Openstack-Ocata-基础配置文档

OpenstackOcata基础配置文档

（版本号：1.0）

文件版本历史

文件版本修订口期/修订人审核口期/审核人批准日期/批准人修订说明

1.01.0版发布

目录

1.环境准备......................................................................4

1.1物理硬件..............................................................................4

1.2基础组件安装：.......................................................................4

2.数据库及消息中间件集群安装配置...............................................6

2.1Mariadb安装配置......................................................................6

2.2RabbitMQ集群安装配置................................................................6

3.Openstack组彳牛集群配置.........................................................7

3.1安装配置Keystone集群.................................................................7

3.2安装配置glance集群..................................................................10

3.3安装配置nova集群....................................................................13

3.4安装配置neutron集群.................................................................22

3.5安装Dashboard集群...................................................................28

3.6安装配置cinder集群..................................................................30

5.配置/etc/chrony.conf文件

serverocataliburst

6.开启服务并设为随机启动

#systemctlenablechronyd.service

#systemctlstartchronyd.service

7.验证服务，在控制节点执行

chronycsources

1.2.2Memcache安装

略。

1.2.3配置安装openstack0版源文件

X.安装不同版本的openslack需要配置不同版本的组件安装包，可以使用在线镜像源，也可以自

己制作本地镜像源，下载官网标准的0版安装源文件

#yuminstallcentos-release-openstack-ocata

2.更新yum源:

#yumupdate（这里需要注意是否要更新系统包和yumupgrade的区别）

1.2.4安装opensatckcIient包

#yumupgrade

在所有节点均需安装:

#yuminstallpython-openstackclient

#yuminstallopenstack-selinux

5/37

2.数据库及消息中间件集群安装配置

2.1Mariadb安装配置

1.安装软件包

#yuminstallmariadbmariadb-serverpython2-PyMqSQL

2・编辑/etc/f.d/f

[mysqld]

bind-address=1

default-storage-engine=innodb

innodb_file_per_table=on

max_connections=4696

collation-server=itf8_general_ci

character-set-server=utf8

3.启动服务并设为随机启动

#systemctlenablemariadb.service

#systemctlstartmariadb.service

4.确保数据库服务

#mysql_secure_installation

2.2RabbitMQ集群安装配置

略。

6/37

3.Openstack组件集群配置

3.1安装配置Keystone集群

1.使用root登录mysql

$mysql-uroot-p

2.创建keystone数据库

CREATEDATABASEkeystone;

3.向keystone数据库授权

GRANTALLPRIVILEGESONkeystone.*TO'keystonelocalhost'\

IDENTIFIEDBY'KEYSTONE_DBPASS'；

GRANTALLPRIVILEGESONkeystone.*TO'keystone%'\

IDENTIFIEDBY'KEYSTONE_DBPASS'；

4.安装软件包

#yuminstallopenstack-keystonehttpdmod_wsgi

5.0c!fi/etc/kestone/keystone.conf文件

[database]

connection=

[token]

