史上最全openstack-T版安装，学不会你打我

最新推荐文章于 2024-04-19 23:38:03 发布

爱吃猫的Linux

最新推荐文章于 2024-04-19 23:38:03 发布

阅读量1.3k

点赞数 3

文章标签：云计算 linux 运维服务器 centos

本文链接：https://blog.csdn.net/qq_52099294/article/details/125275791

版权

1.安装环境规划

controller	4C 4G	/boot 200MB /swap 2G 剩下的全部给/
系统	CentOS-7-x86_64-Minimal-1908
节点
compute	4C 4G	/boot 200MB /swap 2G 剩下的全部给/

1.1.初始化环境

1.关闭防火墙
systemctl stop firewalld&&systemctl disabled firewalld
2.关闭selinux
sed -i "s/^SELINUX=enforcing/SELINUX=disabled/g"
setenforce 0

1.2.安装时间服务器（双节点）

yum -y install chrony

1.3.安装OpenStack包(双节点)

yum install centos-release-openstack-train -y
安装openstack客户端（controller）
yum install python-openstackclient -y

1.4.安装依赖什么的yum源（双节点）

yum install python3-openstackclient openstack-selinux -y

1.5.安装数据库（controller）

yum install mariadb mariadb-server python2-PyMySQL -y

1.6.编辑数据库配置文件

vim /etc/my.cnf.d/openstack.cnf
# 配置文件内容
[mysqld]
bind-address = 控制节点IP
default-storage-engine = innodb
innodb_file_per_table = on
max_connections = 4096
collation-server = utf8_general_ci
character-set-server = utf8

启动数据库
systemctl start mariadb.service;systemctl enable mariadb.service

初始化数据库
mysql_secure_installation

1.7.安装消息队列

yum install rabbitmq-server -y

启动和开机自动启动
systemctl enable rabbitmq-server.service;systemctl start rabbitmq-server.service

添加OpenStack用户
rabbitmqctl add_user openstack 1

允许用户进行配置、写入和读取访问 openstack：
rabbitmqctl set_permissions openstack ".*" ".*" ".*"

查看服务
rabbitmq-plugins list

开启图形化界面
rabbitmq-plugins enable rabbitmq_management rabbitmq_management_agent

查看
ip:15672  
用户名：guest 
密码：guest

1.8.安装Memcached

yum install memcached python-memcached -y

vim /etc/sysconfig/memcached
配置文件内容
OPTIONS="-l 127.0.0.1,::1,controller"

开机启动和自启
systemctl enable memcached.service;systemctl start memcached.service

2.openstack各组件的安装

2.1.keystone组件安装

mysql -u root -p

创建keystone数据库：
CREATE DATABASE keystone;

授予对keystone数据库的适当访问权限：
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone123';

安装软件包
yum install openstack-keystone httpd mod_wsgi -y

配置数据库访问
vim /etc/keystone/keystone.conf
[database]
connection = mysql+pymysql://keystone:keystone123@controller/keystone
[token]
provider = fernet

同步数据库
su -s /bin/sh -c "keystone-manage db_sync" keystone

创建令牌
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone


 keystone-manage bootstrap --bootstrap-password admin \
  --bootstrap-admin-url http://controller:5000/v3/ \
  --bootstrap-internal-url http://controller:5000/v3/ \
  --bootstrap-public-url http://controller:5000/v3/ \
  --bootstrap-region-id RegionOne
  
 配置Apache
 vi /etc/httpd/conf/httpd.conf
 ServerName controller
 
创建软连接
 ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/
 
 启动和开机自启
 systemctl enable httpd.service;systemctl start httpd.service
 
 通过设置适当的环境变量来配置管理帐户：
 vim admin.sh（官方文档名字为clouds.yaml）
 export OS_USERNAME=admin
 export OS_PASSWORD=admin
 export OS_PROJECT_NAME=admin
 export OS_USER_DOMAIN_NAME=Default
 export OS_PROJECT_DOMAIN_NAME=Default
 export OS_AUTH_URL=http://controller:5000/v3
 export OS_IDENTITY_API_VERSION=3
 
 检验openstack是否可以使用
 openstack endpoint list

2.2.创建域、项目、用户和角色

创建域
openstack domain create --description "An Example Domain" example

创建项目
openstack project create --domain default --description "Service Project" service

常规（非管理员）任务应使用非特权项目和用户。例如，本指南创建myproject项目和myuser 用户。
openstack project create --domain default --description "Demo Project" myproject

创建myuser用户：
openstack user create --domain default --password-prompt myuser #设置myuser密码为：1

