_name | keystone |
| service_type | identity |
| url | http://172.25.39.1:5000/v3 |
+--------------+----------------------------------+
[root@open1 keystone]# openstack endpoint list
+----------+----------+--------------+--------------+---------+-----------+------------+
| ID | Region | Service Name | Service Type | Enabled | Interface | URL |
+----------+----------+--------------+--------------+---------+-----------+------------+
| 891cc508 | RegionOn | keystone | identity | True | internal | http://172 |
| dbc14b9c | e | | | | | .25.39.1:5 |
| 818a5de6 | | | | | | 000/v3 |
| e70185b6 | | | | | | |
| 951113d2 | RegionOn | keystone | identity | True | admin | http://172 |
| 355848e8 | e | | | | | .25.39.1:5 |
| 9d1e3bbc | | | | | | 000/v3 |
| f730e6b3 | | | | | | |
| 9e5fc0e3 | RegionOn | keystone | identity | True | public | http://172 |
| c7114a23 | e | | | | | .25.39.1:5 |
| b8dce6ba | | | | | | 000/v3 |
| c93cebb7 | | | | | | |
+----------+----------+--------------+--------------+---------+-----------+------------+如过不慎手残加错，那么使用下述办法删除（如果相同类型名加了多个，那么就要把相同的全部删除）
[root@open1 keystone]# openstack endpoint delete 951113d2355848e89d1e3bbcf730e6b3
[root@open1 keystone]# openstack endpoint list
+------------+-----------+--------------+--------------+---------+-----------+------------+
| ID | Region | Service Name | Service Type | Enabled | Interface | URL |
+------------+-----------+--------------+--------------+---------+-----------+------------+
| 891cc508db | RegionOne | keystone | identity | True | internal | http://172 |
| c14b9c818a | | | | | | .25.39.1:5 |
| 5de6e70185 | | | | | | 000/v3 |
| b6 | | | | | | |
| 9e5fc0e3c7 | RegionOne | keystone | identity | True | public | http://172 |
| 114a23b8dc | | | | | | .25.39.1:5 |
| e6bac93ceb | | | | | | 000/v3 |
| b7 | | | | | | |
+------------+-----------+--------------+--------------+---------+-----------+------------+
[root@open1 keystone]# openstack endpoint create --region RegionOne identity admin http://172.25.39.1:35357/v3
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | ffd8c30bda9a48248a8996e1d5c7df2d |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | dc180da37ec3499ead33bc46bba8c493 |
| service_name | keystone |
| service_type | identity |
| url | http://172.25.39.1:35357/v3 |
+--------------+----------------------------------+七、创建域、项目、用户和角色
创建域default：openstack domain create –description “Default Domain” default
[root@open1 keystone]# openstack domain create --description "Default Domain" default
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Default Domain |
| enabled | True |
| id | a083730276e148f7aeb7e5945a72e313 |
| name | default |
+-------------+----------------------------------+在你的环境中，为进行管理操作，创建管理的项目、用户和角色：
创建 admin 项目：openstack project create –domain default –description “Admin Project” admin
[root@open1 keystone]# openstack project create --domain default \
> --description "Admin Project" admin
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Admin Project |
| domain_id | a083730276e148f7aeb7e5945a72e313 |
| enabled | True |
| id | 1ab2b4aef473437facd40c17255061d8 |
| is_domain | False |
| name | admin |
| parent_id | a083730276e148f7aeb7e5945a72e313 |
+-------------+----------------------------------+创建 admin 用户：openstack user create –domain default –password-prompt admin
也可以使用非交互式openstack user create –domain default –password westos admin
[root@open1 keystone]# openstack user create --domain default \
> --password-prompt admin
User Password:
Repeat User Password:
+-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | a083730276e148f7aeb7e5945a72e313 |
| enabled | True |
| id | d27c9e220e24407dad0d68ef8b5b6dd1 |
| name | admin |
+-----------+----------------------------------+创建 admin 角色:openstack role create admin
[root@open1 keystone]# openstack role create admin
+-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | None |
| id | 3fe8bce6e65346a8a8a3f407b3f7013e |
| name | admin |
+-----------+----------------------------------+
[root@open1 keystone]# openstack role add --project admin --user admin admin-----添加admin角色到 admin 项目和用户上添加你的环境中每个服务包含独有用户的service 项目。
创建service项目：
[root@open1 keystone]# openstack project create --domain default \
> --description "Service Project" service
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Service Project |
| domain_id | a083730276e148f7aeb7e5945a72e313 |
| enabled | True |
| id | 93a2d1312ac6436c9c67f00146f501ae |
| is_domain | False |
| name | service |
| parent_id | a083730276e148f7aeb7e5945a72e313 |
+-------------+----------------------------------+常规（非管理）任务应该使用无特权的项目和用户。
[root@open1 keystone]# openstack project create --domain default \
> --description "Demo Project" demo----创建 demo 项目
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Demo Project |
| domain_id | a083730276e148f7aeb7e5945a72e313 |
| enabled | True |
| id | ecced8c00e8249edb3c5730a8a6a4cd1 |
| is_domain | False |
| name | demo |
| parent_id | a083730276e148f7aeb7e5945a72e313 |
+-------------+----------------------------------+
[root@open1 keystone]# openstack user create --domain default \
> --password-prompt demo0---------创建demo用户
User Password:
Repeat User Password:
+-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | a083730276e148f7aeb7e5945a72e313 |
| enabled | True |
| id | 33a3c544d28c4c3bb8cb1291d224e7b2 |
| name | demo |
+-----------+----------------------------------+
[root@open1 keystone]# openstack role create user----创建 user 角色
+-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | None |
