openstack之train版部署

最新推荐文章于 2024-05-16 15:13:14 发布

风吹指间

最新推荐文章于 2024-05-16 15:13:14 发布

阅读量2.7k

点赞数 2

分类专栏：虚拟化其他文章标签： openstack 运维 linux 云计算

本文链接：https://blog.csdn.net/weixin_43757555/article/details/113913682

版权

虚拟化同时被 2 个专栏收录

7 篇文章 0 订阅

订阅专栏

其他

3 篇文章 0 订阅

订阅专栏

环境

操作系统：CentOS 7.6
控制节点和计算节点需要两张网卡，一张做管理网，另一张做提供者网，选择自助服务网络方式部署，需要能够连接到Internet，用于安装在线包。块存储节点只需要一张网卡，需要连接Internet。
控制节点：eth0 10.1.102.191 eth1 10.1.102.195，8C16G，一块100G系统盘，一块50G数据盘。
计算节点：eth0 10.1.102.192 eth1 10.1.102.196，8C16G，一块100G系统盘，一块50G数据盘。
块存储节点：eth0 10.1.102.197，4C4G，一块100G系统盘，两块50G数据盘。

体系结构

openstack服务之间的关系
体系结构
硬件要求
网络结构

环境准备

1. 配置网卡，解析，防火墙，selinux，yum源

相信各位都是大佬，网卡配置在此省略，关闭防火墙和selinux，配置hosts，配置yum源，禁用epel源（在此我配置的是阿里云的yum源），三个节点均做相同配置。
cat /etc/hosts
10.1.102.195 controller
10.1.102.196 compute
10.1.102.197 cinder
配置完成后，验证各个节点是否能够连接到Internet，各个节点之间是否互通。

2. 配置时间同步

控制节点：

yum install chrony

编辑/etc/chrony.conf,这里用的是阿里云的时间服务器。
server ntp1.aliyun.com iburst
server ntp2.aliyun.com iburst
server ntp3.aliyun.com iburst
server ntp4.aliyun.com iburst
allow 10.1.100.0/22

systemctl enable chronyd.service
systemctl start chronyd.service

其他节点：

yum install chrony

编辑/etc/chrony.conf，注释掉自带的时间同步。
server controller iburst

systemctl enable chronyd.service
systemctl start chronyd.service

验证：
在控制节点上执行chronyc sources

[root@controller ~]# chronyc sources
210 Number of sources = 2
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^* 120.25.115.20                 2  10   377   708  +4276us[+4323us] +/-   17ms
^+ 203.107.6.88                  2  10   377   749  -5086us[-5038us] +/-   31ms

[root@compute ~]# chronyc sources
210 Number of sources = 4
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^+ ntp6.flashdance.cx            2  10   375   722   +203us[ +203us] +/-  236ms
^+ stratum2-1.ntp.led01.ru.>     2  10   377   646    -18ms[  -18ms] +/-  137ms
^* tick.ntp.infomaniak.ch        1  10   373   872   +559us[ +642us] +/-   96ms
^+ de-user.deepinid.deepin.>     3  10   377   311  +2568us[+2568us] +/-  106ms

3. 安装openstack包

在CentOS上，extras存储库提供了启用OpenStack存储库的RPM。

yum install centos-release-openstack-train  //train版本包

yum upgrade //只更新软件，不更新内核
注意：在更新时setup-2.8.71-11.el7.noarch包无法更新，需要下载rpm包手动安装后再更新。

yum install python-openstackclient //安装客户端

yum install openstack-selinux  //安装selinux自动管理，这里selinux是关闭的

4. 安装数据库

在控制节点上操作

yum install mariadb mariadb-server python2-PyMySQL

创建和编辑/etc/my.cnf.d/openstack.cnf文件
[mysqld]
bind-address = 10.1.102.195
default-storage-engine = innodb
innodb_file_per_table = on
max_connections = 4096
collation-server = utf8_general_ci
character-set-server = utf8

systemctl enable mariadb.service
systemctl start mariadb.service
mysql_secure_installation //初始化数据库

5. 安装消息队列

在控制节点上操作

 yum install rabbitmq-server
systemctl enable rabbitmq-server.service
systemctl start rabbitmq-server.service
rabbitmqctl add_user openstack 123qweQWE,./  //添加openstack用户
rabbitmqctl set_permissions openstack ".*" ".*" ".*" //赋予权限

