私有云搭建 OpenStack（centos7.3, centos-release-openstack-ocata）

最新推荐文章于 2024-06-10 19:18:00 发布

weixin_33754913

最新推荐文章于 2024-06-10 19:18:00 发布

阅读量1.6k

点赞数

文章标签：运维数据库 memcached

原文链接：http://blog.51cto.com/2290153/1980706

版权

OpenStack（centos7.3,centos-release-openstack-ocata）

nova：计算节点

queue：消息队列，系统瓶颈所在

scheduler：调度机制

conductor：更新数据库

cert（objectstore）：证书

console：连接端口

consoleauth：连接端口认证

glance：存储映像文件和硬盘

registry：调用数据库的接口，检索接口

database：映像文件的存储位置等

swift：分布式存储

neutron：网络服务，负责接收对网络的调用请求

plugins：插件

agents：网络服务器

cinder：块存储

api：接受请求并分配volume

vloume：

database

scheduler：

swift：存储对象节点

account：账号管理

container:容量管理，管理阿布管理

object：对象管理

环境准备

控制节点

hostname：linux-node1.oldboyedu.com

ip地址：192.168.1.30

计算节点：

hostname：linux-node2.oldboyedu.com

ip地址：192.168.1.31

先配置控制节点192.168.1.30

vi /etc/sysconfig/network-scripts/ifcfg-ens33

BOOTPROTO=static

DEVICE=ens33

NM_CONTROLLLER=yes

IPADDR=192.168.1.30

NETMASK=255.255.255.0

GATEWAY=192.168.1.1

重启网卡使设置生效

nmcli connection down ens33

nmcli connection up ens33

修改主机名

需要修改两处：一处是/etc/hostname，另一处是/etc/hosts

[root@localhost ~]# vi /etc/hostname

linux-node1

[root@localhost ~]# systemctlrestart NetworkManager

[root@localhost ~]# hostname

linux-node1

[root@localhost ~]# vi /etc/hosts

192.168.1.30 linux-node1 linux-node1.oldboyedu.com

192.168.1.31 linux-node2 linux-node2.oldboyedu.com

将上面两个文件修改完后，并不能立刻生效。如果要立刻生效的话，可以用 hostname your-hostname 作临时修改，它只是临时地修改主机名，系统重启后会恢复原样的。

hostname linux-node1

安装时间同步

yum install chrony

[root@localhost ~]# vi /etc/chrony.conf

a llow 192.168.0.0/16

设置开机自启动

[root@localhost ~]# systemctlenable chronyd.service

启动chronyd

[root@localhost ~]# systemctl start chronyd.service

[root@localhost ~]# timedatectl set-timezone Asia/Shanghai

[root@localhost ~]# date

Thu Nov 2 16:23:07 CST 2017

关闭 selinux(centos7.3需要改2个地方/etc/sysconfig/selinux和/etc/selinux/config)
sed -i's#SELINUX=enforcing#SELINUX=disabled#g' /etc/sysconfig/selinux

sed -i 's#SELINUX=enforcing#SELINUX=disabled#g' /etc/selinux/config
setenforce 0

getenforce可查看selinux的状态

关闭 iptables
systemctlstop firewalld.service
systemctldisable firewalld.service

[root@localhost ~]# cat /etc/redhat-release

CentOS Linux release 7.3.1611 (Core)

升级本地软件：

[root@localhost ~]# yum update-y

[root@localhost ~]#yum installcentos-release-openstack-liberty -y

Loaded plugins: fastestmirror

epel/x86_64/metalink | 6.1kB 00:00

epel | 4.3 kB 00:00

(1/3): epel/x86_64/group_gz | 261 kB 00:00

(2/3): epel/x86_64/updateinfo | 842 kB 00:01

(3/3): epel/x86_64/primary_db | 6.1 MB 00:04

Loading mirror speeds from cached hostfile

* base: mirrors.163.com

* epel: mirrors.ustc.edu.cn

* extras: mirrors.cn99.com

* updates: mirrors.163.com

No package centos-release-openstack-liberty available.

