上一篇：构建基于openEuler2209的OpenStack云平台（八）
9 创建实例
成功完成前面的操作，一个最小化部署的OpenStack平台就成功完成了。接下来就可以进行实例部署了。本节中在控制节点上通过命令行界面（CLI）工具完成，也可以通过Dashboard完成，这里不作介绍。
9.1 创建虚拟网络
这里以创建提供商网络（192.168.0.0/24）为例。
1、获取admin凭证
[root@xgk-ctl ~]# source /etc/keystone/admin-openrc2、 创建网络
[root@xgk-ctl ~]# openstack network create --share --external --provider-physical-network provider --provider-network-type flat provider
+---------------------------+--------------------------------------+
| Field | Value |
+---------------------------+--------------------------------------+
| admin_state_up | UP |
| availability_zone_hints | |
| availability_zones | |
| created_at | 2022-12-21T02:18:07Z |
| description | |
| dns_domain | None |
| id | 988c1231-7d15-4779-987c-4d16cce9be44 |
| ipv4_address_scope | None |
| ipv6_address_scope | None |
| is_default | None |
| is_vlan_transparent | None |
| mtu | 1500 |
| name | provider |
| port_security_enabled | True |
| project_id | 83c34dc70d18476097211c384d2e435c |
| provider:network_type | flat |
| provider:physical_network | provider |
| provider:segmentation_id | None |
| qos_policy_id | None |
| revision_number | 1 |
| router:external | External |
| segments | None |
| shared | True |
| status | ACTIVE |
| subnets | |
| tags | |
| updated_at | 2022-12-21T02:18:07Z |
+---------------------------+--------------------------------------+
这里的--share选项允许所有项目使用该虚拟网络。
--external选项将虚拟网络定义为外部网络。如果希望创建内部网络，可以改用--internal。默认值为内部值。
注：用华为云主机构建的OpenStack平台，若使用--external选项定义外部网络，测试发现CirrOS实例无法获取IP地址，利用VMWare Workstation则不存在这个问题。
3、创建子网
这里假定提供商网络使用192.168.0.0/24，网关为192.168.0.1。DHCP服务器为每个实例分配一个从192.168.0.100到192.168.0.250的IP地址，所有实例都使用8.8.8.8作为DNS服务器地址。
[root@xgk-ctl ~]# openstack subnet create --network provider --allocation-pool start=192.168.0.100,end=192.168.0.250 --dns-nameserver 8.8.8.8 --gateway 192.168.0.1 --subnet-range 192.168.0.0/24 provider
+----------------------+--------------------------------------+
| Field | Value |
+----------------------+--------------------------------------+
| allocation_pools | 192.168.0.100-218.8.8.250 |
| cidr | 192.168.0.0/24 |
| created_at | 2022-12-21T02:57:50Z |
| description | |
| dns_nameservers | 8.8.8.8 |
| dns_publish_fixed_ip | None |
| enable_dhcp | True |
| gateway_ip | 192.168.0.1 |
| host_routes | |
| id | b4bbfdb3-0266-4484-bc0c-3c3114912363 |
| ip_version | 4 |
| ipv6_address_mode | None |
| ipv6_ra_mode | None |
| name | provider |
| network_id | 988c1231-7d15-4779-987c-4d16cce9be44 |
| project_id | 83c34dc70d18476097211c384d2e435c |
| revision_number | 0 |
| segment_id | None |
| service_types | |
| subnetpool_id | None |
| tags | |
| updated_at | 2022-12-21T02:57:50Z |
+----------------------+--------------------------------------+
9.2 创建m1.nano flavor
默认情况下，每个实例最少消耗512 MB内存。对于计算节点少于4GB内存的环境，建议创建每个实例仅需要64MB的m1.nano。用于测试目的，仅在CirrOS镜像中使用这种flavor。
[root@xgk-ctl ~]# openstack flavor create --id 0 --vcpus 1 --ram 64 --disk 1 m1.nano
+----------------------------+---------+
| Field | Value |
+----------------------------+---------+
| OS-FLV-DISABLED:disabled | False |
| OS-FLV-EXT-DATA:ephemeral | 0 |
| description | None |
| disk | 1 |
| id | 0 |
| name | m1.nano |
| os-flavor-access:is_public | True |
| properties | |
| ram | 64 |
| rxtx_factor | 1.0 |
| swap | |
| vcpus | 1 |
+----------------------------+---------+
9.3 生成密钥对
大多数云映像支持公钥身份验证，而不是传统的密码身份验证。在启动实例之前，必须向Compute服务添加公钥。
1、获取demo项目凭据
[root@xgk-ctl ~]# source /etc/keystone/demo-openrc
2、生成密钥对并添加公钥
[root@xgk-ctl ~]# ssh-keygen -q -N ""
Enter file in which to save the key (/root/.ssh/id_rsa):
[root@xgk-ctl ~]# openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey
+-------------+-------------------------------------------------+
| Field | Value |
+-------------+-------------------------------------------------+
| created_at | None |
| fingerprint | f2:ef:d9:a4:57:b6:c4:55:a4:ea:5d:fb:a5:ce:27:cf |