6. 安装memcached

在控制节点上操作

yum install memcached python-memcached

编辑/etc/sysconfig/memcached
OPTIONS="-l 0.0.0.0,::1"

systemctl enable memcached.service
systemctl start memcached.service

7. 安装etcd键值对数据库

在控制节点上操作

yum install etcd

编辑/etc/etcd/etcd.conf文件
#[Member]
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS=“http://10.0.0.11:2380”
ETCD_LISTEN_CLIENT_URLS=“http://10.0.0.11:2379”
ETCD_NAME=“controller”
#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS=“http://10.0.0.11:2380”
ETCD_ADVERTISE_CLIENT_URLS=“http://10.0.0.11:2379”
ETCD_INITIAL_CLUSTER=“controller=http://10.0.0.11:2380”
ETCD_INITIAL_CLUSTER_TOKEN=“etcd-cluster-01”
ETCD_INITIAL_CLUSTER_STATE=“new”

systemctl enable etcd
systemctl start etcd
注意：启动时，遇到了启动失败，配置相同，卸载重装后成功启动。

安装keystone服务

在控制节点上操作

mysql -u root -p123qweQWE,./

MariaDB [(none)]> CREATE DATABASE keystone;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \
IDENTIFIED BY '123qweQWE,./';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \
IDENTIFIED BY '123qweQWE,./';

yum install openstack-keystone httpd mod_wsgi

编辑/etc/keystone/keystone.conf

[database]
# ...
connection = mysql+pymysql://keystone:123qweQWE,./@controller/keystone
[token]
# ...
provider = fernet

su -s /bin/sh -c "keystone-manage db_sync" keystone //写入数据库

keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

keystone-manage bootstrap --bootstrap-password 123qweQWE,./ \
  --bootstrap-admin-url http://controller:5000/v3/ \
  --bootstrap-internal-url http://controller:5000/v3/ \
  --bootstrap-public-url http://controller:5000/v3/ \
  --bootstrap-region-id RegionOne

编辑/etc/httpd/conf/httpd.conf
ServerName controller

ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

systemctl enable httpd.service
systemctl start httpd.service

配置环境变量

$ export OS_USERNAME=admin
$ export OS_PASSWORD=ADMIN_PASS
$ export OS_PROJECT_NAME=admin
$ export OS_USER_DOMAIN_NAME=Default
$ export OS_PROJECT_DOMAIN_NAME=Default
$ export OS_AUTH_URL=http://controller:5000/v3
$ export OS_IDENTITY_API_VERSION=3

openstack domain create --description "An Example Domain" example
openstack project create --domain default --description "Service Project" service //创建service项目
openstack project create --domain default --description "Demo Project" myproject //创建myproject项目
openstack user create --domain default  --password-prompt myuser //创建myuser用户
openstack role create myrole //创建myrole角色
openstack role add --project myproject --user myuser myrole //添加myrole角色到myprosject项目和myuser用户

验证

unset OS_AUTH_URL OS_PASSWORD  //取消临时设置环境变量
openstack --os-auth-url http://controller:5000/v3 \
  --os-project-domain-name Default --os-user-domain-name Default \
  --os-project-name admin --os-username admin token issue //验证admin用户令牌
  openstack --os-auth-url http://controller:5000/v3 \
  --os-project-domain-name Default --os-user-domain-name Default \
  --os-project-name myproject --os-username myuser token issue //验证myuser用户令牌

创建admin和myuser项目和用户脚本
编辑admin-openrc

export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=123qweQWE,./
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

编辑demo-openrc

export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=myproject
export OS_USERNAME=myuser
export OS_PASSWORD=123qweQWE,./
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

使用脚本

. admin-openrc
openstack token issue //请求身份验证令牌

安装glance服务

在控制节点上操作

mysql -u root -p123qweQWE,./

MariaDB [(none)]> CREATE DATABASE glance;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost' \
  IDENTIFIED BY '123qweQWE,./';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%' \
  IDENTIFIED BY '123qweQWE,./';

. admin-openrc
openstack user create --domain default --password-prompt glance //创建glance用户
openstack role add --project service --user glance admin //将admin角色添加到glance用户和service项目
openstack service create --name glance --description "OpenStack Image" image //添加glance服务实体
openstack endpoint create --region RegionOne image public http://controller:9292 //创建API端点
openstack endpoint create --region RegionOne image internal http://controller:9292
openstack endpoint create --region RegionOne image admin http://controller:9292
yum install openstack-glance

编辑/etc/glance/glance-api.conf

[database]
# ...
connection = mysql+pymysql://glance:123qweQWE,./@controller/glance
[keystone_authtoken]
# ...
www_authenticate_uri  = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = glance
password = GLANCE_PASS

[paste_deploy]
# ...
flavor = keystone
[glance_store]
# ...
stores = file,http
default_store = file
filesystem_store_datadir = /var/lib/glance/images/

su -s /bin/sh -c "glance-manage db_sync" glance //写入数据库
systemctl enable openstack-glance-api.service
systemctl start openstack-glance-api.service

验证
下载cirros镜像，并导入glance中

. admin-openrc
wget http://download.cirros-cloud.net/0.4.0/cirros-0.4.0-x86_64-disk.img
glance image-create --name "cirros" \
  --file cirros-0.4.0-x86_64-disk.img \
  --disk-format qcow2 --container-format bare \
  --visibility public
glance image-list

