返回首页

OpenStack记录

作者：Superdeep

⚠️致读者⚠️

🚧本文正在施工中ing…🚧

错误多，不规范，比较混乱，请见谅！

注意 本记录适用于 Ubuntu

sudo apt update sudo apt install ntp

sudo systemctl restart ntp

sudo systemctl restart ntp

ntpq -p

openstack –os-auth-url http://controller124:5000/v3
–os-project-domain-name Default –os-user-domain-name Default
–os-project-name admin –os-username admin token issue

unset OS_PROJECT_DOMAIN_NAME unset OS_USER_DOMAIN_NAME unset OS_PROJECT_NAME unset OS_USERNAME unset OS_PASSWORD unset OS_AUTH_URL unset OS_IDENTITY_API_VERSION unset OS_IMAGE_API_VERSION

fish shell

set -e OS_PROJECT_DOMAIN_NAME set -e OS_USER_DOMAIN_NAME set -e OS_PROJECT_NAME set -e OS_USERNAME set -e OS_PASSWORD set -e OS_AUTH_URL set -e OS_IDENTITY_API_VERSION set -e OS_IMAGE_API_VERSION

openstack –os-auth-url http://controller124:5000/v3
–os-project-domain-name default –os-user-domain-name default
–os-project-name admin –os-username admin –os-auth-type password
–os-password ADMIN_PASS token issue

fish shell file

bash
#!/usr/bin/env fish
export OS_USERNAME=admin
export OS_PASSWORD=ADMIN_PASS
export OS_PROJECT_NAME=admin
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default
export OS_AUTH_URL=http://controller124:5000/v3
export OS_IDENTITY_API_VERSION=3

openstack service list |grep -E “ID|keystone”

openstack endpoint list |grep -E “ID|keystone”

glance install

sudo apt install glance

sql
mysql -u root -p
GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost' \
  IDENTIFIED BY 'GLANCE_DBPASS';
GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%' \
  IDENTIFIED BY 'GLANCE_DBPASS';
exit;
bash
source /etc/keystone/admin-openrc


openstack user create --domain default --password GLANCE_PASS glance


openstack project create --domain default --description "Service Project" service
openstack role add --project service --user glance admin
openstack user create --domain default --password MY_PASSWORD MY_SERVICE



openstack role add --user MY_SERVICE --user-domain Default --system all reader
bash
openstack service create --name glance --description "OpenStack Image" image

openstack endpoint create --region RegionOne \
  image public http://controller124:9292

openstack endpoint create --region RegionOne \
  image internal http://controller124:9292

openstack endpoint create --region RegionOne \
  image admin http://controller124:9292

glance-api.conf

sudo su

cd /etc/glance

su -s /bin/sh -c “glance-manage db_sync” glance

mysql -u glance -p password: GLANCE_DBPASS

use glance; show tables; exit;

systemctl restart glance-api

sudo systemctl enable glance-api

sudo systemctl status glance-api

sudo systemctl status glance-api

source admin-openrc-fish.sh

wget http://download.cirros-cloud.net/0.4.0/cirros-0.4.0-x86_64-disk.img

pwd

/home/qtz

glance image-create –name “cirros0.4.0”
–file /home/qtz/cirros-0.4.0-x86_64-disk.img
–disk-format qcow2 –container-format bare
–visibility=public

glance image-list

openstack service list |grep -E “ID|glance”

openstack endpoint list |grep -E “ID|glance”

openstack user list |grep -E “ID|glance”

openstack service list |grep -E “ID|glance” | wc -l 2

openstack endpoint list |grep -E “ID|glance” | wc -l 4

openstack user list |grep -E “ID|glance” | wc -l 2

sql
mysql -u glance -p
use glance;
select name,status,disk_format,created_at from images;

