OpenStack的Ocata版本安装

最新推荐文章于 2022-04-27 13:58:12 发布

一生有你527

最新推荐文章于 2022-04-27 13:58:12 发布

阅读量1.4k

点赞数

分类专栏：大数据文章标签： openstack centos Ocata

本文链接：https://blog.csdn.net/u013288707/article/details/78019694

版权

大数据专栏收录该内容

1 篇文章 0 订阅

订阅专栏

一、环境准备

本次环境适应的centos7以及OpenStack的Ocata版
1、配置网络

controller 节点与compute节点一样，都有两个网卡。第一个网卡配置为管理网络接口，第二个网卡配置为外部网络接口。而block节点只需要一张网卡
1.1 controller 节点与compute节点配置

  在/etc/sysconfig/network-scripts/ 目录下编辑两张网卡的内容。
  第一张网卡设置:IP、子网掩码、网关、DNS服务。这些都根据自己的虚拟机IP属性设置
  第二张网卡设置如下：

DEVICE=ens1
TYPE=Ethernet
ONBOOT="yes"
BOOTPROTO="none"

  其中ens1是自己网卡的名字。
  重启网卡。

hostnamectl set-hostname compute

 1.2 block节点配置

只需配置网卡的:IP、子网掩码、网关、DNS服务。
2、修改主机名字

  2.1  controller节点
  修改/etc/hostname 文件为 controller

hostnamectl set-hostname controller

   2.2  compute节点
  修改/etc/hostname 文件为 compute

hostnamectl set-hostname compute

   2.3  block节点
  修改/etc/hostname 文件为 block

hostnamectl set-hostname block

3、配置域名解析

三个节点的配置如下所示
修改/etc/host文件

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost
192.168.25.67 controller
192.168.25.77 compute
192.168.25.87 block

完成以上三步后要重启系统，以便激活配置
4、关闭selinux

三个节点都做如下操作

sed -i  "s/^SELINUX=enforcing/SELINUX=disabled/g"  /etc/selinux/config

5、安装网络时间协议(NTP)

在三个节点上都要安装NTP。除了配置方式的不同其他步骤都相同
如果是通过代理连接网络的，则配置代理环境

export http_proxy=http://163.58.11.22:8080
export https_proxy=http://163.58.11.22:8080
export no_proxy="127.0.0.1, localhost, controller, 163.0.0.0/8, 10.0.0.0/8"

其中http://163.58.11.22:8080就是自己代理网络
如果提示Timetout on http://mirrorlist.centos.org错误，建议在/etc/yum.cnf中配置代理

[main]
.....
proxy=http://163.58.11.22:8080

安装NTP

yum install chrony -y

controller中配置NTP的方式如下

cp -a /etc/chrony.conf /etc/chrony.conf_bak
sed -i "/iburst/d" /etc/chrony.conf
echo "server 192.168.25.66 iburst">>/etc/chrony.conf
echo "allow 192.168/16">>/etc/chrony.conf
echo "local stratum 10">>/etc/chrony.conf

其中allow 192.168/16是为了让其他节点可以连接到控制节点的chronyc的后端程序
在compute节点和block节点中NTP的配置如下

cp -a /etc/chrony.conf /etc/chrony.conf_bak
sed -i "/iburst/d" /etc/chrony.conf
echo "server co`这里写代码片`ntroller iburst">>/etc/chrony.conf

增加Server到防火墙中

firewall-cmd –permanent –add-service ntp
firewall-cmd –reload

启动NTP服务并设置NTP开systemctl enable chronyd.service
systemctl restart chronyd.service操作
chronyc sources
6 安装OpenStack包

三个节点都进行如下操作
安装Ocata版的统
Openstyum install centos-release-openstack-ocata -y

yum upgrade -y

安装 OpenStack 客户端：
yum install python-openstackclient -y

安装 selinux 安装 openstack-selinux 包实现对OpenStack服务的安全策略进行自动管理：
yum install openstack-selinux -y
7 安装SQL数据库