安装placement服务

在控制节点中操作

mysql -u root -p123qweQWE,./
MariaDB [(none)]> CREATE DATABASE placement;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON placement.* TO 'placement'@'localhost' \
  IDENTIFIED BY '123qweQWE,./';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON placement.* TO 'placement'@'%' \
  IDENTIFIED BY '123qweQWE,./';

. admin-openrc
openstack user create --domain default --password-prompt placement //创建一个placement用户
openstack role add --project service --user placement admin //将placement用户添加到admin角色和service项目中
openstack service create --name placement --description "Placement API" placement //创建API条目
openstack endpoint create --region RegionOne placement public http://controller:8778  //创建API端点
openstack endpoint create --region RegionOne placement internal http://controller:8778
openstack endpoint create --region RegionOne placement admin http://controller:8778

  yum install openstack-placement-api

编辑/etc/placement/placement.conf

  [placement_database]
# ...
connection = mysql+pymysql://placement:123qweQWE,./@controller/placement
[api]
# ...
auth_strategy = keystone

[keystone_authtoken]
# ...
auth_url = http://controller:5000/v3
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = placement
password = 123qweQWE,./

su -s /bin/sh -c "placement-manage db sync" placement //写入数据库

 systemctl restart httpd

验证

. admin-openrc
placement-status upgrade check
pip install osc-placement //安装安装OSC-placement插件
openstack --os-placement-api-version 1.2 resource class list --sort-column name
openstack --os-placement-api-version 1.6 trait list --sort-column name

安装nova服务

在控制节点上操作

mysql -u root -p123qweQWE,./
MariaDB [(none)]> CREATE DATABASE nova_api;
MariaDB [(none)]> CREATE DATABASE nova;
MariaDB [(none)]> CREATE DATABASE nova_cell0;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'localhost' \
  IDENTIFIED BY '123qweQWE,./';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'%' \
  IDENTIFIED BY '123qweQWE,./';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'localhost' \
  IDENTIFIED BY '123qweQWE,./';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' \
  IDENTIFIED BY '123qweQWE,./';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'localhost' \
  IDENTIFIED BY '123qweQWE,./';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'%' \
  IDENTIFIED BY '123qweQWE,./';

. admin-openrc
openstack user create --domain default --password-prompt nova //创建nova用户
openstack role add --project service --user nova admin //将admin角色添加到nova用户
openstack service create --name nova --description "OpenStack Compute" compute //创建nova服务实体
openstack endpoint create --region RegionOne compute public http://controller:8774/v2.1  //创建compute API端点
openstack endpoint create --region RegionOne compute internal http://controller:8774/v2.1
openstack endpoint create --region RegionOne  compute admin http://controller:8774/v2.1
yum install openstack-nova-api openstack-nova-conductor openstack-nova-novncproxy openstack-nova-scheduler

编辑/etc/nova/nova.conf

[DEFAULT]
# ...
enabled_apis = osapi_compute,metadata
transport_url = rabbit://openstack:123qweQWE,./@controller:5672/
my_ip = 10.0.0.11
use_neutron = true
firewall_driver = nova.virt.firewall.NoopFirewallDriver
[api_database]
# ...
connection = mysql+pymysql://nova:123qweQWE,./@controller/nova_api

[database]
# ...
connection = mysql+pymysql://nova:123qweQWE,./@controller/nova
[api]
# ...
auth_strategy = keystone

[keystone_authtoken]
# ...
www_authenticate_uri = http://controller:5000/
auth_url = http://controller:5000/
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = nova
password = 123qweQWE,./
[vnc]
enabled = true
# ...
server_listen = $my_ip
server_proxyclient_address = $my_ip
[glance]
# ...
api_servers = http://controller:9292
[oslo_concurrency]
# ...
lock_path = /var/lib/nova/tmp
[placement]
# ...
region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://controller:5000/v3
username = placement
password = 123qweQWE,./

su -s /bin/sh -c "nova-manage api_db sync" nova
su -s /bin/sh -c "nova-manage cell_v2 map_cell0" nova //注册cell0数据库
su -s /bin/sh -c "nova-manage cell_v2 create_cell --name=cell1 --verbose" nova
su -s /bin/sh -c "nova-manage db sync" nova
su -s /bin/sh -c "nova-manage cell_v2 list_cells" nova
systemctl enable openstack-nova-api.service openstack-nova-scheduler.service openstack-nova-conductor.service openstack-nova-novncproxy.service
systemctl start openstack-nova-api.service openstack-nova-scheduler.service openstack-nova-conductor.service openstack-nova-novncproxy.service

在计算节点上操作

yum install openstack-nova-compute

编辑/etc/nova/nova.conf

[DEFAULT]
# ...
enabled_apis = osapi_compute,metadata
transport_url = rabbit://openstack:123qweQWE,./@controller
my_ip = 10.1.102.196
use_neutron = true
firewall_driver = nova.virt.firewall.NoopFirewallDriver
[api]
# ...
auth_strategy = keystone

