目录一、初始化二、控制节点环境配置2.1 安装OpenStack2.2 安装mariadb2.3 RabbitMQ消息队列部署2.4 部署Memcached缓存服务三、Keystone身份认证服务部署四、镜像服务五、计算服务5.1 控制节点5.1.1 创建Nova两个数据库5.1.2 创建服务证书5.1.3 安装控制节点Nova软件包5.2 计算节点5.2.1 安装nova‑compute计算服务包5.2.2 修改计算节点配置文件5.2.3 控制节点验证Nova整套部署六、网络服务6.1 控制节点6.1.1 创建Neutron数据库6.1.2 创建服务证书6.1.3 选择公共网络配置6.1.4 配置元数据代理6.2 计算节点6.2.1 配置网桥代理6.2.2 配置公共网络6.3 部署验证控制节点执行七、启动实例7.1 创建Provider提供者网络Flat外网7.2 创建子网并配置网段、网关与DNS7.3 创建云主机规格Flavor7.4 生成密钥对7.5 配置安全组放行ICMP、SSH (22 端口) 流量7.6 创建并启动云主机实例八、dashboard8.1 安装Dashboard软件包8.2 修改Dashboard主配置文件8.4 网页访问验证OpenStack是开源的云计算IaaS基础设施即服务平台。 通俗讲它就是一套自建虚拟机云平台作用等同于自己搭一个小型阿里云、华为云可以批量创建、管理虚拟机、网络、存储资源。一、初始化将内存扩到4G将虚拟化引擎的第一个勾选新加一个网络适配器选择模式为NAT如果勾选后虚拟机开不了出现以下页面可以打开Windows的控制面板选择“程序”选择下方红色方框框起来的内容“虚拟机平台”“适用于Linux的Windows子系统”“Windows虚拟机监控程序平台”取消勾选然后点击确定会重启电脑打开虚拟机后将网卡修改为eth0(vim /boot/grub2/grub.cfg)主机名设为controller此时新添加的网卡自动为eth1将eth0的IP固定下来修改成下方模样eth1的文件修改成下方模样不分配IP添加域名解析并将mitaka解压缩[rootcontroller ~]# vim /etc/hosts[rootcontroller ~]# lsanaconda-ks.cfg mitaka.tar[rootcontroller ~]# tar xf mitaka.tar -C /opt/注意需要时间同步防火墙关闭selinux 关闭配置本地yum仓库源[rootcontroller ~]# vim /etc/yum.repos.d/openstack.repo[openstack]namemitakabaseurlfile:///opt/mitakagpgcheck0更新系统软件包[rootcontroller ~]# yum upgrade有更新就得重启虚拟机[rootcontroller ~]# reboot二、控制节点环境配置指导文件OpenStack Docs: OpenStack Installation Guide for Red Hat Enterprise Linux and CentOS2.1 安装OpenStackootcontroller ~]# yum install python-openstackclient2.2 安装mariadb[rootcontroller ~]# yum install mariadb mariadb-server python2-PyMySQL创建并编辑 /etc/my.cnf.d/openstack.cnf设置bind-address值为控制节点的管理网络IP地址以使得其它节点可以通过管理网络访问数据库[rootcontroller ~]# vim /etc/my.cnf.d/openstack.cnf启动mariadb并设置mysql密码[rootcontroller ~]# systemctl enable mariadb.service[rootcontroller ~]# systemctl start mariadb.service[rootcontroller ~]# mysql_secure_installation最开始密码为空然后设置新密码2.3 RabbitMQ消息队列部署安装RabbitMQ服务端[rootcontroller ~]# yum install rabbitmq-server设置开机自启并启动服务[rootcontroller ~]# systemctl enable rabbitmq-server.service[rootcontroller ~]# systemctl start rabbitmq-server.service创建OpenStack专用消息队列账号并设置密码为“openstack”给openstack账号授予全部权限[rootcontroller ~]# rabbitmqctl add_user openstack openstack[rootcontroller ~]# rabbitmqctl set_permissions openstack .* .* .*开启RabbitMQ可视化管理插件[rootcontroller ~]# rabbitmq-plugins enable rabbitmq_management[rootcontroller ~]# systemctl restart rabbitmq-server浏览器访问192.168.159.161:15672密码也是guest2.4 部署Memcached缓存服务[rootcontroller ~]# yum install memcached python-memcached[rootcontroller ~]# systemctl enable memcached.service[rootcontroller ~]# systemctl start memcached.service[rootcontroller ~]# netstat -antlp|grep 11211改成全部端口将里面的内容删掉vim /etc/sysconfig/memcached重启服务三、Keystone身份认证服务部署登录数据库创建keystone数据库与授权账号[rootcontroller ~]# mysql -u root -pwestosMariaDB [(none)] CREATE DATABASE keystone;MariaDB [(none)] GRANT ALL PRIVILEGES ON keystone.* TO keystonelocalhost \- IDENTIFIED BY keystone;MariaDB [(none)] GRANT ALL PRIVILEGES ON keystone.* TO keystone% \- IDENTIFIED BY keystone;MariaDB [(none)] exit生成管理员临时令牌[rootcontroller ~]# openssl rand -hex 10安装Keystone与Apache网页服务[rootcontroller ~]# yum install openstack-keystone httpd mod_wsgi修改keystone主配置文件[rootcontroller ~]# vim /etc/keystone/keystone.confadmin_token填入刚刚openssl生成的随机字符串临时管理员令牌同步数据库表结构[rootcontroller ~]# su -s /bin/sh -c keystone-manage db_sync keystone[rootcontroller ~]# mysql -pwestosMariaDB [(none)] use keystone;MariaDB [keystone] show tables;初始化Fernet密钥仓库[rootcontroller ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone[rootcontroller ~]# vim /etc/httpd/conf/httpd.conf取消注释添加主机名[rootcontroller ~]# vim /etc/httpd/conf.d/wsgi-keystone.conf5000端口公共接口普通用户、云组件访问认证35357端口管理员接口执行管理员权限操作[rootcontroller ~]# systemctl enable httpd.service[rootcontroller ~]# systemctl start httpd.service导入临时环境变量[rootcontroller ~]# export OS_TOKEN5f920a058e8efb7b82c4[rootcontroller ~]# export OS_URLhttp://controller:35357/v3[rootcontroller ~]# export OS_IDENTITY_API_VERSION3创建Keystone服务实体[rootcontroller ~]# openstack service create \ --name keystone --description OpenStack Identity identity创建Keystone三个访问端点公共接口public[rootcontroller ~]# openstack endpoint create --region RegionOne \ identity public http://controller:5000/v3内部接口internal[rootcontroller ~]# openstack endpoint create --region RegionOne \ identity internal http://controller:5000/v3管理员接口admin[rootcontroller ~]# openstack endpoint create --region RegionOne \ identity admin http://controller:35357/v3创建默认域default[rootcontroller ~]# openstack domain create --description Default Domain default创建管理员项目admin[rootcontroller ~]# openstack project create --domain default \ --description Admin Project admin创建管理员用户admin[rootcontroller ~]# openstack user create --domain default \ --password admin admin创建admin管理员角色[rootcontroller ~]# openstack role create admin给admin用户绑定管理员权限用户‑项目‑角色关联[rootcontroller ~]# openstack role add --project admin --user admin admin创建service服务项目[rootcontroller ~]# openstack project create --domain default \ --description Service Project service创建demo普通测试项目[rootcontroller ~]# openstack project create --domain default \ --description Demo Project demo创建demo普通用户[rootcontroller ~]# openstack user create --domain default \ --password-prompt demo创建user普通用户[rootcontroller ~]# openstack role create user绑定demo用户权限[rootcontroller ~]# openstack role add --project demo --user demo user删除临时管理员令牌环境变量[rootcontroller ~]# unset OS_TOKEN OS_URL验证管理员账号登录admin[rootcontroller ~]# openstack --os-auth-url http://controller:35357/v3 \ --os-project-domain-name default --os-user-domain-name default \ --os-project-name admin --os-username admin token issue密码是admin验证普通用户账号登录demo[rootcontroller ~]# openstack --os-auth-url http://controller:5000/v3 \ --os-project-domain-name default --os-user-domain-name default \ --os-project-name demo --os-username demo token issue密码是demo编写admin管理员环境变量脚本[rootcontroller ~]# vim admin-openrcexport OS_PROJECT_DOMAIN_NAMEdefault export OS_USER_DOMAIN_NAMEdefault export OS_PROJECT_NAMEadmin export OS_USERNAMEadmin export OS_PASSWORDadmin export OS_AUTH_URLhttp://controller:35357/v3 export OS_IDENTITY_API_VERSION3 export OS_IMAGE_API_VERSION2编写demo普通用户环境变量脚本[rootcontroller ~]# vim demo-openrcexport OS_PROJECT_DOMAIN_NAMEdefault export OS_USER_DOMAIN_NAMEdefault export OS_PROJECT_NAMEdemo export OS_USERNAMEdemo export OS_PASSWORDdemo export OS_AUTH_URLhttp://controller:5000/v3 export OS_IDENTITY_API_VERSION3 export OS_IMAGE_API_VERSION2加载环境变量脚本、一键测试令牌获取[rootcontroller ~]# . admin-openrc[rootcontroller ~]# openstack token issue四、镜像服务创建glance数据库对glance数据库授予恰当的权限[rootcontroller ~]# mysql -pwestosMariaDB [(none)] CREATE DATABASE glance;MariaDB [(none)] GRANT ALL PRIVILEGES ON glance.* TO glancelocalhost \- IDENTIFIED BY glance;MariaDB [(none)] GRANT ALL PRIVILEGES ON glance.* TO glance% \- IDENTIFIED BY glance;获得admin凭证来获取只有管理员能执行的命令的访问权限创建glance用户[rootcontroller ~]# . admin-openrc[rootcontroller ~]# openstack user create --domain default --password-prompt glance自己设置密码为glance添加admin角色到glance用户和service项目上创建glance服务实体[rootcontroller ~]# openstack role add --project service --user glance admin[rootcontroller ~]# openstack service create --name glance \ --description OpenStack Image image创建镜像服务的API端点[rootcontroller ~]# openstack endpoint create --region RegionOne \ image public http://controller:9292[rootcontroller ~]# openstack endpoint create --region RegionOne \ image internal http://controller:9292[rootcontroller ~]# openstack endpoint create --region RegionOne \ image admin http://controller:9292安装软件包[rootcontroller ~]# yum install openstack-glance编辑文件 /etc/glance/glance-api.conf[rootcontroller ~]# vim /etc/glance/glance-api.conf编辑文件/etc/glance/glance-registry.conf[rootcontroller ~]# vim /etc/glance/glance-registry.conf写入镜像服务数据库[rootcontroller ~]# su -s /bin/sh -c glance-manage db_sync glance启动镜像服务、配置他们开机自启[rootcontroller ~]# systemctl enable openstack-glance-api.service \ openstack-glance-registry.service[rootcontroller ~]# systemctl start openstack-glance-api.service \ openstack-glance-registry.service下载镜像源最新版不建议本人最后换成0.3.4版本的下载官网Index of /[rootcontroller ~]# . admin-openrc[rootcontroller ~]# openstack image create cirros \ --file cirros-0.6.0-x86_64-disk.img \ --disk-format qcow2 --container-format bare \ --public验证镜像源可用是“active”[rootcontroller ~]# openstack image list五、计算服务首先计算节点也需要初始化网卡配置时间同步防火墙更新系统软件包重启等5.1 控制节点5.1.1 创建Nova两个数据库[rootcontroller ~]# mysql -pwestosMariaDB [(none)] CREATE DATABASE nova_api;MariaDB [(none)] CREATE DATABASE nova;MariaDB [(none)] GRANT ALL PRIVILEGES ON nova_api.