| id | b78b59789c844680b95383239cc84362 |
| name | user |
+-----------+----------------------------------+
[root@open1 keystone]# openstack role add --project demo --user demo user----添加 user角色到demo项目和用户八、验证操作
重置OS_TOKEN和OS_URL 环境变量
[root@open1 keystone]# unset OS_TOKEN OS_URL作为 admin 用户，请求认证令牌：
[root@open1 keystone]# openstack --os-auth-url http://172.25.39.1:35357/v3 \
> --os-project-domain-name default --os-user-domain-name default \
> --os-project-name admin --os-username admin token issue
Password:
+------------+------------------------------------------------------------------------+
| Field | Value |
+------------+------------------------------------------------------------------------+
| expires | 2017-08-15T07:40:50.336000Z |
| id | gAAAAABZkpdyzjLa5a3HO0p3XAEI33VfwR6mTum3WL- |
| | cmlDgwLKMZHH6mAZQPKUXeT7Msl7j7IZKAK6sU5PDD8N- |
| | A8WOgER3GPL1Kk6gZFZJZ3HhMYJ9oJ7bKXB_09hGXpH3Nv_u4duIqw4J5udyaQ7Lp- |
| | 40tswbn8-nh2GlyRcBU4TiSZUGmWE |
| project_id | 1ab2b4aef473437facd40c17255061d8 |
| user_id | d27c9e220e24407dad0d68ef8b5b6dd1 |
+------------+------------------------------------------------------------------------+作为demo用户，请求认证令牌：
[root@open1 keystone]# openstack --os-auth-url http://172.25.39.1:5000/v3 \
> --os-project-domain-name default --os-user-domain-name default \
> --os-project-name demo --os-username demo token issue
Password:
+------------+------------------------------------------------------------------------+
| Field | Value |
+------------+------------------------------------------------------------------------+
| expires | 2017-08-15T07:42:20.192604Z |
| id | gAAAAABZkpfMItDJXBmZegknfJkvPecAy5CWvGqQkJ0DXqhNGzUvIlrYaQysVf6IlzAko1 |
| | N8HVk-PcunGkc36CDdOeKzuL1rQTvpqoU2PcAEoJ6aZG16G680Wa8iGHfCJEMdi_1vE0u_ |
| | Lr9hX7bxbRLf87xrvKnDBhLgQMU31ORf_Jmo5tsT1kI |
| project_id | ecced8c00e8249edb3c5730a8a6a4cd1 |
| user_id | 33a3c544d28c4c3bb8cb1291d224e7b2 |
+------------+------------------------------------------------------------------------九、创建 OpenStack 客户端环境脚本
为了提升客户端操作的效率，OpenStack支持简单的客户端环境变量脚本即OpenRC 文件。
创建admin项目和用户创建客户端环境变量脚本
[root@open1 keystone]# vim admin-openrc
[root@open1 keystone]# cat admin-openrc
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=westos
export OS_AUTH_URL=http://172.25.39.1:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2创建demo项目和用户创建客户端环境变量脚本
[root@open1 keystone]# vim demo-openrc
[root@open1 keystone]# cat demo-openrc
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=westos
export OS_AUTH_URL=http://172.25.39.1:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2[root@open1 keystone]# chmod +x admin-openrc
[root@open1 keystone]# chmod +x demo-openrc
脚本的使用：
加载admin-openrc文件来身份认证服务的环境变量位置和admin项目和用户证书：
[root@open1 keystone]# . admin-openrc
[root@open1 keystone]# source admin-openrc
[root@open1 keystone]# openstack user list
+----------------------------------+-------+
| ID | Name |
+----------------------------------+-------+
| 33a3c544d28c4c3bb8cb1291d224e7b2 | demo |
| d27c9e220e24407dad0d68ef8b5b6dd1 | admin |
+----------------------------------+-------+请求认证令牌:
[root@open1 keystone]# openstack token issue
+------------+---------------------------------------------------+
| Field | Value |
+------------+---------------------------------------------------+
| expires | 2017-08-15T07:56:53.860553Z |
| id | gAAAAABZkps11iyK3hs0KUwHKaSohcrXe2nvS7edn- |
| | NTfFka0PKAF1FlBetXG8wU4QLUERmSVhGJ- |
| | CFdbzkgTv0YlUgdsGjohvUpyv-F9iabWHuzzi3iu-O6S_l5xG |
| | ADfnfcsZaE3zsA_IaRb4nDGvssvQ23f1cx3F11tvNU7c- |
| | xBAFdFrhLRF8 |
| project_id | 1ab2b4aef473437facd40c17255061d8 |
| user_id | d27c9e220e24407dad0d68ef8b5b6dd1 |
+------------+---------------------------------------------------+这个时候使用不同的用户就可以发现权限不同：
[root@open1 keystone]# source demo-openrc
[root@open1 keystone]# openstack user list
You are not authorized to perform the requested action: identity:list_users (HTTP 403) (Request-ID: req-39074f7f-fad3-48b1-9d0e-4a3de732cab2)
[root@open1 keystone]# source admin-openrc
[root@open1 keystone]# openstack user list
+----------------------------------+-------+
| ID | Name |
+----------------------------------+-------+
| 33a3c544d28c4c3bb8cb1291d224e7b2 | demo |
| d27c9e220e24407dad0d68ef8b5b6dd1 | admin |
+----------------------------------+-------+十、安装与配置
安全并配置组件
安装软件包：
[root@open1 ~]# yum install openstack-glance
[root@open1 ~]# vim /etc/glance/glance-api.conf
在 [database] 部分，配置数据库访问：
[database]
connection = mysql+pymysql://glance:[email protected]/glance
在 [keystone_authtoken] 和 [paste_deploy] 部分，配置认证服务访问：
[keystone_authtoken]
auth_uri = http://172.25.39.1:5000
auth_url = http://172.25.39.1:35357
memcached_servers = 172.25.39.1:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = glance
password = westos
[paste_deploy]
flavor = keystone
在 [glance_store] 部分，配置本地文件系统存储和镜像文件位置：
[glance_store]
stores = file,http
default_store = file
filesystem_store_datadir = /var/lib/glance/images/[root@open1 ~]# vim /etc/glance/glance-registry.conf
在[database] 部分，配置数据库访问：
[database]
connection = mysql+pymysql://glance:[email protected]/glance
在 [keystone_authtoken] 和 [paste_deploy] 部分，配置认证服务访问：
[keystone_authtoken]
auth_uri = http://172.25.39.1:5000
auth_url = http://172.25.39.1:35357
memcached_servers = 172.25.39.1:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = glance
password = westos
[paste_deploy]
flavor = keystone写入镜像服务数据库：
[root@open1 ~]# su -s /bin/sh -c “glance-manage db_sync” glance
Option "verbose" from group "DEFAULT" is deprecated for removal. Its value may be silently ignored in the future.