Error: Nothing to do

解决：选择安装Ocata的yum源（我的噩梦开始了。。。。。。。。。。。。。）

[root@localhost ~]#yum install centos-release-openstack-ocata -y

再升级一遍，以防万一，防止软件版本过低。

[root@localhost ~]#yumupgrade -y

验证yum源是否可用：

[root@localhost ~]#yum repolist

[root@localhost~]#yum install python-openstackclient -y

MySQL

[root@localhost yum.repos.d]# yum install mariadb mariadb-server MySQL-python-y [root@localhostyum.repos.d]# cp /usr/share/mysql/my-medium.cnf /etc/my.cnf

[root@localhostyum.repos.d]# vi /etc/my.cnf

[mysqld]

default-storage-engine= innodb

innodb_file_per_table

collation-server =utf8_general_ci

init-connect = 'SETNAMES utf8'

character-set-server = utf8

[root@localhostyum.repos.d]# systemctl enable mariadb.service

Created symlink from /etc/systemd/system/multi-user.target.wants/mariadb.serviceto /usr/lib/systemd/system/mariadb.service.

[root@localhostyum.repos.d]#systemctlstart mariadb.service

[root@localhostyum.repos.d]# mysql_secure_installation (一路 y 回车) (设置mysql的密码123456)

[root@localhostyum.repos.d]# mysql -uroot -p123456

CREATE DATABASE keystone;

GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost'IDENTIFIED BY 'keystone';

GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY'keystone';

CREATE DATABASE glance;

GRANT ALL PRIVILEGES ONglance.* TO 'glance'@'localhost' IDENTIFIED BY 'glance';

GRANT ALL PRIVILEGES ONglance.* TO 'glance'@'%' IDENTIFIED BY 'glance';

CREATE DATABASE nova;

GRANT ALL PRIVILEGES ONnova.* TO 'nova'@'localhost' IDENTIFIED BY 'nova';

GRANT ALL PRIVILEGES ONnova.* TO 'nova'@'%' IDENTIFIED BY 'nova';

CREATE DATABASE neutron;

GRANT ALL PRIVILEGES ONneutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'neutron';

GRANT ALL PRIVILEGES ONneutron.* TO 'neutron'@'%' IDENTIFIED BY 'neutron';

CREATE DATABASE cinder;

GRANT ALL PRIVILEGES ONcinder.* TO 'cinder'@'localhost' IDENTIFIED BY 'cinder';

GRANT ALL PRIVILEGES ONcinder.* TO 'cinder'@'%' IDENTIFIED BY 'cinder';

安装RabbitMQ

[root@localhost ~]# yum install rabbitmq-server -y

Error: Package:erlang-erts-18.3.4.4-2.el7.x86_64 (centos-openstack-liberty)

Requires: lksctp-tools

解决：

[root@localhost ~]# rpm -ivhlksctp-tools-1.0.17-2.el7.x86_64.rpm

[root@localhost ~]# yuminstall rabbitmq-server -y

[root@localhost~]# systemctl enable rabbitmq-server.service

Created symlink from/etc/systemd/system/multi-user.target.wants/rabbitmq-server.service to/usr/lib/systemd/system/rabbitmq-server.service.

[root@localhost ~]# systemctl start rabbitmq-server.service

[root@localhost ~]# netstat-ntlp

5672是rabbitmq端口号

新建Rabbitmq用户并授权

[root@localhost ~]# rabbitmqctl add_user openstack openstack

Creating user"openstack" ...

[root@localhost ~]#rabbitmqctl set_permissions openstack".*" ".*" ".*"

Setting permissions for user"openstack" in vhost "/" ...

启用Rabbitmq的web管理插件

[root@localhost ~]#rabbitmq-plugins list

[root@localhost ~]# rabbitmq-pluginsenable rabbitmq_management

The following plugins havebeen enabled:

mochiweb

webmachine

rabbitmq_web_dispatch

amqp_client

rabbitmq_management_agent

rabbitmq_management

Applying pluginconfiguration to rabbit@localhost... started 6 plugins.

