OpenStack icehouse系列之控制节点搭建
OpenStack icehouse系列之控制节点搭建大家都知道openstack是目前最热门、最火的一个开源云计算软件。OpenStack是IaaS(基础设施即服务)组件，让任何人都可以自行建立和提供云端运算服务。
今天学习搭建下openstack icehouse版本的搭建、下面是环境介绍
网络节点：ml2、openvswitch、DHCP、l3、metadata
控制节点：mysql、keystone、glance、nova、neutron、dashboard、cinder
计算节点：nova-compute、qemu-kvm、openvswitch、ml2
keystone：验证
glance：镜像
nova：计算
neutron：网络
Controller setup（控制节点安装）
================
== mysql安装==
================
1.在控制器节点上,安装MySQL客户端和服务器包,Python库
apt-get install python-mysqldb mysql-server
2.编辑 /etc/mysql/my.cnf 数据库文件
---------------------------
...
bind-address = 10.0.0.11
---------------------------
...
default-storage-engine = innodb
innodb_file_per_table
collation-server = utf8_general_ci
init-connect = 'SET NAMES utf8'
character-set-server = utf8
---------------------------
3.修改完后重启mysql
service mysql restart
4.清除默认账户及默认表
mysql_secure_installation
5.如失败，则先执行
mysql_install_db
===============
== 消息队列==
===============
1.安装消息队列服务
apt-get install rabbitmq-server
2.设置消息队列密码(可修改可不修改)
rabbitmqctl change_password guest RABBIT_PASS
Keystone
安装keystone服务
apt-get install keystone
2编辑/etc/keystone/keystone.conf
-------------------------------------------
...
# The SQLAlchemy connection string used to connect to the database
connection = mysql://keystone:KEYSTONE_DBPASS@controller/keystone
...
----------------------------------------------
3.删除默认数据库
rm /var/lib/keystone/keystone.db
4.创建数据库并授权
$ mysql -u root -pmysql> CREATE DATABASE keystone;mysql> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \IDENTIFIED BY 'KEYSTONE_DBPASS';mysql> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \IDENTIFIED BY 'KEYSTONE_DBPASS';mysql> exit
5.同步数据
su -s /bin/sh -c "keystone-manage db_sync" keystone
6.定义一个授权令牌使用之间的共享密钥的身份服务和其他OpenStack服务。使用openssl来生成一个随机的令牌并将其存储在配置文件:
openssl rand -hex 10
7.修改/etc/keystone/keystone.conf 将生成的密钥添加进去
-------------------------------------------------------------------------
# A "shared secret" between keystone and other openstack services
admin_token = ADMIN_TOKEN
...
------------------------------------------------------------------------
8.把日志功能打开
------------------------------------------------------------------------
...
log_dir = /var/log/keystone
-------------------------------------------------------------------------
9.重启keystone服务
service keystone restart
10.默认情况下,服务身份无限期存储数据库中的令牌到期。虽然可能有用的审计在生产环境中,令牌到期的积累将大幅增加数据库的大小,可能会降低服务的性能,特别是在测试环境和有限的资源。我们建议配置一个周期性任务每小时使用cron来清除过期的令牌。
(crontab -l -u keystone 2>&1 | grep -q token_flush) || \echo '@hourly /usr/bin/keystone-manage token_flush >/var/log/keystone/keystone-tokenflush.log 2>&1' >> /var/spool/cron/crontabs/keystone
11.定义变量，建议创建个文件来定义，以免变量消失
export OS_SERVICE_TOKEN=ADMIN_TOKENexport OS_SERVICE_ENDPOINT=http://controller:35357/v2.0
12创建管理用户、角色
◇ Create the admin user:
keystone user-create --name=admin --pass=ADMIN_PASS --email=ADMIN_EMAIL
◇ Create the admin role:
keystone role-create --name=admin
◇ Create the admin tenant:
keystone tenant-create --name=admin --description="Admin Tenant"
◇ 链接用户使用user-role-add option：
keystone user-role-add --user=admin --tenant=admin --role=admin
◇ 链接用户
keystone user-role-add --user=admin --role=_member_ --tenant=admin
◇ Create the demo user:
keystone user-create --name=demo --pass=DEMO_PASS --email=DEMO_EMAIL
◇ Create the demo tenant:
keystone tenant-create --name=demo --description="Demo Tenant"
◇ 链接用户
keystone user-role-add --user=demo --role=_member_ --tenant=demo
◇ Create the service tenant:
keystone tenant-create --name=service --description="Service Tenant"
◇ Create a service entry for the Identity Service:
$ keystone service-create --name=keystone --type=identity \--description="OpenStack Identity"
