赞
踩
虚拟机资源信息
虚拟机 | 配置 |
---|---|
控制节点CT | CPU:双核双线程-CPU虚拟化开启内存:8G 硬盘:300G+300G(CEPH块存储)双网卡:VM1-(局域网)192.168.10.10 NAT-192.168.100.10 操作系统:Centos 7.6(1810)-最小化安装 |
计算节点c1 | CPU:双核双线程-CPU虚拟化开启内存:8G 硬盘:300G+300G(CEPH块存储)双网卡:VM1(局域网)-192.168.10.20 NAT-192.168.100.20 操作系统:Centos 7.6(1810)-最小化安装 |
计算节点c2 | CPU:双核双线程-CPU虚拟化开启内存:8G 硬盘:300G+300G(CEPH块存储)双网卡:VM1(局域网)-192.168.10.30 NAT-192.168.100.30操作系统:Centos 7.6(1810)-最小化安装 |
PS:最小内存8G
修改主机名,关闭防火墙核心防护,安装基础环境依赖包
- [root@localhost ~]# hostnamectl set-hostname ct ##修改主机名
- [root@ct ~]# systemctl stop firewalld ##关闭防火墙
- [root@ct ~]# setenforce 0 ##关闭核心防护
-
- [root@ct ~]# yum -y install net-tools bash-completion vim gcc gcc-c++ make pcre pcre-devel expat-devel cmake bzip2 centos-release-openstack-train python-openstackclient openstack-selinux openstack-utils ##安装基础环境依赖包
-
-
- [root@ct ~]# yum install chrony -y
- [root@ct ~]# vim /etc/chrony.conf ##修改配置文件控制节点ct时间同步配置
-
- # Use public servers from the pool.ntp.org project.
- # Please consider joining the pool (http://www.pool.ntp.org/join.html).
- #server 0.centos.pool.ntp.org iburst
- #server 1.centos.pool.ntp.org iburst
- #server 2.centos.pool.ntp.org iburst
- #server 3.centos.pool.ntp.org iburst
- server ntp6.aliyun.com iburst ##添加阿里云时间同步
- allow 192.168.10.0/24 ##允许内网网段同步时间
- [root@ct ~]# systemctl enable chronyd
- [root@ct ~]# systemctl restart chronyd
- [root@ct ~]# crontab -e ##创建周期性计划,每俩分钟查询一次时间同步信息
-
- */2 * * * * /usr/bin/chronyc sources >> /var/log/chronyc.log
-
- c1,c2设置
- server 0.centos.pool.ntp.org iburst
- #server 1.centos.pool.ntp.org iburst
- #server 2.centos.pool.ntp.org iburst
- #server 3.centos.pool.ntp.org iburst
- server ct iburst #同步主机ct
- [root@ct ~]# ssh-keygen -t rsa
- [root@ct ~]# ssh-copy-id ct
- [root@ct ~]# ssh-copy-id c1
- [root@ct ~]# ssh-copy-id c2
- [root@ct ~]# vim /etc/resolv.conf
-
- nameserver 114.114.114.114
[root@ct ~]# yum -y install mariadb mariadb-server python2-PyMySQL libibverbs
python2-PyMySQL:此包用于openstack的控制端连接mysql所需要的模块,如果不安装,则无法连接数据库;此包只安装在控制端
- [root@ct ~]# vim /etc/my.cnf.d/openstack.cnf
-
- [mysqld]
- bind-address = 192.168.10.10 #控制节点局域网地址
- default-storage-engine = innodb #默认存储引擎
- innodb_file_per_table = on #每张表独立表空间文件
- max_connections = 4096 #最大连接数
- collation-server = utf8_general_ci #默认字符集
- character-set-server = utf8
-
- 开机自启动、开启服务
- [root@ct my.cnf.d]# systemctl enable mariadb
- [root@ct my.cnf.d]# systemctl start mariadb
- [root@ct my.cnf.d]# mysql_secure_installation
- Enter current password for root (enter for none): #回车
- Set root password? [Y/n] Y
- Remove anonymous users? [Y/n] Y
- Disallow root login remotely? [Y/n] N