重启Rabbitmq

[root@localhost ~]# systemctlrestart rabbitmq-server.service

查看Rabbit的端口，其中5672是服务端口，15672是web管理端口，25672是做集群的端口

[root@localhost ~]# netstat -lntup |grep 5672

tcp 0 0 0.0.0.0:15672 0.0.0.0:* LISTEN 6984/beam

tcp 0 0 0.0.0.0:25672 0.0.0.0:* LISTEN 6984/beam

tcp6 0 0 :::5672 :::* LISTEN 6984/beam

登陆 http://192.168.1.30:15672 （用户名：guest密码：guest）

http://192.168.1.30:15672/#/users

点openstack

点update this user

密码中输入：openstack，Tags: administrator

再登陆 http://192.168.1.30:15672（用户名：openstack密码：openstack）

现在已经有了2个用户可以登陆

若想要监控Rabbit，即可使用下图中的API

Keystone

yum install o penstack-keystone httpd mod_wsgi memcached python-memcached -y

修改keystone的配置文件

vi /etc/keystone/keystone.conf

[DEFAULT]

admin_token= 7fff823bda267b2db6cc (通过 openssl rand -hex 10产生的随机数)(用作无用户时，创建用户来链接，此内容使用openssl随机产生)

[database]

#Deprecated group/name - [sql]/connection

#connection = <None>

connection =mysql://k eysto ne:keystone@192.168.1.30/keystone

(用作链接数据库，三个keysthone分别为keystone组件，keystone用户名，mysql中的keysthone库名)

[memcache]

servers = 1 9 2.168.1.30:11211

[token]

pro vider = uuid

driver = memcache

[revoke]

driver = sql

# DEPRECATED: If set tofalse, the logging level will be set to WARNING instead

# of the default INFO level. (boolean value)

# This option is deprecatedfor removal.

# Its value may be silentlyignored in the future.

verbose = true

[root@linux-node2 keystone]#grep '^[a-z]'/etc/keystone/keystone.conf

admin_token =7fff823bda267b2db6cc

verbose= true

connection =mysql://keystone:keystone@192.168.1.30/keystone

servers = 192.168.1.30:11211

driver = sql

provider = uuid

driver = memcache

切换到keystone用户，导入keystoe数据库

[root@localhost ~]#su -s /bin/sh -c "keystone-manage db_sync" keystone（因为keystone 程序启动时需要以 keystone用户写入到该keystone.log文件，如果用root执行，这里keystone程序就不能以keystone用户权限写入到该log文件，以至于程序无法启动。）

[root@localhost ~]#cd /var/log/keystone/

[root@localhost keystone]# ll

total 8

-rw-r--r--. 1 keystonekeystone 6754 Nov 3 08:26 keystone.log

[root@localhost keystone]# mysql-h 192.168.1.30 -u keystone -pkeystone

MariaDB [(none)]> use keystone;

Database changed

MariaDB [keystone]> showtables;

+------------------------+

| Tables_in_keystone |

+------------------------+

| access_token |

| assignment |

| config_register |

| consumer |

| credential |

| endpoint |

| endpoint_group |

| federated_user |

| federation_protocol |

| group |

| id_mapping |

| identity_provider |

| idp_remote_ids |

| implied_role |

| local_user |

| mapping |

| migrate_version |

| nonlocal_user |

| password |

| policy |

| policy_association |

| project |

| project_endpoint |

| project_endpoint_group |

| region |

| request_token |

| revocation_event |

| role |

| sensitive_config |

| service |

| service_provider |

| token |

| trust |

| trust_role |

| user |

| user_group_membership |

| user_option |

| whitelisted_config |

+------------------------+

38 rows in set (0.00 sec)

如果数据库出问题，可以重置

删除数据库（这里删除会和表一起全部删除）

mysql -h 192.168.1.30 -u keystone -pkeystone

MariaDB[(none)]>dropdatabase keystone;

然后创建数据库（这里只是创建一个数据名字，并没有实际的表）

MariaDB[(none)]>createdatabase keystone;

MariaDB[(none)]> quit；

同步keystone；

root@controller1:~#keystone-managedb_sync;

重置完毕

如果数据库同步后没数据，执行以下

[root@localhostyum.repos.d]# mysql-uroot-p123456

CREATE DATABASEkeystone;

GRANT ALLPRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'keystone';

