Openstack Mitaka for Centos7.2 部署指南(一)

前端之家收集整理的这篇文章主要介绍了Openstack Mitaka for Centos7.2 部署指南(一)前端之家小编觉得挺不错的,现在分享给大家,也给大家做个参考。

本文主要参考

https://www.zybuluo.com/ncepuwanghui/note/389373

OpenStack Mitaka for Ubuntu 16.04 LTS 部署指南

http://docs.openstack.org/mitaka/install-guide-rdo/

官方文档

把上面的Ubuntu 换成Centos,其他详情请看上面的部署指南


本文主要参考

https://www.zybuluo.com/ncepuwanghui/note/389373

OpenStack Mitaka for Ubuntu 16.04 LTS 部署指南

http://docs.openstack.org/mitaka/install-guide-rdo/

官方文档

把上面的Ubuntu 换成Centos,其他详情请看上面的部署指南

@H_301_26@

4.1配置OpenStack

yuminstallcentos-release-openstack-mitaka

安装OpenStackclient:
yuminstallpython-openstackclient


安装MariaDB
yuminstallmariadbmariadb-serverpython2-PyMysqL


[root@controller~]#vim/etc/my.cnf.d/openstack.cnf
[MysqLd]
bind-address=10.0.0.11
default-storage-engine=innodb
innodb_file_per_table
max_connections=4096
collation-server=utf8_general_ci
character-set-server=utf8


systemctlenablemariadb.service
systemctlstartmariadb.service


MysqL_secure_installation##设置密码

安装Nosql数据库MongoDB

注:只有计量服务(Telemetry Service)用到

Controller Node

①安装MongoDB
yuminstallmongodb-servermongodb
[root@controller~]#vim/etc/mongod.conf
bind_ip=10.0.0.11
smallfiles=true
systemctlenablemongod.service
systemctlstartmongod.service

安装消息队列服务(RabbitMQ

Controller Node

安装RabbitMQ

yuminstallrabbitmq-server
systemctlenablerabbitmq-server.service
systemctlstartrabbitmq-server.service
rabbitmqctladd_useropenstackopenstack##密码
Creatinguser"openstack"...
rabbitmqctlset_permissionsopenstack".*"".*"".*"##权限
Settingpermissionsforuser"openstack"invhost"/"...

安装Memcached

身份服务(Identity Service)认证机制需要使用Memcached缓存令牌(Token

Controller Node

安装Memcached

yuminstallmemcachedpython-memcached
systemctlenablememcached.service
systemctlstartmemcached.service

4.2 身份服务配置(Identity Service Keystone

Identity服务采用RESTful设计,使用REST API提供Web服务接口。

注:常见的Web Service 方式有SOAP WSDL REST

部署节点:Controller Node

MariaDBMysqL)中创建Keystone数据库


MysqL-uroot-p123456
CREATEDATABASEkeystone;
GRANTALLPRIVILEGESONkeystone.*TO'keystone'@'localhost'IDENTIFIEDBY'keystone';
GRANTALLPRIVILEGESONkeystone.*TO'keystone'@'%'IDENTIFIEDBY'keystone';
flushprivileges;
quit;

%则代表了所有的host都能远程访问该MysqL。但MysqL官方文档指出,%并不包括localhost。因此需要对localhost和%都进行授权。

生成临时管理身份认证令牌(ADMIN_TOKEN

生成一个随机值,作为keystone初始配置时的ADMIN_TOKEN

opensslrand-hex10
2d3c132acf773c01838e


安装KeystoneApache HTTP Server with mod_wsgi

本文采用Apache HTTP server with mod_wsgi 监听端口5000 35357 提供身份服务。默认keystone 服务已经监听端口5000 35357 ,为避免冲突,需首先关闭keystone服务

yuminstallopenstack-keystonehttpdmod_wsgi
vim/etc/keystone/keystone.conf
admin_token=ADMIN_TOKEN
connection=MysqL+pyMysqL://keystone:KEYSTONE_DBPASS@controller/keystone
provider=fernet#####Fernet令牌提供者
将配置信息写入到身份服务数据库keystone:
su-s/bin/sh-c"keystone-managedb_sync"keystone
初始化Fernetkeys:
keystone-managefernet_setup--keystone-userkeystone--keystone-groupkeystone