* TO novalocalhost \- IDENTIFIED BY nova;MariaDB [(none)] GRANT ALL PRIVILEGES ON nova_api.* TO nova% \- IDENTIFIED BY nova;MariaDB [(none)] GRANT ALL PRIVILEGES ON nova.* TO novalocalhost \- IDENTIFIED BY nova;MariaDB [(none)] GRANT ALL PRIVILEGES ON nova.* TO nova% \- IDENTIFIED BY nova;加载管理员环境变量[rootcontroller ~]# . admin-openrc5.1.2 创建服务证书Keystone创建nova服务账号设置密码为nova[rootcontroller ~]# openstack user create --domain default \ --password-prompt nova把nova用户加入service项目授予管理员权限注册Nova服务实体[rootcontroller ~]# openstack role add --project service --user nova admin[rootcontroller ~]# openstack service create --name nova \ --description OpenStack Compute compute创建Nova三个访问端点public/internal/admin[rootcontroller ~]# openstack endpoint create --region RegionOne \ compute public http://controller:8774/v2.1/%\(tenant_id\)s[rootcontroller ~]# openstack endpoint create --region RegionOne \ compute internal http://controller:8774/v2.1/%\(tenant_id\)s[rootcontroller ~]# openstack endpoint create --region RegionOne \ compute admin http://controller:8774/v2.1/%\(tenant_id\)s5.1.3 安装控制节点Nova软件包[rootcontroller ~]# yum install openstack-nova-api openstack-nova-conductor \ openstack-nova-console openstack-nova-novncproxy \ openstack-nova-scheduler修改nova主配置文件 /etc/nova/nova.conf注意IP填的是本机的IP[rootcontroller ~]# vim /etc/nova/nova.conf数据库同步迁移表结构[rootcontroller ~]# su -s /bin/sh -c nova-manage api_db sync nova[rootcontroller ~]# su -s /bin/sh -c nova-manage db sync nova开启并启动Nova控制节点所有服务[rootcontroller ~]# systemctl enable openstack-nova-api.service \ openstack-nova-consoleauth.service openstack-nova-scheduler.service \ openstack-nova-conductor.service openstack-nova-novncproxy.service[rootcontroller ~]# systemctl start openstack-nova-api.service \ openstack-nova-consoleauth.service openstack-nova-scheduler.service \ openstack-nova-conductor.service openstack-nova-novncproxy.service5.2 计算节点5.2.1 安装nova‑compute计算服务包[rootcompute1 ~]# yum install openstack-nova-compute5.2.2 修改计算节点配置文件[rootcompute1 ~]# vim /etc/nova/nova.conf注意IP填的计算节点的本机IP检查服务器CPU虚拟化是否开启[rootcompute1 ~]# egrep -c (vmx|svm) /proc/cpuinfo启动计算节点服务[rootcompute1 ~]# systemctl enable libvirtd.service openstack-nova-compute.service[rootcompute1 ~]# systemctl start libvirtd.service openstack-nova-compute.service5.2.3 控制节点验证Nova整套部署六、网络服务6.1 控制节点6.1.1 创建Neutron数据库[rootcontroller ~]# mysql -pwestosMariaDB [(none)] CREATE DATABASE neutron;Query OK, 1 row affected (0.03 sec)MariaDB [(none)] GRANT ALL PRIVILEGES ON neutron.* TO neutronlocalhost \- IDENTIFIED BY neutron;Query OK, 0 rows affected (0.00 sec)MariaDB [(none)] GRANT ALL PRIVILEGES ON neutron.* TO neutron% \- IDENTIFIED BY neutron;6.1.2 创建服务证书Keystone创建neutron服务用户[rootcontroller ~]# . admin-openrc[rootcontroller ~]# openstack user create --domain default --password-prompt neutron密码为neutron给neutron账号授予管理员权限注册Neutron服务实体[rootcontroller ~]# openstack role add --project service --user neutron admin[rootcontroller ~]# openstack service create --name neutron \ --description OpenStack Networking network创建Neutron三个访问端点public/internal/admin[rootcontroller ~]# openstack endpoint create --region RegionOne \ network public http://controller:9696[rootcontroller ~]# openstack endpoint create --region RegionOne \ network internal http://controller:9696[rootcontroller ~]# openstack endpoint create --region RegionOne \ network admin http://controller:96966.1.3 选择公共网络配置安装控制节点Neutron软件包[rootcontroller ~]# yum install openstack-neutron openstack-neutron-ml2 \ openstack-neutron-linuxbridge ebtables[rootcontroller ~]# vim /etc/neutron/neutron.conf[rootcontroller ~]# vim /etc/neutron/plugins/ml2/ml2_conf.ini修改Linux‑Bridge网桥代理配置[rootcontroller ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.iniprovider公共网络绑定宿主机eth1网卡这里网卡名要和你虚拟机的第二块网卡名称保持一致否则外网不通[rootcontroller ~]# vim /etc/neutron/dhcp_agent.ini6.1.4 配置元数据代理[rootcontroller ~]# vim /etc/neutron/metadata_agent.ini为计算节点配置网络服务[rootcontroller ~]# vim /etc/nova/nova.conf关键字要和上述一样创建插件软链接Neutron数据库同步[rootcontroller ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini[rootcontroller ~]# su -s /bin/sh -c neutron-db-manage --config-file /etc/neutron/neutron.conf \ --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head neutron重启Nova‑API服务启动Neutron所有服务[rootcontroller ~]# systemctl restart openstack-nova-api.service[rootcontroller ~]# systemctl enable neutron-server.service \ neutron-linuxbridge-agent.service neutron-dhcp-agent.service \ neutron-metadata-agent.service[rootcontroller ~]# systemctl start neutron-server.service \ neutron-linuxbridge-agent.service neutron-dhcp-agent.service \ neutron-metadata-agent.service6.2 计算节点6.2.1 配置网桥代理安装网桥代理软件包[rootcompute1 ~]# yum install openstack-neutron-linuxbridge ebtables ipset修改neutron主配置文件[rootcompute1 ~]# vim /etc/neutron/neutron.conf6.2.2 配置公共网络修改计算节点网桥代理配置[rootcompute1 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini网卡映射provider:eth1网卡名和控制节点保持一致必须为第二块物理网卡。修改计算节点Nova配置对接Neutron[rootcompute1 ~]# vim /etc/nova/nova.conf[rootcompute1 ~]# systemctl restart openstack-nova-compute.service[rootcompute1 ~]# systemctl enable neutron-linuxbridge-agent.service[rootcompute1 ~]# systemctl start neutron-linuxbridge-agent.service6.3 部署验证控制节点执行[rootcontroller ~]# . admin-openrc[rootcontroller ~]# neutron ext-list[rootcontroller ~]# neutron agent-list七、启动实例7.1 创建Provider提供者网络Flat外网[rootcontroller ~]# neutron net-create --shared --provider:physical_network provider \ --provider:network_type flat provider[rootcontroller ~]# openstack flavor list7.2 创建子网并配置网段、网关与DNS[rootcontroller ~]# neutron subnet-create --name provider \ --allocation-pool start192.168.159.101,end192.168.159.150 \ --dns-nameserver 114.114.114.114 --gateway 192.168.159.2 \ provider 192.168.159.0/24[rootcontroller ~]# openstack network list7.3 创建云主机规格Flavor[rootcontroller ~]# openstack flavor create --id 0 --vcpus 1 --ram 64 --disk 1 m1.nano7.4 生成密钥对[rootcontroller ~]# . demo-openrc[rootcontroller ~]# ssh-keygen -q -N Enter file in which to save the key (/root/.ssh/id_rsa):[rootcontroller ~]# openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey[rootcontroller ~]# openstack keypair list7.5 配置安全组放行ICMP、SSH (22 端口) 流量[rootcontroller ~]# openstack security group rule create --proto icmp default[rootcontroller ~]# openstack security group rule create --proto tcp --dst-port 22 default[rootcontroller ~]# openstack flavor list重新换一个镜像源之前0.6.0太新了无法登录云主机用id删[rootcontroller ~]# openstack image delete 0e20632f-3986-4b54-b875-567d1fced114[rootcontroller ~]# rm -f cirros-0.6.0-x86_64-disk.img[rootcontroller ~]# wget http://download.cirros-cloud.net/0.3.4/cirros-0.3.4-x86_64-disk.img[rootcontroller ~]# openstack image create cirros \ --file cirros-0.3.4-x86_64-disk.img \ --disk-format qcow2 --container-format bare \ --public7.6 创建并启动云主机实例创建前输出为空使用net_id和m1.nano[rootcontroller ~]# openstack server create --flavor m1.nano --image cirros \ --nic net-id655fbd82-ca8a-415e-b7a4-9b556059e6ac --security-group default \ --key-name mykey provider-instance接口会占用一个ip[rootcontroller ~]# openstack server list[rootcontroller ~]# openstack console url show provider-instance获取后通过浏览器访问正常登录就可以使用了ping外网也能通ssh正常登入八、dashboard8.1 安装Dashboard软件包[rootcontroller ~]# yum install openstack-dashboard -y8.2 修改Dashboard主配置文件[rootcontroller ~]# vim /etc/openstack-dashboard/local_settings8.4 网页访问验证[rootcontroller ~]# systemctl restart httpd.service memcached.service浏览器访问192.168.159.161/dashboard可以对云主机网络子网进行操作
openstack云平台部署
