openstack 云计算平台 mitaka 搭建

最新推荐文章于 2023-01-24 20:46:29 发布
最新推荐文章于 2023-01-24 20:46:29 发布
阅读量1.3k 收藏 4
点赞数 1
分类专栏： openstack 文章标签： openstack 云服务 云计算 运维 keystone
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/thermal_life/article/details/107363454
版权

简介

OpenStack是什么？

云计算：形象化的说法，云计算是一种按使用量付费的模式，这种模式提供可用的、便捷的、按需的网络访问

云计算的分类：

  1. 公有云：公有云通常指第三方提供商为用户提供的能够使用的云，公有云一般可通过 Internet 使用，可能是免费或成本低廉的，公有云的核心属性是共享资源服务。
  2. 私有云：私有云是为一个客户单独使用而构建的，因而提供对数据、安全性和服务质量的最有效控制。该公司拥有基础设施，并可以控制在此基础设施上部署应用程序的方式。私有云可部署在企业数据中心的防火墙内，也可以将它们部署在一个安全的主机托管场所，私有云的核心属性是专有资源。
  3. 混合云：混合云融合了公有云和私有云，是近年来云计算的主要模式和发展方向。我们已经知道私有云主要是面向企业用户，出于安全考虑，企业更愿意将数据存放在私有云中，但是同时又希望可以获得公有云的计算资源，在这种情况下混合云被越来越多的采用，它将公有云和私有云进行混合和匹配，以获得最佳的效果，这种个性化的解决方案，达到了既省钱又安全的目的。

云计算的服务形式：

  • Iaas：基础架构即服务。提供云主机（各种物理资源)

  • Paas：平台即服务。提供中间件，服务组件

  • Saas：软件即服务。提供软件

OpenStack是一种Iaas的解决方案

OpenStack是一个开源的云计算管理平台项目，由几个主要的组件组合起来完成具体工作。OpenStack支持几乎所有类型的云环境，项目目标是提供实施简单、可大规模扩展、丰富、标准统一的云计算管理平台。OpenStack通过各种互补的服务提供了基础设施即服务（IaaS）的解决方案，每个服务提供API以进行集成。

OpenStack和RHV有什么区别

RHV是采用虚拟化资源统一集中的管理的方式，资源由管理员统一分配，类似于计划经济；而OpenStack属于自助管理，需要什么就买什么，按需付费，类似于市场经济。

OpenStack解决了什么问题

OpenStack是一个旨在为公有云以及私有云的建设与管理提供软件的开源项目。它的社区拥有超过130家企业及1350位开发者，这些机构与个人都将OpenStack作为基础设施即服务（IaaS）资源的通用前端。OpenStack项目的首要任务是简化云的部署过程并为其带来良好的可扩展性。本文希望通过提供必要的指导信息，帮助大家利用OpenStack前端来设置及管理自己的公共云或私有云。

OpenStack 中有哪些项目？

  • keystone：认证服务。Keystone 认证所有 OpenStack 服务并对其进行授权。同时，它也是所有服务的端点目录。
  • glance：镜像服务。Glance 可存储和检索多个位置的虚拟机磁盘镜像。
  • nova：计算服务。是一个完整的 OpenStack 计算资源管理和访问工具，负责处理规划、创建和删除操作。
  • neutron：网络服务。Neutron 能够连接其他 OpenStack 服务并连接网络。
  • dashboard：web管理界面
  • Swift： 是一种高度容错的对象存储服务，使用 RESTful API 来存储和检索非结构数据对象。
  • Cinder ：块存储服务。通过自助服务 API 访问持久块存储。
  • Ceilometer：监控服务。计费
  • Heat：集群服务。编排

在这里插入图片描述
从官网入手学习：https://docs.openstack.org/mitaka/zh_CN/install-guide-rdo/environment.html

openstack的部署对计算机的要求是比较高的，我们只部署控制结点，计算结点，存储结点
在这里插入图片描述
控制结点负责调度（跑一些核心应用），计算结点负责运行云主机，存储结点负责存储数据。

环境

安全

OpenStack 服务支持各种各样的安全方式，包括密码 password、policy 和 encryption，支持的服务包括数据库服务器，且消息 broker 至少支持 password 的安全方式。

由于密码比较多，我们可以用表格来记录密码。
还可以用openssl来生成密码：

[root@server1 ~]# openssl rand -hex 10
9275b356d387e3b78215

网络

控制结点需要两个网卡：

[root@server1 network-scripts]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:8b:de:3d brd ff:ff:ff:ff:ff:ff
    inet 172.25.254.1/24 brd 172.25.254.255 scope global ens3
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fe8b:de3d/64 scope link 
       valid_lft forever preferred_lft forever
3: eth0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state D
[root@server1 network-scripts]# cat ifcfg-eth0 
BOOTPROTO=none
DEVICE=eth0
ONBOOT=yes
eth0 是我新加进来的网.

[root@server1 network-scripts]# ifup eth0		/激活这个设备
[root@server1 network-scripts]# ip addr show eth0
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:b2:b9:4e brd ff:ff:ff:ff:ff:ff
    inet6 fe80::5054:ff:feb2:b94e/64 scope link 
       valid_lft forever preferred_lft forever

配置域名解析:

[root@server1 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.254.67 	rhel7host
172.25.254.1	controller
172.25.254.2	compute1
172.25.254.3	block1

[root@server1 ~]# hostnamectl set-hostname controller

时间同步

安装Chrony,保证openstack集群时间同步：

宿主机上：

[root@rhel7host redhat]# systemctl status chronyd
● chronyd.service - NTP client/server
   Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2020-07-15 11:47:17 CST; 8h ago
  Process: 825 ExecStartPost=/usr/libexec/chrony-helper update-daemon (code=exited, status=0/SUCCESS)
  Process: 761 ExecStart=/usr/sbin/chronyd $OPTIONS (code=exited, status=0/SUCCESS)
 Main PID: 779 (chronyd)
   CGroup: /system.slice/chronyd.service
           └─779 /usr/sbin/chronyd

[root@rhel7host redhat]# vim /etc/chrony.conf
server ntp1.aliyun.com iburst
server ntp2.aliyun.com iburst			/使用阿里云的时间同步服务器
server ntp3.aliyun.com iburst
。。
# Allow NTP client access from local network.
allow 172.25/16			/允许172.25这个网段的主机同步我的时间

控制结点上;

[root@server1 network-scripts]# yum install chrony -y
[root@server1 network-scripts]# vim /etc/chrony.conf 
server 172.25.254.67 iburst			从宿主机上同步时间
[root@server1 network-scripts]# systemctl enable --now chronyd		/设置开机自启

[root@server1 network-scripts]# chronyc sources -v
210 Number of sources = 1

  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| /   '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
||                                                 .- xxxx [ yyyy ] +/- zzzz
||      Reachability register (octal) -.           |  xxxx = adjusted offset,
||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
||                                \     |          |  zzzz = estimated error.
||                                 |    |           \
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^* rhel7host                     3   6    17    31  -2665ns[-5183ns] +/-   41ms

除过控制结点，起他的结点也是同样的配置，这只是一种方式，可以根据采用不同的选择，比如只在openstack集群中同步即可

安装openstack包

我们使用的是openstack的mitaka版本：

[root@rhel7host mitaka]# pwd
/var/ftp/pub/openstack/mitaka		/放在宿主机的这个路径下

在server1中配置yum源

[root@server1 yum.repos.d]# cat openstack.repo 
[openstack]
name=mitaka
baseurl=ftp://172.25.254.67/pub/openstack/mitaka
gpgcheck=0
[root@server1 yum.repos.d]# yum repolist 
Loaded plugins: product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager to register.
openstack                                                                                                                                                                                   | 2.9 kB  00:00:00     
openstack/primary_db                                                                                                                                                                        | 141 kB  00:00:00     
repo id                                                                                                 repo name                                                                                            status
openstack                                                                                               mitaka                                                                                                 279
westos                                                                                                  westos                                                                                               5,152
repolist: 5,431
  1. 我们先更新一下系统：
[root@server1 ~]# yum upgrade
  1. 安装 OpenStack 客户端（命令行）：
yum install python-openstackclient
  1. 关闭SELinux
[root@server1 ~]# getenforce 
Disabled

SQL数据库

  1. 安装软件包：
yum install mariadb mariadb-server python2-PyMySQL
  1. 创建并编辑 /etc/my.cnf.d/openstack.cnf
[root@server1 ~]# vim /etc/my.cnf.d/openstack.cnf
[root@server1 ~]# cat /etc/my.cnf.d/openstack.cnf
[mysqld]
bind-address = 172.25.254.1			/绑定控制结点地址
default-storage-engine = innodb		/存储引擎
innodb_file_per_table		/独占表空间
max_connections = 4096		/最大连接数
collation-server = utf8_general_ci
character-set-server = utf8		/字符集

[root@server1 ~]# systemctl enable --now mariadb				/设置开机自启
Created symlink from /etc/systemd/system/multi-user.target.wants/mariadb.service to /usr/lib/systemd/system/mariadb.service.
[root@server1 ~]# mysql_secure_installation 

Set root password? [Y/n] y
New password: 	caoaoyuan
Re-enter new password: 	caoaoyuan

Remove anonymous users? [Y/n] y

Disallow root login remotely? [Y/n] y

Remove test database and access to it? [Y/n] y

Reload privilege tables now? [Y/n] y

消息队列

安装包：
[root@server1 ~]# yum install rabbitmq-server -y
启动消息队列服务并将其配置为随系统启动：
[root@server1 ~]# systemctl enable --now rabbitmq-server.service 
Created symlink from /etc/systemd/system/multi-user.target.wants/rabbitmq-server.service to /usr/lib/systemd/system/rabbitmq-server.service.
添加 openstack 用户：
[root@server1 ~]# rabbitmqctl add_user openstack openstack		/我这里设置密码和用户名相同，后面的是密码
Creating user "openstack" ...

