配置域名解析：vi /etc/hosts
检查防火墙是否关闭：getenforce
清除防火墙规则：
iptables -F
iptables -X
iptables -Z
/usr/sbin/iptables-save
安装时间同步： yum install -y chrony
修改配置文件：
删除四行
server 0.centos.pool.ntp.org iburst
server 1.centos.pool.ntp.org iburst
server 2.centos.pool.ntp.org iburst
server 3.centos.pool.ntp.org iburst
添加
local stratum 10
allow 10.32.24.0/23(控制节点多添加这一条)
server controller iburst
重启chrony服务
systemctl restart chronyd
systemctl enable chronyd
检查是否时间同步成功：
chronyc sources
210 Number of sources = 1
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* controller 10 6 377 54 -1990ns[-4466ns] +/- 16us
升级安装包：
yum upgrade -y
升级完之后删除yun源文件中的网络源：
rm -rvf /etc/yum.repos.d/CentOS-*
安装openstack客户端
yum install python-openstackclient -y
安装 openstack-selinux软件包以自动管理OpenStack服务的安全策略：
yum install openstack-selinux -y
安装mariadb数据库(controller)
yum install mariadb mariadb-server python2-PyMySQL -y
添加文件：
vi /etc/my.cnf.d/mariadb-server.cnf
内容如下：
[mysqld]
bind-address = 10.32.24.255
default-storage-engine = innodb
innodb_file_per_table = on
max_connections = 4096
collation-server = utf8_general_ci
character-set-server = utf8
重启并设置开机自启：
systemctl start mariadb.service && systemctl enable mariadb.service
初始化数据库：
mysql_secure_installation
安装消息队列服务：
yum install -y rabbitmq-server
启动并自启消息队列：
systemctl enable rabbitmq-server.service && systemctl start rabbitmq-server.service
创建openstack用户
rabbitmqctl add_user openstack 000000
为openstack用户增加配置、读取及写入相关权限
rabbitmqctl set_permissions openstack ".*" ".*" ".*"
安装Memcached缓存数据库
yum install memcached python-memcached -y
编辑/etc/sysconfig/memcached文件并完成以下操作：
OPTIONS="-l 127.0.0.1,::1,controller" 添加controller
启动Memcached服务并将其配置为在系统引导时启动：
systemctl enable memcached.service && systemctl start memcached.service
安装Etcd服务
yum install etcd -y
编辑/etc/etcd/etcd.conf文件
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="http://10.32.24.255:2380"
ETCD_LISTEN_CLIENT_URLS="http://10.32.24.255:2379"
ETCD_NAME="controller"
ETCD_INITIAL_ADVERTISE_PEER_URLS="http://10.32.24.255:2380"
ETCD_ADVERTISE_CLIENT_URLS="http://10.32.24.255:2379"
ETCD_INITIAL_CLUSTER="controller=http://10.32.24.255:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster-01"
ETCD_INITIAL_CLUSTER_STATE="new"
重启etc服务
systemctl restart etcd && systemctl enable etcd
安装keystone服务
创建keystone数据库
mysql -uroot -p000000
create database keystone;
grant all privileges on keystone.* to 'keystone'@'localhost' identified by '000000';
grant all privileges on keystone.* to 'keystone'@'%' identified by '000000';
安装和配置keystone组件
yum install -y openstack-keystone httpd mod_wsgi
编辑并修改/etc/keystone/keystone.conf配置文件
vi /etc/keystone/keystone.conf
添加
[database]
connection = mysql+pymysql://keystone:000000@controller/keystone
[token]
provider = fernet
同步认证服务数据库：
su -s /bin/sh -c "keystone-manage db_sync" keystone
初始化Fernet key库：
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
引导身份认证服务：
keystone-manage bootstrap --bootstrap-password 000000 --bootstrap-admin-url http://controller:5000/v3/ --bootstrap-internal-url
http://controller:5000/v3/ --bootstrap-public-url http://controller:5000/v3/ --bootstrap-region-id RegionOne
配置apache http服务
vi /etc/httpd/conf/httpd.conf
添加：
ServerName controller
创建到/usr/share/keystone/wsgi-keystone.conf文件的链接：
ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/
启动Apache HTTP服务并配置开机启动:
systemctl enable httpd.service && systemctl start httpd.service
配置administrative 账户
export OS_USERNAME=admin
export OS_PASSWORD=000000
export OS_PROJECT_NAME=admin
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default
export OS_AUTH_URL=http://controller:35357/v3
export OS_IDENTITY_API_VERSION=3
创建项目和用户:
openstack domain create --description "Domain" example
openstack project create --domain default --description "Service Project" service
openstack project create --domain default --description "Demo Project" demo
openstack user create --domain default --password 000000 demo
openstack role create user
openstack role add --project demo --user demo user
验证认证服务操作
unset OS_AUTH_URL OS_PASSWORD
作为管理员用户，请求身份验证令牌L:
openstack --os-auth-url http://controller:35357/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name admin