provider=fernet

6.初始化Identity服务数据库

#su-s/bin/sh-c"keystone-managedb_sync"keystone

7.初始化Fernet密钥库

7/37

#keystone-managefernet_setup--keystone-userkeystone--keystone-grojpkeys

tone

#keystone-managecredential_setup--keystone-userkeystone--keystone-group

keystone

8.拉起Identity服务（取代之前版本创建keystoneendpoint）

#keystone-managebootstrap--bootstrap-passwordsuccess-S--bootstrap-admin-

urlhttp://ocatal:35357/v3/--bootstrap-internal-urlhttp://ocatal:5000/v3/-

-bootstrap-public-urlhttp://ocatal:5000/v3/--bootstrap-region-idRegionOne

9.配置ApacheHTTP服务，编辑/etc/httpd/conf/httpd.conf文件

ocatal

10.添力口/etc/hltpd/conf.d/wsgi-keystone.conf文件

#In-s/usr/share/keystone/wsgi-keystone.conf/etc/httpd/conf.d/

11.启动服务

#systemctlenablehttpd.service

#systemctlstarthttpd.service

12.输入账户信息

#exportOS_USERNAME=admin

#exportOS_PASSWORD=SUCCESS-SS

#exportOS_PROJECT_NAME=admin

#exportOS_USER_DOMAIN_NAME=Default

#exportOS_PROJECT_DOMAIN_NAME=Defau11

#exportOS_AUTH_URL=http://ocatal:35357/v3

#exportOS_IDENTIT¥_API_VERSION=3

13.创建senice项H

$openstackprojectcreate--domaindefault\

8/37

--description"ServiceProject"service

14.创建demo项目

$openstackprojectcreate--domaindefault\

--description"DeiroProject"demo

15.创建demo用户

$openstackusercreate--domaindefault\

--password-promptdemo

16.创建user角色

$openstackrolecreateuser

17.向demo项目和用户添加user角色

$openstackroleadd--projectdemo--userdemouser

18.取消临时用的授权token机制

编辑/etc/keystone/keys(one-paste.ini文件，从[pipeline:public_api],[pipeline:adinin_api],

[pipeline:api_v3]中删除admin_token_atuh。

19.创建环境脚本用于登录admin账户。

exportOS_PRO：ECT_DOMAIN_NAME=default

exportOS_USER_DOMAIN_NAME=default

exportOS_PRO3ECT_NAME=admin

exportOS_USERNAME=admin

exportOS_PASSWORD=SUCCESS-SS

exportOS_AUTH_URL=http://controller:35357/v3

exportOS_IDENTITY_API_VERSION=3

exportOS_IMAGE_API_VERSION=2

9/37

3.2安装配置glance集群

1.用root用户登录mysqI

$mysql-uroot-p

2.创建glance数据库

CREATEDATABASEglance;

3・向glance数据库授权

GRANTALLPRIVILEGESONglance.*TO'glancelocalhost'\

IDENTIFIEDBY'GLANCE_DBPASS'；

GRANTALLPRIVILEGESONglance.*TO'glance'@'%'\

IDENTIFIEDBY'GLANCE_DBPASS'；

4.载入admin身份

$.admin-openrc

5.创建glance用户

$openstackusercreate--domaindefault--password-promptglance

6.向glancefH户和service项Fl授予admin角色

$openstackroleadd--projectservice--userglanceadmin

7•创建glance服务实体

$openstackservicecreate--nameglance\

--description"OpenStackImage"image

8・仓II建Image服务APIendpoints

$openstackendpointcreate--regionRegionOne\

10/37

imagepublichttp://controller:9292

$openstackendpointcreate--regionRegionOne\

imageinternalhttp://controller:9292

$openstackendpointcreate--regionRegionOne\

imageadminhttp://controller:9292

9.安装软件包

#yuminstallopenstack-glance

10.配置/ctc/glancc/glance-api.conf文件

[DEFAULT]

debug=true

verbose=true

[database]

connection=mysql+pymysql://glance:GLANCE_DBPASS@ocatal/glance

[glance_store]

default_store=rbd

show_image_direct_url=True

stores=rbd

rbd_store_pool=images

rbd_store_user=glance

rbd_store_ceph_conf=/etc/ceph/ceph.conf

[keystone_authtoken；

auth_uri=http://ocatal:5000

auth_url=http://ocatal:35357

memcached_servers=ocatal:11211

auth_type=passworc

project_domain_name=default

user_domain_name=cefault

projcct_namc-service

11/37

username=glance

password=SUCCESS-ASS

[paste_deploy]

flavor=keystone

11.B£®/etc/glance/glance-registry.conf文件

[DEFAULT]

debug=true

verbose=true

[database]

connection=mysql+pymysql://glance:GLANCE_DBPASS@ocatal/glance

[kpy<;tnnA_Authtokpn"

auth_uri=http://ocatal:5000

auth_url=http://ocatal:35357

memcached_servers=ocatal:11211

auth_type=passworc

project_domain_name=default

user_domain_name=cefault

project_name=service

username=glance

password=SUCCESS-ASS

12.初始化数据库

ftsu-s/bin/sh-c"glance-managedb_sync"glance

13.启动服务并设为随机启动

#systemctlenableopenstack-glance-api.serviceopenstack-glance-registry.ser

vice

#systemctlstartopenstack-glance-api.serviceopenstack-glance-registry.serv

ice

12/37

3.3安装配置nova集群

3.3.1控制节点配置

创建nova数据库

1.创建nova数据库

ftmysql-uroot-pl234156

MariaDB[(none)]>CREATEDATABASEnova_api;