@H_301_26@

@H_301_26@

vim /etc/httpd/conf/httpd.conf

ServerName controller

vim /etc/httpd/conf.d/wsgi-keystone.conf

Listen 5000Listen 35357

<VirtualHost *:5000>
WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-public
WSGIScriptAlias / /usr/bin/keystone-wsgi-public
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
ErrorLogFormat "%{cu}t %M"
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined

<Directory /usr/bin>
Require all granted
</Directory></VirtualHost>

<VirtualHost *:35357>
WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-admin
WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
ErrorLogFormat "%{cu}t %M"
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined

<Directory /usr/bin>
Require all granted

</Directory></VirtualHost>



systemctlenablehttpd.service
systemctlstarthttpd.service




创建服务实体(Service Entity)和API路径(API Endpoints

vimadmin##设置环境变量
exportOS_TOKEN=2d3c132acf773c01838e
exportOS_URL=http://controller:35357/v3
exportOS_IDENTITY_API_VERSION=3
sourceadmin



创建服务实体

身份服务管理着一个OpenStack的服务目录,通过服务目录确定其他服务是否可用

openstackservicecreate--namekeystone--description"OpenStackIdentity"identity


创建API路径

OpenStack每个服务可使用三种API路径变体: admin , internal 和public 。默认情况, admin 类型的

API路径可修改用户(user)和租户(tenant),而internal 和public 类型的API路径不允许该操作。

openstackendpointcreate--regionRegionOneidentitypublichttp://controller:5000/v3
openstackendpointcreate--regionRegionOneidentityinternalhttp://controller:5000/v3
openstackendpointcreate--regionRegionOneidentityadminhttp://controller:35357/v3



创建域(Domain)、计划(Project)、用户(User)、角色(Role):

openstackdomaincreate--description"DefaultDomain"default
openstackprojectcreate--domaindefault--description"AdminProject"admin
openstackusercreate--domaindefault--password-promptadmin
openstackrolecreateadmin


创建的任何角色都必须映射到OpenStack配置文件policy.json 指定的角色:

openstackroleadd--projectadmin--useradminadmin


创建服务计划

openstackprojectcreate--domaindefault--description"ServiceProject"service


常规(非管理员)的任务应该使用一个普通的项目和用户

openstackprojectcreate--domaindefault--description"DemoProject"demo
openstackusercreate--domaindefault--password-promptdemo
openstackrolecreateuser


将普通用户角色授予示例计划和示例用户

openstackroleadd--projectdemo--userdemouser

@H_301_26@

处于安全考虑,禁用临时身份认证令牌机制

修改文件vi /etc/keystone/keystone�paste.ini ,从

[pipeline:public_api] 、[pipeline:admin_api] , [pipeline:api_v3] 处移除admin_token_auth 配置信息。

取消环境变量OS_TOKEN 和OS_URL

unsetOS_TOKENOS_URL


为admin 用户申请一个身份认证令牌

openstack��os�auth�urlhttp://controller:35357/v3��os�project�domain�namedefault��osuser�domain�namedefault��os�project�nameadmin��os�usernameadmintokenissue


为demo用户申请一个身份认证令牌
openstack--os-auth-urlhttp://controller:5000/v3--os-project-domain-namedefault--os-user-domain-namedefault--os-project-namedemo--os-usernamedemotokenissue