创建myrole角色：
openstack role create myrole

将myrole角色添加到myproject项目和myuser用户：
openstack role add --project myproject --user myuser myrole

验证
unset OS_AUTH_URL OS_PASSWORD
 
需要输入admin密码
openstack --os-auth-url http://controller:5000/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name admin --os-username admin token issue
 
需要输入myuser密码：
openstack --os-auth-url http://controller:5000/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name myproject --os-username myuser token issue

创建admin的环境变量
vim admin.sh
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

创建myuser的环境变量
vim myuser.sh（官方文档名字为demo-openrc）
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=myproject
export OS_USERNAME=myuser
export OS_PASSWORD=1
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

2.3.glance组件安装

创建数据库
CREATE DATABASE glance;

授予对glance数据库的适当访问权限：
GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%' IDENTIFIED BY 'glance123';

退出数据库然后获取admin凭据以访问仅限管理员的 CLI 命令：
source admin.sh

创建glance用户：
openstack user create --domain default --password-prompt glance #密码：1

将admin角色添加到glance用户和 service项目：
openstack role add --project service --user glance admin

创建glance服务实体：
openstack service create --name glance --description "OpenStack Image" image

创建图像服务 API 端点：
openstack endpoint create --region RegionOne image public http://controller:9292
openstack endpoint create --region RegionOne image internal http://controller:9292
openstack endpoint create --region RegionOne image admin http://controller:9292

安装软件包
yum install openstack-glance -y

配置glance文件
vim /etc/glance/glance-api.conf
[database]
connection = mysql+pymysql://glance:glance123@controller/glance

在[keystone_authtoken]和[paste_deploy]部分中，配置身份服务访问：
[keystone_authtoken]
www_authenticate_uri  = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = glance
password = 1

[paste_deploy]
flavor = keystone

在该[glance_store]部分中，配置本地文件系统存储和图像文件的位置：
[glance_store]
stores = file,http
default_store = file
filesystem_store_datadir = /var/lib/glance/images/

同步数据库
su -s /bin/sh -c "glance-manage db_sync" glance

启动自启服务
systemctl enable openstack-glance-api.service;systemctl start openstack-glance-api.service

验证：上传镜像
glance image-create --name "cirros" --file cirros-0.4.0-x86_64-disk.img --disk-format qcow2 --container-format bare --visibility public

2.4.placement组件安装

创建placement数据库：
CREATE DATABASE placement;

授予对数据库的适当访问权限：
GRANT ALL PRIVILEGES ON placement.* TO 'placement'@'%' IDENTIFIED BY 'placement123';

退出数据库，然后获取admin凭据以访问仅限管理员的 CLI 命令：
source admin.sh

使用您选择的创建放置服务用户PLACEMENT_PASS：
openstack user create --domain default --password-prompt placement  #设置密码：1

将 Placement 用户添加到具有管理员角色的服务项目中：
openstack role add --project service --user placement admin

在服务目录中创建 Placement API 条目：
openstack service create --name placement --description "Placement API" placement

创建 Placement API 服务端点：
openstack endpoint create --region RegionOne placement public http://controller:8778
openstack endpoint create --region RegionOne placement internal http://controller:8778
openstack endpoint create --region RegionOne placement admin http://controller:8778

安装软件包：
yum install openstack-placement-api -y


vim /etc/placement/placement.conf
在该[placement_database]部分中，配置数据库访问：

[placement_database]
connection = mysql+pymysql://placement:placement123@controller/placement

在[api]和[keystone_authtoken]部分中，配置身份服务访问：
[api]
auth_strategy = keystone

[keystone_authtoken]
auth_url = http://controller:5000/v3
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = placement
password = 1

同步数据库
su -s /bin/sh -c "placement-manage db sync" placement

bug 如果httpd的版本大于2.4需要配置(最后面添加)
vim /etc/httpd/conf.d/00-placement-api.conf
<Directory /usr/bin>
   <IfVersion >= 2.4>
      Require all granted
   </IfVersion>
   <IfVersion < 2.4>
      Order allow,deny
      Allow from all
   </IfVersion>
</Directory>


重启服务
systemctl restart httpd

验证
source admin.sh
placement-status upgrade check

2.5. nova组件安装

创建nova_api、nova和nova_cell0数据库：
CREATE DATABASE nova_api;
CREATE DATABASE nova;
CREATE DATABASE nova_cell0;

授予对数据库的适当访问权限：
GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'%' IDENTIFIED BY 'nova123';

GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' IDENTIFIED BY 'nova123';
  
GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'%' IDENTIFIED BY 'nova123';

退出数据库，然后加载权限
创建nova用户：
openstack user create --domain default --password-prompt nova #设置密码：1