GRANT ALL PRIVILEGES ON keystone.* TO'keystone'@'%' IDENTIFIED BY 'keystone';

添加一个apache的wsgi-keystone配置文件，其中5000端口是提供该服务的，35357是为admin提供管理用的

vi /etc/httpd/conf.d/wsgi-keystone.conf

Listen5000

Listen 35357

WSGIDaemonProcess keystone-publicprocesses=5 threads=1 user=keystone group=keystone display-name=%{GROUP}

WSGIProcessGroup keystone-public

WSGIScriptAlias / /usr/bin/keystone-wsgi-public

WSGIApplicationGroup %{GLOBAL}

WSGIPassAuthorization On

ErrorLogFormat "%{cu}t %M"

</IfVersion>

ErrorLog /var/log/httpd/keystone-error.log

CustomLog /var/log/httpd/keystone-access.logcombined

Require all granted

</IfVersion>

Order allow,deny

Allow from all

</IfVersion>

</Directory>

</VirtualHost>

WSGIDaemonProcess keystone-adminprocesses=5 threads=1 user=keystone group=keystone display-name=%{GROUP}

WSGIProcessGroup keystone-admin

WSGIScriptAlias //usr/bin/keystone-wsgi-admin

WSGIApplicationGroup %{GLOBAL}

WSGIPassAuthorization On

ErrorLogFormat "%{cu}t %M"

</IfVersion>

ErrorLog /var/log/httpd/keystone-error.log

CustomLog /var/log/httpd/keystone-access.logcombined

Require all granted

</IfVersion>

Order allow,deny

Allow from all

</IfVersion>

</Directory>

</VirtualHost>

配置apache的servername,如果不配置servername，会影响keystone服务

vi /etc/httpd/conf/httpd.conf

#Server Name w ww.example.com:80

ServerName 192.168.1.30:80

启动memcached，httpd，keystone

[root@localhost etc]#systemctl enable memcached

Created symlink from/etc/systemd/system/multi-user.target.wants/memcached.service to/usr/lib/systemd/system/memcached.service.

[root@localhost etc]# systemctl enable httpd

Created symlink from/etc/systemd/system/multi-user.target.wants/httpd.service to/usr/lib/systemd/system/httpd.service.

[root@localhost etc]# systemctl start httpd

[root@localhost etc]#netstat-ntlp |grep http

tcp6 0 0 :::80 :::* LISTEN

42732/httpd

tcp6 0 0 :::35357 :::* LISTEN

42732/httpd

tcp6 0 0 :::5000 :::* LISTEN

42732/httpd

keystone监听的两个端口35357和5000。 35357用于管理,5000用于普通用户。

[root@localhost etc]#systemctlstart memcached

创建用户并连接 keystone，在这里可以使用两种方式，通过 keystone -help后家参数的方式，或者使用环境变量env的方式，下面就将使用环境变量的方式,分别设置了token，API及控制版本（SOA种很适用）

[root@localhost etc]# export OS_TOKEN=7fff823bda267b2db6cc

[root@localhost etc]# export OS_URL=http://192.168.1.30:35357/v3

[root@localhost etc]# exportOS_IDENTITY_API_VERSION=3

创建域‘default’：

提示：--description是域的描述，最后一个default是域的名称

[root@linux-node1~]#openstackdomain create default

+-------------+----------------------------------+

| Field | Value |

+-------------+----------------------------------+

| description | |

| enabled | True |

| id | 660bc70fb8f046ba8c565b08a5f2dd6c |

| name | default |

+-------------+----------------------------------+

创建admin项目（project）

命令格式：openstack project --domain 域 --description"描述" 项目名

作用：管理所有的云主机

[root@linux-node1 ~]# openstack projectcreate --domain default --description "Admin Project"admin

+-------------+----------------------------------+

| Field | Value |

+-------------+----------------------------------+

| description | AdminProject |

| domain_id | 660bc70fb8f046ba8c565b08a5f2dd6c |

| enabled | True |

| id | bc6145f01fb849fcb9ea6a7ba1d84ffe |

| is_domain | False |

| name | admin |

| parent_id | 660bc70fb8f046ba8c565b08a5f2dd6c |

+-------------+----------------------------------+

创建admin用户（user）并设置密码（生产环境一定设置一个复杂的）

[root@linux-node1 ~]#openstack user create --domain default--password-prompt admin