/usr/lib/python2.7/site-packages/oslo_db/sqlalchemy/enginefacade.py:1056: OsloDBDeprecationWarning: EngineFacade is deprecated; please use oslo_db.sqlalchemy.enginefacade
expire_on_commit=expire_on_commit, _conf=conf)
/usr/lib/python2.7/site-packages/pymysql/cursors.py:166: Warning: (1831, u'Duplicate index `ix_image_properties_image_id_name`. This is deprecated and will be disallowed in a future release.')
result = self._query(query)验证：
[root@open1 ~]# mysql -pwestos
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 4
Server version: 10.1.20-MariaDB MariaDB Server
Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| glance |
| information_schema |
| keystone |
| mysql |
| neutron |
| nova |
| nova_api |
| performance_schema |
+--------------------+
8 rows in set (0.00 sec)
MariaDB [(none)]> use glance;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
MariaDB [glance]> show tables;
+----------------------------------+
| Tables_in_glance |
+----------------------------------+
| artifact_blob_locations |
| artifact_blobs |
| artifact_dependencies |
| artifact_properties |
| artifact_tags |
| artifacts |
| image_locations |
| image_members |
| image_properties |
| image_tags |
| images |
| metadef_namespace_resource_types |
| metadef_namespaces |
| metadef_objects |
| metadef_properties |
| metadef_resource_types |
| metadef_tags |
| migrate_version |
| task_info |
| tasks |
+----------------------------------+
20 rows in set (0.00 sec)
MariaDB [glance]> exit
Bye启动镜像服务、配置他们随机启动：
[root@open1 ~]# systemctl enable openstack-glance-api.service \
openstack-glance-registry.service
Created symlink from /etc/systemd/system/multi-user.target.wants/openstack-glance-api.service to /usr/lib/systemd/system/openstack-glance-api.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/openstack-glance-registry.service to /usr/lib/systemd/system/openstack-glance-registry.service.
[root@open1 ~]# systemctl start openstack-glance-api.service \
openstack-glance-registry.service
端口的查看：（9292、9191）
[root@open1 ~]# netstat -antlp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:25672 0.0.0.0:* LISTEN 920/beam
tcp 0 0 172.25.39.1:3306 0.0.0.0:* LISTEN 2233/mysqld
tcp 0 0 172.25.39.1:11211 0.0.0.0:* LISTEN 928/memcached
tcp 0 0 127.0.0.1:11211 0.0.0.0:* LISTEN 928/memcached
tcp 0 0 0.0.0.0:9292 0.0.0.0:* LISTEN 3356/python2
tcp 0 0 0.0.0.0:4369 0.0.0.0:* LISTEN 1/systemd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 919/sshd
tcp 0 0 0.0.0.0:15672 0.0.0.0:* LISTEN 920/beam
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2201/master
tcp 0 0 0.0.0.0:9191 0.0.0.0:* LISTEN 3357/python2
tcp 0 0 127.0.0.1:51219 127.0.0.1:4369 ESTABLISHED 920/beam
tcp 0 0 172.25.39.1:4369 172.25.39.1:52101 TIME_WAIT -
tcp 0 0 127.0.0.1:4369 127.0.0.1:51219 ESTABLISHED 2305/epmd
tcp 0 0 172.25.39.1:22 172.25.39.250:44435 ESTABLISHED 3041/sshd: root@pts
tcp6 0 0 :::5672 :::* LISTEN 920/beam
tcp6 0 0 :::5000 :::* LISTEN 931/httpd
tcp6 0 0 ::1:11211 :::* LISTEN 928/memcached
tcp6 0 0 :::80 :::* LISTEN 931/httpd
tcp6 0 0 :::22 :::* LISTEN 919/sshd
tcp6 0 0 ::1:25 :::* LISTEN 2201/master
tcp6 0 0 :::35357 :::* LISTEN 931/httpd 获得 admin 凭证来获取只有管理员能执行的命令的访问权限：
[root@open1 ~]# cd /etc/keystone/
[root@open1 keystone]# ls
admin-openrc keystone-paste.ini
default_catalog.templates logging.conf
demo-openrc policy.json
fernet-keys sso_callback_template.html
keystone.conf
[root@open1 keystone]# . admin-openrc 要创建服务证书，完成这些步骤：
创建 glance 用户：
[root@open1 keystone]# openstack user create --domain default --password westos glance
+-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | a083730276e148f7aeb7e5945a72e313 |
| enabled | True |
| id | 04d7b60512a14903b7c1b52c47d950d7 |
| name | glance |
+-----------+----------------------------------+
添加 admin 角色到 glance 用户和 service 项目上。
[root@open1 keystone]# openstack role add --project service --user glance admin
创建``glance``服务实体：
[root@open1 keystone]# openstack service create --name glance \
> --description "OpenStack Image" image
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Image |
| enabled | True |
| id | c2ff763f0d984c9ab4d07fef5cd11fb4 |
| name | glance |
| type | image |
+-------------+----------------------------------+
创建镜像服务的 API 端点：
[root@open1 keystone]# openstack endpoint create --region RegionOne \
> image public http://172.25.39.1:9292