目录一、初始化二、控制节点环境配置2.1 安装OpenStack2.2 安装mariadb2.3 RabbitMQ消息队列部署2.4 部署Memcached缓存服务三、Keystone身份认证服务部署四、镜像服务五、计算服务5.1 控制节点5.1.1 创建Nova两个数据库5.1.2 创建服务证书5.1.3 安装控制节点Nova软件包5.2 计算节点5.2.1 安装nova‑compute计算服务包5.2.2 修改计算节点配置文件5.2.3 控制节点验证Nova整套部署六、网络服务6.1 控制节点6.1.1 创建Neutron数据库6.1.2 创建服务证书6.1.3 选择公共网络配置6.1.4 配置元数据代理6.2 计算节点6.2.1 配置网桥代理6.2.2 配置公共网络6.3 部署验证控制节点执行七、启动实例7.1 创建Provider提供者网络Flat外网7.2 创建子网并配置网段、网关与DNS7.3 创建云主机规格Flavor7.4 生成密钥对7.5 配置安全组放行ICMP、SSH (22 端口) 流量7.6 创建并启动云主机实例八、dashboard8.1 安装Dashboard软件包8.2 修改Dashboard主配置文件8.4 网页访问验证OpenStack是开源的云计算IaaS基础设施即服务平台。 通俗讲它就是一套自建虚拟机云平台作用等同于自己搭一个小型阿里云、华为云可以批量创建、管理虚拟机、网络、存储资源。一、初始化将内存扩到4G将虚拟化引擎的第一个勾选新加一个网络适配器选择模式为NAT如果勾选后虚拟机开不了出现以下页面可以打开Windows的控制面板选择“程序”选择下方红色方框框起来的内容“虚拟机平台”“适用于Linux的Windows子系统”“Windows虚拟机监控程序平台”取消勾选然后点击确定会重启电脑打开虚拟机后将网卡修改为eth0(vim /boot/grub2/grub.cfg)主机名设为controller此时新添加的网卡自动为eth1将eth0的IP固定下来修改成下方模样eth1的文件修改成下方模样不分配IP添加域名解析并将mitaka解压缩[rootcontroller ~]# vim /etc/hosts[rootcontroller ~]# lsanaconda-ks.cfg mitaka.tar[rootcontroller ~]# tar xf mitaka.tar -C /opt/注意需要时间同步防火墙关闭selinux 关闭配置本地yum仓库源[rootcontroller ~]# vim /etc/yum.repos.d/openstack.repo[openstack]namemitakabaseurlfile:///opt/mitakagpgcheck0更新系统软件包[rootcontroller ~]# yum upgrade有更新就得重启虚拟机[rootcontroller ~]# reboot二、控制节点环境配置指导文件OpenStack Docs: OpenStack Installation Guide for Red Hat Enterprise Linux and CentOS2.1 安装OpenStackootcontroller ~]# yum install python-openstackclient2.2 安装mariadb[rootcontroller ~]# yum install mariadb mariadb-server python2-PyMySQL创建并编辑 /etc/my.cnf.d/openstack.cnf设置bind-address值为控制节点的管理网络IP地址以使得其它节点可以通过管理网络访问数据库[rootcontroller ~]# vim /etc/my.cnf.d/openstack.cnf启动mariadb并设置mysql密码[rootcontroller ~]# systemctl enable mariadb.service[rootcontroller ~]# systemctl start mariadb.service[rootcontroller ~]# mysql_secure_installation最开始密码为空然后设置新密码2.3 RabbitMQ消息队列部署安装RabbitMQ服务端[rootcontroller ~]# yum install rabbitmq-server设置开机自启并启动服务[rootcontroller ~]# systemctl enable rabbitmq-server.service[rootcontroller ~]# systemctl start rabbitmq-server.service创建OpenStack专用消息队列账号并设置密码为“openstack”给openstack账号授予全部权限[rootcontroller ~]# rabbitmqctl add_user openstack openstack[rootcontroller ~]# rabbitmqctl set_permissions openstack .* .* .*开启RabbitMQ可视化管理插件[rootcontroller ~]# rabbitmq-plugins enable rabbitmq_management[rootcontroller ~]# systemctl restart rabbitmq-server浏览器访问192.168.159.161:15672密码也是guest2.4 部署Memcached缓存服务[rootcontroller ~]# yum install memcached python-memcached[rootcontroller ~]# systemctl enable memcached.service[rootcontroller ~]# systemctl start memcached.service[rootcontroller ~]# netstat -antlp|grep 11211改成全部端口将里面的内容删掉vim /etc/sysconfig/memcached重启服务三、Keystone身份认证服务部署登录数据库创建keystone数据库与授权账号[rootcontroller ~]# mysql -u root -pwestosMariaDB [(none)] CREATE DATABASE keystone;MariaDB [(none)] GRANT ALL PRIVILEGES ON keystone.* TO keystonelocalhost \- IDENTIFIED BY keystone;MariaDB [(none)] GRANT ALL PRIVILEGES ON keystone.* TO keystone% \- IDENTIFIED BY keystone;MariaDB [(none)] exit生成管理员临时令牌[rootcontroller ~]# openssl rand -hex 10安装Keystone与Apache网页服务[rootcontroller ~]# yum install openstack-keystone httpd mod_wsgi修改keystone主配置文件[rootcontroller ~]# vim /etc/keystone/keystone.confadmin_token填入刚刚openssl生成的随机字符串临时管理员令牌同步数据库表结构[rootcontroller ~]# su -s /bin/sh -c keystone-manage db_sync keystone[rootcontroller ~]# mysql -pwestosMariaDB [(none)] use keystone;MariaDB [keystone] show tables;初始化Fernet密钥仓库[rootcontroller ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone[rootcontroller ~]# vim /etc/httpd/conf/httpd.conf取消注释添加主机名[rootcontroller ~]# vim /etc/httpd/conf.d/wsgi-keystone.conf5000端口公共接口普通用户、云组件访问认证35357端口管理员接口执行管理员权限操作[rootcontroller ~]# systemctl enable httpd.service[rootcontroller ~]# systemctl start httpd.service导入临时环境变量[rootcontroller ~]# export OS_TOKEN5f920a058e8efb7b82c4[rootcontroller ~]# export OS_URLhttp://controller:35357/v3[rootcontroller ~]# export OS_IDENTITY_API_VERSION3创建Keystone服务实体[rootcontroller ~]# openstack service create \ --name keystone --description OpenStack Identity