安装软件包
yum install mariadb mariadb-server python2-PyMySQL -y

创建并编辑/etc/my.cnf.d/openstack.cnf
[mysqld]
bind-address = 192.168.25.66
default-storage-engine = innodb
innodb_file_per_table = on
max_connections = 4096
collation-server = utf8_general_ci
character-set-server = utf8
增加Server到防火墙中
firewall-cmd –permanent –add-service mysql
firewall-cmd –reload

启动数据库服务，并且配置开机启动
systemctl enable mariadb.service
systemctl start mariadb.service

创建数据库的登录密码
mysql_secure_installation
创建好密码以后，默认选项最好选Y,否则在keystone认证服务安装的时候就会出现很多http报告 500/501等错误
8 安装消息队列

安装rabbitmqa包
yum install rabbitmq-server -y
启动数据库服务，并且配置开机启动
systemctl enable rabbitmq-server.service
systemctl start rabbitmq-server.service
添加OpenStack用户到消息队列中
rabbitmqctl add_user openstack RABBIT_PASS
注：这里的RABBIT_PASS是Openstack用的密码，在这里可以将其替换为自己的密码。
本文中所以的密码都使用Test12345
给Openstack用户赋予读和写的权限
rabbitmqctl set_permissions openstack “.” “.” “.*”
9 安装Memcached

认证服务的认证机制使用Memcached来缓存令牌
yum install memcached python-memcached -y
编辑/etc/sysconfig/memcached 文件。
sed -i “s/127.0.0.1/192.168.25.66/g” /etc/sysconfig/memcached

增加port到防火墙中
firewall-cmd –add-port={11211/tcp,5672/tcp} –permanent
firewall-cmd –reload

启动数据库服务，并且配置开机启动
systemctl enable memcached.service
systemctl restart memcached.service
/etc/sysconfig/memcached文件最终的配置如下所示
PORT=”11211”
USER=”memcached”
MAXCONN=”1024”
CACHESIZE=”64”
OPTIONS=”-l 192.168.25.66,::1”
至此第一部分安装完毕，做Snapshot保存起来，以便后边的安装出错可以恢复
二、keystone的安装

2.1 在数据库中安装keystone数据库。

使用root用户连接数据库并创建keystone数据库
mysql -uroot -pTest12345 -e “CREATE DATABASE keystone;”
对创建出来的keystone数据库赋予恰当的权限
mysql -uroot -pTest12345-e “GRANT ALL PRIVILEGES ON keystone.* TO ‘keystone’@’localhost’ IDENTIFIED BY ‘Test12345’;”
mysql -uroot -pTest12345 -e “GRANT ALL PRIVILEGES ON keystone.* TO ‘keystone’@’%’ IDENTIFIED BY ‘Test12345’;”
KEYSTONE_DBPASS更改为自己的密码
退出数据库
2.2 安装配置组件

yum install openstack-keystone httpd mod_wsgi -y
编辑/etc/keystone/keystone.conf 文件
openstack-config –set /etc/keystone/keystone.conf database connection mysql+pymysql://keystone:Test12345@controller/keystone
openstack-config –set /etc/keystone/keystone.conf token provider fernet
注：[database]置数据库的连接方式, [token]配置fernet令牌的提供者。
如果提示： openstack报错openstack-config：command not find
则执行该命令：
yum install -y openstack-utils

同步认证服务su -s /bin/sh -c “keystone-manage db_sync” keystoneFernetkey仓库

 keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
 keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

Bootstrap身份认证的服务

keystone-manage bootstrap –bootstrap-password Test12345 \

–bootstrap-admin-url http://controller:35357/v3/ \
–bootstrap-internal-url http://controller:5000/v3/ \
–bootstrap-public-url http://controller:5000/v3/ \
–bootstrap-region-id RegionOne
注：将Test12345替换成自己的密码。
2.3 配置Apache HTTP服务

编辑/etc/httpd/conf/httpd.conf文件
ServerName controller
创建/usr/share/keystone/wsgi-keystone.conf文件的链接到/etc/httpd/conf.d/
ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