其他申请方法

创建OpenStack客户端环境脚本方法

vimadmin-openrc
exportOS_PROJECT_DOMAIN_NAME=default
exportOS_USER_DOMAIN_NAME=default
exportOS_PROJECT_NAME=admin
exportOS_USERNAME=admin
exportOS_PASSWORD=admin
exportOS_AUTH_URL=http://controller:35357/v3
exportOS_AUTH_TYPE=password
exportOS_IDENTITY_API_VERSION=3
exportOS_IMAGE_API_VERSION=2
sourceadmin-openrc
openstacktokenissue



vimdemo-openrc
exportOS_PROJECT_DOMAIN_NAME=default
exportOS_USER_DOMAIN_NAME=default
exportOS_PROJECT_NAME=demo
exportOS_USERNAME=demo
exportOS_PASSWORD=demo
exportOS_AUTH_URL=http://controller:5000/v3
exportOS_AUTH_TYPE=password
exportOS_IDENTITY_API_VERSION=3
exportOS_IMAGE_API_VERSION=2
sourcedemo-openrc
openstacktokenissue

4.3 镜像服务配置(Image Service Glance

用户可使用OpenStack镜像服务提供的REST API 查询注册、恢复虚拟机镜像。

部署节点:Controller Node

MysqL-uroot-p123456
CREATEDATABASEglance;
GRANTALLPRIVILEGESONglance.*TO'glance'@'localhost'IDENTIFIEDBY'glance';
GRANTALLPRIVILEGESONglance.*TO'glance'@'%'IDENTIFIEDBY'glance';
flushprivileges;


. admin-openrc

在OpenStack中创建一个glance用户

openstackusercreate--domaindefault--password-promptglance
UserPassword:glance
RepeatUserPassword:glance

将admin 角色授予glance 用户和service 计划

openstackroleadd--projectservice--userglanceadmin

创建glance服务实体

openstackservicecreate--nameglance--description"OpenStackImage"image

创建镜像服务API路径

openstackendpointcreate--regionRegionOneimagepublichttp://controller:9292
openstackendpointcreate--regionRegionOneimageinternalhttp://controller:9292
openstackendpointcreate--regionRegionOneimageadminhttp://controller:9292

安装和配置Glance服务组件

yuminstallopenstack-glance
vim/etc/glance/glance-api.conf

connection = MysqL+pyMysqL://glance:GLANCE_DBPASS@controller/glance

在[keystone_authtoken] 和[paste_deploy] 处,配置身份服务访问。

注:注释掉[keystone_authtoken] 处所有默认内容 M版默认是全注释掉的

[keystone_authtoken]
...
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = glance
password = GLANCE_PASS

[paste_deploy]
...

flavor = keystone

在[glance_store]处配置本地文件系统存储和镜像文件存储位置。

stores = file,http

default_store = file

filesystem_store_datadir = /var/lib/glance/images/

@H_301_26@

vim/etc/glance/glance-registry.conf
connection=MysqL+pyMysqL://glance:GLANCE_DBPASS@controller/glance
[keystone_authtoken]
auth_uri=http://controller:5000
auth_url=http://controller:35357
memcached_servers=controller:11211
auth_type=password
project_domain_name=default
user_domain_name=default
project_name=service
username=glance
password=GLANCE_PASS
[paste_deploy]
flavor=keystone


将配置信息写入glance数据库

su-s/bin/sh-c"glance-managedb_sync"glance


忽略所有有关’弃用’(deprecate)的输出

Option "verbose" from group "DEFAULT" is deprecated for removal. Its value may be silently ignored in the future.

/usr/lib/python2.7/site-packages/oslo_db/sqlalchemy/enginefacade.py:1056: OsloDBDeprecationWarning: EngineFacade is deprecated; please use oslo_db.sqlalchemy.enginefacade

expire_on_commit=expire_on_commit,_conf=conf)


systemctlenableopenstack-glance-api.serviceopenstack-glance-registry.service
systemctlstartopenstack-glance-api.serviceopenstack-glance-registry.service
wgethttp://download.cirros-cloud.net/0.3.4/cirros-0.3.4-x86_64-disk.img
openstackimagecreate"cirros"--filecirros-0.3.4-x86_64-disk.img--disk-formatqcow2--container-formatbare--public
[root@controller~]#openstackimagelist
+--------------------------------------+--------+--------+
|ID|Name|Status|
+--------------------------------------+--------+--------+
|9866bbe8-5efb-43e4-9c22-3984a63276c8|cirros|active|
+--------------------------------------+--------+--------+

猜你在找的CentOS相关文章