安装Placement

mysql -u root -p

sql
CREATE DATABASE placement;
GRANT ALL PRIVILEGES ON placement.* TO 'placement'@'localhost' IDENTIFIED BY 'PLACEMENT_DBPASS';
GRANT ALL PRIVILEGES ON placement.* TO 'placement'@'%' IDENTIFIED BY 'PLACEMENT_DBPASS';
exit;

bash admin-openrc-fish.sh

shell
openstack user create --domain default --password PLACEMENT_PASS placement
openstack role add --project service --user placement admin
shell
openstack service create --name placement --description "Placement API" placement

openstack endpoint create --region RegionOne placement public http://controller124:8778

openstack endpoint create --region RegionOne placement internal http://controller124:8778

openstack endpoint create --region RegionOne placement admin http://controller124:8778

sudo apt install placement-api

vim /etc/placement/placement.conf

sudo cp /etc/placement/placement.conf /etc/placement/placement.confback

ini

[DEFAULT]
[api]
[cors]
[keystone_authtoken]
auth_url = http://controller124:5000/v3
memcached_servers = controller124:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = placement
password = PLACEMENT_PASS
[oslo_middleware]
[oslo_policy]
[placement]
[placement_database]
connection = mysql+pymysql://placement:PLACEMENT_DBPASS@controller124/placement
[profiler]

[auth_strategy]
keystone =

sudo su

su -s /bin/sh -c “placement-manage db sync” placement

sql
mysql -u placement -pPLACEMENT_DBPASS
use placement;
show tables;
exit;

sudo systemctl restart apache2

sudo placement-status upgrade check

openstack service list |grep -E “ID|placement”

openstack endpoint list |grep -E “ID|placement”

openstack user list |grep -E “ID|placement”

shell
sudo apt install net-tools
netstat -tulpn|grep 8778

sudo lsof -i :8778

bash opst-proc-show.sh

安装 Nova 计算服务

sql
mysql -u root -p
CREATE DATABASE nova_api;
CREATE DATABASE nova;
CREATE DATABASE nova_cell0;
 
GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'localhost'  IDENTIFIED BY 'NOVA_DBPASS';
GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'%'  IDENTIFIED BY 'NOVA_DBPASS';
 
GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'localhost'  IDENTIFIED BY 'NOVA_DBPASS';
GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' IDENTIFIED BY 'NOVA_DBPASS';
 
GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'localhost' IDENTIFIED BY 'NOVA_DBPASS';

GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'%'  IDENTIFIED BY 'NOVA_DBPASS';
exit;

openstack user create –domain default –password NOVA_PASS nova

openstack role add –project service –user nova admin

openstack service create –name nova –description “OpenStack Compute” compute

openstack endpoint create –region RegionOne compute public http://controller124:8774/v2.1

openstack endpoint create –region RegionOne compute internal http://controller124:8774/v2.1

openstack endpoint create –region RegionOne compute admin http://controller124:8774/v2.1

apt install nova-api nova-conductor nova-novncproxy nova-scheduler

sudo vi /etc/nova/nova.conf

conf here:

ini
[DEFAULT]
enabled_apis = osapi_compute,metadata
rpc_backend = rabbit
auth_strategy = keystone
my_ip = 192.168.2.24
use_neutron = True
firewall_driver = nova.virt.firewall.NoopFirewallDriver
transport_url = rabbit://openstack:RABBIT_PASS@controller124:5672/
verbose = True
debug = True
log_dir = /var/log/nova
[api]
auth_strategy = keystone
[api_database]
connection = mysql+pymysql://nova:NOVA_DBPASS@controller124/nova_api
[barbican]
[barbican_service_user]
[cache]
[cinder]
[compute]
[conductor]
[console]
[consoleauth]
[cors]
[cyborg]
[database]
connection = mysql+pymysql://nova:NOVA_DBPASS@controller124/nova
[devices]
[ephemeral_storage_encryption]
[filter_scheduler]
[glance]
api_servers = http://controller124:9292
[guestfs]
[healthcheck]
[hyperv]
[image_cache]
[ironic]
[key_manager]
[keystone]
[keystone_authtoken]
www_authenticate_uri = http://controller124:5000
auth_url = http://controller124:5000
memcached_servers = controller124:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = nova
password = NOVA_PASS
[libvirt]
[metrics]
[mks]
[neutron]
[notifications]
[oslo_concurrency]
lock_path = /var/lib/nova/tmp
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_middleware]
[oslo_policy]
[oslo_reports]
[pci]
[placement]
region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://controller124:5000/v3
username = placement
password = PLACEMENT_PASS
[powervm]
[privsep]
[profiler]
[quota]
[rdp]
[remote_debug]
[scheduler]
[serial_console]
[service_user]
send_service_user_token = true
auth_url = http://controller124:5000/identity
auth_strategy = keystone
auth_type = password
project_domain_name = Default
project_name = service
user_domain_name = Default
username = nova
password = NOVA_PASS
[spice]
[upgrade_levels]
[vault]
[vendordata_dynamic_auth]
[vmware]
[vnc]
enabled = true
server_listen = $my_ip
server_proxyclient_address = $my_ip
[workarounds]
[wsgi]
[zvm]