增加service到防火墙中
firewall-cmd –permanent –add-service http
firewall-cmd –add-port={5000/tcp,35357/tcp} –permanent
firewall-cmd –reload

启动数据库服务，并且配置开机启动
systemctl enable httpd.service
systemctl start httpd.service
配置管理员账户
$export OS_USERNAME=admin$ export OS_PASSWORD=Test12345
$export OS_PROJECT_NAME=admin$ export OS_USER_DOMAIN_NAME=Default
$export OS_PROJECT_DOMAIN_NAME=Default$ export OS_AUTH_URL=http://controller:35357/v3
$ export OS_IDENTITY_API_VERSION=3
注：将Test12345替换成自己的密码。
2.4 创建域、项目、用户和角色

创建demo用户
[root@controller conf.d]# openstack user create –domain default \

–password-prompt demo
User Password:
Repeat User Password:
+———————+———————————-+
| Field | Value |
+———————+———————————-+
| domain_id | default |
| enabled | True |
| id | ea5f91f40dd742e38adc2ac963d87e85 |
| name | demo |
| options | {} |
| password_expires_at | None |
+———————+———————————-+
创建User角色
[root@controller conf.d]# openstack role create user
+———–+———————————-+
| Field | Value |
+———–+———————————-+
| domain_id | None |
| id | 583c3698d1084eeabeaf03c479314b47 |
| name | user |
+———–+———————————-+

将user角色添加到demo项目和用户中
openstack role add –project demo –user demo user
2.5 验证操作

基于安全的原因，必须禁用初始化令牌认证。
编辑文件/etc/keystone/keystone-paste.ini。在文件的[pipeline:public_api], [pipeline:admin_api], and [pipeline:api_v3]中将admin_token_auth移除
[pipeline:public_api]

The last item in this pipeline must be public_service or an equivalent

application. It cannot be a filter.

pipeline = healthcheck cors sizelimit http_proxy_to_wsgi osprofiler url_normalize request_id admin_token_auth build_auth_context token_auth json_body ec2_extension public_service

[pipeline:admin_api]

The last item in this pipeline must be admin_service or an equivalent

application. It cannot be a filter.

pipeline = healthcheck cors sizelimit http_proxy_to_wsgi osprofiler url_normalize request_id admin_token_auth build_auth_context token_auth json_body ec2_extension s3_extension admin_service

[pipeline:api_v3]

The last item in this pipeline must be service_v3 or an equivalent

application. It cannot be a filter.

pipeline = healthcheck cors sizelimit http_proxy_to_wsgi osprofiler url_normalize request_id admin_token_auth build_auth_context token_auth json_body ec2_extension_v3 s3_extension service_v3

取消临时变量
unset OS_AUTH_URL OS_PASSWORD

使用admin，请求认证令牌
openstack –os-auth-url http://controller:35357/v3 \
–os-project-domain-name default –os-user-domain-name default \
–os-project-name admin –os-username admin token issue
Password:
+————+—————————————————————–+
| Field | Value |
+————+—————————————————————–+
| expires | 2016-02-12T20:14:07.056119Z |
| id | gAAAAABWvi7_B8kKQD9wdXac8MoZiQldmjEO643d-e_j-XXq9AmIegIbA7UHGPv |
| | atnN21qtOMjCFWX7BReJEQnVOAj3nclRQgAYRsfSU_MrsuWb4EDtnjU7HEpoBb4 |
| | o6ozsA_NmFWEpLeKy0uNn_WeKbAhYygrsmQGA49dclHVnz-OMVLiyM9ws |
| project_id | 343d245e850143a096806dfaefa9afdc |
| user_id | ac3377633149401296f6c0d92d79dc16 |
+————+—————————————————————–+
使用demo，请求认证令牌
openstack –os-auth-url http://controller:5000/v3 \
–os-project-domain-name default –os-user-domain-name default \
–os-project-name demo –os-username demo token issue
Password:
+————+—————————————————————–+
| Field | Value |
+————+—————————————————————–+
| expires | 2016-02-12T20:15:39.014479Z |
| id | gAAAAABWvi9bsh7vkiby5BpCCnc-JkbGhm9wH3fabS_cY7uabOubesi-Me6IGWW |
| | yQqNegDDZ5jw7grI26vvgy1J5nCVwZ_zFRqPiz_qhbq29mgbQLglbkq6FQvzBRQ |
| | JcOzq3uwhzNxszJWmzGC7rJE_H0A_a3UFhqv8M4zMRYSbS2YF0MyFmp_U |
| project_id | ed0b60bf607743088218b0a533d5943f |
| user_id | 58126687cbcc4888bfa9ab73a2256f27 |
+————+—————————————————————–+
2.6 创建客户端脚本