- Remove test database and access to it? [Y/n] Y
- Reload privilege tables now? [Y/n] Y
-
- [root@ct ~]# yum -y install rabbitmq-server
- root@ct ~]# systemctl enable rabbitmq-server.service
- [root@ct ~]# systemctl start rabbitmq-server.service
用于controler和node节点连接rabbitmq的认证
- [root@ct ~]# rabbitmqctl add_user openstack RABBIT_PASS
- Creating user "openstack"
- [root@ct ~]# rabbitmqctl set_permissions openstack ".*" ".*" ".*" ###正则,配置读写权限
- Setting permissions for user "openstack" in vhost "/"
- root@ct ~]# rabbitmq-plugins list
- Configured: E = explicitly enabled; e = implicitly enabled
- | Status: * = running on rabbit@ct
- |/
- [e*] amqp_client 3.6.16
- [e*] cowboy 1.0.4
- [e*] cowlib 1.0.2
- [ ] rabbitmq_amqp1_0 3.6.16
- [ ] rabbitmq_auth_backend_ldap 3.6.16
- [ ] rabbitmq_auth_mechanism_ssl 3.6.16
- [ ] rabbitmq_consistent_hash_exchange 3.6.16
- [ ] rabbitmq_event_exchange 3.6.16
- [ ] rabbitmq_federation 3.6.16
- [ ] rabbitmq_federation_management 3.6.16
- [root@ct ~]# rabbitmq-plugins enable
-
- [root@ct ~]# ss -natp | grep 5672 ##检查端口(25672 5672 15672)
- LISTEN 0 128 *:25672 *:* users:(("beam.smp",pid=30954,fd=46))
- LISTEN 0 128 *:15672 *:* users:(("beam.smp",pid=30954,fd=57))
- LISTEN 0 128 :::5672 :::* users:(("beam.smp",pid=30954,fd=55))
- [root@ct ~]#
地址:192.168.100.10:15672 默认账号密码均为guest
安装memcached是用于存储session信息;服务身份验证机制使用Memcached来缓存令牌 在登录openstack的dashboard时,会产生一些session信息,这些session信息会存放到memcached中
- [root@ct ~]# yum install -y memcached python-memcached
-
- python-*模块在OpenStack中起到连接数据库的作用
- [root@ct ~]# vi /etc/sysconfig/memcached
-
- PORT="11211" ##默认端口
- USER="memcached" ##用户
- MAXCONN="1024" ##最大连接数
- CACHESIZE="64" ##缓存大小
- OPTIONS="-l 127.0.0.1,::1,CT" ##监听地址
-
- [root@ct ~]# systemctl start memcached ##启动memcached
[root@ct ~]# yum -y install etcd
- [root@ct ~]# vi /etc/etcd/etcd.conf
-
- ETCD_DATA_DIR="/var/lib/etcd/default.etcd" #数据目录位置
- ETCD_LISTEN_PEER_URLS="http://192.168.10.10:2380" #监听其他etcd member的url(2380端口,集群之间通讯,域名为无效值)
- ETCD_LISTEN_CLIENT_URLS="http://192.168.10.10:2379" #对外提供服务的地址(2379端口,集群内部的通讯端口)
- ETCD_NAME="ct" #集群中节点标识(名称)
- ETCD_INITIAL_ADVERTISE_PEER_URLS="http://192.168.10.10:2380" #该节点成员的URL地址,2380端口:用于集群之间通讯。
- ETCD_ADVERTISE_CLIENT_URLS="http://192.168.10.10:2379" #客户端跟etcd服务进行交互时请求的url
- ETCD_INITIAL_CLUSTER="ct=http://192.168.10.10:2380"
- ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster-01" #集群唯一标识
- ETCD_INITIAL_CLUSTER_STATE="new" #初始集群状态,new为静态,若为existing,则表示此ETCD服务将尝试加入已有的集群
- 若为DNS,则表示此集群将作为被加入的对象
- [root@ct ~]# systemctl enable etcd
- [root@ct ~]# systemctl start etcd
- [root@ct ~]# netstat -anutp | grep 2379