[keystone_authtoken]
# ...
www_authenticate_uri = http://controller:5000/
auth_url = http://controller:5000/
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = nova
password = 123qweQWE,./
[vnc]
# ...
enabled = true
server_listen = 0.0.0.0
server_proxyclient_address = $my_ip
novncproxy_base_url = http://controller:6080/vnc_auto.html
[glance]
# ...
api_servers = http://controller:9292
[oslo_concurrency]
# ...
lock_path = /var/lib/nova/tmp
[placement]
# ...
region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://controller:5000/v3
username = placement
password = 123qweQWE,./
（egrep -c '(vmx|svm)' /proc/cpuinfo //如果此命令返回值为one or greater，您的计算节点支持硬件加速，这通常不需要额外的配置。如果此命令返回值为zero，您的计算节点不支持硬件加速，您必须配置libvirt使用QEMU而不是KVM）
[libvirt]
# ...
virt_type = qemu

systemctl enable libvirtd.service openstack-nova-compute.service
systemctl start libvirtd.service openstack-nova-compute.service

. admin-openrc
openstack compute service list --service nova-compute 
su -s /bin/sh -c "nova-manage cell_v2 discover_hosts --verbose" nova //发现计算主机

添加新的计算节点时，必须运行nova-manage cell_v2 discover_hosts在控制器节点上注册这些新的计算节点。或者，您可以在/etc/nova/nova.conf
[scheduler]
discover_hosts_in_cells_interval = 300
验证

. admin-openrc
openstack compute service list
openstack catalog list
openstack image list
nova-status upgrade check

安装neutron服务

在控制节点上

mysql -u root -p123qweQWE,./
MariaDB [(none)] CREATE DATABASE neutron;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' \
  IDENTIFIED BY '123qweQWE,./';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' \
  IDENTIFIED BY '123qweQWE,./';

. admin-openrc
openstack user create --domain default --password-prompt neutron
openstack role add --project service --user neutron admin
openstack service create --name neutron --description "OpenStack Networking" network
openstack endpoint create --region RegionOne network public http://controller:9696
openstack endpoint create --region RegionOne network internal http://controller:9696
openstack endpoint create --region RegionOne network admin http://controller:9696

yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables

编辑/etc/neutron/neutron.conf

[DEFAULT]
# ...
core_plugin = ml2
service_plugins = router
allow_overlapping_ips = true
transport_url = rabbit://openstack:123qweQWE,./@controller
auth_strategy = keystone
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true
[database]
# ...
connection = mysql+pymysql://neutron:123qweQWE,./@controller/neutron
[keystone_authtoken]
# ...
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = 123qweQWE,./
[nova]
# ...
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = 123qweQWE,./
[oslo_concurrency]
# ...
lock_path = /var/lib/neutron/tmp

编辑/etc/neutron/plugins/ml2/ml2_conf.ini

[ml2]
type_drivers = flat,vlan,vxlan
tenant_network_types = vxlan
mechanism_drivers = linuxbridge,l2population
extension_drivers = port_security
[ml2_type_flat]
# ...
flat_networks = provider
[ml2_type_vxlan]
# ...
vni_ranges = 1:1000
[securitygroup]
# ...
enable_ipset = true

编辑/etc/neutron/plugins/ml2/linuxbridge_agent.ini

[linux_bridge]
physical_interface_mappings = provider:eth0
[vxlan]
enable_vxlan = true
local_ip = 10.1.102.195
l2_population = true
[securitygroup]
# ...
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

编辑/etc/neutron/l3_agent.ini

[DEFAULT]
# ...
interface_driver = linuxbridge

编辑/etc/neutron/dhcp_agent.ini

[DEFAULT]
# ...
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true

编辑/etc/neutron/metadata_agent.ini

[DEFAULT]
# ...
nova_metadata_host = controller
metadata_proxy_shared_secret = 123qweQWE,./

编辑/etc/nova/nova.conf

[neutron]
# ...
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = 123qweQWE,./
service_metadata_proxy = true
metadata_proxy_shared_secret = 123qweQWE,./

ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf  --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
systemctl restart openstack-nova-api.service
systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
systemctl start neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service systemctl enable neutron-l3-agent.service
systemctl start neutron-l3-agent.service

vim /etc/security/limits.conf
*               soft    nofile            1024000
*               hard    nofile            1024000

在计算节点上操作

yum install openstack-neutron-linuxbridge ebtables ipset

编辑/etc/neutron/neutron.conf

[DEFAULT]
# ...
transport_url = rabbit://openstack:123qweQWE,./@controller
auth_strategy = keystone
[keystone_authtoken]
# ...
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = 123qweQWE,./
[oslo_concurrency]
# ...
lock_path = /var/lib/neutron/tmp