MariaDB[(none)]>CREATEDATABASEnova;

MariaDB[(none)]>CREATEDATABASEnova_cell0;

2.创建数据库用户并赋予权限

MariaDB[(none)]>GRANTALLPRIVILEGESONnova_api.*TO'novalocalhost'\

IDENTIFIEDBY'NOVA_DBPASS'；

MariaDB[(none)]>GRANTALLPRIVILEGESONnova_api.*TO'nova'©'%'\

IDENTIFIEDBY'NOVA_DBPASS';

MariaDB[(none)]>GRANTALLPRIVILEGESONnova.*TO'novalocalhost'\

IDENTIFIEDBY'NOVA_DBPASS'；

MariaDB[(none)]>GRANTALLPRIVILEGESONnova.*TO'nova'@'%'\

IDENTIFIEDBY'NOVA_DBPASS'；

MariaDB[(none)]>GRANTALLPRIVILEGESONnova_cell0.*TO'novalocalhost'\

IDENTIFIEDBY'NOVA_DBPASS'；

MariaDB[(none)]>GHANrALLPRiVlLfcGESONnova_celie.*10'nova'0'%'\

IDENTIFIEDBY'NOVA_DBPASS'；

3.3.1.2创建nova服务及赋予权限

1.创建nova用户及赋予admin权限

13/37

#source/root/admin

#openstackusercreate--domaindefault--password-promptnova

#openstackroleadd--projectservice--usernovaadmin

2.创建nova服务

#openstackservicecreate--namenova--description"OpenStackCompute"comput

e

3.创建ComputeserviceAPIendpoints

#openstackendpointcreate--regionRegionOnecomputepublichttp://ocatal:87

74/v2.1/%\(tenant_id\)s

#openstackendpointcreate--regionRegionOnecomputeinternalhttp://ocatal:

8774/v2.l/%\(tenant_id\)s

#openstackendpointcreate--regionRegionOnecomputeadmin

4.创建Placement服务的用户

#openstackusercreate--domaindefault--password-promptplacement

5.向Placement用户加入service项目并添加admin角色

#openstackroleadd--projectservice--userplacementadmin

6.在服务目录中添加placementapi

#openstackservicecreate--nameplacement--description"PlacementAPI"plac

ement

7.仓!l建placement的endpoint

$openstackendpointcreate--regionRegionOneplacementpublichttp://ocatal:

8778

$openstackendpointcreate--regionRegionOneplacementinternalhttp://ocata

1:8778

14/37

$openstackendpointcreate--regionRegionOneplacementadminhttp://ocatal:8

778

33.1.3安装nova软件及修改配置文件

1.安装nova软件包

#yuminstallopenstack-nova-apiopenstack-nova-conductor\

openstack-nova-consoleopenstack-nova-novncproxy\

openstack-nova-scheduleropenstack-nova-placement-api

2.配置文件nova.conf

[DEFAULT]

my_ip=8

enabled_apis=osapi_compute,metadata

transport_url=rabbit://openstack:RABBIT_PASS@ocatal

[api]

auth_strategy=keystone

[api_database]

connection=mysql+pymysql://nova:NOVA_DBPASS@ocatal/nova_api

[cinder]

os_region_name=RegionOne

[database]

connection=mysql+pymysql://nova:NOVA_DBPASS@ocatal/nova

[glance]

api_servers=http://ocatal:9292

[keystone_authtoken]

auth_uri=http://ocatal:5000/v3

auth_url=http:〃ocatal:35357八3

memcached_servers=ocatal:11211

auth_type=passworc

15/37

project_domain_name=Default

user_domain_name=Default

project_name=service

username=nova

password=NOVA_PASS

[neutron]

url=http://ocatal:9696

auth_url=http://ocatal:35357/v3

auth_type=passworc

project_domain_name=default

user_domain_name=cefault

region_name=RegiorOne

project_name=service

username=neutron

password=SUCCESS-ASS

service_metadata_proxy=true

metadata_proxy_shared_secret=METADATA_SECRET

[oslo_roncurrpncy]

lock_path=/var/lib/nova/tmp

[placement]