$ keystone endpoint-create \--service-id=$(keystone service-list | awk '/ identity / {print $2}') \--publicurl=http://controller:5000/v2.0 \--internalurl=http://controller:5000/v2.0 \--adminurl=http://controller:35357
13.验证身份服务安装
1）unset OS_SERVICE_TOKEN OS_SERVICE_ENDPOINT
2）keystone --os-username=admin --os-password=ADMIN_PASS \--os-auth-url=http://controller:35357/v2.0 token-get
3）keystone --os-username=admin --os-password=ADMIN_PASS \--os-tenant-name=admin --os-auth-url=http://controller:35357/v2.0 \token-get
4）定义变量、建议创建个文件来定义，以免变量消失
export OS_USERNAME=admin
export OS_PASSWORD=ADMIN_PASS
export OS_TENANT_NAME=admin
export OS_AUTH_URL=http://controller:35357/v2.0
5）执行变量
source admin-openrc.sh
安装命令行工具
1.apt-get install python-pip
2.Pip install python-novaclient
安装glance
1.安装镜像服务
apt-get install glance python-glanceclient
2.编辑/etc/glance/glance-api.conf和/etc/glance/glance-registry.conf
-----------------------------------------
...
connection = mysql://glance:GLANCE_DBPASS@controller/glance
------------------------------------------
3.删除默认数据库
rm /var/lib/glance/glance.sqlite
4.创建glance数据库
mysql -u root -pmysql> CREATE DATABASE glance;mysql> GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost' \IDENTIFIED BY 'GLANCE_DBPASS';mysql> GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%' \IDENTIFIED BY 'GLANCE_DBPASS';
5.同步数据
su -s /bin/sh -c "glance-manage db_sync" glance
6.创建glance用户
1）keystone user-create --name=glance --pass=GLANCE_PASS \ --email=glance@example.com
2）keystone user-role-add --user=glance --tenant=service --role=admin
7.编辑/etc/glance/glance-api.conf和/etc/glance/glance-registry.conf
-------------------------------------------
auth_uri = http://controller:5000
auth_host = controller
auth_port = 35357
auth_protocol = http
admin_tenant_name = service
admin_user = glance
admin_password = GLANCE_PASS
-------------------------------------------
...
flavor = keystone
-------------------------------------------
8.注册服务创建站点
1）keystone service-create --name=glance --type=image \--description="OpenStack Image Service"
2）keystone endpoint-create \--service-id=$(keystone service-list | awk '/ image / {print $2}') \--publicurl=http://controller:9292 \--internalurl=http://controller:9292 \--adminurl=http://controller:9292
9.重启服务
service glance-registry restart
service glance-api restart
10.验证glance镜像服务
Cd /var/lib/glance/images/
1）wget http://cdn.download.cirros-cloud.net/0.3.2/cirros-0.3.2-x86_64-disk.img
2）glance image-create --name "cirros-0.3.2-x86_64" --disk-format qcow2 \--container-format bare --is-public True --progress < cirros-0.3.2-x86_64-disk.img
3）glance image-list
安装nova controller
1.安装nova
apt-get install -y nova-api nova-cert nova-conductor nova-consoleauth \nova-novncproxy nova-scheduler python-novaclient
2.创建nova数据库
mysql -u root -p CREATE DATABASE nova;GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'localhost' IDENTIFIED BY 'NOVA_DBPASS';GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' IDENTIFIED BY 'NOVA_DBPASS';
Flush privileges;
3.创建服务用户和角色
keystone user-create --name=nova --pass=service_pass --email=nova@domain.comkeystone user-role-add --user=nova --tenant=service --role=admin
4.注册服务和创建API端点
keystone service-create --name=nova --type=compute --description="OpenStack Compute"keystone endpoint-create \--service-id=$(keystone service-list | awk '/ compute / {print $2}') \--publicurl=http://controller:8774/v2/%\(tenant_id\)s \--internalurl=http://controller:8774/v2/%\(tenant_id\)s \--adminurl=http://controller:8774/v2/%\(tenant_id\)s
5.编辑/etc/nova/nova.conf
vi /etc/nova/nova.conf connection = mysql://nova:NOVA_DBPASS@controller/nova rpc_backend = rabbitrabbit_host = controllermy_ip = 10.0.0.11vncserver_listen = 10.0.0.11vncserver_proxyclient_address = 10.0.0.11auth_strategy = keystone auth_uri = http://controller:5000auth_host = controllerauth_port = 35357auth_protocol = httpadmin_tenant_name = serviceadmin_user = novaadmin_password = service_pass