给	openstack 用户配置写和读权限：
[root@server1 ~]# rabbitmqctl set_permissions openstack ".*" ".*" ".*"
Setting permissions for user "openstack" in vhost "/" ...

这里的 .* 的意思是：

[root@server1 ~]# rabbitmq-plugins list			/查看插件
[root@server1 ~]# rabbitmq-plugins enable rabbitmq_management   /打开管理器，回启动响应插件

在这里插入图片描述
账户密码都是 guest。
在这里插入图片描述
可以看到我们刚才设置的权限。

Memcached

接下来的认证服务认证缓存使用Memcached缓存令牌。缓存服务memecached运行在控制节点。在生产部署中，我们推荐联合启用防火墙、认证和加密保证它的安全。以前使用的是mysql，但是会造成压力且需要定期回收，memcache可以设置最长存储时间，来解决这个问题。

安装软件包：
[root@server1 ~]# yum install memcached python-memcached -y
[root@server1 ~]# vim /etc/sysconfig/memcached 
PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="64"
#OPTIONS="-l 127.0.0.1,::1"		/注释掉这里，让他监听本机所有的接口，保证远程连接可以成功


启动Memcached服务，并且配置它随机启动。
[root@server1 ~]# systemctl enable --now memcached.service 
Created symlink from /etc/systemd/system/multi-user.target.wants/memcached.service to /usr/lib/systemd/system/memcached.service.
[root@server1 ~]# netstat -tnlp |grep 11211
tcp        0      0 0.0.0.0:11211           0.0.0.0:*               LISTEN      5320/memcached      
tcp6       0      0 :::11211                :::*                    LISTEN      5320/memcached

认证服务keystone

认证服务的主要作用就是提供认证和授权服务，颁布令牌，它还有一个目录专门用于存放各个api的端点，当不同的组件进行通信时，就可以通过 api 进行访问。

在你配置 OpenStack 身份认证服务前，你必须创建一个数据库和管理员令牌。所有的数据都存放在数据库当中，美创建一个组件，就要创建相应的数据库。

[root@server1 ~]# mysql -uroot -pcaoaoyuan
/创建 keystone 数据库：
MariaDB [(none)]> CREATE DATABASE keystone;
Query OK, 1 row affected (0.00 sec)
/对``keystone``数据库授予恰当的权限：
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'keystone';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone';
% 让外部也可以连接

/生成一个随机值在初始的配置中作为管理员的令牌。
[root@controller ~]# openssl rand -hex 10
f8eea09f945c8d29431b

安全并配置组件

[root@controller ~]# vim /etc/keystone/keystone.conf
[DEFAULT]

admin_token = f8eea09f945c8d29431b		/定义初始管理令牌的值,和上面生成的一致，仅在初始化是使用

[database]
connection = mysql+pymysql://keystone:keystone@controller/keystone
							   用户		密码				要访问的数据库

[token]
provider = fernet			/选择token的提供者

以keystone初始化身份认证服务的数据库：
[root@controller ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone
[root@controller ~]# mysql -p

MariaDB [(none)]> use keystone;

MariaDB [keystone]> show tables;
+------------------------+
| Tables_in_keystone     |
+------------------------+
| access_token           |
	.......
| service_provider       |
| token                  |
| trust                  |
| trust_role             |
| user                   |				/表已经生成了
| user_group_membership  |
| whitelisted_config     |
+------------------------+

初始化Fernet keys：

[root@controller ~]# cd /etc/keystone/
[root@controller keystone]# ls
default_catalog.templates  keystone.conf  keystone-paste.ini  logging.conf  policy.json  sso_callback_template.html
[root@controller keystone]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
[root@controller keystone]# ls
default_catalog.templates  fernet-keys  keystone.conf  keystone-paste.ini  logging.conf  policy.json  sso_callback_template.html


生成了  fernet-keys  这个目录

配置 Apache HTTP 服务器

[root@controller keystone]# vim /etc/httpd/conf/httpd.conf			
#ServerName www.example.com:80
ServerName controller				/配置``ServerName`` 选项为控制节点

[root@controller conf.d]# vim /etc/httpd/conf.d/wsgi-keystone.conf
Listen 5000
Listen 35357			/监听两个端口

<VirtualHost *:5000>
    WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-public
    WSGIScriptAlias / /usr/bin/keystone-wsgi-public			/用于外部访问
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    ErrorLogFormat "%{cu}t %M"
    ErrorLog /var/log/httpd/keystone-error.log
    CustomLog /var/log/httpd/keystone-access.log combined

    <Directory /usr/bin>
        Require all granted
    </Directory>
</VirtualHost>

<VirtualHost *:35357>
    WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-admin
    WSGIScriptAlias / /usr/bin/keystone-wsgi-admin				/用于内部控制
    WSGIApplicationGroup %{GLOBAL}			
    WSGIPassAuthorization On
    ErrorLogFormat "%{cu}t %M"
    ErrorLog /var/log/httpd/keystone-error.log
    CustomLog /var/log/httpd/keystone-access.log combined

    <Directory /usr/bin>
        Require all granted
    </Directory>
</VirtualHost>

[root@controller conf.d]# systemctl enable --now httpd.service 
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
[root@controller conf.d]# netstat -tnlp | grep 5000
tcp6       0      0 :::5000                 :::*                    LISTEN      16119/httpd         
[root@controller conf.d]# netstat -tnlp | grep 35357
tcp6       0      0 :::35357                :::*                    LISTEN      16119/httpd

创建服务实体和API端点

先决条件

[root@controller conf.d]# export OS_TOKEN=f8eea09f945c8d29431b		/配置认证令牌
[root@controller conf.d]# export OS_URL=http://controller:35357/v3		/配置端点URL
[root@controller conf.d]# export OS_IDENTITY_API_VERSION=3		/配置认证 API 版本

在你的Openstack环境中，认证服务管理服务目录。服务使用这个目录来决定您的环境中可用的服务。
创建服务实体和身份认证服务：

[root@controller conf.d]# openstack service create --name keystone --description "OpenStack Identity" identity
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | OpenStack Identity               |
| enabled     | True                             |
| id          | eb2a914b7f0d4752868784b47a31a703 |
| name        | keystone                         |
| type        | identity                         |
[root@controller conf.d]# openstack service list
+----------------------------------+----------+----------+
| ID                               | Name     | Type     |
+----------------------------------+----------+----------+
| eb2a914b7f0d4752868784b47a31a703 | keystone | identity |
+----------------------------------+----------+----------+

创建认证服务的 API 端点：

[root@controller conf.d]# openstack endpoint create --region RegionOne identity public http://controller:5000/v3
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | 7be3b4c7194344dcb883a3fa63123467 |
| interface    | public                           |				/外部使用的端点
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | eb2a914b7f0d4752868784b47a31a703 |
| service_name | keystone                         |
| service_type | identity                         |
| url          | http://controller:5000/v3        |
+--------------+----------------------------------+
[root@controller conf.d]# openstack endpoint create --region RegionOne \
>   identity internal http://controller:5000/v3
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | 6bdd28b8ece7497181ca3f97347caa37 |
| interface    | internal                         |
| region       | RegionOne                        |			/内部使用的端点
| region_id    | RegionOne                        |
| service_id   | eb2a914b7f0d4752868784b47a31a703 |
| service_name | keystone                         |
| service_type | identity                         |
| url          | http://controller:5000/v3        |
+--------------+----------------------------------+
[root@controller conf.d]# openstack endpoint create --region RegionOne \
>   identity admin http://controller:35357/v3
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | cd6130854ba143f0bdfd6c9603fa6e95 |
| interface    | admin                            |
| region       | RegionOne                        |			/管理员使用的端点
| region_id    | RegionOne                        |
| service_id   | eb2a914b7f0d4752868784b47a31a703 |
| service_name | keystone                         |
| service_type | identity                         |
| url          | http://controller:35357/v3       |
+--------------+----------------------------------+
[root@controller conf.d]# openstack endpoint list
+----------------------------------+-----------+--------------+--------------+---------+-----------+----------------------------+
| ID                               | Region    | Service Name | Service Type | Enabled | Interface | URL                        |
+----------------------------------+-----------+--------------+--------------+---------+-----------+----------------------------+
| 6bdd28b8ece7497181ca3f97347caa37 | RegionOne | keystone     | identity     | True    | internal  | http://controller:5000/v3  |
| 7be3b4c7194344dcb883a3fa63123467 | RegionOne | keystone     | identity     | True    | public    | http://controller:5000/v3  |
| cd6130854ba143f0bdfd6c9603fa6e95 | RegionOne | keystone     | identity     | True    | admin     | http://controller:35357/v3 |
+----------------------------------+-----------+--------------+--------------+---------+-----------+----------------------------+