os_region_name=RegionOne

project_domain_name=Default

project_name=service

auth_type=passworc

user_domain_name=Default

auth_url=http://ocatal:35357/v3

username=placement

password=PLACEMENT_PASS

[scheduler]

discover_hosts_in_cells_interval-3600

16/37

[vnc]

enabled=true

vncserver_lister=$my_ip

vncserver_proxyclient_address=$my_ip

3.由于发版错误，必须修正/etc/httpd/conf.d/00・nova・placement・api.conf

<Directory/usr/bin>

<IfVersion>=2.4>

Requireallgranted

</IfVersion>

<IfVersion<2.4>

Ordprallnw,dpny

Allowfromall

</IfVersion>

</Directory>

4.重启httpd

#systemctlrestarthttpd

5.初始化nova■叩i数据库

#su-s/bin/sh-c"nova-manageapi_dbsync"nova

6.注册cell。数据库

#su-s/bin/sh-c"nova-managecell_v2map_cell0"nova

7.创建celll

#su-s/bin/sh-c"nova-managecell_v2create_cell--name=celll--verbose"no

va

8.初始化nova数据库

17/37

#su-s/bin/sh-c"nova-managedbsync"nova

9.验证cellO和celll得到正确注册

#nova-managecell_v2list_cells

IName|UUID|

|celll|109eld4b-536a-40d0-83c6-5fl21b82b650|

|cell0|00000000-6000-0000-0000-000000000000|

+------+--------------------------------------+

10.设置nova随机启动并启动服务

#systemctlenableopenstack-nova-api.service\

openstack-nova-corsoleauth.serviceopenstack-nova-scheduler.service\

openstack-nova-corductor.serviceopenstack-nova-novncproxy.service

#systemctlstartopenstack-nova-api.service\

openstack-nova-corsoleauth.serviceopenstack-nova-scheduler.service\

openstack-nova-corductor.serviceopenstack-nova-novncproxy.service

3.3.2计算节点配置

计算节点安装nova相关服务

1.新建计算节点computer!安装nova包

#yuminstallopenstack-nova-compute

3・3・2・2配置nova.conf文件

1.按照以下过滤项配置nova.conf文件

18/37

[DEFAULT]

enabled_apis=osapi_compute,metadata

transport_url=rabbit://openstack:RABBIT_PASS@ocatal

my_ip=9

use_neutron=True

firewall_driver=nova.virt.firewall.NoopFirewallDriver

rbd_user=cinder

rbd_secret_uuid=457eb676-33da-42ec-9a8c-9293d545c337

[api]

auth_strategy=keystone

[glance]

api_servers=http://ocatal:9292

[keystone_authtoken]

auth_uri=http://ocatal:5000

auth_url=http://ocatal:35357

memcached_servers=ocatal:11211

auth_type=password

projprt_domain_namp=default

user_domain_name=cefault

project_name=service

username=nova

password=NOVA_PASS

[libvirt]

virt_type=qemu

images_type=rbd

images_rbd_ceph_conf=/etc/ceph/ceph.conf

rbd_user=cinder

rbd_secret_uuid=4S7eb676-33da-42ec-9a8c-9293d545c337

diskcachemodes="retwork=writeback"

inject_password-fslse

19/37

inject_key=false

inject_partition="2

hw_disk_discard=urmap

[neutron]

url=http://ocatal:9696

auth_url=http://ocatal:35357

auth_type=passworc

project_domain_name=default

user_domain_name=cefault

region_name=RegiorOne

project_name=service

username=neutron

password=SUCCESS-ASS

[placement]

os_region_name=RegionOne

project_domain_name=Default

project_name=service

auth_typp=password

user_domain_name=Default

auth_url=http://ocatal:35357/v3

username=placement

password=PLACEMENT_PASS

[vnc]