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 32e784619964466c90d0f81afeaaa2c5 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | c2ff763f0d984c9ab4d07fef5cd11fb4 |
| service_name | glance |
| service_type | image |
| url | http://172.25.39.1:9292 |
+--------------+----------------------------------+
[root@open1 keystone]# openstack endpoint create --region RegionOne image internal http://172.25.39.1:9292
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | e60c8ea7213a4bc4a2d1312b39b5b433 |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | c2ff763f0d984c9ab4d07fef5cd11fb4 |
| service_name | glance |
| service_type | image |
| url | http://172.25.39.1:9292 |
+--------------+----------------------------------+
[root@open1 keystone]# openstack endpoint create --region RegionOne image admin http://172.25.39.1:9292
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 65111feb6762436389b96cffc30c2b7b |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | c2ff763f0d984c9ab4d07fef5cd11fb4 |
| service_name | glance |
| service_type | image |
| url | http://172.25.39.1:9292 |
+--------------+----------------------------------+
[root@open1 keystone]# cd
[root@open1 ~]# ls
cirros-0.3.4-x86_64-disk.img
[root@open1 ~]# du -sh
13M .
[root@open1 ~]# openstack endpoint list
+----------+----------+--------------+--------------+---------+-----------+----------+
| ID | Region | Service Name | Service Type | Enabled | Interface | URL |
+----------+----------+--------------+--------------+---------+-----------+----------+
| 32e78461 | RegionOn | glance | image | True | public | http://1 |
| 9964466c | e | | | | | 72.25.39 |
| 90d0f81a | | | | | | .1:9292 |
| feaaa2c5 | | | | | | |
| 65111feb | RegionOn | glance | image | True | admin | http://1 |
| 67624363 | e | | | | | 72.25.39 |
| 89b96cff | | | | | | .1:9292 |
| c30c2b7b | | | | | | |
| 891cc508 | RegionOn | keystone | identity | True | internal | http://1 |
| dbc14b9c | e | | | | | 72.25.39 |
| 818a5de6 | | | | | | .1:5000/ |
| e70185b6 | | | | | | v3 |
| 9e5fc0e3 | RegionOn | keystone | identity | True | public | http://1 |
| c7114a23 | e | | | | | 72.25.39 |
| b8dce6ba | | | | | | .1:5000/ |
| c93cebb7 | | | | | | v3 |
| e60c8ea7 | RegionOn | glance | image | True | internal | http://1 |
| 213a4bc4 | e | | | | | 72.25.39 |
| a2d1312b | | | | | | .1:9292 |
| 39b5b433 | | | | | | |
| ffd8c30b | RegionOn | keystone | identity | True | admin | http://1 |
| da9a4824 | e | | | | | 72.25.39 |
| 8a8996e1 | | | | | | .1:35357 |
| d5c7df2d | | | | | | /v3 |
+----------+----------+--------------+--------------+---------+-----------+----------+使用 QCOW2 磁盘格式， bare 容器格式上传镜像到镜像服务并设置公共可见，这样所有的项目都可以访问它：
[root@open1 ~]# openstack image create “cirros” \
–file cirros-0.3.4-x86_64-disk.img \
–disk-format qcow2 –container-format bare \
–public
+------------------+-------------------------------------+
| Field | Value |
+------------------+-------------------------------------+
| checksum | ee1eca47dc88f4879d8a229cc70a07c6 |
| container_format | bare |
| created_at | 2017-08-15T08:32:49Z |
| disk_format | qcow2 |
| file | /v2/images/03b18764-941d-419c-894d- |
| | db3f1f4f73e0/file |
| id | 03b18764-941d-419c-894d- |
| | db3f1f4f73e0 |
| min_disk | 0 |
| min_ram | 0 |
| name | cirros |
| owner | 1ab2b4aef473437facd40c17255061d8 |
| protected | False |
| schema | /v2/schemas/image |
| size | 13287936 |
| status | active |
| tags | |
| updated_at | 2017-08-15T08:32:49Z |
| virtual_size | None |
| visibility | public |
+------------------+-------------------------------------+确认镜像的上传并验证属性：
[root@open1 ~]# openstack image list
+--------------------------------------+--------+--------+
| ID | Name | Status |
+--------------------------------------+--------+--------+
| 03b18764-941d-419c-894d-db3f1f4f73e0 | cirros | active |
+--------------------------------------+--------+--------+
[root@open1 ~]# cd /var/lib/glance/
[root@open1 glance]# ls
images
[root@open1 glance]# cd images/
[root@open1 images]# ls
03b18764-941d-419c-894d-db3f1f4f73e0
[root@open1 images]# du -h
13M .十一、计算服务
【【【安装并配置控制节点】】】——控制节点
获得 admin 凭证来获取只有管理员能执行的命令的访问权限：
[root@open1 ~]# cd /etc/keystone/
[root@open1 keystone]# source admin-openrc
[root@open1 keystone]# . admin-openrc
要创建服务证书
创建 nova 用户：openstack user create --domain default --password westos nova
给 nova 用户添加 admin 角色：openstack role add --project service --user nova admin
创建 nova 服务实体：openstack service create --name nova --description "OpenStack Compute" compute