创建域、项目、用户和角色

[root@controller conf.d]# openstack domain list
			/当前没有域
[root@controller conf.d]# 

[root@controller conf.d]# openstack domain create --description "Default Domain" default
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Default Domain                   |
| enabled     | True                             |			/创建域``default``
| id          | c80fd98d2b4b4946839e90c6a4eea979 |
| name        | default                          |
+-------------+----------------------------------+
[root@controller conf.d]# openstack project create --domain default \
>   --description "Admin Project" admin
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+			/创建 admin 项目：
| description | Admin Project                    |
| domain_id   | c80fd98d2b4b4946839e90c6a4eea979 |
| enabled     | True                             |
| id          | 5bd822f5700d4153bc85403de17b35db |
| is_domain   | False                            |
| name        | admin                            |
| parent_id   | c80fd98d2b4b4946839e90c6a4eea979 |
+-------------+----------------------------------+
[root@controller conf.d]# openstack user create --domain default \
>   --password admin admin
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | c80fd98d2b4b4946839e90c6a4eea979 |
| enabled   | True                             |
| id        | 7d45ebaf9a974ce69b8f6197c7f8719f |
| name      | admin                            |				/创建 admin 用户：
+-----------+----------------------------------+
[root@controller conf.d]# openstack role create admin
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | None                             |			
| id        | c08749bee57d4d2ead99fb744da4bd00 |
| name      | admin                            |			/创建 admin 角色：
+-----------+----------------------------------+
[root@controller conf.d]# openstack role add --project admin --user admin admin		/添加``admin`` 角色到 admin 项目和用户上：



[root@controller conf.d]# openstack project create --domain default \
>   --description "Service Project" service
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Service Project                  |
| domain_id   | c80fd98d2b4b4946839e90c6a4eea979 |
| enabled     | True                             |
| id          | 1785606c122c413c9a134bf92e6f5374 |
| is_domain   | False                            |
| name        | service                          |			/创建``service``项目：
| parent_id   | c80fd98d2b4b4946839e90c6a4eea979 |
+-------------+----------------------------------+
[root@controller conf.d]# openstack project create --domain default \
>   --description "Demo Project" demo
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Demo Project                     |
| domain_id   | c80fd98d2b4b4946839e90c6a4eea979 |
| enabled     | True                             |
| id          | cdc49f2f64d24621b0f54bcc72b6b5df |
| is_domain   | False                            |
| name        | demo                             |			/创建``demo`` 项目：无特权的项目和用户
| parent_id   | c80fd98d2b4b4946839e90c6a4eea979 |
+-------------+----------------------------------+
[root@controller conf.d]# openstack user create --domain default \
>   --password demo demo
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | c80fd98d2b4b4946839e90c6a4eea979 |
| enabled   | True                             |
| id        | aa9345f4858145ca8a4e295f63a44647 |
| name      | demo                             |			/创建``demo`` 用户
+-----------+----------------------------------+
[root@controller conf.d]# openstack role create user
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | None                             |
| id        | bd16a57f93ba41a9b1a1bf16af4b5dd2 |
| name      | user                             |			/创建 user 角色
+-----------+----------------------------------+
[root@controller conf.d]# openstack role add --project demo --user demo user	/添加 user``角色到 ``demo 项目和用户

验证操作

重置``OS_TOKEN``和``OS_URL`` 环境变量：
[root@controller conf.d]#  unset OS_TOKEN OS_URL

作为 admin 用户，连接keystone请求认证令牌：
[root@controller conf.d]# openstack --os-auth-url http://controller:35357/v3 \
>   --os-project-domain-name default --os-user-domain-name default \
>   --os-project-name admin --os-username admin token issue
Password: 
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field      | Value                                                                                                                                                                                   |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires    | 2020-07-16T04:52:21.551634Z                                                                                                                                                             |
| id         | gAAAAABfD871WyI80v9BBl7Kykt3JMvSJa_VOs7Mr1qx-IdCJm4Q_RzXELO4JRdEXnUEkRgm9xDwKu6Hafi3wftADCQ48_gbTKxOwoqwDPGkccv5bnc7ydWf-Awoqg-Y0oLlNjwc4v8e1XVrus3Y6QZLY1r5qKU7vwDwR_WuRU8rV654x9vHIak |
| project_id | 5bd822f5700d4153bc85403de17b35db                                                                                                                                                        |
| user_id    | 7d45ebaf9a974ce69b8f6197c7f8719f                                                                                                                                                        |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
默认存放在memcache中

作为``demo`` 用户，请求认证令牌：
[root@controller conf.d]# openstack --os-auth-url http://controller:5000/v3 \
>   --os-project-domain-name default --os-user-domain-name default \
>   --os-project-name demo --os-username demo token issue
Password: 
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field      | Value                                                                                                                                                                                   |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| expires    | 2020-07-16T04:53:10.651151Z                                                                                                                                                             |
| id         | gAAAAABfD88m_PHLeX07fQc9rVtznPrOGJcZjx4bGNj42V5lTj6U7XQQTpgINUgNVSRYvaiP1TRg-Z5KjJDvs3FPICMbONMoqCvt2Pypt8U9u5-8hTMJJniN0_EUAflfilI3ZCGoVWbQ5qmJBGQ8ze6LjPXZgaYItj4KfTwmaQWei5XAnA3LaJE |
| project_id | cdc49f2f64d24621b0f54bcc72b6b5df                                                                                                                                                        |
| user_id    | aa9345f4858145ca8a4e295f63a44647                                                                                                                                                        |
+------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

列出用户：
[root@controller conf.d]# openstack --os-auth-url http://controller:5000/v3   --os-project-domain-name default --os-user-domain-name default   --os-project-name admin --os-username admin user list
Password: 
+----------------------------------+-------+
| ID                               | Name  |
+----------------------------------+-------+
| 7d45ebaf9a974ce69b8f6197c7f8719f | admin |
| aa9345f4858145ca8a4e295f63a44647 | demo  |
+----------------------------------+-------+

每次连接openstack都使用这种方式是比较麻烦的，所以官方让我们创建脚本，放到环境变量中：

创建 OpenStack 客户端环境脚本

[root@controller ~]# cat admin-openrc 			/管理员脚本
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_AUTH_URL=http://controller:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

[root@controller ~]# vim demo-openrc 			/demo用户脚本
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

[root@controller ~]# source admin-openrc 			/切换到管理员的脚本
[root@controller ~]# openstack user list
+----------------------------------+-------+
| ID                               | Name  |
+----------------------------------+-------+
| 7d45ebaf9a974ce69b8f6197c7f8719f | admin |
| aa9345f4858145ca8a4e295f63a44647 | demo  |			/就可以直接列出了
+----------------------------------+-------+

[root@controller ~]# source demo-openrc 
[root@controller ~]# openstack user list		/切换到普通用户就不行了。
You are not authorized to perform the requested action: identity:list_users (HTTP 403) (Request-ID: req-3c904770-943e-49a9-9b92-d35ac7749b17)

[root@controller ~]# source admin-openrc 
[root@controller ~]# openstack project list
+----------------------------------+---------+
| ID                               | Name    |
+----------------------------------+---------+
| 1785606c122c413c9a134bf92e6f5374 | service |
| 5bd822f5700d4153bc85403de17b35db | admin   |
| cdc49f2f64d24621b0f54bcc72b6b5df | demo    |
+----------------------------------+---------+

Glance镜像服务

OpenStack镜像服务包括以下组件：

glance-api

  • 接收镜像API的调用，诸如镜像发现、恢复、存储。

glance-registry

  • 存储、处理和恢复镜像的元数据，元数据包括项诸如大小和类型。

数据库

  • 存放镜像元数据，用户是可以依据个人喜好选择数据库的，多数的部署使用MySQL或SQLite。

镜像文件的存储仓库

  • 支持多种类型的仓库，它们有普通文件系统、对象存储、RADOS块设备、HTTP、以及亚马逊S3。记住，其中一些仓库仅支持只读方式使用。

元数据定义服务

  • 通用的API，是用于为厂商，管理员，服务，以及用户自定义元数据。这种元数据可用于不同的资源，例如镜像，工件，卷，配额以及集合。一个定义包括了新属性的键，描述，约束以及可以与之关联的资源的类型。

安装和配置

创建glance数据库

(openstack) [root@controller ~]# mysql -u root -p
Enter password: 

MariaDB [(none)]> CREATE DATABASE glance;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost'  IDENTIFIED BY 'glance';
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%'  IDENTIFIED BY 'glance';
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> Ctrl-C -- exit!
Aborted
[root@controller ~]# mysql -uglance -pglance

MariaDB [(none)]>	/测试可以登陆即可

创建服务证书

[root@controller ~]# source admin-openrc 
[root@controller ~]# openstack user create --domain default --password glance glance
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | c80fd98d2b4b4946839e90c6a4eea979 |
| enabled   | True                             |
| id        | 12b1ebac364f42d3b499347824d4f13a |
| name      | glance                           |		/创建 glance 用户
+-----------+----------------------------------+	
[root@controller ~]# openstack role add --project service --user glance admin	/添加 admin 角色到 glance 用户和 service 项目上
[root@controller ~]# openstack service create --name glance \		
>   --description "OpenStack Image" image		/创建``glance``服务实体
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | OpenStack Image                  |
| enabled     | True                             |
| id          | 0783cb66f29049fcb4a2c9c0789aeb14 |
| name        | glance                           |
| type        | image                            |
+-------------+----------------------------------+