创建admin-openrc.sh脚本
cat </root/admin-openrc.sh
export OS_PROJECT_DOMAIN_ID=default
export OS_USER_DOMAIN_ID=default
export OS_PROJECT_NAME=admin
export OS_TENANT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=Test12345
export OS_AUTH_URL=http://controller:35357/v3
export OS_IDENTITY_API_VERSION=3
END

创建demo-openrc.sh脚本
cat </root/demo-openrc.sh
export OS_PROJECT_DOMAIN_ID=default
export OS_USER_DOMAIN_ID=default
export OS_PROJECT_NAME=demo
export OS_TENANT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=Test12345
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
END

至此keystone，安装完毕。做snapshot保存，以便出错恢复
三、安装镜像服务

3.1 在数据库中创建glance数据库

mysql -uroot -pTest12345 -e “CREATE DATABASE glance;”
赋予恰当的权限给glance
mysql -uroot -pTest12345 -e “GRANT ALL PRIVILEGES ON glance.* TO ‘glance’@’localhost’ IDENTIFIED BY ‘Test12345’;”
mysql -uroot -pTest12345 -e “GRANT ALL PRIVILEGES ON glance.* TO ‘glance’@’%’ IDENTIFIED BY ‘Test12345’;”
3.2创建服务和API端点

获得 admin 凭证来获取只有管理员能执行命令的访问权限
source /root/admin-openrc.sh
创建glance用户
$ openstack user create –domain default –password-prompt glance
User Password:
Repeat User Password:
+———————+———————————-+
| Field | Value |
+———————+———————————-+
| domain_id | default |
| enabled | True |
| id | 3f4e777c4062483ab8d9edd7dff829df |
| name | glance |
| options | {} |
| password_expires_at | None |
+———————+———————————-+
添加 admin 角色到 glance 用户和 service 项目上
openstack role add –project service –user glance admin

安装glance
yum install openstack-glance -y

编辑文件/etc/glance/glance-api.conf
[database]

…

配置数据库的访问

connection = mysql+pymysql://glance:Test12345@controller/glance

[keystone_authtoken]

…

配置认证服务访问

auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = glance
password = Test12345

[paste_deploy]

…

flavor = keystone

[glance_store]

…

本地文件系统存储和镜像文件位置

stores = file,http
default_store = file
filesystem_store_datadir = /var/lib/glance/images/

编辑文件/etc/glance/glance-registry.conf
[database]

…

connection = mysql+pymysql://glance:GLANCE_DBPASS@controller/glance

[keystone_authtoken]

…

flavor = keystone

写入镜像数据库
su -s /bin/sh -c “glance-manage db_sync” glance

增加service到防火墙中
firewall-cmd –add-port={9191/tcp,9292/tcp} –permanent
firewall-cmd –reload
启动数据库服务，并且配置开机启动
systemctl enable openstack-glance-api.service openstack-glance-registry.service
systemctl start openstack-glance-api.service openstack-glance-registry.service
3.4 验证操作

使用脚本
source /root/admin-openrc.sh
下载源image
wget http://download.cirros-cloud.net/0.3.5/cirros-0.3.5-x86_64-disk.img