sudo su

su -s /bin/sh -c “nova-manage api_db sync” nova

su -s /bin/sh -c “nova-manage cell_v2 map_cell0” nova

su -s /bin/sh -c “nova-manage cell_v2 create_cell –name=cell1 –verbose” nova

su -s /bin/sh -c “nova-manage cell_v2 list_cells” nova

su -s /bin/sh -c “nova-manage db sync” nova

sql
mysql -u nova -pNOVA_DBPASS
use nova;
show tables;
use nova_api;
show tables;
use nova_cell0;
show tables;
exit;

sudo systemctl restart nova-api nova-scheduler nova-conductor nova-novncproxy

sudo systemctl enable nova-api nova-scheduler nova-conductor nova-novncproxy

可能是我查看了python代码，然后我把虚拟机的内存设置为了4GB python.analysis.exclude

apt install nova-compute -y

计算节点！

ssh qtz@192.168.2.25

sudo vim /etc/nova/nova.conf

myconf

ini
[DEFAULT]
enabled_apis = osapi_compute,metadata
transport_url = rabbit://openstack:RABBIT_PASS@controller124
my_ip = 192.168.2.25
compute_driver = libvirt.LibvirtDriver
verbose = True
debug = True
log_dir = /var/log/nova
instances_path = /var/lib/nova/instances
[api]
auth_strategy = keystone
[api_database]
[barbican]
[barbican_service_user]
[cache]
[cinder]
[compute]
[conductor]
[console]
[consoleauth]
[cors]
[cyborg]
[database]
[devices]
[ephemeral_storage_encryption]
[filter_scheduler]
[glance]
api_servers = http://controller124:9292
[guestfs]
[healthcheck]
[hyperv]
[image_cache]
[ironic]
[key_manager]
[keystone]
[keystone_authtoken]
www_authenticate_uri = http://controller124:5000/
auth_url = http://controller124:5000/
memcached_servers = controller124:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = nova
password = NOVA_PASS
[libvirt]
virt_type = qemu
cpu_mode = none
[metrics]
[mks]
[neutron]
[notifications]
[oslo_concurrency]
lock_path = /var/lib/nova/tmp
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_middleware]
[oslo_policy]
[oslo_reports]
[pci]
[placement]
region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://controller124:5000/v3
username = placement
password = PLACEMENT_PASS
[powervm]
[privsep]
[profiler]
[quota]
[rdp]
[remote_debug]
[scheduler]
[serial_console]
[service_user]
send_service_user_token = true
auth_url = http://controller124:5000/identity
auth_strategy = keystone
auth_type = password
project_domain_name = Default
project_name = service
user_domain_name = Default
username = nova
password = NOVA_PASS
[spice]
[upgrade_levels]
[vault]
[vendordata_dynamic_auth]
[vmware]
[vnc]
enabled = true
server_listen = 0.0.0.0
server_proxyclient_address = $my_ip
novncproxy_base_url = http://192.168.2.24:6080/vnc_auto.html
[workarounds]
[wsgi]
[zvm]