创建 Compute 服务 API 端点 ：openstack endpoint create --region RegionOne \
compute public http://172.25.39.1:8774/v2.1/%\(tenant_id\)s
openstack endpoint create --region RegionOne \
compute internal http://controller:8774/v2.1/%\(tenant_id\)s
openstack endpoint create --region RegionOne \
compute admin http://controller:8774/v2.1/%\(tenant_id\)s安装并配置组件
yum install openstack-nova-api openstack-nova-conductor openstack-nova-console openstack-nova-novncproxy openstack-nova-scheduler
编辑/etc/nova/nova.conf文件并完成下面的操作：
1 [DEFAULT]
2 enabled_apis = osapi_compute,metadata----只启用计算和元数据API
3 rpc_backend = rabbit
4 auth_strategy = keystone
5 use_neutron = True
6 firewall_driver = nova.virt.firewall.NoopFirewallDriver
（默认情况下，计算服务使用内置的防火墙服务。由于网络服务包含了防火墙服务，你必须使用``nova.virt.firewall.NoopFirewallDriver``防火墙服务来禁用掉计算服务内置的防火墙服务）
配置数据库的连接：
2166 [api_database]
2167 connection = mysql+pymysql://nova:[email protected]/nova_api
3112 [database]
3113 connection = mysql+pymysql://nova:[email protected]/nova
配置 “RabbitMQ” 消息队列访问：
4412 [oslo_messaging_rabbit]
4413 rabbit_host = 172.25.39.1
4414 rabbit_userid = openstack
4415 rabbit_password = westos
配置认证服务访问：
3531 [keystone_authtoken]
3532 auth_uri = http://172.25.39.1:5000
3533 auth_url = http://172.25.39.1:35357
3534 memcached_servers = 172.25.39.1:11211
3535 auth_type = password
3536 project_domain_name = default
3537 user_domain_name = default
3538 project_name = service
3539 username = nova
3540 password = westos
配置VNC代理使用控制节点的管理接口IP地址 ：
5368 [vnc]
5369 vncserver_listen = 172.25.39.1
5370 vncserver_proxyclient_address = 172.25.39.1
配置镜像服务 API 的位置：
3330 [glance]
3331 api_servers = http://172.25.39.1:9292
配置锁路径：
4300 [oslo_concurrency]
4301 lock_path = /var/lib/nova/tmp同步Compute 数据库：
su -s /bin/sh -c "nova-manage api_db sync" nova
su -s /bin/sh -c "nova-manage db sync" nova启动 Compute 服务并将其设置为随系统启动：
# systemctl enable openstack-nova-api.service \
openstack-nova-consoleauth.service openstack-nova-scheduler.service \
openstack-nova-conductor.service openstack-nova-novncproxy.service
# systemctl start openstack-nova-api.service \
openstack-nova-consoleauth.service openstack-nova-scheduler.service \
openstack-nova-conductor.service openstack-nova-novncproxy.service【【【安装和配置计算节点】】】——–计算节点
另一台节点，记得时间同步
安装软件包：
yum install openstack-nova-compute -y
编辑/etc/nova/nova.conf文件并完成下面的操作：
[DEFAULT]
rpc_backend = rabbit
auth_strategy = keystone
my_ip = 172.25.39.1-----配置 my_ip （计算节点上的管理网络接口的IP 地址）《可以不加》
use_neutron = True
firewall_driver = nova.virt.firewall.NoopFirewallDriver
配置RabbitMQ消息队列的连接：
[oslo_messaging_rabbit]
rabbit_host = 172.25.39.1
rabbit_userid = openstack
rabbit_password = westos
配置认证服务访问：
[keystone_authtoken]
auth_uri = http://172.25.39.1:5000
auth_url = http://172.25.39.1:35357
memcached_servers = 172.25.39.1:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = nova
password = westos
启用并配置远程控制台访问：
[vnc]
enabled = True
vncserver_listen = 0.0.0.0
vncserver_proxyclient_address = 172.25.39.2
novncproxy_base_url = http://172.25.39.1:6080/vnc_auto.html
配置镜像服务 API 的位置：
[glance]
api_servers = http://172.25.39.1:9292
配置锁路径：
[oslo_concurrency]
lock_path = /var/lib/nova/tmp
[确定您的计算节点是否支持虚拟机的硬件加速。egrep -c '(vmx|svm)' /proc/cpuinfo]
如果不支持那么就要在文件中编辑如下：
[libvirt]
virt_type = qemu启动计算服务及其依赖，并将其配置为随系统自动启动：
systemctl enable libvirtd.service openstack-nova-compute.service
systemctl start libvirtd.service openstack-nova-compute.service
获得 admin 凭证来获取只有管理员能执行的命令的访问权限：
在这个文件存在的目录下：
. admin-openrc
列出服务组件，以验证是否成功启动并注册了每个进程：
[root@open1 keystone]# openstack compute service list
+----+----------+-------+----------+---------+-------+------------+
| Id | Binary | Host | Zone | Status | State | Updated At |
+----+----------+-------+----------+---------+-------+------------+
| 1 | nova-con | open1 | internal | enabled | up | 2017-08-16 |
| | ductor | | | | | T02:47:08. |
| | | | | | | 000000 |
| 2 | nova-con | open1 | internal | enabled | up | 2017-08-16 |
| | soleauth | | | | | T02:47:08. |
| | | | | | | 000000 |
| 3 | nova-sch | open1 | internal | enabled | up | 2017-08-16 |
| | eduler | | | | | T02:47:08. |
| | | | | | | 000000 |
| 6 | nova- | open2 | nova | enabled | up | 2017-08-16 |
| | compute | | | | | T02:47:10. |
| | | | | | | 000000 |
+----+----------+-------+----------+---------+-------+------------+十二、Networking 服务
【【【安装并配置控制节点】】】
获得 admin 凭证来获取只有管理员能执行的命令的访问权限：