创建镜像服务的 API 端点

[root@controller ~]# openstack endpoint create --region RegionOne \
>   image public http://controller:9292
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | 40b0c5637a20483b97e91907a966021a |
| interface    | public                           |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 0783cb66f29049fcb4a2c9c0789aeb14 |
| service_name | glance                           |
| service_type | image                            |
| url          | http://controller:9292           |
+--------------+----------------------------------+
[root@controller ~]# openstack endpoint create --region RegionOne \
>   image internal http://controller:9292
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | 36a2e7acde264897983487c2efaf6b6f |
| interface    | internal                         |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 0783cb66f29049fcb4a2c9c0789aeb14 |
| service_name | glance                           |
| service_type | image                            |
| url          | http://controller:9292           |
+--------------+----------------------------------+
[root@controller ~]# openstack endpoint create --region RegionOne \
>   image admin http://controller:9292
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | d18ac764e04d4b1d973b83e85349c63b |
| interface    | admin                            |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 0783cb66f29049fcb4a2c9c0789aeb14 |
| service_name | glance                           |
| service_type | image                            |
| url          | http://controller:9292           |
+--------------+----------------------------------+

[root@controller ~]# yum install openstack-glance -y
[root@controller ~]# vim  /etc/glance/glance-api.conf 
[DEFAULT]
connection = mysql+pymysql://glance:glance@controller/glance		/连接数据库

[keystone_authtoken]				/连接keystone，进行认证授权
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = glance
password = glance

[paste_deploy]
flavor = keystone

[glance_store]
stores = file,http		/在 [glance_store] 部分，配置本地文件系统存储和镜像文件位置
default_store = file
filesystem_store_datadir = /var/lib/glance/images/


[DEFAULT]
connection = mysql+pymysql://glance:glance@controller/glance

[keystone_authtoken]
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = glance
password = glance

[paste_deploy]
flavor = keystone

[root@controller ~]# su -s /bin/sh -c "glance-manage db_sync" glance	/以glance身份同步数据库

[root@controller ~]# systemctl enable --now openstack-glance-api.service openstack-glance-registry.service
Created symlink from /etc/systemd/system/multi-user.target.wants/openstack-glance-api.service to /usr/lib/systemd/system/openstack-glance-api.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/openstack-glance-registry.service to /usr/lib/systemd/system/openstack-glance-registry.service.
[root@controller ~]# netstat -tnlp|grep 9292
tcp        0      0 0.0.0.0:9292            0.0.0.0:*               LISTEN      17924/python2

验证操作

下载源镜像：
wget http://download.cirros-cloud.net/0.3.4/cirros-0.3.4-x86_64-disk.img

上传：
[root@controller ~]# openstack image create "cirros" \
>   --file cirros-0.3.4-x86_64-disk.img \
>   --disk-format qcow2 --container-format bare \			公共可见
>   --public
+------------------+------------------------------------------------------+
| Field            | Value                                                |
+------------------+------------------------------------------------------+
| checksum         | ee1eca47dc88f4879d8a229cc70a07c6                     |
| container_format | bare                                                 |
| created_at       | 2020-07-16T05:52:49Z                                 |
| disk_format      | qcow2                                                |
| file             | /v2/images/5b9aae7b-761b-4551-8a5d-e569b63fc070/file |
| id               | 5b9aae7b-761b-4551-8a5d-e569b63fc070                 |
| min_disk         | 0                                                    |
| min_ram          | 0                                                    |
| name             | cirros                                               |
| owner            | 5bd822f5700d4153bc85403de17b35db                     |
| protected        | False                                                |
| schema           | /v2/schemas/image                                    |
| size             | 13287936                                             |
| status           | active                                               |
| tags             |                                                      |
| updated_at       | 2020-07-16T05:52:49Z                                 |
| virtual_size     | None                                                 |
| visibility       | public                                               |
+------------------+------------------------------------------------------+
[root@controller ~]# cd /var/lib/glance/images/
[root@controller images]# ls
5b9aae7b-761b-4551-8a5d-e569b63fc070
[root@controller images]# openstack image list
+--------------------------------------+--------+--------+
| ID                                   | Name   | Status |
+--------------------------------------+--------+--------+
| 5b9aae7b-761b-4551-8a5d-e569b63fc070 | cirros | active |
+--------------------------------------+--------+--------+

就成功了。

nova计算服务

OpenStack计算服务由下列组件所构成：

  • nova-api 服务

    • 接收和响应来自最终用户的计算API请求。此服务支持OpenStack计算服务API，Amazon EC2 API，以及特殊的管理API用于赋予用户做一些管理的操作。它会强制实施一些规则，发起多数的编排活动，例如运行一个实例。

  • nova-api-metadata 服务

    • 接受来自虚拟机发送的元数据请求。

。。。。。。

安装并配置控制节点

先决条件

[root@controller ~]# mysql -uroot -p
Enter password: 

MariaDB [(none)]> CREATE DATABASE nova_api;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> CREATE DATABASE nova;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'localhost' \
    ->   IDENTIFIED BY 'nova';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'%' \
    ->   IDENTIFIED BY 'nova';
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'localhost' \
    ->   IDENTIFIED BY 'nova';
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%'    IDENTIFIED BY 'nova';
Query OK, 0 rows affected (0.00 sec)

[root@controller ~]# mysql -unova -p nova
Enter password: 

MariaDB [nova]> 

[root@controller ~]# mysql -unova -p nova_api
Enter password: 

MariaDB [nova_api]> 			/能登录进去即可

创建服务证书：

[root@controller ~]# openstack user create --domain default \
>   --password nova nova		/创建 nova 用户
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | c80fd98d2b4b4946839e90c6a4eea979 |
| enabled   | True                             |
| id        | e9821d5458e241fc8c7938a8999f6176 |
| name      | nova                             |
+-----------+----------------------------------+
[root@controller ~]# openstack role add --project service --user nova admin		/给 nova 用户添加 admin 角色
[root@controller ~]# openstack service create --name nova \		：
>   --description "OpenStack Compute" compute			/创建 nova 服务实体
+-------------+----------------------------------+	
| Field       | Value                            |
+-------------+----------------------------------+
| description | OpenStack Compute                |
| enabled     | True                             |
| id          | 93792920eb764f3c8515e2532e5ab48e |
| name        | nova                             |
| type        | compute                          |
+-------------+----------------------------------+

创建 Compute 服务 API 端点:
[root@controller ~]# openstack endpoint create --region RegionOne \
>   compute public http://controller:8774/v2.1/%\(tenant_id\)s
+--------------+-------------------------------------------+
| Field        | Value                                     |
+--------------+-------------------------------------------+
| enabled      | True                                      |
| id           | ef90b4491aa9434b9ffd50f1c6b23fee          |
| interface    | public                                    |
| region       | RegionOne                                 |
| region_id    | RegionOne                                 |
| service_id   | 93792920eb764f3c8515e2532e5ab48e          |
| service_name | nova                                      |
| service_type | compute                                   |
| url          | http://controller:8774/v2.1/%(tenant_id)s |
+--------------+-------------------------------------------+
[root@controller ~]# openstack endpoint create --region RegionOne \
>   compute internal http://controller:8774/v2.1/%\(tenant_id\)s
+--------------+-------------------------------------------+
| Field        | Value                                     |
+--------------+-------------------------------------------+
| enabled      | True                                      |
| id           | 36adfeaaf2454ee39977af8e70db4368          |
| interface    | internal                                  |
| region       | RegionOne                                 |
| region_id    | RegionOne                                 |
| service_id   | 93792920eb764f3c8515e2532e5ab48e          |
| service_name | nova                                      |
| service_type | compute                                   |
| url          | http://controller:8774/v2.1/%(tenant_id)s |
+--------------+-------------------------------------------+
[root@controller ~]# openstack endpoint create --region RegionOne \
>   compute admin http://controller:8774/v2.1/%\(tenant_id\)s
+--------------+-------------------------------------------+
| Field        | Value                                     |
+--------------+-------------------------------------------+
| enabled      | True                                      |
| id           | 1886fea1ccdc47e6898f1c98ea2640e0          |
| interface    | admin                                     |
| region       | RegionOne                                 |
| region_id    | RegionOne                                 |
| service_id   | 93792920eb764f3c8515e2532e5ab48e          |
| service_name | nova                                      |
| service_type | compute                                   |
| url          | http://controller:8774/v2.1/%(tenant_id)s |
+--------------+-------------------------------------------+

安全并配置组件

[root@controller ~]#  yum install openstack-nova-api openstack-nova-conductor   openstack-nova-console openstack-nova-novncproxy   openstack-nova-scheduler -y

[root@controller ~]# vim /etc/nova/nova.conf

[DEFAULT]
enabled_apis = osapi_compute,metadata		/只启用计算和元数据API
rpc_backend = rabbit
auth_strategy = keystone
my_ip = 172.25.254.1
use_neutron = True
firewall_driver = nova.virt.firewall.NoopFirewallDriver		/使能 Networking 服务