egrep -c ‘(vmx|svm)’ /proc/cpuinfo

sudo systemctl restart nova-compute

sudo systemctl enable libvirtd sudo systemctl enable nova-compute sudo systemctl start libvirtd sudo systemctl start nova-compute

bash opst-proc-show.sh

sudo grep -o controller124 /etc/nova/nova.conf|wc -l

sudo cat /etc/nova/nova.conf | grep controller124 | wc -l

openstack compute service list –service nova-compute

su -s /bin/sh -c “nova-manage cell_v2 discover_hosts –verbose” nova

安装 Neutron 网络服务

sql
mysql -u root -p
CREATE DATABASE neutron;
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' \
  IDENTIFIED BY 'NEUTRON_DBPASS';
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' \
  IDENTIFIED BY 'NEUTRON_DBPASS';
exit;

openstack user create –domain default –password NEUTRON_PASS neutron

openstack role add –project service –user neutron admin

openstack service create –name neutron
–description “OpenStack Networking” network

openstack endpoint create –region RegionOne
network public http://controller124:9696

openstack endpoint create –region RegionOne
network internal http://controller124:9696

openstack endpoint create –region RegionOne
network admin http://controller124:9696

apt install neutron-server neutron-plugin-ml2 python3-neutronclient openvswitch-switch sudo apt install neutron-linuxbridge-agent neutron-dhcp-agent neutron-metadata-agent

conf here: sudo vim /etc/neutron/neutron.conf

ini
[DEFAULT]
core_plugin = ml2
service_plugins = 
transport_url = rabbit://openstack:RABBIT_PASS@controller124
auth_strategy = keystone
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true
[agent]
[cache]
[cors]
[database]
connection = mysql+pymysql://neutron:NEUTRON_DBPASS@controller124/neutron
[healthcheck]
[ironic]
[keystone_authtoken]
www_authenticate_uri = http://controller124:5000
auth_url = http://controller124:5000
memcached_servers = controller124:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = NEUTRON_PASS
[nova]
auth_url = http://controller124:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = nova
password = NOVA_PASS
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_middleware]
[oslo_policy]
[oslo_reports]
[placement]
[privsep]
[profiler]
[quotas]
[ssl]

sudo vim /etc/neutron/plugins/ml2/ml2_conf.ini

ini
[DEFAULT]
[ml2]
type_drivers = flat,vlan
tenant_network_types = 
mechanism_drivers = linuxbridge
extension_drivers = port_security
[ml2_type_flat]
flat_networks = provider
[ml2_type_geneve]
[ml2_type_gre]
[ml2_type_vlan]
[ml2_type_vxlan]
[ovs_driver]
[securitygroup]
enable_ipset = true
[sriov_driver]

why? ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

cp /etc/neutron/plugins/ml2/linuxbridge_agent.ini /etc/neutron/plugins/ml2/linuxbridge_agent.inibak

sudo vi/etc/neutron/plugins/ml2/linuxbridge_agent.ini

ini
[DEFAULT]
[agent]
[linux_bridge]
physical_interface_mappings = provider:eth1
[network_log]
[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
[vxlan]
enable_vxlan = false

modprobe br_netfilter

sudo su

echo ‘net.bridge.bridge-nf-call-iptables = 1’ >> /etc/sysctl.conf echo ‘net.bridge.bridge-nf-call-ip6tables = 1’ >> /etc/sysctl.conf

vi /etc/modules-load.d/br_netfilter.conf

ini
br_netfilter

chmod +x /etc/modules-load.d/br_netfilter.conf chmod 755 /etc/modules-load.d/br_netfilter.conf

lsmod |grep br_netfilter

sudo cp /etc/neutron/dhcp_agent.ini /etc/neutron/dhcp_agent.inibak

sudo vi /etc/neutron/dhcp_agent.ini

ini
[DEFAULT]
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true
[agent]
[ovs]

sudo cp /etc/neutron/metadata_agent.ini /etc/neutron/metadata_agent.inibak

sudo vi /etc/neutron/metadata_agent.ini

ini
[DEFAULT]
nova_metadata_host = controller124
metadata_proxy_shared_secret = METADATA_SECRET
[agent]
[cache]