| id | mykey |
| is_deleted | None |
| name | mykey |
| type | ssh |
| user_id | f8472742c25a43319ebbd5e0732f8214 |
+-------------+-------------------------------------------------+
3、验证是否添加了密钥对
[root@xgk-ctl ~]# openstack keypair list
+-------+-------------------------------------------------+------+
| Name | Fingerprint | Type |
+-------+-------------------------------------------------+------+
| mykey | f2:ef:d9:a4:57:b6:c4:55:a4:ea:5d:fb:a5:ce:27:cf | ssh |
+-------+-------------------------------------------------+------+
9.4 添加安全组规则
默认情况下，默认安全组适用于所有实例，并包括拒绝对实例进行远程访问的防火墙规则。对于CirrOS等Linux镜像，建议至少允许ICMP（ping）和安全shell（SSH）。
9.4.1 允许ICMP（ping）
[root@xgk-ctl ~]# openstack security group rule create --proto icmp default
+-------------------------+--------------------------------------+
| Field | Value |
+-------------------------+--------------------------------------+
| created_at | 2022-12-21T03:38:14Z |
| description | |
| direction | ingress |
| ether_type | IPv4 |
| id | 62853f53-fef4-4a33-8392-f8b3fda2d88a |
| name | None |
| port_range_max | None |
| port_range_min | None |
| project_id | a9a1630648c34468be5d540e7fd65523 |
| protocol | icmp |
| remote_address_group_id | None |
| remote_group_id | None |
| remote_ip_prefix | 0.0.0.0/0 |
| revision_number | 0 |
| security_group_id | 4a1a39fa-394d-478d-a3ef-42e0a8d2f4d8 |
| tags | [] |
| tenant_id | a9a1630648c34468be5d540e7fd65523 |
| updated_at | 2022-12-21T03:38:14Z |
+-------------------------+--------------------------------------+
9.4.2 允许安全shell（SSH）访问
[root@xgk-ctl ~]# openstack security group rule create --proto tcp --dst-port 22 default
+-------------------------+--------------------------------------+
| Field | Value |
+-------------------------+--------------------------------------+
| created_at | 2022-12-21T03:39:11Z |
| description | |
| direction | ingress |
| ether_type | IPv4 |
| id | 5403ab64-a0dd-4a53-b814-22fb3c1bbb45 |
| name | None |
| port_range_max | 22 |
| port_range_min | 22 |
| project_id | a9a1630648c34468be5d540e7fd65523 |
| protocol | tcp |
| remote_address_group_id | None |
| remote_group_id | None |
| remote_ip_prefix | 0.0.0.0/0 |
| revision_number | 0 |
| security_group_id | 4a1a39fa-394d-478d-a3ef-42e0a8d2f4d8 |
| tags | [] |
| tenant_id | a9a1630648c34468be5d540e7fd65523 |
| updated_at | 2022-12-21T03:39:11Z |
+-------------------------+--------------------------------------+
9.5 创建并启动实例
9.5.1 确定实例选项
1、获取demo凭证
[root@xgk-ctl ~]# source /etc/keystone/demo-openrc 2、列出可用的flavor
flavor指定虚拟资源分配配置文件，其中包括处理器、内存和存储。
[root@xgk-ctl ~]# openstack flavor list
+----+---------+-----+------+-----------+-------+-----------+
| ID | Name | RAM | Disk | Ephemeral | VCPUs | Is Public |
+----+---------+-----+------+-----------+-------+-----------+
| 0 | m1.nano | 64 | 1 | 0 | 1 | True |
+----+---------+-----+------+-----------+-------+-----------+
3、列出可用镜像
[root@xgk-ctl ~]# openstack image list
+--------------------------------------+--------+--------+
| ID | Name | Status |
+--------------------------------------+--------+--------+
| 57ea2d66-8865-4900-b960-fb14b4c6a484 | cirros | active |
+--------------------------------------+--------+--------+
本实例将使用这个cirros镜像
4、列出可用网络
[root@xgk-ctl ~]# openstack network list
+--------------------------------------+----------+--------------------------------------+
| ID | Name | Subnets |
+--------------------------------------+----------+--------------------------------------+
| 988c1231-7d15-4779-987c-4d16cce9be44 | provider | b4bbfdb3-0266-4484-bc0c-3c3114912363 |
+--------------------------------------+----------+--------------------------------------+
本实例将使用提供商网络。但是，必须使用ID而不是名称来引用此网络，因此这里的ID需要了解。
5、列出可用的安全组
[root@xgk-ctl ~]# openstack security group list
+--------------------------------------+---------+-------------+----------------------------------+------+