- tcp 0 0 192.168.10.10:2379 0.0.0.0:* LISTEN 44913/etcd
- tcp 0 0 192.168.10.10:40116 192.168.10.10:2379 ESTABLISHED 44913/etcd
- tcp 0 0 192.168.10.10:2379 192.168.10.10:40116 ESTABLISHED 44913/etcd
- [root@ct ~]# netstat -anutp | grep 2380
- tcp 0 0 192.168.10.10:2380 0.0.0.0:* LISTEN 44913/etcd
部署openstack组件时,需先行安装认证服务(keystone),而认证服务是使用Apache运行的,安装完成后才可以创建、管理账号,然后安装镜像服务(glance)、计算服务(nova)、网络服务(neutron)
其中计算服务和网络服务分为管理端和客户端,所以需要在openstack的管理端安装计算服务和网络服务的管理端,在创建虚拟机的node节点上安装计算服务和网络服务的客户端,最后安装dashboard服务,openstack各种组件的API都是通过apache运行的;
openstack的管理端负责创建虚拟机过程的调度
通过openstack管理端创建虚拟机的相关数据最终都会记录到mysql(mariadb)中;node节点没有权限往数据库中写数据,只有控制端有权限,并且node节点与控制端通讯是通过rabbitmq间接通讯,node节点会监听rabbitmq,控制端也会监听rabbitmq,控制端把创建虚拟机的指令发送到rabbitmq,由监听rabbitmq指定队列的node节点接收消息并创建虚拟机。
- [root@ct ~]# mysql -u root -p
- Enter password:
-
- MariaDB [(none)]> create database keystone;
- Query OK, 1 row affected (0.001 sec)
-
- MariaDB [(none)]> grant all privileges on keystone.* to 'keystone'@'localhost' identified by 'keystone_dbpass';
- Query OK, 0 rows affected (0.001 sec)
-
- MariaDB [(none)]> grant all privileges on keystone.* to 'keystone'@'%'identified by 'keystone_dbpass';
- Query OK, 0 rows affected (0.000 sec)
-
- MariaDB [(none)]> flush privileges;
- Query OK, 0 rows affected (0.002 sec)
mod_wsgi包的作用是让apache能够代理pythone程序的组件;openstack的各个组件,包括API都是用python写的,但访问的是apache,apache会把请求转发给python去处理,这些包只安装在controler节点
[root@ct ~]# yum -y install openstack-keystone httpd mod_wsgi
- [root@ct ~]# cp -a /etc/keystone/keystone.conf{,.bak} ##备份配置文件
-
- [root@ct ~]# grep -Ev "^$|#" /etc/keystone/keystone.conf.bak > /etc/keystone/keystone.conf ##匹配文件内容导入
通过pymysql模块访问mysql,指定用户名密码、数据库的域名、数据库名
[root@ct ~]# openstack-config --set /etc/keystone/keystone.conf database connection mysql+pymysql://keystone:KEYSTONE_DBPASS@ct/keystone
指定token的提供者;提供者就是keystone自己本身
[root@ct ~]# openstack-config --set /etc/keystone/keystone.conf token provider fernet
注:Fernet:一种安全的消息传递格式
[root@ct ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone
- [root@ct keystone]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
-
- [root@ct keystone]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
-
- drwx------. 2 keystone keystone 24 12月 16 14:10 credential-keys
- drwx------. 2 keystone keystone 24 12月 16 14:07 fernet-keys
- [root@ct keystone]# keystone-manage bootstrap --bootstrap-password ADMIN_PASS \
- --bootstrap-admin-url http://CT:5000/v3/ \
- --bootstrap-internal-url http://CT:5000/v3/ \
- --bootstrap-public-url http://CT:5000/v3/ \
- --bootstrap-region-id RegionOne
命令详解:
keystone-manage bootstrap --bootstrap-password ADMIN_PASS \ #此步骤是初始化openstack,会把openstack的admin用户的信息写入到mysql的user表中,以及url等其他信息写入到mysql的相关表中;