编辑/etc/neutron/plugins/ml2/linuxbridge_agent.ini

[linux_bridge]
physical_interface_mappings = provider:eth0
[vxlan]
enable_vxlan = true
local_ip = 10.1.102.196
l2_population = true
[securitygroup]
# ...
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

vim /etc/security/limits.conf
*               soft    nofile            1024000
*               hard    nofile            1024000

编辑/etc/nova/nova.conf

[neutron]
# ...
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = 123qweQWE,./

systemctl restart openstack-nova-compute.service
systemctl enable neutron-linuxbridge-agent.service
systemctl start neutron-linuxbridge-agent.service

在控制节点上验证

. admin-openrc
openstack extension list --network
openstack network agent list

安装horizon服务

在控制节点上操作
要求：
Python 2.7、3.6或3.7
Django 1.11、2.0和2.2
Django 2.0和2.2支持在Train版本中处于试验阶段

yum install openstack-dashboard

编辑/etc/openstack-dashboard/local_settings

#配置仪表盘在controller节点上使用OpenStack服务
OPENSTACK_HOST = "controller"
#允许主机访问仪表板,接受所有主机,不安全不应在生产中使用
ALLOWED_HOSTS = ['*']
#ALLOWED_HOSTS = ['one.example.com', 'two.example.com']
#配置memcached会话存储服务
SESSION_ENGINE = 'django.contrib.sessions.backends.cache'
CACHES = {
    'default': {
         'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
         'LOCATION': 'controller:11211',
    }
}
#启用身份API版本3
OPENSTACK_KEYSTONE_URL = "http://%s:5000/v3" % OPENSTACK_HOST
#启用对域的支持
OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True
#配置API版本
OPENSTACK_API_VERSIONS = {
    "identity": 3,
    "image": 2,
    "volume": 3,
}
#配置Default为通过仪表板创建的用户的默认域
OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = "Default"
#配置user为通过仪表板创建的用户的默认角色
OPENSTACK_KEYSTONE_DEFAULT_ROLE = "user"
#如果选择网络选项1，请禁用对第3层网络服务的支持,如果选择网络选项2,则可以打开
OPENSTACK_NEUTRON_NETWORK = {
	#自动分配的网络
    'enable_auto_allocated_network': False,
	#Neutron分布式虚拟路由器（DVR）
    'enable_distributed_router': False,
	#FIP拓扑检查
    'enable_fip_topology_check': False,
	#高可用路由器模式
    'enable_ha_router': False,
	#下面三个已过时,不用过多了解,官方文档配置中是关闭的
	'enable_lb': False,
    'enable_firewall': False,
    'enable_vpn': False,
	#ipv6网络
    'enable_ipv6': True,
	#Neutron配额功能
    'enable_quotas': True,
	#rbac政策
    'enable_rbac_policy': True,
	#路由器的菜单和浮动IP功能,如果Neutron部署有三层功能的支持可以打开
    'enable_router': True,
	#默认的DNS名称服务器
    'default_dns_nameservers': [],
	#网络支持的提供者类型,在创建网络时，该列表中的网络类型可供选择
    'supported_provider_types': ['*'],
	#使用与提供网络ID范围,仅涉及到VLAN，GRE，和VXLAN网络类型
    'segmentation_id_range': {},
	#使用与提供网络类型
    'extra_provider_types': {},
	#支持的vnic类型,用于与端口绑定扩展
    #'supported_vnic_types': ['*'],
	#物理网络
    #'physical_networks': [],
}
#配置时区为亚洲上海
TIME_ZONE = "Asia/Shanghai"

重建apache的dashboard配置文件

cd /usr/share/openstack-dashboard
python manage.py make_web_conf --apache > /etc/httpd/conf.d/openstack-dashboard.conf
ln -s /etc/openstack-dashboard /usr/share/openstack-dashboard/openstack_dashboard/conf
systemctl restart httpd.service memcached.service
systemctl enable httpd.service memcached.service

验证
使用web浏览器访问仪表板http://controller/dashboard
域: default
用户名: admin
密码: 123qweQWE,./

安装cinder服务

在控制节点上操作

mysql -u root -p123qweQWE,./
MariaDB [(none)]> CREATE DATABASE cinder;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'localhost' \
  IDENTIFIED BY '123qweQWE,./';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'%' \
  IDENTIFIED BY '123qweQWE,./';