| ID | Name | Description | Project | Tags |
+--------------------------------------+---------+-------------+----------------------------------+------+
| 4a1a39fa-394d-478d-a3ef-42e0a8d2f4d8 | default | 缺省安全组 | a9a1630648c34468be5d540e7fd65523 | [] |
+--------------------------------------+---------+-------------+----------------------------------+------+
本实例使用默认安全组。
9.5.2 创建实例
1、创建实例
[root@xgk-ctl ~]# openstack server create --flavor m1.nano --image cirros --nic net-id=988c1231-7d15-4779-987c-4d16cce9be44 --security-group default --key-name mykey provider-instance
+-----------------------------+-----------------------------------------------+
| Field | Value |
+-----------------------------+-----------------------------------------------+
| OS-DCF:diskConfig | MANUAL |
| OS-EXT-AZ:availability_zone | |
| OS-EXT-STS:power_state | NOSTATE |
| OS-EXT-STS:task_state | scheduling |
| OS-EXT-STS:vm_state | building |
| OS-SRV-USG:launched_at | None |
| OS-SRV-USG:terminated_at | None |
| accessIPv4 | |
| accessIPv6 | |
| addresses | |
| adminPass | jvfZ5W2Bd7qZ |
| config_drive | |
| created | 2022-12-21T03:55:25Z |
| flavor | m1.nano (0) |
| hostId | |
| id | 046f3fe9-6566-489d-aa72-2887a8687d14 |
| image | cirros (57ea2d66-8865-4900-b960-fb14b4c6a484) |
| key_name | mykey |
| name | provider-instance |
| progress | 0 |
| project_id | a9a1630648c34468be5d540e7fd65523 |
| properties | |
| security_groups | name='4a1a39fa-394d-478d-a3ef-42e0a8d2f4d8' |
| status | BUILD |
| updated | 2022-12-21T03:55:25Z |
| user_id | f8472742c25a43319ebbd5e0732f8214 |
| volumes_attached | |
+-----------------------------+-----------------------------------------------+
（2）检查实例的状态
[root@xgk-ctl ~]# openstack server list
+--------------------------------------+-------------------+--------+------------------------+--------------------------+---------+
| ID | Name | Status | Networks | Image | Flavor |
+--------------------------------------+-------------------+--------+------------------------+--------------------------+---------+
| 666c03e8-83a5-4e81-9e6a-31ceab8556d3 | provider-instance | BUILD | | cirros | m1.nano |
+--------------------------------------+-------------------+--------+------------------------+--------------------------+---------+
当生成过程成功完成时，状态从BUILD变为ACTIVE。
[root@xgk-ctl ~]# openstack server list
+--------------------------------------+-------------------+--------+------------------------+--------------------------+---------+
| ID | Name | Status | Networks | Image | Flavor |
+--------------------------------------+-------------------+--------+------------------------+--------------------------+---------+
| 666c03e8-83a5-4e81-9e6a-31ceab8556d3 | provider-instance | ACTIVE | provider=192.168.0.186 | cirros | m1.nano |
+--------------------------------------+-------------------+--------+------------------------+--------------------------+---------+2、通过虚拟控制台访问实例
（1）获取实例的VNC会话URL，并从web浏览器访问
[root@xgk-ctl ~]# openstack console url show provider-instance
+----------+-----------------------------------------------------------------------------------------------+
| Field | Value |
+----------+-----------------------------------------------------------------------------------------------+
| protocol | vnc |
| type | novnc |
| url | http://192.168.18.200:6080/vnc_auto.html?path=%3Ftoken%3D14ea1654-fde5-4759-9bb7-6afcafa6d1f3 |
+----------+-----------------------------------------------------------------------------------------------+
注：命令中的provider-instance为实例名称
通过返回的结果可以看到访问该实例的URL地址，在浏览器中访问该URL地址，可看到如下图所示的界面，同是可以看到CirrOS 镜像给出了登录用户名和密码。
（2）登录并测试实例的网络连通性
通过系统给出的登录用户名和密码登录系统，执行【ip a】命令可以看到该实例获得的IP地址。
- ping网关地址，执行命令【ping -c 4 192.168.0.1】，如下图所示。
- ping外网地址，比如ping百度域名，执行命令【ping www.baidu.com】，如下图所示
可见实例可以访问外网。
- 在控制节点上ping实例IP地址，如下图所示。
[root@xgk-ctl ~]# ping -c4 192.168.0.241
PING 192.168.0.241 (192.168.0.241) 56(84) bytes of data.