[root@open1 keystone]# . admin-openrc
创建``neutron``用户：
openstack user create --domain default --password westos neutron
添加``admin`` 角色到``neutron`` 用户：
openstack user create --domain default --password westos neutron
创建``neutron``服务实体
openstack service create --name neutron \
--description "OpenStack Networking" network
创建网络服务API端点：
openstack endpoint create --region RegionOne \
network public http://172.25.39.1:9696
openstack endpoint create --region RegionOne \
network internal http://172.25.39.1:9696
openstack endpoint create --region RegionOne \
network admin http://172.25.39.1:9696{公共网络里面}
在controller节点上安装并配置网络组件
安装组件
yum install openstack-neutron openstack-neutron-ml2 \
openstack-neutron-linuxbridge ebtables
配置服务组件
编辑/etc/neutron/neutron.conf
配置数据库访问:
[database]
connection = mysql+pymysql://neutron:[email protected]/neutron
[DEFAULT]
core_plugin = ml2---启用ML2插件并禁用其他插件
service_plugins =
rpc_backend = rabbit
auth_strategy = keystone
notify_nova_on_port_status_changes = True
notify_nova_on_port_data_changes = True
配置 “RabbitMQ” 消息队列的连接：
[oslo_messaging_rabbit]
rabbit_host = 172.25.39.1
rabbit_userid = openstack
rabbit_password = westos
配置认证服务访问：
[keystone_authtoken]
auth_uri = http://172.25.39.1:5000
auth_url = http://172.25.39.1:35357
memcached_servers = 172.25.39.1:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = westos
配置网络服务来通知计算节点的网络拓扑变化：
[nova]
auth_url = http://172.25.39.1:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = westos
配置锁路径：
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
配置 Modular Layer 2 (ML2) 插件(ML2插件使用Linuxbridge机制来为实例创建layer－2虚拟网络基础设施)
编辑/etc/neutron/plugins/ml2/ml2_conf.ini
[ml2]
type_drivers = flat,vlan------启用flat和VLAN网络
tenant_network_types = ---------禁用私有网络
mechanism_drivers = linuxbridge -----启用Linuxbridge机制
extension_drivers = port_security ------启用端口安全扩展驱动
配置公共虚拟网络为flat网络
[ml2_type_flat]
flat_networks = provider
启用 ipset 增加安全组规则的高效性：
[securitygroup]
enable_ipset = True配置Linuxbridge代理(Linuxbridge代理为实例建立layer－2虚拟网络并且处理安全组规则。)
编辑/etc/neutron/plugins/ml2/linuxbridge_agent.ini
将公共虚拟网络和公共物理网络接口对应起来：
[linux_bridge]
physical_interface_mappings = provider:eth1
禁止VXLAN覆盖网络：
[vxlan]
enable_vxlan = False
启用安全组并配置 Linuxbridge iptables firewall driver:
[securitygroup]
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver配置DHCP代理
编辑/etc/neutron/dhcp_agent.ini文件
配置Linuxbridge驱动接口，DHCP驱动并启用隔离元数据，这样在公共网络上的实例就可以通过网络来访问元数据
[DEFAULT]
interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = True配置元数据代理
编辑`/etc/neutron/metadata_agent.ini
配置元数据主机以及共享密码：
[DEFAULT]
nova_metadata_ip = 172.25.39.1
metadata_proxy_shared_secret = westos为计算节点配置网络服务
编辑/etc/nova/nova.conf文件
配置访问参数，启用元数据代理并设置密码：
[neutron]
url = http://172.25.39.1:9696
auth_url = http://172.25.39.1:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = westos
service_metadata_proxy = True
metadata_proxy_shared_secret = METADATA_SECRET完成安装
网络服务初始化脚本需要一个超链接 /etc/neutron/plugin.ini指向ML2插件配置文件/etc/neutron/plugins/ml2/ml2_conf.ini
ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini同步数据库：
su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
--config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron重启计算API 服务
systemctl restart openstack-nova-api.service
当系统启动时，启动 Networking 服务并配置它启动。
对于两种网络选项：
systemctl enable neutron-server.service \
neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
neutron-metadata-agent.service
systemctl start neutron-server.service \
neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
neutron-metadata-agent.service
【【【安装和配置计算节点】】】
安装组件
yum install openstack-neutron-linuxbridge ebtables ipset -y
配置通用组件
编辑/etc/neutron/neutron.conf
[DEFAULT]
rpc_backend = rabbit
auth_strategy = keystone
配置 “RabbitMQ” 消息队列的连接：
[oslo_messaging_rabbit]
rabbit_host = 172.25.39.1
rabbit_userid = openstack
rabbit_password = westos
配置认证服务访问：
[keystone_authtoken]
auth_uri = http://172.25.39.1:5000
auth_url = http://172.25.39.1:35357
memcached_servers = 172.25.39.1:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = westos
配置锁路径：
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp配置Linuxbridge代理
编辑/etc/neutron/plugins/ml2/linuxbridge_agent.ini
将公共虚拟网络和公共物理网络接口对应起来：
[linux_bridge]
physical_interface_mappings = provider:eth1
禁止VXLAN覆盖网络
[vxlan]
enable_vxlan = False
启用安全组并配置 Linuxbridge iptables firewall driver:
[securitygroup]
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver为计算节点配置网络服务
编辑/etc/nova/nova.conf
配置访问参数：
[neutron]