--os-username admin token issue
创建客户端环境脚本
vim admin-openrc
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=000000
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
vim demo-openrc
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=000000
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
加载admin-openrc文件以使用Identity服务的位置以及管理项目和用户凭据执行环境变量：
. admin-openrc
openstack token issue
创建glance数据库
mysql -uroot -p000000
CREATE DATABASE glance;
GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost' IDENTIFIED BY '000000';
GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%' IDENTIFIED BY '000000';
创建glance用户：
openstack user create --domain default --password 000000 glance
把admin角色添加到glance用户和项目中:
openstack role add --project service --user glance admin
创建glance服务实体：
openstack service create --name glance --description "OpenStack Image" image
创建镜像服务API端点
openstack endpoint create --region RegionOne image public http://controller:9292
openstack endpoint create --region RegionOne image internal http://controller:9292
openstack endpoint create --region RegionOne image admin http://controller:9292
安装和配置组件
yum install openstack-glance -y
编辑/etc/glance/glance-api.conf文件，完成以下操作
vim /etc/glance/glance-api.conf
添加：
[database]
connection = mysql+pymysql://glance:000000@controller/glance
[keystone_authtoken]
auth_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = glance
password = 000000
[paste_deploy]
flavor = keystone
[glance_store]
stores = file,http
default_store = file
filesystem_store_datadir = /var/lib/glance/images/
编辑/etc/glance/glance-registry.conf配置文件
vim /etc/glance/glance-registry.conf
[database]
connection = mysql+pymysql://glance:000000@controller/glance
在[keystone_authtoken] 和 [paste_deploy] 部分, 配置认证服务访问：
[keystone_authtoken]
auth_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = glance
password = 000000
[paste_deploy]
flavor = keystone
同步镜像服务数据库：
su -s /bin/sh -c "glance-manage db_sync" glance
完成安装,启动镜像服务并设为开机启动：
systemctl enable openstack-glance-api.service openstack-glance-registry.service
systemctl restart openstack-glance-api.service openstack-glance-registry.service
安装compute服务:
创建数据库:
mysql -uroot -p000000
CREATE DATABASE nova_api;
CREATE DATABASE nova;
CREATE DATABASE nova_cell0;
GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'localhost' IDENTIFIED BY '000000';
GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'%' IDENTIFIED BY '000000';
GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'localhost' IDENTIFIED BY '000000';
GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' IDENTIFIED BY '000000';
GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'localhost' IDENTIFIED BY '000000';
GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'%' IDENTIFIED BY '000000';
获取admin凭证
. admin-openrc
创建计算服务凭证
创建nova用户：
openstack user create --domain default --password 000000 nova
为nova用户添加admin角色：
openstack role add --project service --user nova admin
创建nova服务端点：
openstack service create --name nova --description "OpenStack Compute" compute
创建compute API 服务端点：
openstack endpoint create --region RegionOne compute public http://controller:8774/v2.1
openstack endpoint create --region RegionOne compute admin http://controller:8774/v2.1
openstack endpoint create --region RegionOne compute internal http://controller:8774/v2.1
创建一个placement服务用户:
openstack user create --domain default --password 000000 placement
添加placement用户为项目服务admin角色
openstack role add --project service --user placement admin
在服务目录中创建Placement API条目：
openstack service create --name placement --description "Placement API" placement
创建Placement API服务端点
openstack endpoint create --region RegionOne placement public http://controller:8778
openstack endpoint create --region RegionOne placement internal http://controller:8778
openstack endpoint create --region RegionOne placement admin http://controller:8778
安装和配置组件
yum install openstack-nova-api openstack-nova-conductor openstack-nova-console openstack-nova-novncproxy openstack-nova-scheduler openstack-nova-placement-api -y
编辑 /etc/nova/nova.conf文件并完成以下操作
vim /etc/nova/nova.conf
[DEFAULT]
enabled_apis = osapi_compute,metadata