enabled=True

vncserver_listen=G.0.0.0

vncserver_proxyclient_address=$my_ip

novncproxy_base_url=http://ocatal:6080/vnc_auto.html

2.设置服务开机自启动并启动nova・compute服务

ftsystemctlenableopenstack-nova-compute

20/37

#systemctlrestartopenstack-nova-compute

3.3.23开启热迁移功能

1.在compute节点配置nova用户

[rootusermod-s/bin/bashnova

[root:~]#passwdnova

[rootsunova

[nova:/root]$cd

[nova:~]#mkdir-p-m700.ssh

2.配置nova用户在迁移源主机和目的主机间无密码访问

[nova:~]$ssh-keygen#所有compute主机执行此句，回车过所有输入信息

[nova:~]$ssh-copy-idnova@{compute}#把木主机外的所有主机名替换compute然后用no

va的密码进行sshkey的复制

3.更改nova用户文件权限

[rnnt:*«]#chown-Rnnva:nnva/var/1ih/nnva

[rootchmod700/var/lib/nova/.ssh

[rootchmod600/var/lib/nova/.ssh/authorized_keys

4.配置compute节点的libvirtd服务

->Edit/etc/libvirt/libvirtd.conf

lister)_tls=0

listen_tcp=1

auth_tcp="none”

->Edit/etc/sysconfig/libvirtd

LIBVIRTD_ARGS="--listen"

5.编辑compute节点的nova.conf的[libvirt]部分

21/37

[libvirt]

block_migration_flag=VIR_MIGRATE_UNDEFINE_S0URCE,VIR_MIGRATE_PEER2PEER,VIR

_MIGRATE_LIVE,VIR_MIGRATE_TUNNELLED,VIR_MIGRATE_NON_SHARED_INC

live_migration_flag=VIR_MIGRATE_UNDEFINE_SCURCE,VIR_MIGRATE_PEER2PEER,VIR

_MIGRATE_LIVE,VIR_MIGRATE_TUNNELLED

live_migration_uri=qemu+tcp://%s/system

6.重启openstack-nova-compute和libvirtd

3.4安装配置neutron集群

3.4.1控制节点配置

创建neutron数据库

1.创建数据库

#mysql-uroot-pl23456

MariaDB[(none)]>CREATEDATABASEneutron;

2.创建数据库用户并赋予权限

MariaDB[(none)]>GRANTALLPRIVILEGESONneutron.*TO'neutronlocalhost'

IDENTIFIEDBY'NEUTRON_DBPASS'；

MariaDB[(none)]>GRANTALLPRIVILEGESONneutron.*TO'neutron\

IDENTIFIEDBY'NEUTRON_DBPASS'；

3.在controller!上创建neutron用户及赋予admin权限

#source/root/admin

#openstackusercreate--domaindefault--password-promptneutron

#openstackroleadd--projectservice--userneutronadmin

4.创建neutron服务

22/37

#openstackservicecreate--nameneutron\

--description"OpenStackNetworking"network

5.创建NetworkingserviceAPIendpoints

#openstackendpointcreate--regionRegionOne\

networkpublichttp://ocatal:9696

#openstackendpointcreate--regionRegionOne\

networkinternalhttp://ocatal:9696

#openstackendpointcreate--regionRegionOne\

networkadminhttp://ocatal:9696

安装Self-servicenetworks

1.安装neutronSelf-servicenetworks相关软件

#yuminstallopenstack-neutronopenstack-neutron-ml2openstack-neutron-linuxb

ridgeebtables-y

2.按以下配置项配置

[DEFAULT]

core_plugin=ml2

service_plugins=router

allow_overlapping_ips=true

transport_url=rabbit://openstack:RABBIT_PASS@ocatal

authstrategy=keystone

notify_nova_on_port_status_changes=true

notify_nova_on_port_data_changes=true

[database]

connection=mysql+pymysql://neutron:NEUTRON_DBPASS@ocatal/neutron

[keystone_authtoken；

auth_uri-http://ocatal:5000/v3

23/37

auth_url=http://ocatal:35357/v3

memcached_servers=ocatal:11211

auth_type=passworc

project_domain_name=default

user_domain_name=cefault

project_name=service

username=neutron

password=SUCCESS-ASS

[matchmaker_redis]

[nova]

auth_url=http://ocatal:35357/v3

auth_type=passworc

project_domain_name=default

user_domain_name=cefault

region_name=RegiorOne

project_name=service

username=nova

password=NOVA_PAOS

[oslo_concurrency]

lock_path=/var/lib/neutron/tmp

配置ml2_conf.ini

1.SB8/etc/neutron/plugins/ml2/ml2_conf.ini

[DEFAULT]