. admin-openrc
openstack user create --domain default --password-prompt cinder
openstack role add --project service --user cinder admin
openstack service create --name cinderv2  --description "OpenStack Block Storage" volumev2
openstack service create --name cinderv3 --description "OpenStack Block Storage" volumev3
openstack endpoint create --region RegionOne volumev2 public http://controller:8776/v2/%\(project_id\)s
openstack endpoint create --region RegionOne  volumev2 internal http://controller:8776/v2/%\(project_id\)s
openstack endpoint create --region RegionOne  volumev2 admin http://controller:8776/v2/%\(project_id\)s
openstack endpoint create --region RegionOne volumev3 public http://controller:8776/v3/%\(project_id\)s
openstack endpoint create --region RegionOne volumev3 internal http://controller:8776/v3/%\(project_id\)s
openstack endpoint create --region RegionOne  volumev3 admin http://controller:8776/v3/%\(project_id\)s

yum install openstack-cinder
  注意：在安装时会出现nfs安装失败的信息，需要手动下载apm包安装

编辑/etc/cinder/cinder.conf

[DEFAULT]
# ...
transport_url = rabbit://openstack:123qweQWE,./@controller
auth_strategy = keystone
my_ip = 10.1.102.195
[database]
# ...
connection = mysql+pymysql://cinder:123qweQWE,./@controller/cinder
[keystone_authtoken]
# ...
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = cinder
password = 123qweQWE,./
[oslo_concurrency]
# ...
lock_path = /var/lib/cinder/tmp

su -s /bin/sh -c "cinder-manage db sync" cinder

编辑/etc/nova/nova.conf

[cinder]
os_region_name = RegionOne

systemctl restart openstack-nova-api.service
systemctl enable openstack-cinder-api.service openstack-cinder-scheduler.service
systemctl start openstack-cinder-api.service openstack-cinder-scheduler.service

在块存储节点上操作

yum install lvm2 device-mapper-persistent-data
systemctl enable lvm2-lvmetad.service
systemctl start lvm2-lvmetad.service
pvcreate /dev/sdb
vgcreate cinder-volumes /dev/sdb

编辑/etc/lvm/lvm.conf

devices {
...
filter = [ "a/sdb/", "r/.*/"]
yum install openstack-cinder targetcli python-keystone

编辑/etc/cinder/cinder.conf

[DEFAULT]
# ...
transport_url = rabbit://openstack:123qweQWE,./@controller
auth_strategy = keystone
my_ip = 10.1.102.197
enabled_backends = lvm
glance_api_servers = http://controller:9292
[database]
# ...
connection = mysql+pymysql://cinder:123qweQWE,./@controller/cinder
[keystone_authtoken]
# ...
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = cinder
password = 123qweQWE,./
[lvm]
volume_driver = cinder.volume.drivers.lvm.LVMVolumeDriver
volume_group = cinder-volumes
target_protocol = iscsi
target_helper = lioadm
[oslo_concurrency]
# ...
lock_path = /var/lib/cinder/tmp

systemctl enable openstack-cinder-volume.service target.service
systemctl start openstack-cinder-volume.service target.service

在控制节点上验证

. admin-openrc
openstack volume service list

安装swift服务（可选）

在控制节点上操作

. admin-openrc
openstack user create --domain default --password-prompt swift
openstack role add --project service --user swift admin
openstack service create --name swift --description "OpenStack Object Storage" object-store
openstack endpoint create --region RegionOne object-store public http://controller:8080/v1/AUTH_%\(project_id\)s
openstack endpoint create --region RegionOne object-store internal http://controller:8080/v1/AUTH_%\(project_id\)s
openstack endpoint create --region RegionOne object-store admin http://controller:8080/v1

yum install openstack-swift-proxy python-swiftclient python-keystoneclient python-keystonemiddleware memcached
curl -o /etc/swift/proxy-server.conf https://opendev.org/openstack/swift/raw/branch/master/etc/proxy-server.conf-sample  //从对象存储源存储库获取代理服务配置文件

编辑/etc/swift/proxy-server.conf

[DEFAULT]
...
bind_port = 8080
user = swift
swift_dir = /etc/swift
[pipeline:main]
pipeline = catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk ratelimit authtoken keystoneauth container-quotas account-quotas slo dlo versioned_writes proxy-logging proxy-server
[app:proxy-server]
use = egg:swift#proxy
...
account_autocreate = True
[filter:keystoneauth]
use = egg:swift#keystoneauth
...
operator_roles = admin,user
[filter:authtoken]
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
...
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_id = default
user_domain_id = default
project_name = service
username = swift
password = 123qweQWE,./
delay_auth_decision = True
[filter:cache]
use = egg:swift#memcache
...
memcache_servers = controller:11211

在swift存储节点上操作

yum install xfsprogs rsync
mkfs.xfs /dev/sdb
mkfs.xfs /dev/sdc
mkdir -p /srv/node/sdb
mkdir -p /srv/node/sdc
blkid //查看uuid

编辑/etc/fstab

UUID="<UUID-from-output-above>" /srv/node/sdb xfs noatime 0 2
UUID="<UUID-from-output-above>" /srv/node/sdc xfs noatime 0 2
mount /srv/node/sdb
mount /srv/node/sdc