6.删除nova默认数据库
rm /var/lib/nova/nova.sqlite
7.同步数据库
nova-manage db sync
8.重启nova所有服务
service nova-api restartservice nova-cert restartservice nova-conductor restartservice nova-consoleauth restartservice nova-novncproxy restartservice nova-scheduler restart
9.查看nova服务状态，如果是:-)则服务正常
nova-manage service list
10.查看images镜像
nova image-list
安装neutron
1.安装neutron-server服务和openvswith
apt-get install -y neutron-server neutron-plugin-ml2
2.创建neutron数据库
mysql -u root -p CREATE DATABASE neutron;GRANT ALL PRIVILEGES ON neutron.* TO neutron@'localhost' IDENTIFIED BY 'NEUTRON_DBPASS';GRANT ALL PRIVILEGES ON neutron.* TO neutron@'%' IDENTIFIED BY 'NEUTRON_DBPASS';
3.创建服务用户和角色
keystone user-create --name=neutron --pass=service_pass --email=neutron@domain.comkeystone user-role-add --user=neutron --tenant=service --role=admin
4.注册服务和创建API端点
keystone service-create --name=neutron --type=network --description="OpenStack Networking" keystone endpoint-create \--service-id=$(keystone service-list | awk '/ network / {print $2}') \--publicurl=http://controller:9696 \--internalurl=http://controller:9696 \--adminurl=http://controller:9696
5.编辑/etc/neutron/neutron.conf
replace connection = sqlite:////var/lib/neutron/neutron.sqlite withconnection = mysql://neutron:NEUTRON_DBPASS@controller/neutron core_plugin = ml2service_plugins = routerallow_overlapping_ips = True auth_strategy = keystonerpc_backend = neutron.openstack.common.rpc.impl_komburabbit_host = controller notify_nova_on_port_status_changes = Truenotify_nova_on_port_data_changes = Truenova_url = http://controller:8774/v2nova_admin_username = nova
nova_admin_tenant_id = SERVICE_TENANT_ID SERVICE_TENANT_ID--------》keystone tenant-list | awk '/ service / { print $2 }'nova_admin_password = service_passnova_admin_auth_url = http://controller:35357/v2.0
auth_uri = http://controller:5000auth_host = controllerauth_port = 35357auth_protocol = httpadmin_tenant_name = serviceadmin_user = neutronadmin_password = service_pass
6.编辑/etc/neutron/plugins/ml2/ml2_conf.ini
type_drivers = gretenant_network_types = gremechanism_drivers = openvswitch tunnel_id_ranges = 1:1000 firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriverenable_security_group = True
7.编辑/etc/nova/nova.conf
vi /etc/nova/nova.conf network_api_class=nova.network.neutronv2.api.APIneutron_url=http://controller:9696neutron_auth_strategy=keystoneneutron_admin_tenant_name=serviceneutron_admin_username=neutronneutron_admin_password=service_passneutron_admin_auth_url=http://controller:35357/v2.0libvirt_vif_driver=nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriverlinuxnet_interface_driver=nova.network.linux_net.LinuxOVSInterfaceDriverfirewall_driver=nova.virt.firewall.NoopFirewallDriversecurity_group_api=neutron
8.重启nova服务
service nova-api restartservice nova-scheduler restartservice nova-conductor restart
9.重启neutron服务
service neutron-server restart
安装dashboard
1.安装服务
apt-get install -y apache2 memcached libapache2-mod-wsgi openstack-dashboard
2.卸载openstack-dashboard-ubuntu-theme
apt-get remove -y --purge openstack-dashboard-ubuntu-theme
3.编辑/etc/openstack-dashboard/local_settings.py
vi /etc/openstack-dashboard/local_settings.pyALLOWED_HOSTS = ['localhost', 'controller']OPENSTACK_HOST = "controller"
4.重启apache和memcache服务
service apache2 restart; service memcached restart
5.访问dashboard
http://controller/horizon
注意：
如果在启动apache的时候报错：
apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1.Set the 'ServerName' directiveglobally to suppress this message”
解决方法：
vi /etc/apache2/apache2.conf
添加ServerName XXXX
修改完之后再重启下apache和memcache
页:
[1]