64 bytes from 192.168.0.241: icmp_seq=1 ttl=128 time=2.27 ms
64 bytes from 192.168.0.241: icmp_seq=2 ttl=128 time=0.858 ms
64 bytes from 192.168.0.241: icmp_seq=3 ttl=128 time=0.747 ms
64 bytes from 192.168.0.241: icmp_seq=4 ttl=128 time=0.948 ms
--- 192.168.0.241 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3040ms
rtt min/avg/max/mdev = 0.747/1.206/2.274/0.620 ms- 在控制节点上通过ssh远程登录实例，如下图所示。
[root@xgk-ctl ~]# ssh cirros@192.168.0.241
The authenticity of host '192.168.0.241 (192.168.0.241)' can't be established.
ECDSA key fingerprint is SHA256:LSYkP/6EBqnkvRGmcDv+PdfytF+bk2hTB3thggtp1kE.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.0.241' (ECDSA) to the list of known hosts.
$可见，外网主机也可以访问实例。
9.6 创建卷并附加到实例
由于前面创建的实例并没有卷，这里可以创建一个卷并附加到该实例上。
1、获取demo凭证
[root@xgk-ctl ~]# source /etc/keystone/demo-openrc 2、创建卷
执行以下命令，创建一个大小为1GB的卷，卷名为volume1
[root@xgk-ctl ~]# openstack volume create --size 1 volume1
+---------------------+--------------------------------------+
| Field | Value |
+---------------------+--------------------------------------+
| attachments | [] |
| availability_zone | nova |
| bootable | false |
| consistencygroup_id | None |
| created_at | 2023-02-08T12:51:17.039675 |
| description | None |
| encrypted | False |
| id | 68fd1408-8c30-4bfc-9bfa-e6299c80a41e |
| multiattach | False |
| name | volume1 |
| properties | |
| replication_status | None |
| size | 1 |
| snapshot_id | None |
| source_volid | None |
| status | creating |
| type | __DEFAULT__ |
| updated_at | None |
| user_id | c21756ca45f8403fba030b53b0d4c366 |
+---------------------+--------------------------------------+3、查看卷及其状态
稍候片刻，可以查看到该卷的状态变为available 。
[root@xgk-ctl ~]# openstack volume list
+--------------------------------------+---------+-----------+------+-------------+
| ID | Name | Status | Size | Attached to |
+--------------------------------------+---------+-----------+------+-------------+
| 68fd1408-8c30-4bfc-9bfa-e6299c80a41e | volume1 | available | 1 | |
+--------------------------------------+---------+-----------+------+-------------+
4、将卷附加到实例
[root@xgk-ctl ~]# openstack server add volume provider-instance volume1
+-----------------------+--------------------------------------+
| Field | Value |
+-----------------------+--------------------------------------+
| ID | 68fd1408-8c30-4bfc-9bfa-e6299c80a41e |
| Server ID | 38914904-1681-401b-85ab-63a758bebfda |
| Volume ID | 68fd1408-8c30-4bfc-9bfa-e6299c80a41e |
| Device | /dev/vdb |
| Tag | None |
| Delete On Termination | False |
+-----------------------+--------------------------------------+
5、再次查看卷，可见其状态变为in-use，并附加到实例上，成为其磁盘卷/dev/vdb
[root@xgk-ctl ~]# openstack volume list
+--------------------------------------+---------+--------+------+--------------------------------------------+
| ID | Name | Status | Size | Attached to |
+--------------------------------------+---------+--------+------+--------------------------------------------+
| 68fd1408-8c30-4bfc-9bfa-e6299c80a41e | volume1 | in-use | 1 | Attached to provider-instance on /dev/vdb |
+--------------------------------------+---------+--------+------+--------------------------------------------+
6、在控制节点通过SSH远程登录实例，然后查看该实例上的块存储设备
[root@xgk-ctl ~]# ssh cirros@192.168.0.241
$ sudo lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
vda 253:0 0 1G 0 disk
|-vda1 253:1 0 1015M 0 part /
`-vda15 253:15 0 8M 0 part
vdb 253:16 0 1G 0 disk
可见卷vdb已成功附加到该实例，要使用该磁盘卷，需先利用fdisk命令对该磁盘卷进行分区，然后创建和挂载文件系统。
1806
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