transport_url = rabbit://openstack:000000@controller
my_ip = 10.32.24.255
use_neutron = True
firewall_driver = nova.virt.firewall.NoopFirewallDriver
[api_database]
connection = mysql+pymysql://nova:000000@controller/nova_api
[database]
connection = mysql+pymysql://nova:000000@controller/nova
[api]
auth_strategy = keystone
[keystone_authtoken]
auth_url = http://controller:5000/v3
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = nova
password = 000000
[vnc]
enabled = true
server_listen = $my_ip
server_proxyclient_address = $my_ip
novncproxy_base_url=http://$my_ip:6080/vnc_auto.html
[glance]
api_servers = http://controller:9292
[oslo_concurrency]
lock_path = /var/lib/nova/tmp
[placement]
os_region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://controller:5000/v3
username = placement
password = 000000
需要在/etc/httpd/conf.d/00-nova-placement-api.conf文件中添加如下配置
vi /etc/httpd/conf.d/00-nova-placement-api.conf
添加如下配置：
<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
Allow from all
</IfVersion>
</Directory>
重新启动httpd服务
systemctl restart httpd
同步nova-api数据库
su -s /bin/sh -c "nova-manage api_db sync" nova
注册cell0数据库
su -s /bin/sh -c "nova-manage cell_v2 map_cell0" nova
创建cell1 cell
su -s /bin/sh -c "nova-manage cell_v2 create_cell --name=cell1 --verbose" nova
同步nova数据库
su -s /bin/sh -c "nova-manage db sync" nova
验证 nova、 cell0、 cell1数据库是否注册正确
nova-manage cell_v2 list_cells
启动计算服务并配置为开机启动
systemctl enable openstack-nova-api.service openstack-nova-consoleauth.service openstack-nova-scheduler.service openstack-nova-conductor.service openstack-nova-novncproxy.service
systemctl restart openstack-nova-api.service openstack-nova-consoleauth.service openstack-nova-scheduler.service openstack-nova-conductor.service openstack-nova-novncproxy.service
以下操作在计算节点执行
安装和配置组件
yum install openstack-nova-compute -y
编辑/etc/nova/nova.conf配置文件并完成以下操作
vim /etc/nova/nova.conf
[DEFAULT]
my_ip = 10.32.24.123
enabled_apis = osapi_compute,metadata
transport_url = rabbit://openstack:000000@controller
use_neutron = True
firewall_driver = nova.virt.firewall.NoopFirewallDriver
[api]
auth_strategy = keystone
[keystone_authtoken]
auth_url = http://controller:5000/v3
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = nova
password = 000000
[vnc]
enabled = True
server_listen = 0.0.0.0
server_proxyclient_address = $my_ip
novncproxy_base_url = http://controller:6080/vnc_auto.html
[glance]
api_servers = http://controller:9292
[oslo_concurrency]
lock_path = /var/lib/nova/tmp
[placement]
os_region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://controller:5000/v3
username = placement
password = 000000
vim /etc/nova/nova.conf
[libvirt]
virt_type = qemu
启动计算服务（包括其相关性），并将其配置为在系统引导时自动启动：
systemctl enable libvirtd.service openstack-nova-compute.service
systemctl restart libvirtd.service openstack-nova-compute.service
执行admin-openrc，验证有几个计算节点在数据库中
[root@controller ~]# openstack compute service list --service nova-compute
在controller节点操作：
发现计算节点
su -s /bin/sh -c "nova-manage cell_v2 discover_hosts --verbose" nova
列出身份服务中的API端点以验证与身份服务的连接：
[root@controller ~]# openstack catalog list
检查cells和placement API是否正常运行
[root@controller ~]# nova-status upgrade check
安装 Neutron 服务
创建 neutron 数据库
mysql -uroot -p000000
CREATE DATABASE neutron;
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY '000000';
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY '000000';
openstack user create --domain default --password 000000 neutron
添加 admin 角色到 neutron 用户
openstack role add --project service --user neutron admin
创建服务实体
openstack service create --name neutron --description "OpenStack Networking" network
创建服务端点
openstack endpoint create --region RegionOne network public http://controller:9696
openstack endpoint create --region RegionOne network internal http://controller:9696
openstack endpoint create --region RegionOne network admin http://controller:9696
安装 neutron 相关软件包
yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables -y
编辑/etc/neutron/neutron.conf 文件
vim /etc/neutron/neutron.conf
[DEFAULT]
core_plugin = ml2
service_plugins = router
allow_overlapping_ips = true
transport_url = rabbit://openstack:000000@controller
auth_strategy = keystone