创建或编辑/etc/rsyncd.conf

uid = swift
gid = swift
log file = /var/log/rsyncd.log
pid file = /var/run/rsyncd.pid
address = 10.1.102.198
[account]
max connections = 2
path = /srv/node/
read only = False
lock file = /var/lock/account.lock
[container]
max connections = 2
path = /srv/node/
read only = False
lock file = /var/lock/container.lock
[object]
max connections = 2
path = /srv/node/
read only = False
lock file = /var/lock/object.lock

systemctl enable rsyncd.service
systemctl start rsyncd.service
yum install openstack-swift-account openstack-swift-container openstack-swift-object
curl -o /etc/swift/account-server.conf https://opendev.org/openstack/swift/raw/branch/master/etc/account-server.conf-sample
curl -o /etc/swift/container-server.conf https://opendev.org/openstack/swift/raw/branch/master/etc/container-server.conf-sample
curl -o /etc/swift/object-server.conf https://opendev.org/openstack/swift/raw/branch/master/etc/object-server.conf-sample

编辑/etc/swift/account-server.conf

[DEFAULT]
...
bind_ip = 10.1.102.198
bind_port = 6202
user = swift
swift_dir = /etc/swift
devices = /srv/node
mount_check = True
[pipeline:main]
pipeline = healthcheck recon account-server
[filter:recon]
use = egg:swift#recon
...
recon_cache_path = /var/cache/swift

编辑/etc/swift/container-server.conf

[DEFAULT]
...
bind_ip = 10.1.102.198
bind_port = 6201
user = swift
swift_dir = /etc/swift
devices = /srv/node
mount_check = True
[pipeline:main]
pipeline = healthcheck recon container-server
[filter:recon]
use = egg:swift#recon
...
recon_cache_path = /var/cache/swift

编辑/etc/swift/object-server.conf

[DEFAULT]
...
bind_ip = 10.1.102.198
bind_port = 6200
user = swift
swift_dir = /etc/swift
devices = /srv/node
mount_check = True
[pipeline:main]
pipeline = healthcheck recon object-server
[filter:recon]
use = egg:swift#recon
...
recon_cache_path = /var/cache/swift
recon_lock_path = /var/lock

chown -R swift:swift /srv/node
mkdir -p /var/cache/swift
chown -R root:swift /var/cache/swift
chmod -R 775 /var/cache/swift
firewall-cmd --permanent --add-port=6200/tcp
firewall-cmd --permanent --add-port=6201/tcp
firewall-cmd --permanent --add-port=6202/tcp

在控制节点上创建分发初始环
创建账户环

swift-ring-builder account.builder create 10 3 1
swift-ring-builder account.builder add --region 1 --zone 1 --ip 10.1.102.198 --port 6202 --device sdb --weight 100 //重复此命令将对象存储节点的所以设备添加进来
swift-ring-builder account.builder //核实环内容
swift-ring-builder account.builder rebalance //重新平衡

创建容器环

swift-ring-builder container.builder create 10 3 1
swift-ring-builder container.builder add  --region 1 --zone 1 --ip 10.1.102.198 --port 6201 --device sdb --weight 100 //重复此命令将对象存储节点的所以设备添加进来
swift-ring-builder container.builder
swift-ring-builder container.builder rebalance

创建对象环

swift-ring-builder object.builder create 10 3 1
swift-ring-builder object.builder add --region 1 --zone 1 --ip 10.1.102.198 --port 6200 --device sdb --weight 100  //重复此命令将对象存储节点的所以设备添加进来
swift-ring-builder object.builder
swift-ring-builder object.builder rebalance

复制account.ring.gz, container.ring.gz，和object.ring.gz文件到/etc/swift每个存储节点和运行代理服务的任何其他节点上的目录。
在控制节点上

curl -o /etc/swift/swift.conf https://opendev.org/openstack/swift/raw/branch/master/etc/swift.conf-sample

编辑/etc/swift/swift.conf

[swift-hash]
...
swift_hash_path_suffix = HASH_PATH_SUFFIX
swift_hash_path_prefix = HASH_PATH_PREFIX
[storage-policy:0]
...
name = Policy-0
default = yes

复制swift.conf文件到/etc/swift每个存储节点和运行代理服务的任何其他节点上的目录。在所有节点上，确保配置目录的正确所有权。

chown -R root:swift /etc/swift

在控制器节点和运行代理服务的任何其他节点上，启动对象存储代理服务(包括其依赖项)，并将它们配置为在系统启动时启动。

systemctl enable openstack-swift-proxy.service memcached.service
systemctl start openstack-swift-proxy.service memcached.service

在存储节点上，启动对象存储服务，并将它们配置为在系统启动时启动。

systemctl enable openstack-swift-account.service openstack-swift-account-auditor.service openstack-swift-account-reaper.service openstack-swift-account-replicator.service
systemctl start openstack-swift-account.service openstack-swift-account-auditor.service openstack-swift-account-reaper.service openstack-swift-account-replicator.service
systemctl enable openstack-swift-container.service openstack-swift-container-auditor.service openstack-swift-container-replicator.service openstack-swift-container-updater.service
systemctl start openstack-swift-container.service openstack-swift-container-auditor.service openstack-swift-container-replicator.service openstack-swift-container-updater.service
systemctl enable openstack-swift-object.service openstack-swift-object-auditor.service openstack-swift-object-replicator.service openstack-swift-object-updater.service
systemctl start openstack-swift-object.service openstack-swift-object-auditor.service openstack-swift-object-replicator.service openstack-swift-object-updater.service

