openstack octavia手工部署

###一、创建数据库
mysql> CREATE DATABASE octavia;
mysql> GRANT ALL PRIVILEGES ON octavia.* TO ‘octavia’@‘localhost’ IDENTIFIED BY ‘OCTAVIA_DBPASS’;
mysql> GRANT ALL PRIVILEGES ON octavia.* TO ‘octavia’@’%’ IDENTIFIED BY ‘OCTAVIA_DBPASS’;
mysql> flush privileges ;

##二、安装软件包

yum -y install openstack-octavia-api.noarch openstack-octavia-common.noarch openstack-octavia-health-manager.noarch openstack-octavia-housekeeping.noarch openstack-octavia-worker.noarch

##三、制作amphora镜像（需要网络环境好，否则制作过程中会频繁出现timeout）

yum install openstack-octavia-diskimage-create.noarch
octavia-diskimage-create.sh -i centos -r 123456

注： -i Linux发行版，可以设为ubuntu；-r 为root密码，生产环境推荐不要设

##四、创建管理网络
openstack network create lb-mgmt-net
openstack subnet create --subnet-range 192.168.0.0/24 --allocation-pool start=192.168.0.2,end=192.168.0.200 --network lb-mgmt-net lb-mgmt-subnet

##五、创建用户、角色、endpoint
openstack user create --domain default --password-prompt octavia
openstack role add --project service --user octavia admin
openstack service create load-balancer --name octavia
openstack endpoint create octavia public http://10.0.38.205:9876 --region RegionOne
openstack endpoint create octavia admin http://10.0.38.205:9876 --region RegionOne
openstack endpoint create octavia internal http://10.0.38.205:9876–region RegionOne

##六、创建安全组（为了方便调试，我们还可以放开ping规则）

openstack security group create lb-mgmt-sec-grp --project <service租户的租户id>
openstack security group rule create --protocol udp --dst-port 5555 <安全组ID>
openstack security group rule create --protocol tcp --dst-port 22 <安全组ID>
openstack security group rule create --protocol tcp --dst-port 9443 <安全组ID>

如果有需要，请自行添加icmp规则

##七、创建管理端口

neutron port-create --name octavia-mgmt-port --security-group <六中创建的安全组ID> --device-owner Octavia:health-mgr --binding:host_id=<hostname> lb-mgmt-net(四中创建的网络) --tenant-id < service租户的租户id >
ovs-vsctl  --may-exist add-port br-int o-hm0 -- set Interface o-hm0 type=internal -- set Interface o-hm0 external-ids:iface-status=active -- set Interface o-hm0 external-ids:attached-mac=<上条命令创建的port的mac> -- set Interface o-hm0 external-ids:iface-id=<上条命令创建的port的id>

##八、为管理端口设置ip
修改创建的ovs端口的mac并在宿主机上创建dhcp服务

ip link set dev o-hm0 address <mac地址>
dhclient -v o-hm0 -cf /etc/octavia/dhcp/dhclient.conf

注：如果 /etc/octavia/dhcp/dhclient.conf不存在，需要先自己创建，文件内容如下：

##九、生成octavia controller与amphora通信的证书
这里为了方便，我们借助octavia的工具生成证书
1、获取源码

git clone https://github.com/openstack/octavia.git

2、进入目录

 cd octavia/bin

3、运行命令，生成证书

source create_certificates.sh /etc/octavia/certs/ /root/octavia/etc/certificates/openssl.cnf
chown octavia:octavia /etc/octavia/certs -R

注意：加粗部分的路径是绝对路径（这里我假设git克隆的代码位于/root）

##十、导入镜像
将第三部制作好的镜像上传到glance中

openstack  image create amphora-x64-haproxy --public --container-format=bare --disk-format qcow2 --file amphora-x64-haproxy .qcow2  --tag amphora

##十一、创建密钥对

mkdir -p /etc/octavia/.ssh
ssh-keygen -b 2048 -t rsa -N "" -f /etc/octavia/.ssh/octavia_ssh_key
nova keypair-add --pub-key=/etc/octavia/.ssh/octavia_ssh_key.pub octavia_ssh_key --user <octavia的user id>

##十二、修改配置文件

1、 数据库配置信息

[database]
connection = mysql+pymysql://root:pass@127.0.0.1:3306/Octavia

2、 配置rabbitmq信息

[DEFAULT]
transport_url = rabbit://<user>:<pass>@server01,<user>:<pass>@server02/<vhost>

3、 设置api服务绑定的IP

[api_settings]
bind_host = xx.xx.xx.xx

4、设置amphora配置信息

[haproxy_amphora]
server_ca = /etc/octavia/certs/ca_01.pem
client_cert = /etc/octavia/certs/client.pem
key_path = /etc/octavia/.ssh/octavia_ssh_key
base_path = /var/lib/octavia
base_cert_dir = /var/lib/octavia/certs

注：如果在虚拟机中部署，amphora启动较慢，需要修改以下参数，加大超时时间

connection_max_retries = 1500
connection_retry_interval = 5
rest_request_conn_timeout = 10
rest_request_read_timeout = 120

5、证书相关配置

[certificates]
ca_private_key_passphrase = foobar
ca_private_key = /etc/octavia/certs/private/cakey.pem
ca_certificate = /etc/octavia/certs/ca_01.pem

6、octavia-worker服务相关配置

[controller_worker]
amp_boot_network_list = <第四步创建的管理网络的id>
amp_image_tag = amphora #第十步：导入镜像时的tag参数
amp_secgroup_list = <第六步创建的安全组的id>
amp_flavor_id = 8f1a7300-1762-48ba-b03d-93814f52c349 #为amphora虚机选择合适的flavor
amp_image_owner_id = <需要使用glance image-show <image id>查看> #镜像的owner信息
amp_ssh_key_name = octavia_ssh_key #第十一步创建的密钥对名称
network_driver = allowed_address_pairs_driver
compute_driver = compute_nova_driver
amphora_driver = amphora_haproxy_rest_driver

如果在虚拟机环境中部署可适当调整下面两个参数

amp_active_retries = 100
amp_active_wait_sec = 2

7、配置认证信息

[keystone_authtoken]
auth_protocol = http
auth_type=password
auth_host = 192.168.30.196
auth_uri = http://192.168.30.196:5000/v3
auth_url = http://192.168.30.196:35357/v3
username = octavia
password = octavia
project_name = services
project_domain_name = Default
user_domain_name = Default
[service_auth]
project_domain_name = Default
project_name = services
user_domain_name = Default
password = octavia
username = octavia
auth_type = password
auth_url = http://192.168.30.196:35357/v3

8、octavia-health-manager服务相关配置

[health_manager]
heartbeat_key = insecure
bind_port = 5555 #udp端口，注意 需要在启动服务的机器上有iptables打开该端口
bind_ip = 192.168.0.7 #第七步创建的管理端口的IP
controller_ip_port_list = 192.168.0.7:5555

9、设置消息队列的topic

[oslo_messaging]
topic = octavia_prov

##十三、同步数据库

octavia-db-manage   upgrade head

##十四、启动服务

   systemctl start octavia-api.service
   systemctl start octavia-worker.service
   systemctl start octavia-health-manager.service
   systemctl start octavia-housekeeping.service