identity创建Keystone三个访问端点公共接口public[rootcontroller ~]# openstack endpoint create --region RegionOne \ identity public http://controller:5000/v3内部接口internal[rootcontroller ~]# openstack endpoint create --region RegionOne \ identity internal http://controller:5000/v3管理员接口admin[rootcontroller ~]# openstack endpoint create --region RegionOne \ identity admin http://controller:35357/v3创建默认域default[rootcontroller ~]# openstack domain create --description Default Domain default创建管理员项目admin[rootcontroller ~]# openstack project create --domain default \ --description Admin Project admin创建管理员用户admin[rootcontroller ~]# openstack user create --domain default \ --password admin admin创建admin管理员角色[rootcontroller ~]# openstack role create admin给admin用户绑定管理员权限用户‑项目‑角色关联[rootcontroller ~]# openstack role add --project admin --user admin admin创建service服务项目[rootcontroller ~]# openstack project create --domain default \ --description Service Project service创建demo普通测试项目[rootcontroller ~]# openstack project create --domain default \ --description Demo Project demo创建demo普通用户[rootcontroller ~]# openstack user create --domain default \ --password-prompt demo创建user普通用户[rootcontroller ~]# openstack role create user绑定demo用户权限[rootcontroller ~]# openstack role add --project demo --user demo user删除临时管理员令牌环境变量[rootcontroller ~]# unset OS_TOKEN OS_URL验证管理员账号登录admin[rootcontroller ~]# openstack --os-auth-url http://controller:35357/v3 \ --os-project-domain-name default --os-user-domain-name default \ --os-project-name admin --os-username admin token issue密码是admin验证普通用户账号登录demo[rootcontroller ~]# openstack --os-auth-url http://controller:5000/v3 \ --os-project-domain-name default --os-user-domain-name default \ --os-project-name demo --os-username demo token issue密码是demo编写admin管理员环境变量脚本[rootcontroller ~]# vim admin-openrcexport OS_PROJECT_DOMAIN_NAMEdefault export OS_USER_DOMAIN_NAMEdefault export OS_PROJECT_NAMEadmin export OS_USERNAMEadmin export OS_PASSWORDadmin export OS_AUTH_URLhttp://controller:35357/v3 export OS_IDENTITY_API_VERSION3 export OS_IMAGE_API_VERSION2编写demo普通用户环境变量脚本[rootcontroller ~]# vim demo-openrcexport OS_PROJECT_DOMAIN_NAMEdefault export OS_USER_DOMAIN_NAMEdefault export OS_PROJECT_NAMEdemo export OS_USERNAMEdemo export OS_PASSWORDdemo export OS_AUTH_URLhttp://controller:5000/v3 export OS_IDENTITY_API_VERSION3 export OS_IMAGE_API_VERSION2加载环境变量脚本、一键测试令牌获取[rootcontroller ~]# . admin-openrc[rootcontroller ~]# openstack token issue四、镜像服务创建glance数据库对glance数据库授予恰当的权限[rootcontroller ~]# mysql -pwestosMariaDB [(none)] CREATE DATABASE glance;MariaDB [(none)] GRANT ALL PRIVILEGES ON glance.* TO glancelocalhost \- IDENTIFIED BY glance;MariaDB [(none)] GRANT ALL PRIVILEGES ON glance.* TO glance% \- IDENTIFIED BY glance;获得admin凭证来获取只有管理员能执行的命令的访问权限创建glance用户[rootcontroller ~]# . admin-openrc[rootcontroller ~]# openstack user create --domain default --password-prompt glance自己设置密码为glance添加admin角色到glance用户和service项目上创建glance服务实体[rootcontroller ~]# openstack role add --project service --user glance admin[rootcontroller ~]# openstack service create --name glance \ --description OpenStack Image image创建镜像服务的API端点[rootcontroller ~]# openstack endpoint create --region RegionOne \ image public http://controller:9292[rootcontroller ~]# openstack endpoint create --region RegionOne \ image internal http://controller:9292[rootcontroller ~]# openstack endpoint create --region RegionOne \ image admin http://controller:9292安装软件包[rootcontroller ~]# yum install openstack-glance编辑文件 /etc/glance/glance-api.conf[rootcontroller ~]# vim /etc/glance/glance-api.conf编辑文件/etc/glance/glance-registry.conf[rootcontroller ~]# vim /etc/glance/glance-registry.conf写入镜像服务数据库[rootcontroller ~]# su -s /bin/sh -c glance-manage db_sync glance启动镜像服务、配置他们开机自启[rootcontroller ~]# systemctl enable openstack-glance-api.service \ openstack-glance-registry.service[rootcontroller ~]# systemctl start openstack-glance-api.service \ openstack-glance-registry.service下载镜像源最新版不建议本人最后换成0.3.4版本的下载官网Index of /[rootcontroller ~]# . admin-openrc[rootcontroller ~]# openstack image create cirros \ --file cirros-0.6.0-x86_64-disk.img \ --disk-format qcow2 --container-format bare \ --public验证镜像源可用是“active”[rootcontroller ~]# openstack image list五、计算服务首先计算节点也需要初始化网卡配置时间同步防火墙更新系统软件包重启等5.1 控制节点5.1.1 创建Nova两个数据库[rootcontroller ~]# mysql -pwestosMariaDB [(none)] CREATE DATABASE nova_api;MariaDB [(none)] CREATE DATABASE nova;MariaDB [(none)] GRANT ALL PRIVILEGES ON nova_api.