[ml2]

type_drivers=vlan,vxlan

tenant_network_types=vxlan

mechanism_drivers=linuxbridge,12population

extension_drivers=port_security

24/37

[ml2_type_flat]

[ml2_type_geneve]

[ml2_type_gre]

[ml2_type_vlan]

network_vlan_ranges=provider:3135:3135

[ml2_type_vxlan]

vni_ranges=1:1000

[securitygroup]

enable_ipset=true

配置linuxbridge_agent.ini

1.@SS/etc/neutron/plugins/ml2/linuxbridge_agent.ini

[DEFAULT]

[agent]

[linux_bridge]

physical_interface_mappings=provider:ens33

[securitygroupj

enable_security_group=true

firewall_driver=neutron.agent.linux.iptables_firewall.IptablesFirewallDrive

r

[vxlan]

enable_vxlan=true

local_ip=8

12_population=true

配置13_agent.ini

1.配置/etc/neutron/l3_agent.ini

[DEFAULT]

25/37

interface_driver=linuxbridge

配置dhcp_agent.ini

1.@BS/etc/neutron/dhcp_agent.ini

[DEFAULT]

interface_driver=linuxbridge

dhcp_driver=neutron.agent.linux.dhcp.Dnsmasq

enable_isolated_metadata=true

配置metadata_agent.ini

1.HdM/etc/neutron/metadata_agent.ini

[DEFAULT]

nova_metadata_ip=ocatal

metadata_proxy_shared_secret=METADATA_SECRET

2.在controlled、2、3上创建软链接

#In-s/etc/neutron/plugins/ml2/ml2_conf.ini/etc/neutron/plugin.ini

3.同步数据库：

#su-s/bin/sh-c"neutron-db-manage--config-file/etc/neutron/neutron.conf

--config-file/etc/neutron/plugins/ml2/ml2_ccnf.iniupgradehead"neutron

4.重启neutron相关服务并设置开机启动

#systemctlrestartopenstack-nova-api.service

#systemctlenableneutron-server.service\

neutron-linuxbridge-agent.serviceneutron-dhcp-agent.service\

neutron-metadata-agent.serviceneutron-13-agent.service

26/37

#systemctlrestartneutron-server.service\

neutron-linuxbridge-agent.serviceneutron-dhcp-agent.service\

neutron-metadata-cgent.serviceneutron-13-agent.service

3.4.2计算节点配置

计算节点安装neutron相关服务

1.计算节点安装openstack-neutron-openvswitch

#yuminstallopenstack-neutron-linuxbridgeebtablesipset-y

配置neutron.conf

1.修改/etc/neutron/neutron.conf文件，按照如下过滤配置修改：

[DEFAULT]

auth_strategy=keystone

transport_url=rabbit://openstack:RABBIT_PASS@ocatal

[keystone_authtoken]

auth_uri=http://ocatal:5000/v3

auth_url=http://ocatal:35357/v3

memcached_servers=ocatal:11211

auth_type=passworc

project_domain_name=default

user_domain_name=cefault

project_name=service

username=neutron

password=SUCCESS-ASS

[oslo_concurrency]

lock_path=/var/lib/neutron/tmp

27/37

配置openvswitch_agent

1.配置openvswitch_agent.ini文件

[DEFAULT]

[agent]

Llinux_bridgeJ

physical_interface_mappings=provider:ens34

[securitygroup]

enable_security_group=true

firewall_driver=neutron.agent.linux.iptables_firewall.IptablesFirewallDrive

r

[vxlan]

enable_vxlan=true

local_ip=9

12_population=true

2.重启计算节点服务：

#systemctlrestartopenstack-nova-compute.service

#systemctlenableneutnon-openvswitch-agent.service

#systemctlstartneutron-openvswitch-agent.service

I3.5安装Dashboard集群

1.安装软件包

#yuminstallopenstack-dashboard

2・酉己置/etc/opcnstack-dashboard/local_settings文件

OPENSTACK_HOST="controller"

ALLOWED_HOSTS=['','']

SESSION_ENGINE="django.contrib.sessions.backends.cache

28/37

CACHES={

'default':{

'BACKEND':django.core.cache.backends.memcached.MemcachedCache',

'LOCATION':'controller:11211',

)

)

OPENSTACK_KEYSTONE_URL="http：//%S：