将admin角色添加到nova用户：
openstack role add --project service --user nova admin

创建nova服务实体：
openstack service create --name nova --description "OpenStack Compute" compute

创建计算 API 服务端点：
openstack endpoint create --region RegionOne compute public http://controller:8774/v2.1
openstack endpoint create --region RegionOne compute internal http://controller:8774/v2.1
openstack endpoint create --region RegionOne compute admin http://controller:8774/v2.1


安装软件包：
yum install openstack-nova-api openstack-nova-conductor(提供数据库连接) openstack-nova-novncproxy（访问云主机） openstack-nova-scheduler（负责调度） -y

vim /etc/nova/nova.conf
在该[DEFAULT]部分中，仅启用计算和元数据 API：

[DEFAULT]
enabled_apis = osapi_compute,metadata
在[api_database]和[database]部分中，配置数据库访问：

[api_database]
connection = mysql+pymysql://nova:nova123@controller/nova_api

[database]
connection = mysql+pymysql://nova:nova123@controller/nova

在该[DEFAULT]部分中，配置RabbitMQ消息队列访问：
[DEFAULT]
transport_url = rabbit://openstack:1@controller:5672/

#注意，此处密码同消息队列中创建openstack用户的密码
my_ip = 192.168.135.159
use_neutron = true
firewall_driver = nova.virt.firewall.NoopFirewallDriver

在[api]和[keystone_authtoken]部分中，配置身份服务访问：

[api]
auth_strategy = keystone

[keystone_authtoken]
www_authenticate_uri = http://controller:5000/
auth_url = http://controller:5000/
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = nova
password = 1

[vnc]
enabled = true
server_listen = $my_ip
server_proxyclient_address = $my_ip

[glance]
api_servers = http://controller:9292

[oslo_concurrency]
lock_path = /var/lib/nova/tmp

[placement]
region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://controller:5000/v3
username = placement
password = 1

同步数据库
su -s /bin/sh -c "nova-manage api_db sync" nova

注册cell0数据库：
su -s /bin/sh -c "nova-manage cell_v2 map_cell0" nova

创建cell1单元格：
su -s /bin/sh -c "nova-manage cell_v2 create_cell --name=cell1 --verbose" nova

填充新星数据库：
su -s /bin/sh -c "nova-manage db sync" nova

验证 nova cell0 和 cell1 是否正确注册：
su -s /bin/sh -c "nova-manage cell_v2 list_cells" nova

启动自启服务
systemctl enable \
    openstack-nova-api.service \
    openstack-nova-scheduler.service \
    openstack-nova-conductor.service \
    openstack-nova-novncproxy.service
systemctl restart \
    openstack-nova-api.service \
    openstack-nova-scheduler.service \
    openstack-nova-conductor.service \
    openstack-nova-novncproxy.service
    
    
    
    
    
计算节点配置
安装软件包
yum install openstack-nova-compute -y

vim /etc/nova/nova.conf
[DEFAULT]
enabled_apis = osapi_compute,metadata
transport_url = rabbit://openstack:1@controller
my_ip = 192.168.135.160
use_neutron = true
firewall_driver = nova.virt.firewall.NoopFirewallDriver

[api]
auth_strategy = keystone

[keystone_authtoken]
www_authenticate_uri = http://controller:5000/
auth_url = http://controller:5000/
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = nova
password = 1

[vnc]
enabled = true
server_listen = 0.0.0.0
server_proxyclient_address = $my_ip
novncproxy_base_url = http://controller:6080/vnc_auto.html

[glance]
api_servers = http://controller:9292

[oslo_concurrency]
lock_path = /var/lib/nova/tmp

[placement]
region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://controller:5000/v3
username = placement
password = 1

查看是否支持CPU虚拟化
egrep -c '(vmx|svm)' /proc/cpuinfo

如为零配置
[libvirt]
virt_type = qemu

启动服务自启
systemctl enable libvirtd.service openstack-nova-compute.service;systemctl start libvirtd.service openstack-nova-compute.service

验证（控制节点）
 openstack compute service list --service nova-compute
 
主机发现
su -s /bin/sh -c "nova-manage cell_v2 discover_hosts --verbose" nova

2.6. neutron组件安装(控制节点)

创建数据库
CREATE DATABASE neutron;
授权
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'neutron123';

退出数据库
创建neutron用户：
openstack user create --domain default --password-prompt neutron #创建密码：1

将admin角色添加到neutron用户：
openstack role add --project service --user neutron admin

创建neutron服务实体：
openstack service create --name neutron --description "OpenStack Networking" network