User Password:

Repeat User Password:

+---------------------+----------------------------------+

| Field | Value |

+---------------------+----------------------------------+

| domain_id | 660bc70fb8f046ba8c565b08a5f2dd6c |

| enabled | True |

| id |009d9c1b575c48a598d1700ea42f2870 |

| name | admin |

| options | {} |

| password_expires_at |None |

+---------------------+----------------------------------+

或者直接创建密码

[root@localhost ~]# openstackuser create --domain default --password=admin admin

+---------------------+----------------------------------+

| Field | Value |

+---------------------+----------------------------------+

| domain_id | 81f258d962ee49ef8814cc6054ce65c0|

| enabled | True |

| id |89d4ab9674c044928e8ded6ab98b1ebc |

| name | admin |

| options | {} |

| password_expires_at |None |

+---------------------+----------------------------------+

创建admin的角色（role）

[root@linux-node1 ~]#openstack role create admin

+-----------+----------------------------------+

| Field | Value |

+-----------+----------------------------------+

| domain_id | None |

| id |be3fa42e824f44758201f249fbd9299d |

| name | admin |

+-----------+----------------------------------+

把admin用户加到admin项目，赋予admin角色，把角色，项目，用户关联起来

[root@localhost keystone]#openstack role add --project admin --user admin admin

创建一个普通用户demo,demo项目，角色为普通用户（uesr），并把它们关联起来

在Openstack中一般的任务我们都应该使用一个没有太多权限的user来操作。在这里我们创建一个demo user。

[root@linux-node1 ~]#openstack project create --domain default--description "Demo Project" demo

+-------------+----------------------------------+

| Field | Value |

+-------------+----------------------------------+

| description | DemoProject |

| domain_id | 660bc70fb8f046ba8c565b08a5f2dd6c |

| enabled | True |

| id | b0bfa350ea0a4af4934a64f646691eed |

| is_domain | False |

| name | demo |

| parent_id | 660bc70fb8f046ba8c565b08a5f2dd6c |

+-------------+----------------------------------+

[root@linux-node1 ~]#openstack user create --domain default --password=demo demo

+---------------------+----------------------------------+

| Field | Value |

+---------------------+----------------------------------+

| domain_id | 660bc70fb8f046ba8c565b08a5f2dd6c |

| enabled | True |

| id | 4bd21e87bcfa4f7696d26d5e6bfa7592|

| name | demo |

| options | {} |

| password_expires_at |None |

+---------------------+----------------------------------+

[root@linux-node1 ~]# openstackrole create user

+-----------+----------------------------------+

| Field | Value |

+-----------+----------------------------------+

| domain_id | None |

| id | 874f576d6a864b0589ffbd1150ee35d4 |

| name | user |

+-----------+----------------------------------+

[root@localhost ~]#openstackrole add --project demo --user demo user

创建一个service的项目，此服务用来管理nova，neuturn，glance等组件的服务

[root@linux-node1 ~]#openstackproject create --domain default --description "Service Project"service