-region-id RegionOn #指定一个区域名称
-admin-url #admin-url是管理网(如公有云内部openstack管理网络),用于管理虚拟机的扩容或删除;如果共有网络和管理网是一个网络,则当业务量大时,会造成无法通过openstack的控制端扩容虚拟机,所以需要一个管理网;
-internal-url #internal-url是内部网络,进行数据传输,如虚拟机访问存储和数据库、zookeeper等中间件,这个网络是不能被外网访问的,只能用于企业内部访问
-public-url #public-url是共有网络,可以给用户访问的(如公有云) #但是此环境没有这些网络,则公用同一个网络
#5000端口是keystone提供认证的端口
#需要在haproxy服务器上添加一条listen
#各种网络的url需要指定controler节点的域名,一般是haproxy的vip的域名(高可用模式)
[root@ct ~]# echo "ServerName controller" >> /etc/httpd/conf/httpd.conf
安装完mod_wsgi包后,会生成 wsgi-keystone.conf 这个文件,文件中配置了虚拟主机及监听了5000端口,mod_wsgi就是python的网关
[root@ct ~]# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf
- [root@ct ~]# systemctl enable httpd
- Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
- [root@ct ~]# systemctl start httpd
这些环境变量用于创建角色和项目使用,但是创建角色和项目需要有认证信息,所以通过环境变量声明用户名和密码等认证信息,欺骗openstack已经登录且通过认证,这样就可以创建项目和角色;也就是把admin用户的验证信息通过声明环境变量的方式传递给openstack进行验证,实现针对openstack的非交互式操作
- [root@ct ~]# cat >> ~/.bashrc << EOF
- > export OS_USERNAME=admin #控制台登陆用户名
- > export OS_PASSWORD=ADMIN_PASS #控制台登陆密码
- > export OS_PROJECT_NAME=admin
- > export OS_USER_DOMAIN_NAME=Default
- > export OS_PROJECT_DOMAIN_NAME=Default
- > export OS_AUTH_URL=http://CT:5000/v3
- > export OS_IDENTITY_API_VERSION=3
- > export OS_IMAGE_API_VERSION=2
- > EOF
-
- [root@ct ~]# source ~/.bashrc
-
- [root@ct keystone]# openstack user list
- +----------------------------------+-------+
- | ID | Name |
- +----------------------------------+-------+
- | 19d74e726cdb47eb8a4c307c918a4839 | admin |
- +----------------------------------+-------+
创建一个项目(project),创建在指定的domain(域)中,指定描述信息,project名称为service(可使用openstack domain list 查询)
- [root@ct keystone]# openstack project create --domain default --description "Service Project" service
- +-------------+----------------------------------+
- | Field | Value |
- +-------------+----------------------------------+
- | description | Service Project |
- | domain_id | default |
- | enabled | True |
- | id | ea838c9251cf424d888527875c02744f |
- | is_domain | False |
- | name | service |
- | options | {} |
- | parent_id | default |
- | tags | [] |
- +-------------+----------------------------------+
创建角色(可使用openstack role list查看)
- [root@ct keystone]# openstack role create user
- +-------------+----------------------------------+
- | Field | Value |
- +-------------+----------------------------------+
- | description | None |
- | domain_id | None |
- | id | 09e54f9876bd484ebf940c5b6eb2a1c3 |
- | name | user |
- | options | {} |
- +-------------+----------------------------------+
Copyright © 2003-2013 www.wpsshop.cn 版权所有,并保留所有权利。