sudo vi /etc/nova/nova.conf

ini
[neutron]
auth_url = http://controller124:5000
auth_type = password
project_domain_name = Default
user_domain_name = Default
region_name = RegionOne
project_name = service
username = neutron
password = NEUTRON_PASS
service_metadata_proxy = True
metadata_proxy_shared_secret = METADATA_SECRET

cd /etc/neutron

su -s /bin/sh -c “neutron-db-manage –config-file /etc/neutron/neutron.conf
–config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head” neutron

systemctl restart nova-api

systemctl enable neutron-server
neutron-linuxbridge-agent neutron-dhcp-agent
neutron-metadata-agent

systemctl start neutron-server
neutron-linuxbridge-agent neutron-dhcp-agent
neutron-metadata-agent

计算节点： sudo apt install neutron-linuxbridge-agent ebtables ipset -y

sudo cp /etc/neutron/neutron.conf /etc/neutron/neutron.confbak

sudo vi /etc/neutron/neutron.conf

ini
[DEFAULT]
transport_url = rabbit://openstack:RABBIT_PASS@controller124
auth_strategy = keystone
[agent]
[cache]
[cors]
[database]
[healthcheck]
[ironic]
[keystone_authtoken]
www_authenticate_uri = http://controller124:5000
auth_url = http://controller124:5000
memcached_servers = controller124:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = neutron
password = NEUTRON_PASS
[nova]
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_middleware]
[oslo_policy]
[oslo_reports]
[placement]
[privsep]
[profiler]
[quotas]
[ssl]

sudo cp /etc/neutron/plugins/ml2/linuxbridge_agent.ini /etc/neutron/plugins/ml2/linuxbridge_agent.inibak

ini
[linux_bridge]
physical_interface_mappings = external:eth1


[vxlan]
enable_vxlan = false


[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

systemctl restart nova-compute systemctl enable neutron-linuxbridge-agent systemctl start neutron-linuxbridge-agent

安装Dashboard

apt install openstack-dashboard -y

/etc/apache2/conf-available/openstack-dashboard.conf

python3 manage.py make_web_conf –apache > /etc/apache2/conf-available/openstack-dashboard.conf

dashboard link http://192.168.2.24/horizon/

fix problem about linuxbridge

sudo apt-get install -y neutron-plugin-ml2 neutron-l3-agent
neutron-dhcp-agent neutron-metadata-agent
neutron-linuxbridge-agent

配置sudo不需要密码：

修改 /etc/sudoers 文件以允许 neutron 用户在不需要密码的情况下运行 privsep-helper。您可以添加以下内容： css 复制代码 neutron ALL=(ALL) NOPASSWD: /usr/bin/privsep-helper 确保使用 visudo 命令来编辑 /etc/sudoers 文件，以防止语法错误。

Part 9 - 启动一个镜像实例

openstack network create –share –provider-physical-network provider –provider-network-type flat net124

openstack subnet create –allocation-pool start=10.0.0.101,end=10.0.0.250 –dns-nameserver 223.5.5.5 –gateway 10.0.0.254 –network net124 –subnet-range 10.0.0.0/24 subnet124

openstack flavor create –id 0 –vcpus 1 –ram 64 –disk 1 m1.nano openstack flavor create –id 1 –vcpus 1 –ram 256 –disk 1 m1.mini openstack flavor create –id 2 –vcpus 1 –ram 384 –disk 1 m1.regular openstack flavor create –id 3 –vcpus 1 –ram 512 –disk 1 m1.pro

ssh-keygen -q -N “” -f ~/.ssh/124id_rsa openstack keypair create –public-key ~/.ssh/124id_rsa.pub key124

openstack security group rule create –proto icmp default openstack security group rule create –proto tcp –dst-port 22 default

openstack server create –flavor m1.regular –image cirros40 –nic net-id=net124 –security-group default –key-name key124 ins124

openstack server start ins124