url = http://172.25.39.1:9696
auth_url = http://172.25.39.1:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = westos完成安装
重启计算服务
systemctl restart openstack-nova-compute.service
启动Linuxbridge代理并配置它开机自启动：
systemctl enable neutron-linuxbridge-agent.service
systemctl start neutron-linuxbridge-agent.service
查看：
[root@open1 keystone]# neutron ext-list
+-----------------------+------------------------+
| alias | name |
+-----------------------+------------------------+
| default-subnetpools | Default Subnetpools |
| availability_zone | Availability Zone |
| network_availability_ | Network Availability |
| zone | Zone |
| auto-allocated- | Auto Allocated |
| topology | Topology Services |
| binding | Port Binding |
| agent | agent |
| subnet_allocation | Subnet Allocation |
| dhcp_agent_scheduler | DHCP Agent Scheduler |
| tag | Tag support |
| external-net | Neutron external |
| | network |
| net-mtu | Network MTU |
| network-ip- | Network IP |
| availability | Availability |
| quotas | Quota management |
| | support |
| provider | Provider Network |
| multi-provider | Multi Provider Network |
| address-scope | Address scope |
| timestamp_core | Time Stamp Fields |
| | addition for core |
| | resources |
| extra_dhcp_opt | Neutron Extra DHCP |
| | opts |
| security-group | security-group |
| rbac-policies | RBAC Policies |
| standard-attr- | standard-attr- |
| description | description |
| port-security | Port Security |
| allowed-address-pairs | Allowed Address Pairs |
+-----------------------+------------------------+
[root@open1 keystone]# neutron agent-list
+----------+------------+-------+-------------------+-------+----------------+----------+
| id | agent_type | host | availability_zone | alive | admin_state_up | binary |
+----------+------------+-------+-------------------+-------+----------------+----------+
| 79749b6e | Metadata | open1 | | :-) | True | neutron- |
| -1342-46 | agent | | | | | metadata |
| 1c-a062- | | | | | | -agent |
| 8de67bec | | | | | | |
| c702 | | | | | | |
| 8f52a78d | Linux | open2 | | :-) | True | neutron- |
| -f525-44 | bridge | | | | | linuxbri |
| 15-a37c- | agent | | | | | dge- |
| 6861416a | | | | | | agent |
| 9a60 | | | | | | |
| 98c1c94c | Linux | open1 | | :-) | True | neutron- |
| -30b8-4e | bridge | | | | | linuxbri |
| 8e-8026- | agent | | | | | dge- |
| e146c757 | | | | | | agent |
| 475c | | | | | | |
| 9dccd17c | DHCP agent | open1 | nova | :-) | True | neutron- |
| -2dfb- | | | | | | dhcp- |
| 4c8e-8e6 | | | | | | agent |
| 9-84f357 | | | | | | |
| 2bae47 | | | | | | |
+----------+------------+-------+-------------------+-------+----------------+----------+接下来就可以启动实例了～
在控制节点上，加载 admin 凭证来获取管理员能执行的命令访问权限：
$ . admin-openrc
创建网络：
neutron net-create --shared --provider:physical_network provider \
--provider:network_type flat provider
+-------------------------+--------------------------+
| Field | Value |
+-------------------------+--------------------------+
| admin_state_up | True |
| availability_zone_hints | |
| availability_zones | |
| created_at | 2017-08-16T07:34:31 |
| description | |
| id | 918f9709-917c-4665-a117- |
| | 1f7ea7c33b49 |
| ipv4_address_scope | |
| ipv6_address_scope | |
| mtu | 1500 |
| name | provider |
| port_security_enabled | True |
| provider:network_type | flat |
| provider:physical_netwo | provider |
| rk | |
| provider:segmentation_i | |
| d | |
| router:external | False |
| shared | True |
| status | ACTIVE |
| subnets | |
| tags | |
| tenant_id | 1ab2b4aef473437facd40c17 |
| | 255061d8 |
| updated_at | 2017-08-16T07:34:31 |
+-------------------------+--------------------------+
在网络上创建一个子网：
neutron subnet-create --name provider \
--allocation-pool start=203.0.113.101,end=203.0.113.250 \
--dns-nameserver 8.8.4.4 --gateway 203.0.113.1 \
provider 203.0.113.0/24
+-------------------+--------------------------------+
| Field | Value |
+-------------------+--------------------------------+
| allocation_pools | {"start": "203.0.113.101", |
| | "end": "203.0.113.250"} |
| cidr | 203.0.113.0/24 |
| created_at | 2017-08-16T07:35:51 |
| description | |
| dns_nameservers | 8.8.4.4 |
| enable_dhcp | True |
| gateway_ip | 203.0.113.1 |
| host_routes | |
| id | edd00b24-5537-4dcd- |
| | abd9-2ec6006afd41 |
| ip_version | 4 |
| ipv6_address_mode | |
| ipv6_ra_mode | |
| name | provider |
| network_id | 918f9709-917c-4665-a117-1f7ea7 |
| | c33b49 |