[api_database]
connection = mysql+pymysql://nova:nova@controller/nova_api

[database]		/配置数据库的连接：
connection = mysql+pymysql://nova:nova@controller/nova

[oslo_messaging_rabbit]
rabbit_host = controller
rabbit_userid = openstack		/配置 “RabbitMQ” 消息队列访问
rabbit_password = openstack

[keystone_authtoken]
...
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service				/配置认证服务访问
username = nova
password = nova

[vnc]		/配置VNC代理使用控制节点的管理接口IP地址
vncserver_listen = $my_ip
vncserver_proxyclient_address = $my_ip

[glance]		/配置镜像服务 API 的位置
api_servers = http://controller:9292

配置锁路径:
[oslo_concurrency]
lock_path = /var/lib/nova/tmp

使用nova同步Compute 数据库，授权：

[root@controller ~]# su -s /bin/sh -c "nova-manage api_db sync" nova

[root@controller ~]# su -s /bin/sh -c "nova-manage db sync" nova

[root@controller ~]# systemctl enable openstack-nova-api.service \
>   openstack-nova-consoleauth.service openstack-nova-scheduler.service \
>   openstack-nova-conductor.service openstack-nova-novncproxy.service

[root@controller ~]# systemctl start openstack-nova-api.service   openstack-nova-consoleauth.service openstack-nova-scheduler.service   openstack-nova-conductor.service openstack-nova-novncproxy.service

[root@controller ~]# openstack compute service list
+----+------------------+------------+----------+---------+-------+----------------------------+
| Id | Binary           | Host       | Zone     | Status  | State | Updated At                 |
+----+------------------+------------+----------+---------+-------+----------------------------+
|  1 | nova-consoleauth | controller | internal | enabled | up    | 2020-07-16T07:17:52.000000 |
|  2 | nova-conductor   | controller | internal | enabled | up    | 2020-07-16T07:17:52.000000 |
|  3 | nova-scheduler   | controller | internal | enabled | up    | 2020-07-16T07:17:52.000000 |
+----+------------------+------------+----------+---------+-------+----------------------------+

计算服务正常。

安装和配置计算节点

我们在开启一台虚拟机作为计算结点，注意它的CPU模式要设置为host-passthrough模式。不然等会就要设置nova 为 qemu 的方式。
在这里插入图片描述

[root@compute1 ~]# vim /etc/hosts
[root@compute1 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.254.67 	rhel7host
172.25.254.1	controller
172.25.254.2	compute1
172.25.254.3	block1		/做好本地解析

[root@controller ~]# scp /etc/yum.repos.d/openstack.repo compute1:/etc/yum.repos.d/ 配置yum源


[root@compute1 ~]# yum upgrade
[root@compute1 ~]# yum  install chrony -y
[root@compute1 ~]# vim /etc/chrony.conf 
server 172.25.254.67 iburst

[root@compute1 ~]# systemctl restart chronyd

安全并配置组件:

[root@compute1 ~]# yum install openstack-nova-compute -y

[root@compute1 ~]# vim /etc/nova/nova.conf
[DEFAULT]
backend = rabbit
auth_strategy = keystone
my_ip = 172.25.254.2
use_neutron = True
firewall_driver = nova.virt.firewall.NoopFirewallDriver

[oslo_messaging_rabbit]
rabbit_host = controller
rabbit_userid = openstack
rabbit_password = openstack

[keystone_authtoken]
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = nova
password = nova

[vnc]
enabled = True
vncserver_listen = 0.0.0.0
vncserver_proxyclient_address = $my_ip
novncproxy_base_url = http://controller:6080/vnc_auto.html

[glance]
api_servers = http://controller:9292

[oslo_concurrency]
lock_path = /var/lib/nova/tmp

完成安装:

[root@compute1 ~]# egrep -c '(vmx|svm)' /proc/cpuinfo
2		/确定您的计算节点是否支持虚拟机的硬件加速,我们有两个cpu

[root@compute1 ~]# vim /etc/nova/nova.conf
[libvirt]
virt_type=kvm			/告诉他们使用kvm虚拟化，如果cpu不是host-passthrough，则这里使用qemu的方式

[root@compute1 ~]# systemctl enable --now libvirtd.service openstack-nova-compute.service
Created symlink from /etc/systemd/system/multi-user.target.wants/openstack-nova-compute.service to /usr/lib/systemd/system/openstack-nova-compute.service.
libvirtd.service  提供一个虚拟化接口，便于我们的管理。
[root@compute1 ~]# yum install -y libvirt-client	/安装客户端，可以看后面创建的云主机。
[root@compute1 ~]# virsh list
 Id    Name                           State
----------------------------------------------------	/当前没有主机


[root@controller ~]# openstack compute service list
+----+------------------+------------+----------+---------+-------+----------------------------+
| Id | Binary           | Host       | Zone     | Status  | State | Updated At                 |
+----+------------------+------------+----------+---------+-------+----------------------------+
|  1 | nova-consoleauth | controller | internal | enabled | up    | 2020-07-16T08:42:54.000000 |
|  2 | nova-conductor   | controller | internal | enabled | up    | 2020-07-16T08:42:54.000000 |
|  3 | nova-scheduler   | controller | internal | enabled | up    | 2020-07-16T08:42:54.000000 |
|  6 | nova-compute     | compute1   | nova     | enabled | up    | 2020-07-16T08:42:58.000000 |
+----+------------------+------------+----------+---------+-------+----------------------------+

创建成功。

Networking 服务

它包含下列组件：

neutron-server

接收和路由API请求到合适的OpenStack网络插件，以达到预想的目的。

OpenStack网络插件和代理

插拔端口，创建网络和子网，以及提供IP地址，这些插件和代理依赖于供应商和技术而不同，OpenStack网络基于插件和代理为Cisco 虚拟和物理交换机、NEC OpenFlow产品，Open vSwitch,Linux bridging以及VMware NSX 产品穿线搭桥。

常见的代理L3(3层)，DHCP(动态主机IP地址)，以及插件代理。

消息队列

大多数的OpenStack Networking安装都会用到，用于在neutron-server和各种各样的代理进程间路由信息。也为某些特定的插件扮演数据库的角色，以存储网络状态

OpenStack网络主要和OpenStack计算交互，以提供网络连接到它的实例。

安装并配置控制节点

创建数据库：

[root@controller ~]# mysql -u root -p
Enter password: 

MariaDB [(none)]> CREATE DATABASE neutron;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' \
    ->   IDENTIFIED BY 'neutron';
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' \
    ->   IDENTIFIED BY 'neutron';
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> Ctrl-C -- exit!
Aborted
[root@controller ~]# mysql -u neutron -p neutron
Enter password: 

MariaDB [neutron]>		/可以查看即可

创建服务证书：

[root@controller ~]# openstack user create --domain default --password  neutron  neutron
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | c80fd98d2b4b4946839e90c6a4eea979 |
| enabled   | True                             |
| id        | 9ae043c57c6e4cef9b01960fe349db53 |
| name      | neutron                          |
+-----------+----------------------------------+
[root@controller ~]# openstack role add --project service --user neutron admin		/添加``admin`` 角色到``neutron`` 用户

创建``neutron``服务实体:
[root@controller ~]# openstack service create --name neutron \
>   --description "OpenStack Networking" network
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | OpenStack Networking             |
| enabled     | True                             |
| id          | 0a299286098c497fb753d989c3534377 |
| name        | neutron                          |
| type        | network                          |
+-------------+----------------------------------+

网络服务API端点:
[root@controller ~]# openstack endpoint create --region RegionOne \
>   network public http://controller:9696
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | db64468bf6ac448ba1f22ac183ff393e |
| interface    | public                           |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 0a299286098c497fb753d989c3534377 |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://controller:9696           |
+--------------+----------------------------------+
[root@controller ~]# openstack endpoint create --region RegionOne \
>   network internal http://controller:9696
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | 0e1d98aa999d41a49f4c2cf12bc9881b |
| interface    | internal                         |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 0a299286098c497fb753d989c3534377 |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://controller:9696           |
+--------------+----------------------------------+
[root@controller ~]# openstack endpoint create --region RegionOne \
>   network admin http://controller:9696
+--------------+----------------------------------+
| Field        | Value                            |
+--------------+----------------------------------+
| enabled      | True                             |
| id           | fe1f53ef8e3b4c1bad3d2a5f426b78cf |
| interface    | admin                            |
| region       | RegionOne                        |
| region_id    | RegionOne                        |
| service_id   | 0a299286098c497fb753d989c3534377 |
| service_name | neutron                          |
| service_type | network                          |
| url          | http://controller:9696           |
+--------------+----------------------------------+

然后我们创建公共网络，将所有的云主机放到同一个网段:

[root@controller ~]# yum install openstack-neutron openstack-neutron-ml2   openstack-neutron-linuxbridge ebtables -y
[root@controller ~]# vim /etc/neutron/neutron.conf

[DEFAULT]
core_plugin = ml2
service_plugins =		/启用ML2插件并禁用其他插件
rpc_backend = rabbit
auth_strategy = keystone
notify_nova_on_port_status_changes = True
notify_nova_on_port_data_changes = True