创建网络服务 API 端点：
openstack endpoint create --region RegionOne network public http://controller:9696
openstack endpoint create --region RegionOne network internal http://controller:9696
openstack endpoint create --region RegionOne network admin http://controller:9696

安装服务
yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables


配置文件
vim /etc/neutron/neutron.conf
[database]
connection = mysql+pymysql://neutron:neutron123@controller/neutron

[DEFAULT]
core_plugin = ml2
service_plugins =
transport_url = rabbit://openstack:1@controller
auth_strategy = keystone
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true

[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = 1

注意neutron残缺配置文件需要从别的配置问价拷贝
https://docs.openstack.org/ocata/config-reference/networking/samples/ml2_conf.ini.html


[nova]
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = 1

[oslo_concurrency]
lock_path = /var/lib/neutron/tmp






配置 Modular Layer 2 (ML2) 插件
vim /et：c/neutron/plugins/ml2/ml2_conf.ini
[ml2]
type_drivers = flat,vlan
tenant_network_types =
mechanism_drivers = linuxbridge
extension_drivers = port_security

[ml2_type_flat]
flat_networks = extnet(名称可以自己起，但是一定要记住)

[securitygroup]
enable_ipset = true


配置 Linux 网桥代理
vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
(此文件不完整需要从https://docs.openstack.org/ocata/config-reference/networking/samples/linuxbridge_agent.ini.html这里复制然后粘贴进去)
[linux_bridge]
physical_interface_mappings = extnet:ens33

[vxlan]
enable_vxlan = false

[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

配置内核参数
vim /etc/sysctl.conf
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
加载模块
modprobe br_netfilter
sysctl -p



配置 DHCP 代理
vim /etc/neutron/dhcp_agent.ini
[DEFAULT]
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true


配置元数据代理¶
vim /etc/neutron/metadata_agent.ini
[DEFAULT]
nova_metadata_host = controller
metadata_proxy_shared_secret = 1

配置计算服务以使用网络服务¶
vim /etc/nova/nova.conf
[neutron]
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = 1
service_metadata_proxy = true
metadata_proxy_shared_secret = 1

创建软连接
ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
同步数据库
su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

重启计算api服务
systemctl restart openstack-nova-api.service

systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service;systemctl restart neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service

2.7.neutron组件安装(计算节点)

安装组件
yum install openstack-neutron-linuxbridge ebtables ipset

配置文件
vim /etc/neutron/neutron.conf
[DEFAULT]
transport_url = rabbit://openstack:1@controller
auth_strategy = keystone

[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = 1

[oslo_concurrency]
lock_path = /var/lib/neutron/tmp


配置提供商网络
vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[linux_bridge]
physical_interface_mappings = extnet:ens33

[vxlan]
enable_vxlan = false

[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

配置内核参数
vim /etc/sysctl.conf 
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1


配置计算服务以使用网络服务¶
vim /etc/nova/nova.conf
[neutron]
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = 1

重启计算服务
systemctl restart openstack-nova-compute.service

启动 Linux 网桥代理并将其配置为在系统引导时启动：
systemctl enable neutron-linuxbridge-agent.service;systemctl start neutron-linuxbridge-agent.service

控制节点验证
openstack network agent list

2.8.dashboard组件安装

安装软件包
yum install openstack-dashboard -y

配置文件
vim /etc/openstack-dashboard/local_settings 
OPENSTACK_HOST = "controller"
ALLOWED_HOSTS = ["*"]

SESSION_ENGINE = 'django.contrib.sessions.backends.cache'

CACHES = {
    'default': {
         'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
         'LOCATION': 'controller:11211',
    }
}


OPENSTACK_KEYSTONE_URL = "http://%s:5000/v3" % OPENSTACK_HOST

OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True

OPENSTACK_API_VERSIONS = {
    "identity": 3,
    "image": 2,
    "volume": 3,
}


OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = "Default"

OPENSTACK_KEYSTONE_DEFAULT_ROLE = "user"(注意)

OPENSTACK_NEUTRON_NETWORK = {
    ...
    'enable_router': False,
    'enable_quotas': False,
    'enable_distributed_router': False,
    'enable_ha_router': False,
    'enable_lb': False,
    'enable_firewall': False,
    'enable_vpn': False,
    'enable_fip_topology_check': False,
}


TIME_ZONE = "Asia/Shanghai"

vim /etc/httpd/conf.d/openstack-dashboard.conf
WSGIApplicationGroup %{GLOBAL}

重启服务
systemctl restart httpd.service memcached.service

访问不了页面
在 /etc/openstack-dashboard/local_settings文件中添加
WEBROOT = "/dashboard"（在197行）