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true
[database]
connection = mysql+pymysql://neutron:000000@controller/neutron
[keystone_authtoken]
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = 000000
[nova]
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = 000000
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
编辑/etc/neutron/plugins/ml2/ml2_conf.ini 文件
vim /etc/neutron/plugins/ml2/ml2_conf.ini
[ml2]
type_drivers = flat,vlan,vxlan
tenant_network_types = vxlan
mechanism_drivers = linuxbridge,l2population
extension_drivers = port_security
[ml2_type_flat]
flat_networks = provider
[ml2_type_vxlan]
vni_ranges = 1:1000
[securitygroup]
enable_ipset = true
编辑/etc/neutron/plugins/ml2/linuxbridge_agent.ini 文件
vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
此文件配置 Linux 网桥代理：
[linux_bridge]
physical_interface_mappings = provider:eth1
[vxlan]
enable_vxlan = true
local_ip = 10.32.30.255
l2_population = true
[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
编辑/etc/neutron/l3_agent.ini 文件
[DEFAULT]
interface_driver = linuxbridge
编辑/etc/neutron/dhcp_agent.ini 文件
vim /etc/neutron/dhcp_agent.ini
[DEFAULT]
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true
编辑文件
vim /etc/neutron/metadata_agent.ini
[DEFAULT]
nova_metadata_host = controller
metadata_proxy_shared_secret = 000000
编辑/etc/nova/nova.conf 文件
vim /etc/nova/nova.conf
[neutron]
url = http://controller:9696
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = 000000
service_metadata_proxy = true
metadata_proxy_shared_secret = 000000
配置l3
vi /etc/neutron/l3_agent.ini
[DEFAULT]
interface_driver=linuxbridge
创建链接
ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
同步数据库.
su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
重启 nova-api 服务
systemctl restart openstack-nova-api.service
启动 neutron 相关服务
systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service neutron-l3-agent.service
systemctl restart neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service neutron-l3-agent.service
在 compute 节点执行以下操作
安装 neutron 相关服务
yum install openstack-neutron-linuxbridge ebtables ipset -y
编辑/etc/neutron/neutron.conf 文件
vim /etc/neutron/neutron.conf
[DEFAULT]
transport_url = rabbit://openstack:000000@controller
auth_strategy = keystone
[keystone_authtoken]
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = 000000
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
编辑/etc/neutron/plugins/ml2/linuxbridge_agent.ini 文件
vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[linux_bridge]
physical_interface_mappings = provider:enp9s0 ## 此处填写实际网卡名称
[vxlan]
enable_vxlan = true
local_ip = 10.32.30.123
l2_population = true
[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
编辑/etc/nova/nova.conf 文件
vim /etc/nova/nova.conf
[neutron]
url = http://controller:9696
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = 000000
重启 nova-compute 服务
systemctl restart openstack-nova-compute.service
启动网桥代理服务
systemctl restart neutron-linuxbridge-agent.service
systemctl enable neutron-linuxbridge-agent.service
验证 neutron 服务是否成功安装
在 controller 节点执行以下命令
[root@controller ~]# openstack network agent list
安装Horizon服务
以下操作在控制节点执行
yum install openstack-dashboard -y
编辑 /etc/openstack-dashboard/local_settings 文件并完成以下操作：
vim /etc/openstack-dashboard/local_settings
OPENSTACK_HOST = "controller"
ALLOWED_HOSTS = ['*',]
SESSION_ENGINE = 'django.contrib.sessions.backends.cache'
CACHES = {
'default': {
'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
'LOCATION': 'controller:11211',
}
}
注释掉任何其他会话存储配置。开启身份认证API 版本v3
OPENSTACK_KEYSTONE_URL = "http://%s:5000/v3" % OPENSTACK_HOST
启用对域的支持：
OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True
配置API版本:
OPENSTACK_API_VERSIONS = {
"identity": 3,
"image": 2,
"volume": 2,
}
配置Default为您通过仪表板创建的用户的默认域：
OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = "Default"
将用户配置为通过仪表板创建的用户的默认角色：
OPENSTACK_KEYSTONE_DEFAULT_ROLE = "user"
如果未包括，则将以下行添加到/etc/httpd/conf.d/openstack-dashboard.conf。
vim /etc/httpd/conf.d/openstack-dashboard.conf
WSGIApplicationGroup %{GLOBAL}
完成安装，重启web服务和会话存储
systemctl restart httpd.service memcached.service
扫一扫
462
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