[database]
connection = mysql+pymysql://neutron:neutron@controller/neutron	/配置数据库访问

[oslo_messaging_rabbit]
rabbit_host = controller		/配置 “RabbitMQ” 消息队列的连接
rabbit_userid = openstack
rabbit_password = openstack

[keystone_authtoken]			/配置认证服务访问
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = neutron

[nova]
auth_url = http://controller:35357
auth_type = password			/配置网络服务来通知计算节点的网络拓扑变化
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = nova

[oslo_concurrency]
lock_path = /var/lib/neutron/tmp		/配置锁路径

配置 Modular Layer 2 (ML2) 插件:

[root@controller ~]# vim /etc/neutron/plugins/ml2/ml2_conf.ini
[ml2]
type_drivers = flat,vlan		/启用flat和VLAN网络
tenant_network_types =			/禁用私有网络
mechanism_drivers = linuxbridge		/启用Linuxbridge机制
extension_drivers = port_security		/启用端口安全扩展驱动


[ml2_type_flat]
flat_networks = provider		/配置公共虚拟网络为flat网络

[securitygroup]
enable_ipset = True		/启用 ipset 增加安全组规则的高效性,让我们的第二块网卡（无IP）映射过来用于虚拟机的网络访问

配置Linuxbridge代理：

[root@controller ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[linux_bridge]
physical_interface_mappings = provider:eth0 		/将公共虚拟网络和公共物理网络接口对应起来

[securitygroup]			/启用安全组并配置 Linuxbridge iptables firewall driver
enable_security_group = True		
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

[vxlan]
enable_vxlan = False		/禁止VXLAN覆盖网络

配置DHCP代理,用于给云主机动态分配IP：

[root@controller ~]# vim /etc/neutron/dhcp_agent.ini
[DEFAULT]
interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = True

配置Linuxbridge驱动接口，DHCP驱动并启用隔离元数据，这样在公共网络上的实例就可以通过网络来访问元数据

配置元数据代理：

[root@controller ~]# vim /etc/neutron/metadata_agent.ini
[DEFAULT]
nova_metadata_ip = controller
metadata_proxy_shared_secret = westos		/配置访问参数，启用元数据代理并设置密码

为计算节点配置网络服务,配置访问参数，启用元数据代理并设置密码:

[root@controller ~]# vim /etc/nova/nova.conf
[neutron]
url = http://controller:9696
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron

service_metadata_proxy = True
metadata_proxy_shared_secret = westos

网络服务初始化脚本需要一个超链接 /etc/neutron/plugin.ini指向ML2插件配置文件/etc/neutron/plugins/ml2/ml2_conf.ini。如果超链接不存在，使用下面的命令创建它：

[root@controller ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

同步数据库：

[root@controller ~]# su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
>   --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

由于更改了配置文件，所以要:

[root@controller ~]# systemctl restart openstack-nova-api.service

[root@controller ~]# systemctl enable neutron-server.service \
>   neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
>   neutron-metadata-agent.service
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-server.service to /usr/lib/systemd/system/neutron-server.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-linuxbridge-agent.service to /usr/lib/systemd/system/neutron-linuxbridge-agent.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-dhcp-agent.service to /usr/lib/systemd/system/neutron-dhcp-agent.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-metadata-agent.service to /usr/lib/systemd/system/neutron-metadata-agent.service.
[root@controller ~]# systemctl start neutron-server.service   neutron-linuxbridge-agent.service neutron-dhcp-agent.service   neutron-metadata-agent.service

[root@controller ~]# neutron agent-list
+--------------------------------------+--------------------+------------+-------------------+-------+----------------+---------------------------+
| id                                   | agent_type         | host       | availability_zone | alive | admin_state_up | binary                    |
+--------------------------------------+--------------------+------------+-------------------+-------+----------------+---------------------------+
| 05dadf42-2c97-41ab-b33c-727919d7e7f7 | Metadata agent     | controller |                   | :-)   | True           | neutron-metadata-agent    |
| d0837e5a-0351-408c-9bb8-1b808beb0e73 | DHCP agent         | controller | nova              | :-)   | True           | neutron-dhcp-agent        |
| d2a9b415-d227-4815-b449-a43e1d39b9fe | Linux bridge agent | controller |                   | :-)   | True           | neutron-linuxbridge-agent |
+--------------------------------------+--------------------+------------+-------------------+-------+----------------+---------------------------+

正常启动

安装和配置计算节点

[root@compute1 ~]#  yum install openstack-neutron-linuxbridge ebtables ipset -y

[root@compute1 ~]# vim /etc/neutron/neutron.conf
[DEFAULT]
...
rpc_backend = rabbit
auth_strategy = keystone

[oslo_messaging_rabbit]
rabbit_host = controller
rabbit_userid = openstack
rabbit_password = openstack

[keystone_authtoken]
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = neutron

[oslo_concurrency]
lock_path = /var/lib/neutron/tmp

配置共有网络：

配置Linuxbridge代理:
[root@compute1 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
[linux_bridge]
physical_interface_mappings = provider:eth0

[vxlan]
enable_vxlan = False

[securitygroup]
enable_security_group = True
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

为计算节点配置网络服务:

[root@compute1 ~]# vim /etc/nova/nova.conf
[neutron]
url = http://controller:9696
auth_url = http://controller:35357
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = neutron

[root@compute1 ~]# systemctl restart openstack-nova-compute.service
[root@compute1 ~]# systemctl enable --now neutron-linuxbridge-agent.service
Created symlink from /etc/systemd/system/multi-user.target.wants/neutron-linuxbridge-agent.service to /usr/lib/systemd/system/neutron-linuxbridge-agent.service.

[root@controller ~]# neutron agent-list
+--------------------------------------+--------------------+------------+-------------------+-------+----------------+---------------------------+
| id                                   | agent_type         | host       | availability_zone | alive | admin_state_up | binary                    |
+--------------------------------------+--------------------+------------+-------------------+-------+----------------+---------------------------+
| 05dadf42-2c97-41ab-b33c-727919d7e7f7 | Metadata agent     | controller |                   | :-)   | True           | neutron-metadata-agent    |
| 753f0cca-82ee-44f5-a77e-856924003134 | Linux bridge agent | compute1   |                   | :-)   | True           | neutron-linuxbridge-agent |
| d0837e5a-0351-408c-9bb8-1b808beb0e73 | DHCP agent         | controller | nova              | :-)   | True           | neutron-dhcp-agent        |
| d2a9b415-d227-4815-b449-a43e1d39b9fe | Linux bridge agent | controller |                   | :-)   | True           | neutron-linuxbridge-agent |
+--------------------------------------+--------------------+------------+-------------------+-------+----------------+---------------------------+

计算结点也找到了代理，现在你的 OpenStack 环境包含了启动一个基本实例所必须的核心组件。接下来我们就可以启动云主机了。

启动一个实例

创建虚拟网络

我们一直是创建共有网络，所以我们现在创建提供者网络，而不是私有网络。

[root@controller ~]# neutron net-create --shared --provider:physical_network provider \
>   --provider:network_type flat provider
Created a new network:			/创建网络
+---------------------------+--------------------------------------+
| Field                     | Value                                |
+---------------------------+--------------------------------------+
| admin_state_up            | True                                 |
| availability_zone_hints   |                                      |
| availability_zones        |                                      |
| created_at                | 2020-07-16T09:54:53                  |
| description               |                                      |
| id                        | 411727ab-294b-4e20-89ce-de39122f2cf6 |
| ipv4_address_scope        |                                      |
| ipv6_address_scope        |                                      |
| mtu                       | 1500                                 |
| name                      | provider                             |
| port_security_enabled     | True                                 |
| provider:network_type     | flat                                 |
| provider:physical_network | provider                             |
| provider:segmentation_id  |                                      |
| router:external           | False                                |
| shared                    | True                                 |
| status                    | ACTIVE                               |
| subnets                   |                                      |
| tags                      |                                      |
| tenant_id                 | 5bd822f5700d4153bc85403de17b35db     |
| updated_at                | 2020-07-16T09:54:53                  |
+---------------------------+--------------------------------------+

在网络上创建一个子网：

[root@controller ~]# neutron subnet-create --name provider \
>   --allocation-pool start=172.25.254.100,end=172.25.254.200 \
>  --dns-nameserver 114.114.114.114 --gateway 172.25.254.67 \
>  provider 172.25.254.0/24
Created a new subnet:
+-------------------+------------------------------------------------------+
| Field             | Value                                                |
+-------------------+------------------------------------------------------+
| allocation_pools  | {"start": "172.25.254.100", "end": "172.25.254.200"} |
| cidr              | 172.25.254.0/24                                      |
| created_at        | 2020-07-16T09:58:35                                  |
| description       |                                                      |
| dns_nameservers   | 114.114.114.114                                      |
| enable_dhcp       | True                                                 |
| gateway_ip        | 172.25.254.67                                        |
| host_routes       |                                                      |
| id                | 8121a48b-406d-4eac-8955-36d53b30e8c7                 |
| ip_version        | 4                                                    |
| ipv6_address_mode |                                                      |
| ipv6_ra_mode      |                                                      |
| name              | provider                                             |
| network_id        | 411727ab-294b-4e20-89ce-de39122f2cf6                 |
| subnetpool_id     |                                                      |
| tenant_id         | 5bd822f5700d4153bc85403de17b35db                     |
| updated_at        | 2020-07-16T09:58:35                                  |
+-------------------+------------------------------------------------------+