在控制节点上验证

 chcon -R system_u:object_r:swift_data_t:s0 /srv/node
. demo-openrc
swift stat
openstack container create container1
openstack object create container1 FILE
openstack object list container1
openstack object save container1 FILE

在块存储节点上安装备份服务（可选）

yum install openstack-cinder

编辑/etc/cinder/cinder.conf

[DEFAULT]
# ...
backup_driver = cinder.backup.drivers.swift.SwiftBackupDriver
backup_swift_url = SWIFT_URL  //swift的API端点中可以找URL

openstack catalog show object-store
systemctl enable openstack-cinder-backup.service
systemctl start openstack-cinder-backup.service

创建虚拟网络

在控制节点上创建提供者网络

. admin-openrc
openstack network create  --share --external --provider-physical-network provider --provider-network-type flat provider //创建提供者网络
openstack subnet create --network provider --allocation-pool start=10.1.102.1200,end=10.1.102.250 --dns-nameserver 114.114.114.114 --gateway 10.1.103.254 --subnet-range 10.1.100.0/22 provider //创建提供者网络的子网

在控制节点上创建自助服务网络

. demo-openrc
openstack network create selfservice //创建私有网络
openstack subnet create --network selfservice --dns-nameserver 114.114.114.114 --gateway 172.16.1.1 --subnet-range 172.16.1.0/24 selfservice  //创建私有网络的子网
. demo-openrc
openstack router create router //创建路由器
openstack router add subnet router selfservice //绑定私有网络
openstack router set router --external-gateway provider //绑定提供者网络
. admin-openrc
ip netns
openstack port list --router router

从控制节点和其他节点能够ping通路由器上的IP。
创建规格

openstack flavor create --id 0 --vcpus 1 --ram 64 --disk 1 m1.nano
. demo-openrc
ssh-keygen -q -N ""  //生成密钥对
openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey //添加公钥
openstack keypair list //验证密钥对

添加安全组

openstack security group rule create --proto icmp default //默认安全组中添加icmp规则
openstack security group rule create --proto tcp --dst-port 22 default //添加ssh访问规则

启动实例

在提供者网络上启动一个实例

. demo-openrc
openstack flavor list
openstack image list
openstack network list
openstack security group list
openstack server create --flavor m1.nano --image cirros --nic net-id=PROVIDER_NET_ID --security-group default --key-name mykey provider-instance //启动实例，PROVIDER_NET_ID表示提供者网络id
openstack server list
openstack console url show provider-instance //使用虚拟控制台访问实例，验证网络的连通性，是否可以远程连接

在自助服务网络上启动一个实例

. demo-openrc
openstack flavor list
openstack image list
openstack network list
openstack security group list
openstack server create --flavor m1.nano --image cirros  --nic net-id=SELFSERVICE_NET_ID --security-group default --key-name mykey selfservice-instance
openstack server list
openstack console url show selfservice-instance
openstack floating ip create provider //创建一个浮动IP
openstack server add floating ip selfservice-instance 10.1.102.201//绑定到实例上
openstack server list

创建卷绑定到实例

. demo-openrc
openstack volume create --size 1 volume1 //创建一个卷
openstack volume list
openstack server add volume INSTANCE_NAME VOLUME_NAME  //将卷附加到实例

连接实例，查看块存储设备fdisk -l

完成

补充

载包后更新安装，然后更新系统软件，下载地址
[http://mirror.centos.org/altarch/7/os/aarch64/Packages/setup-2.8.71-11.el7.noarch.rpm]
启动etcd失败

卸载了，重新安装启动后成功
按照官方文档安装并配置完成，访问dashboard页面没有反应，报404错误

此文档的dashboard部署方式，已解决这个问题。
安装yum install openstack-cinder targetcli python-keystone提示nfs无法安装

下载nfs的rpm包，手动安装，参考这篇文章

风吹指间

关注

2
点赞
踩
9

收藏

觉得还不错? 一键收藏
2
评论
openstack之train版部署

环境操作系统：CentOS 7.6控制节点和计算节点需要两张网卡，一张做管理网，另一张做提供者网，选择自助服务网络方式部署，需要能够连接到Internet，用于安装在线包。块存储节点只需要一张网卡，需要连接Internet。控制节点：eth0 10.1.102.191 eth1 10.1.102.195，8C16G，一块100G系统盘，一块50G数据盘。计算节点：eth0 10.1.102.192 eth1 10.1.102.196，8C16G，一块100G系统盘，一块50G数据盘。块存储节点：e
复制链接

扫一扫

专栏目录