* TO novalocalhost \- IDENTIFIED BY nova;MariaDB [(none)] GRANT ALL PRIVILEGES ON nova_api.* TO nova% \- IDENTIFIED BY nova;MariaDB [(none)] GRANT ALL PRIVILEGES ON nova.* TO novalocalhost \- IDENTIFIED BY nova;MariaDB [(none)] GRANT ALL PRIVILEGES ON nova.* TO nova% \- IDENTIFIED BY nova;加载管理员环境变量[rootcontroller ~]# . admin-openrc5.1.2 创建服务证书Keystone创建nova服务账号设置密码为nova[rootcontroller ~]# openstack user create --domain default \ --password-prompt nova把nova用户加入service项目授予管理员权限注册Nova服务实体[rootcontroller ~]# openstack role add --project service --user nova admin[rootcontroller ~]# openstack service create --name nova \ --description OpenStack Compute compute创建Nova三个访问端点public/internal/admin[rootcontroller ~]# openstack endpoint create --region RegionOne \ compute public http://controller:8774/v2.1/%\(tenant_id\)s[rootcontroller ~]# openstack endpoint create --region RegionOne \ compute internal http://controller:8774/v2.1/%\(tenant_id\)s[rootcontroller ~]# openstack endpoint create --region RegionOne \ compute admin http://controller:8774/v2.1/%\(tenant_id\)s5.1.3 安装控制节点Nova软件包[rootcontroller ~]# yum install openstack-nova-api openstack-nova-conductor \ openstack-nova-console openstack-nova-novncproxy \ openstack-nova-scheduler修改nova主配置文件 /etc/nova/nova.conf注意IP填的是本机的IP[rootcontroller ~]# vim /etc/nova/nova.conf数据库同步迁移表结构[rootcontroller ~]# su -s /bin/sh -c nova-manage api_db sync nova[rootcontroller ~]# su -s /bin/sh -c nova-manage db sync nova开启并启动Nova控制节点所有服务[rootcontroller ~]# systemctl enable openstack-nova-api.service \ openstack-nova-consoleauth.service openstack-nova-scheduler.service \ openstack-nova-conductor.service openstack-nova-novncproxy.service[rootcontroller ~]# systemctl start openstack-nova-api.service \ openstack-nova-consoleauth.service openstack-nova-scheduler.service \ openstack-nova-conductor.service openstack-nova-novncproxy.service5.2 计算节点5.2.1 安装nova‑compute计算服务包[rootcompute1 ~]# yum install openstack-nova-compute5.2.2 修改计算节点配置文件[rootcompute1 ~]# vim /etc/nova/nova.conf注意IP填的计算节点的本机IP检查服务器CPU虚拟化是否开启[rootcompute1 ~]# egrep -c (vmx|svm) /proc/cpuinfo启动计算节点服务[rootcompute1 ~]# systemctl enable libvirtd.service openstack-nova-compute.service[rootcompute1 ~]# systemctl start libvirtd.service openstack-nova-compute.service5.2.3 控制节点验证Nova整套部署六、网络服务6.1 控制节点6.1.1 创建Neutron数据库[rootcontroller ~]# mysql -pwestosMariaDB [(none)] CREATE DATABASE neutron;Query OK, 1 row affected (0.03 sec)MariaDB [(none)] GRANT ALL PRIVILEGES ON neutron.* TO neutronlocalhost \- IDENTIFIED BY neutron;Query OK, 0 rows affected (0.00 sec)MariaDB [(none)] GRANT ALL PRIVILEGES ON neutron.* TO neutron% \- IDENTIFIED BY neutron;6.1.2 创建服务证书Keystone创建neutron服务用户[rootcontroller ~]# . admin-openrc[rootcontroller ~]# openstack user create --domain default --password-prompt neutron密码为neutron给neutron账号授予管理员权限注册Neutron服务实体[rootcontroller ~]# openstack role add --project service --user neutron admin[rootcontroller ~]# openstack service create --name neutron \ --description OpenStack Networking network创建Neutron三个访问端点public/internal/admin[rootcontroller ~]# openstack endpoint create --region RegionOne \ network public http://controller:9696[rootcontroller ~]# openstack endpoint create --region RegionOne \ network internal http://controller:9696[rootcontroller ~]# openstack endpoint create --region RegionOne \ network admin http://controller:96966.1.3 选择公共网络配置安装控制节点Neutron软件包[rootcontroller ~]# yum install openstack-neutron openstack-neutron-ml2 \ openstack-neutron-linuxbridge