创建m1.nano规格的主机

默认的最小规格的主机需要512 MB内存。对于环境中计算节点内存不足4 GB的，我们推荐创建只需要64 MB的m1.nano规格的主机。若单纯为了测试的目的，请使用m1.nano规格的主机来加载CirrOS镜像:

[root@controller ~]# openstack flavor create --id 0 --vcpus 1 --ram 64 --disk 1 m1.nano
+----------------------------+---------+
| Field                      | Value   |
+----------------------------+---------+
| OS-FLV-DISABLED:disabled   | False   |
| OS-FLV-EXT-DATA:ephemeral  | 0       |
| disk                       | 1       |
| id                         | 0       |
| name                       | m1.nano |
| os-flavor-access:is_public | True    |
| ram                        | 64      |
| rxtx_factor                | 1.0     |
| swap                       |         |
| vcpus                      | 1       |
+----------------------------+---------+

生成一个键值对

大部分云镜像支持公共密钥认证而不是传统的密码认证。在启动实例前，你必须添加一个公共密钥到计算服务。

[root@controller ~]# source demo-openrc 
[root@controller ~]# ssh-keygen -q -N ""
Enter file in which to save the key (/root/.ssh/id_rsa): ^C
[root@controller ~]# ssh-keygen -q -N ""
Enter file in which to save the key (/root/.ssh/id_rsa): 
[root@controller ~]# openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey
+-------------+-------------------------------------------------+
| Field       | Value                                           |
+-------------+-------------------------------------------------+
| fingerprint | e0:c6:84:35:88:b2:08:c4:3a:84:85:09:4c:d6:62:a5 |
| name        | mykey                                           |
| user_id     | aa9345f4858145ca8a4e295f63a44647                |
+-------------+-------------------------------------------------+
[root@controller ~]# openstack keypair list
+-------+-------------------------------------------------+
| Name  | Fingerprint                                     |
+-------+-------------------------------------------------+
| mykey | e0:c6:84:35:88:b2:08:c4:3a:84:85:09:4c:d6:62:a5 |
+-------+-------------------------------------------------+

生成一个公钥，把公要上传到openstack中，叫做mykey。来实现云主机的免密访问。

增加安全组规则

让外部可以允许 ICMP (ping)：的方式访问云主机

[root@controller ~]# openstack security group rule create --proto icmp default
+-----------------------+--------------------------------------+
| Field                 | Value                                |
+-----------------------+--------------------------------------+
| id                    | 6c3c4512-ac1f-4474-8b7d-9c76162f6b0d |
| ip_protocol           | icmp                                 |
| ip_range              | 0.0.0.0/0                            |
| parent_group_id       | e079876a-a035-48b2-8681-7a6e8afd9c5b |
| port_range            |                                      |
| remote_security_group |                                      |
+-----------------------+--------------------------------------+

允许安全 shell (SSH) 的访问：

[root@controller ~]# openstack security group rule create --proto tcp --dst-port 22 default
+-----------------------+--------------------------------------+
| Field                 | Value                                |
+-----------------------+--------------------------------------+
| id                    | 8cbdd408-d1e1-4df1-a4ea-20f8a87a104f |
| ip_protocol           | tcp                                  |
| ip_range              | 0.0.0.0/0                            |
| parent_group_id       | e079876a-a035-48b2-8681-7a6e8afd9c5b |
| port_range            | 22:22                                |
| remote_security_group |                                      |
+-----------------------+--------------------------------------+

启动一个实例

一个实例指定了虚拟机资源的大致分配，包括处理器、内存和存储。

列出可用类型：
[root@controller ~]# openstack flavor list
+----+-----------+-------+------+-----------+-------+-----------+
| ID | Name      |   RAM | Disk | Ephemeral | VCPUs | Is Public |
+----+-----------+-------+------+-----------+-------+-----------+
| 0  | m1.nano   |    64 |    1 |         0 |     1 | True      |	/我们定义的
| 1  | m1.tiny   |   512 |    1 |         0 |     1 | True      |
| 2  | m1.small  |  2048 |   20 |         0 |     1 | True      |
| 3  | m1.medium |  4096 |   40 |         0 |     2 | True      |
| 4  | m1.large  |  8192 |   80 |         0 |     4 | True      |
| 5  | m1.xlarge | 16384 |  160 |         0 |     8 | True      |
+----+-----------+-------+------+-----------+-------+-----------+

列出可用镜像：
[root@controller ~]# openstack image list
+--------------------------------------+--------+--------+
| ID                                   | Name   | Status |
+--------------------------------------+--------+--------+
| 5b9aae7b-761b-4551-8a5d-e569b63fc070 | cirros | active |
+--------------------------------------+--------+--------+

列出可用网络：
[root@controller ~]# openstack network list
+--------------------------------------+----------+--------------------------------------+
| ID                                   | Name     | Subnets                              |
+--------------------------------------+----------+--------------------------------------+
| 411727ab-294b-4e20-89ce-de39122f2cf6 | provider | 8121a48b-406d-4eac-8955-36d53b30e8c7 |
+--------------------------------------+----------+--------------------------------------+

列出可用安全组
[root@controller ~]# openstack security group list
+--------------------------------------+---------+------------------------+----------------------------------+
| ID                                   | Name    | Description            | Project                          |
+--------------------------------------+---------+------------------------+----------------------------------+
| e079876a-a035-48b2-8681-7a6e8afd9c5b | default | Default security group | cdc49f2f64d24621b0f54bcc72b6b5df |
+--------------------------------------+---------+------------------------+----------------------------------+

创建实例

[root@controller ~]# openstack server create --flavor m1.nano --image cirros \
> --nic net-id=411727ab-294b-4e20-89ce-de39122f2cf6 --security-group default \
> --key-name mykey provider-instance
+--------------------------------------+-----------------------------------------------+
| Field                                | Value                                         |
+--------------------------------------+-----------------------------------------------+
| OS-DCF:diskConfig                    | MANUAL                                        |
| OS-EXT-AZ:availability_zone          |                                               |
| OS-EXT-STS:power_state               | 0                                             |
| OS-EXT-STS:task_state                | scheduling                                    |
| OS-EXT-STS:vm_state                  | building                                      |
| OS-SRV-USG:launched_at               | None                                          |
| OS-SRV-USG:terminated_at             | None                                          |
| accessIPv4                           |                                               |
| accessIPv6                           |                                               |
| addresses                            |                                               |
| adminPass                            | G2dqfrhJEC87                                  |
| config_drive                         |                                               |
| created                              | 2020-07-16T10:13:40Z                          |
| flavor                               | m1.nano (0)                                   |
| hostId                               |                                               |
| id                                   | 9face239-809c-4852-994c-04440a6fb699          |
| image                                | cirros (5b9aae7b-761b-4551-8a5d-e569b63fc070) |
| key_name                             | mykey                                         |
| name                                 | provider-instance                             |
| os-extended-volumes:volumes_attached | []                                            |
| progress                             | 0                                             |
| project_id                           | cdc49f2f64d24621b0f54bcc72b6b5df              |
| properties                           |                                               |
| security_groups                      | [{u'name': u'default'}]                       |
| status                               | BUILD                                         |
| updated                              | 2020-07-16T10:13:40Z                          |
| user_id                              | aa9345f4858145ca8a4e295f63a44647              |
+--------------------------------------+-----------------------------------------------+


 openstack server create 
 --flavor m1.nano 			/使用nao类型
 --image cirros 			/使用cirros镜像
--nic net-id=411727ab-294b-4e20-89ce-de39122f2cf6 		/网络
--security-group default \		/安全组
--key-name mykey		/key
 provider-instance		/云主机名

[root@controller ~]# openstack server list			/查看实例状态
+--------------------------------------+-------------------+--------+-------------------------+
| ID                                   | Name              | Status | Networks                |
+--------------------------------------+-------------------+--------+-------------------------+
| 9face239-809c-4852-994c-04440a6fb699 | provider-instance | ACTIVE | provider=172.25.254.101 |
+--------------------------------------+-------------------+--------+-------------------------+
[root@controller ~]# openstack console url show provider-instance		/获取实例url
+-------+---------------------------------------------------------------------------------+
| Field | Value                                                                           |
+-------+---------------------------------------------------------------------------------+
| type  | novnc                                                                           |
| url   | http://controller:6080/vnc_auto.html?token=575f8909-b1af-4bb0-8307-a08ea732128d |
+-------+---------------------------------------------------------------------------------+

[root@rhel7host Downloads]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.254.1 server1 controller		/在物理主机做好解析

访问刚才的url地址：
在这里插入图片描述
这就是我们的云主机啦，它把用户和密码都打在了上面。
在这里插入图片描述
它获得的ip时172.25.254.101，100被连接接口占用了。

[root@controller ~]# ping 172.25.254.101		/可以ping 通
PING 172.25.254.101 (172.25.254.101) 56(84) bytes of data.
64 bytes from 172.25.254.101: icmp_seq=1 ttl=64 time=0.574 ms