4.1 在controller节点中安装

4.1.1 创建数据库

创建数据库，并且赋予恰当的权限
mysql -uroot -pTest12345 -e “CREATE DATABASE nova;”
mysql -uroot -pTest12345 -e “GRANT ALL PRIVILEGES ON nova.* TO ‘nova’@’localhost’ IDENTIFIED BY ‘Test12345’;”
mysql -uroot -pTest12345 -e “GRANT ALL PRIVILEGES ON nova.* TO ‘nova’@’%’ IDENTIFIED BY ‘Test12345’;”
mysql -uroot -pTest12345 -e “CREATE DATABASE nova_api;”
mysql -uroot -pTest12345 -e “GRANT ALL PRIVILEGES ON nova_api.* TO ‘nova’@’localhost’ IDENTIFIED BY ‘Test12345’;”
mysql -uroot -pTest12345 -e “GRANT ALL PRIVILEGES ON nova_api.* TO ‘nova’@’%’ IDENTIFIED BY ‘Test12345’;”
mysql -uroot -pTest12345 -e “CREATE DATABASE nova_cell0;”
mysql -uroot -pTest12345 -e “GRANT ALL PRIVILEGES ON nova_cell0.* TO ‘nova’@’localhost’ IDENTIFIED BY ‘Test12345’;”
mysql -uroot -pTest12345 -e “GRANT ALL PRIVILEGES ON nova_cell0.* TO ‘nova’@’%’ IDENTIFIED BY ‘Test12345’;”
4.1.2 创建服务实体和API端点

获得 admin 凭证来获取只有管理员能执行命令的访问权限
source /root/admin-openrc.sh

创建nova用户
$ openstack user create –domain default –password-prompt nova
User Password:
Repeat User Password:
+———————+———————————-+
| Field | Value |
+———————+———————————-+
| domain_id | default |
| enabled | True |
| id | 8a7dbf5279404537b1c7b86c033620fe |
| name | nova |
| options | {} |
| password_expires_at | None |
+———————+———————————-+

增加Admin到nova用户
$ openstack role add –project service –user nova admin

创建Placement service
openstack user create –domain default –password-prompt placement
User Password:
Repeat User Password:
+———————+———————————-+
| Field | Value |
+———————+———————————-+
| domain_id | default |
| enabled | True |
| id | fa742015a6494a949f67629884fc7ec8 |
| name | placement |
| options | {} |
| password_expires_at | None |
+———————+———————————-+
将Placement用户添加到Service项目和admin角色中
openstack role add –project service –user placement admin
创建Placement的服务实体
$ openstack service create –name placement –description “Placement API” placement
+————-+———————————-+
| Field | Value |
+————-+———————————-+
| description | Placement API |
| enabled | True |
| id | 2d1a27022e6e4185b86adac4444c495f |
| name | placement |
| type | placement |
+————-+———————————-+
创建Plancement的API端点
openstack endpoint create –region RegionOne placement public http://controller:8778
+————–+———————————-+
| Field | Value |
+————–+———————————-+
| enabled | True |
| id | 2b1b2637908b4137a9c2e0470487cbc0 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 2d1a27022e6e4185b86adac4444c495f |
| service_name | placement |
| service_type | placement |
| url | http://controller:8778 |
+————–+———————————-+
$ openstack endpoint create –region RegionOne placement internal http://
,!controller:8778
+————–+———————————-+
| Field | Value |
+————–+———————————-+
| enabled | True |
| id | 02bcda9a150a4bd7993ff4879df971ab |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 2d1a27022e6e4185b86adac4444c495f |
| service_name | placement |
| service_type | placement |
| url | http://controller:8778 |
+————–+———————————-+
$ openstack endpoint create –region RegionOne placement admin http://controller:8778
+————–+———————————-+
| Field | Value |
+————–+———————————-+
| enabled | True |
| id | 3d71177b9e0f406f98cbff198d74b182 |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 2d1a27022e6e4185b86adac4444c495f |
| service_name | placement |
| service_type | placement |
| url | http://controller:8778 |
+————–+———————————-+

4.3 安装并且配置组件
安装软件包

yum install openstack-nova-api openstack-nova-conductor \
openstack-nova-console openstack-nova-novncproxy \
openstack-nova-scheduler openstack-nova-placement-api

本机已经将控制节点安装完毕。