+-------------+----------------------------------+

| Field | Value |

+-------------+----------------------------------+

| description | ServiceProject |

| domain_id | 660bc70fb8f046ba8c565b08a5f2dd6c |

| enabled | True |

| id | 20019fb0d9864523b3015aac8da4a31c |

| is_domain | False |

| name | service |

| parent_id | 660bc70fb8f046ba8c565b08a5f2dd6c |

+-------------+----------------------------------+

查看创建的用户,角色，项目

[root@linux-node1 ~]#openstackuser list

+----------------------------------+-------+

| ID | Name |

+----------------------------------+-------+

|009d9c1b575c48a598d1700ea42f2870 | admin |

|4bd21e87bcfa4f7696d26d5e6bfa7592 | demo |

+----------------------------------+-------+

[root@linux-node1 ~]# openstack projectlist

+----------------------------------+---------+

| ID | Name |

+----------------------------------+---------+

|20019fb0d9864523b3015aac8da4a31c | service |

| b0bfa350ea0a4af4934a64f646691eed| demo |

|bc6145f01fb849fcb9ea6a7ba1d84ffe | admin |

+----------------------------------+---------+

[root@linux-node1 ~]#openstack role list

+----------------------------------+-------+

| ID | Name |

+----------------------------------+-------+

|874f576d6a864b0589ffbd1150ee35d4 | user |

|be3fa42e824f44758201f249fbd9299d | admin |

+----------------------------------+-------+

注册keystone服务，虽然keystone本身是搞注册的，但是自己也需要注册服务

创建keystone认证

[root@linux-node1 ~]# openstackservice create --name keystone --description "OpenStack Identity"identity

+-------------+----------------------------------+

| Field | Value |

+-------------+----------------------------------+

| description | OpenStackIdentity |

| enabled | True |

| id | c7688c61f8b3414785528d1aa220d4b9 |

| name | keystone |

| type | identity |

+-------------+----------------------------------+

分别创建三种类型的endpoint,分别为public:对外可见，internal内部使用，admin管理使用

[root@linux-node1 ~]# openstackendpoint create --region RegionOne identity publichttp://192.168.1.30:5000/v2.0

+--------------+----------------------------------+

| Field | Value |

+--------------+----------------------------------+

| enabled | True |

| id | dacd7ffd8769460289cba8a5b14ecfc4 |

| interface | public |

| region | RegionOne |

| region_id | RegionOne |

| service_id | c7688c61f8b3414785528d1aa220d4b9 |

| service_name |keystone |

| service_type |identity |

| url | http://192.168.1.30:5000/v2.0 |

+--------------+----------------------------------+

[root@linux-node1 ~]# openstack endpoint create --region RegionOneidentity internal http://192.168.1.30:5000/v2.0

+--------------+----------------------------------+

| Field | Value |

+--------------+----------------------------------+

| enabled | True |

| id | 084e20b52a4f4b8b9c31fe411819b25e |

| interface | internal |

| region | RegionOne |

| region_id | RegionOne |

| service_id | c7688c61f8b3414785528d1aa220d4b9 |

| service_name |keystone |

| service_type |identity |

| url | http://192.168.1.30:5000/v2.0 |

+--------------+----------------------------------+

[root@linux-node1 ~]# openstackendpoint create --region RegionOne identity admin http://192.168.1.30:35357/v2.0

+--------------+----------------------------------+

| Field | Value |

+--------------+----------------------------------+

| enabled | True |

| id | f6e6bf61e92e407c85d4a1d336b095eb |

| interface | admin |

| region | RegionOne |

| region_id | RegionOne |

| service_id | c7688c61f8b3414785528d1aa220d4b9 |

| service_name |keystone |

| service_type |identity |

| url | http://192.168.1.30:35357/v2.0 |

+--------------+----------------------------------+

查看创建的endpoint

[root@linux-node1 ~]#openstack endpoint list

+----------------------------------+-----------+--------------+--------------+---------+-----------+--------------------------------+

+----------------------------------+-----------+--------------+--------------+---------+-----------+--------------------------------+

+----------------------------------+-----------+--------------+--------------+---------+-----------+--------------------------------+

链接到keystone，请求token，在这里由于已经添加了用户名和密码，就不在使用token，所有就一定要取消环境变量了

[root@localhost keystone]# unset OS_TOKEN

[root@localhost keystone]#unset OS_URL

[root@linux-node1 ~]#openstack --os-auth-url http://192.168.1.30:5000/v3 --os-project-domain-iddefault --os-user-domain-id default --os-project-name demo --os-username demouser list

出的错误无法解决。。。。。。。。。。。。。。。。。。。。。。。。

转载于:https://blog.51cto.com/2290153/1980706

weixin_33754913

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
私有云搭建 OpenStack（centos7.3, centos-release-openstack-ocata）

OpenStack（centos7.3,centos-release-openstack-ocata）nova：计算节点 queue：消息队列，系统瓶颈所在 scheduler：调度机制 conductor：更新数据库 cert（objectstore）：证书 console：连接端口...
复制链接

扫一扫