[root@controller ~]# ssh root@172.25.254.101
The authenticity of host '172.25.254.101 (172.25.254.101)' can't be established.
RSA key fingerprint is SHA256:Y8kKCEqRI7dE/w0kvj+IxaEUyD18KbITuCPHkINMaSg.
RSA key fingerprint is MD5:1f:f4:8b:b4:76:48:9c:6f:3c:cc:ea:74:95:c5:9f:0c.
Are you sure you want to continue connecting (yes/no)? yes^[[3~
Warning: Permanently added '172.25.254.101' (RSA) to the list of known hosts.
Please login as 'cirros' user, not as root		/不允许通过root连接
		
^CConnection to 172.25.254.101 closed.
[root@controller ~]# ssh cirros@172.25.254.101
$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether fa:16:3e:20:55:e5 brd ff:ff:ff:ff:ff:ff
    inet 172.25.254.101/24 brd 172.25.254.255 scope global eth0
    inet6 fe80::f816:3eff:fe20:55e5/64 scope link 
       valid_lft forever preferred_lft forever
$ poweroff
poweroff: Operation not permitted
$ sudo poweroff		/超级用户可以关机

[root@controller ~]# source demo-openrc 		/新开的shell需要切换到demo用户环境
[root@controller ~]# openstack server list
+--------------------------------------+-------------------+---------+-------------------------+
| ID                                   | Name              | Status  | Networks                |
+--------------------------------------+-------------------+---------+-------------------------+
| 9face239-809c-4852-994c-04440a6fb699 | provider-instance | SHUTOFF | provider=172.25.254.101 |
+--------------------------------------+-------------------+---------+-------------------------+
[root@controller ~]# openstack server start provider-instance
[root@controller ~]# openstack server list
+--------------------------------------+-------------------+--------+-------------------------+
| ID                                   | Name              | Status | Networks                |
+--------------------------------------+-------------------+--------+-------------------------+
| 9face239-809c-4852-994c-04440a6fb699 | provider-instance | ACTIVE | provider=172.25.254.101 |

它运行在compute1 主机上：
[root@compute1 ~]# virsh list
 Id    Name                           State
----------------------------------------------------
 2     instance-00000001              running

其实就是一个虚拟机。使用kvm虚拟化.
young_dump_broke
关注
  • 1
    点赞
  • 踩
  • 4
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
OpenStack-M版（Mitaka）搭建- – -计算服务（Nova）篇
姬子的博客
11-29 2251
转载请注明：姬子的博客 » OpenStack-M版（Mitaka）搭建- – -计算服务（Nova）篇 Nova OpenStack计算服务（Nova）是基础设施即服务(IaaS)系统的主要部分，该模块主要由Python实现。 OpenStack计算组件请求OpenStack Identity服务进行认证；请求OpenStack Image服务提供磁盘镜像；为Ope
Openstack云平台搭建
weixin_48705916的博客
09-05 6096
一、openstack 安装 环境准备 主机名称 IP地址 最小资源配置 openstack 192.168.1.10 2CPU,8G内存 nova01 192.168.1.11 2CPU,3G内存 nova02 192.168.1.12 2CPU,3G内存 repo 192.168.1.250 2CPU,1G内存 上传 RHEL7-extras.iso、RHEL7OSP-10.iso 到功能服务器[repo] 二、功能服务器安装配置 1.时间源服务器 [root@repo
基于OpenStack的私有云计算平台的搭建.pdf
11-22
基于OpenStack的私有云计算平台的搭建 介绍如何搭建OPENSTACK平台
OpenStack-Mitaka
weixin_30566111的博客
04-01 241
一、Cloud 基础概念 IAAS：Infrastructre As A Service 基础架构及服务，OpenStack，CloudStack PAAS：Platform As A Service 平台及服务，Docker SAAS：Software As A Service 软件及服务 FWaas，DBaas，LBaas，... Private Cloud Public Cloud Hyb...
基于OpenStack的云计算平台设计与实现
mypods
07-20 4490
基于OpenStack的云计算平台设计与实现 李冉，王晓波，范建华，王明强 云计算能够有效的组织各类计算资源，提升计算性能。现有的成熟云计算平台的核心技术和构建过程由于商业原因而无法获取，基于开源项目OpenStack，设计并实现了一个云计算平台，平台支持多种类型客户端通过管理员和用户交互接口动态连接以请求各种配置虚拟机及获取计算、存储、软件资源等服务。云端的虚拟化管理、调度控制、存储
Openstack-mitaka安装部署
最新发布
weixin_55443474的博客
01-24 496
Openstack-mitaka安装部署
自动安装分布式mitaka版本openstack
ztsinghua的专栏
04-25 2052
作者：【吴业亮】云计算开发工程师  博客：http://blog.csdn.net/wylfengyujiancheng  mitaka已经发布四天，目前代码bug还不少，本次本地源为4月12号的代码，由于个人能力有限，一些问题暂时没解决，欢迎共同交流。  安装过程视频：http://pan.baidu.com/s/1miPE9Xu  代码路径： 链接：http://pan.baidu.c
OpenStack-mitaka部署（手把手一步一步教你搭建）
01-09
本文将详细介绍如何部署一个基于OpenStack Mitaka版本的云平台，并通过手把手教学的方式帮助读者完成搭建过程。OpenStack作为一款开源的云计算管理平台，因其高度可扩展性和灵活性而受到广泛欢迎。Mitaka版本作为...
手动搭建T版openstack平台（不会你还不学）
qq_53152568的博客
02-28 3931
此次演示安装版本为 T （Train）版 一：安装两台centos7服务器 建议最小化安装centos7 （在Windows上的VMware中安装即可）； 要求： 两台主机都再添加一块网卡（添加后一共两块网卡，建议第一块使用NAT，第二块使用桥接） 给其中一台主机多添加两块硬盘当做compute节点（都要100G） … 此过程省略… 二：设置centos7基本配置 1）：基本配置 修改主机名（两台服务器，一台改名为controller，另一台是多添加硬盘的那个命名为compute） 主机
OpenStack平台搭建
01-29
- **定义**：OpenStack是一个开源的云计算管理平台项目，是一系列软件开源项目的组合。它提供了部署云基础设施所需的全部工具，支持所有主流的虚拟化技术，并能很好地处理与云相关的各种任务。 - **功能**：包括计算...
OpenstackMitaka本地源
12-19
用于Centos7的OpenstackMitaka版的包，全部下载到本地了，传进去设置好yum源就能用。
openstack实验（一）概念介绍和基本环境的搭建
qq_44236589的博客
08-17 1018
一、初识openstack OpenStack是一个由NASA（美国国家航空航天局）和Rackspace合作研发并发起的，以Apache许可证授权的自由软件和开放源代码项目。 OpenStack是一个开源的云计算管理平台项目，由几个主要的组件组合起来完成具体工作。OpenStack支持几乎所有类型的云环境，项目目标是提供实施简单、可大规模扩展、丰富、标准统一的云计算管理平台。OpenSta...
云计算基础设施平台iaas（openstack）超级详细搭建（十八）系统卸载和版本说明
抛物线的博客
06-24 1006
注意：接与上一篇博客内容 进行更新 由于整个开源openstack安装过程过于繁琐，命令太长，太繁琐，于是把整个安装命令写成shell脚本。 脚本数量内容过多，已经推送自我的github源码托管中心了。 这是本篇脚本内容所在的github仓库位置 脚本内容介绍 #/bin/bash source /etc/xiandian/openrc.sh cat <<- EOF !!!!!!!!...
OpenStack-MitakaCentos7.2双节点搭建--（五）Neutron服务
指剑
02-06 1005
一、数据库配置（Controller节点） 用数据库连接客户端以 root 用户连接到数据库服务器： #mysql -u root -p000000 创建neutron 数据库： CREATE DATABASE neutron; 对neutron 数据库授予合适的访问权限 GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDE...
2、openstack-Mitaka 部署
Tiamon_的博客
02-28 699
2.1 环境部署 这次试验部署在了 VMware 虚拟机上，用的是 CentOS7.6 系统；openstack-M 版安装流程，同学们还可以参考 openstack 官方文档。 节点（主机名） cpu虚拟化 主机配置 IP controller 开启cpu虚拟化 4C4G 192.168.117.130 compute 开启cpu虚拟化 4C4G 192.168.117.131 2.1.1 修改主机名（所有节点均进行配置） controller 节点 [root@localho
openstack -mitaka-install(-)
weixin_34198583的博客
04-19 98
环境说明使用的光盘为centos7-x86_64-dvd-1511.iso控制节点： 主机名：controller RAM: 4G 管理接口:192.168.31.11/24桥接 承载虚拟机流量接口：10.0.0.2/24 vmnet1计算节点： 主机名：computer1 RAM...
OpenStack-Mitaka 一键安装测试环境脚本
sinat_28371057的博客
02-10 556
　　说明：这个脚本是采用Bash Shell编写，这个版本还只能作为测试环境搭建使用。 　　此脚本原形的发起人是网友：WuYuLiang.这里有他的博客链接: 　 第一版的链接:http://blog.csdn.net/wylfengyujiancheng/article/details/51137707 　　最新版链接:http://blog.csdn.net/wylfengyujiancheng/article/details/51939239 　　这个连接是我github上关于...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值