ebtables[rootcontroller ~]# vim /etc/neutron/neutron.conf[rootcontroller ~]# vim /etc/neutron/plugins/ml2/ml2_conf.ini修改Linux‑Bridge网桥代理配置[rootcontroller ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.iniprovider公共网络绑定宿主机eth1网卡这里网卡名要和你虚拟机的第二块网卡名称保持一致否则外网不通[rootcontroller ~]# vim /etc/neutron/dhcp_agent.ini6.1.4 配置元数据代理[rootcontroller ~]# vim /etc/neutron/metadata_agent.ini为计算节点配置网络服务[rootcontroller ~]# vim /etc/nova/nova.conf关键字要和上述一样创建插件软链接Neutron数据库同步[rootcontroller ~]# ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini[rootcontroller ~]# su -s /bin/sh -c neutron-db-manage --config-file /etc/neutron/neutron.conf \ --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head neutron重启Nova‑API服务启动Neutron所有服务[rootcontroller ~]# systemctl restart openstack-nova-api.service[rootcontroller ~]# systemctl enable neutron-server.service \ neutron-linuxbridge-agent.service neutron-dhcp-agent.service \ neutron-metadata-agent.service[rootcontroller ~]# systemctl start neutron-server.service \ neutron-linuxbridge-agent.service neutron-dhcp-agent.service \ neutron-metadata-agent.service6.2 计算节点6.2.1 配置网桥代理安装网桥代理软件包[rootcompute1 ~]# yum install openstack-neutron-linuxbridge ebtables ipset修改neutron主配置文件[rootcompute1 ~]# vim /etc/neutron/neutron.conf6.2.2 配置公共网络修改计算节点网桥代理配置[rootcompute1 ~]# vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini网卡映射provider:eth1网卡名和控制节点保持一致必须为第二块物理网卡。修改计算节点Nova配置对接Neutron[rootcompute1 ~]# vim /etc/nova/nova.conf[rootcompute1 ~]# systemctl restart openstack-nova-compute.service[rootcompute1 ~]# systemctl enable neutron-linuxbridge-agent.service[rootcompute1 ~]# systemctl start neutron-linuxbridge-agent.service6.3 部署验证控制节点执行[rootcontroller ~]# . admin-openrc[rootcontroller ~]# neutron ext-list[rootcontroller ~]# neutron agent-list七、启动实例7.1 创建Provider提供者网络Flat外网[rootcontroller ~]# neutron net-create --shared --provider:physical_network provider \ --provider:network_type flat provider[rootcontroller ~]# openstack flavor list7.2 创建子网并配置网段、网关与DNS[rootcontroller ~]# neutron subnet-create --name provider \ --allocation-pool start192.168.159.101,end192.168.159.150 \ --dns-nameserver 114.114.114.114 --gateway 192.168.159.2 \ provider 192.168.159.0/24[rootcontroller ~]# openstack network list7.3 创建云主机规格Flavor[rootcontroller ~]# openstack flavor create --id 0 --vcpus 1 --ram 64 --disk 1 m1.nano7.4 生成密钥对[rootcontroller ~]# . demo-openrc[rootcontroller ~]# ssh-keygen -q -N Enter file in which to save the key (/root/.ssh/id_rsa):[rootcontroller ~]# openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey[rootcontroller ~]# openstack keypair list7.5 配置安全组放行ICMP、SSH (22 端口) 流量[rootcontroller ~]# openstack security group rule create --proto icmp default[rootcontroller ~]# openstack security group rule create --proto tcp --dst-port 22 default[rootcontroller ~]# openstack flavor list重新换一个镜像源之前0.6.0太新了无法登录云主机用id删[rootcontroller ~]# openstack image delete 0e20632f-3986-4b54-b875-567d1fced114[rootcontroller ~]# rm -f cirros-0.6.0-x86_64-disk.img[rootcontroller ~]# wget http://download.cirros-cloud.net/0.3.4/cirros-0.3.4-x86_64-disk.img[rootcontroller ~]# openstack image create cirros \ --file cirros-0.3.4-x86_64-disk.img \ --disk-format qcow2 --container-format bare \ --public7.6 创建并启动云主机实例创建前输出为空使用net_id和m1.nano[rootcontroller ~]# openstack server create --flavor m1.nano --image cirros \ --nic net-id655fbd82-ca8a-415e-b7a4-9b556059e6ac --security-group default \ --key-name mykey provider-instance接口会占用一个ip[rootcontroller ~]# openstack server list[rootcontroller ~]# openstack console url show provider-instance获取后通过浏览器访问正常登录就可以使用了ping外网也能通ssh正常登入八、dashboard8.1 安装Dashboard软件包[rootcontroller ~]# yum install openstack-dashboard -y8.2 修改Dashboard主配置文件[rootcontroller ~]# vim /etc/openstack-dashboard/local_settings8.4 网页访问验证[rootcontroller ~]# systemctl restart httpd.service memcached.service浏览器访问192.168.159.161/dashboard可以对云主机网络子网进行操作
![[光学原理与应用-521]：对光的错误理解与纠偏](http://pic.xiahunao.cn/yaotu/[光学原理与应用-521]：对光的错误理解与纠偏)