| subnetpool_id | |
| tenant_id | 1ab2b4aef473437facd40c17255061 |
| | d8 |
| updated_at | 2017-08-16T07:35:51 |
+-------------------+--------------------------------+
创建m1.nano规格的主机
openstack flavor create --id 0 --vcpus 1 --ram 64 --disk 1 m1.nano
+----------------------------+---------+
| Field | Value |
+----------------------------+---------+
| OS-FLV-DISABLED:disabled | False |
| OS-FLV-EXT-DATA:ephemeral | 0 |
| disk | 1 |
| id | 0 |
| name | m1.nano |
| os-flavor-access:is_public | True |
| ram | 64 |
| rxtx_factor | 1.0 |
| swap | |
| vcpus | 1 |
+----------------------------+---------+生成一个键值对
导入租户demo的凭证
$ . demo-openrc
生成和添加秘钥对：
$ ssh-keygen -q -N ""
$ openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey
+-------------+--------------------------------------+
| Field | Value |
+-------------+--------------------------------------+
| fingerprint | e4:0f:ce:1f:7a:ac:5b:eb:98:c3:32:b5: |
| | 9a:42:4e:22 |
| name | mykey |
| user_id | 33a3c544d28c4c3bb8cb1291d224e7b2 |
+-------------+--------------------------------------+
验证公钥的添加：
$ openstack keypair list
+-------+--------------------------------------------+
| Name | Fingerprint |
+-------+--------------------------------------------+
| mykey | e4:0f:ce:1f:7a:ac:5b:eb:98:c3:32:b5:9a:42: |
| | 4e:22 |
+-------+--------------------------------------------+增加安全组规则
添加规则到 default 安全组。
允许 ICMP (ping)：
openstack security group rule create --proto icmp default
+-----------------------+----------------------------+
| Field | Value |
+-----------------------+----------------------------+
| id | 47c78a30-02cc-4527-964e- |
| | baff81f5ee95 |
| ip_protocol | icmp |
| ip_range | 0.0.0.0/0 |
| parent_group_id | f9c56544-0157-4227-a6af- |
| | 3642b6b0f341 |
| port_range | |
| remote_security_group | |
+-----------------------+----------------------------+
允许安全 shell (SSH) 的访问：
openstack security group rule create --proto tcp --dst-port 22 default
+-----------------------+----------------------------+
| Field | Value |
+-----------------------+----------------------------+
| id | 78806c49-2591-4d5d- |
| | a8e0-6533f7af5d56 |
| ip_protocol | tcp |
| ip_range | 0.0.0.0/0 |
| parent_group_id | f9c56544-0157-4227-a6af- |
| | 3642b6b0f341 |
| port_range | 22:22 |
| remote_security_group | |
+-----------------------+----------------------------+确定实例选项
在控制节点上，获得 admin 凭证来获取只有管理员能执行的命令的访问权限：
$ . demo-openrc
一个实例指定了虚拟机资源的大致分配，包括处理器、内存和存储。
列出可用类型：
$ openstack flavor list
+----+----------+-------+------+-----------+-------+-----------+
| ID | Name | RAM | Disk | Ephemeral | VCPUs | Is Public |
+----+----------+-------+------+-----------+-------+-----------+
| 0 | m1.nano | 64 | 1 | 0 | 1 | True |
| 1 | m1.tiny | 512 | 1 | 0 | 1 | True |
| 2 | m1.small | 2048 | 20 | 0 | 1 | True |
| 3 | m1.mediu | 4096 | 40 | 0 | 2 | True |
| | m | | | | | |
| 4 | m1.large | 8192 | 80 | 0 | 4 | True |
| 5 | m1.xlarg | 16384 | 160 | 0 | 8 | True |
| | e | | | | | |
+----+----------+-------+------+-----------+-------+-----------+
列出可用镜像：
$ openstack image list
+--------------------------------------+--------+--------+
| ID | Name | Status |
+--------------------------------------+--------+--------+
| 03b18764-941d-419c-894d-db3f1f4f73e0 | cirros | active |
+--------------------------------------+--------+--------+
列出可用网络：
$ openstack network list
+--------------------------+----------+---------------------------+
| ID | Name | Subnets |
+--------------------------+----------+---------------------------+
| 918f9709-917c-4665-a117- | provider | edd00b24-5537-4dcd- |
| 1f7ea7c33b49 | | abd9-2ec6006afd41 |
+--------------------------+----------+---------------------------+
列出可用的安全组：
$ openstack security group list
+-----------------+---------+-----------------+-------------------+
| ID | Name | Description | Project |
+-----------------+---------+-----------------+-------------------+
| f9c56544-0157-4 | default | Default | ecced8c00e8249edb |
| 227-a6af- | | security group | 3c5730a8a6a4cd1 |
| 3642b6b0f341 | | | |
+-----------------+---------+-----------------+-------------------+启动实例：
openstack server create --flavor m1.nano --image cirros --nic net-id=918f9709-917c-4665-a117-1f7ea7c33b49 --security-group default --key-name mykey provider-instance
检查实例的状态:
$ openstack server list
使用虚拟控制台访问实例
获取你实例的 Virtual Network Computing (VNC) 会话URL并从web浏览器访问它：
openstack console url show provider-instance到此简单私有云就搭建成功啦～～