OpenStack简介-HQY 一个和谐有爱的空间

架构：

OpenStack 采用分布式架构，由多个组件组成。以下是 OpenStack 核心组件的描述：

Nova（计算服务）： Nova 负责管理和调度计算资源，包括虚拟机实例的创建、销毁和监控。它提供了弹性的计算能力，支持自动扩展和负载均衡。
Neutron（网络服务）： Neutron 提供了网络服务，包括虚拟网络的创建、管理和连接。它支持软件定义网络（SDN）技术，允许用户自定义网络拓扑，并提供安全组和防火墙等网络安全功能。
Cinder（块存储服务）： Cinder 提供了块存储服务，允许用户创建和管理持久化的块存储设备，用于虚拟机实例的数据存储和持久化。
Swift（对象存储服务）： Swift 是一个分布式对象存储系统，可用于存储大规模的非结构化数据。它提供了高可用性和可扩展性，并支持数据冗余和数据备份。
Keystone（身份认证服务）： Keystone 提供了身份认证和授权服务，用于管理用户、角色和权限。它提供了单一登录（SSO）和身份验证服务，用于保护和管理其他 OpenStack 服务。
Glance（镜像服务）： Glance 提供了虚拟机镜像的存储和管理功能。它允许用户上传、注册和检索镜像，用于虚拟机实例的创建和部署。

核心概念描述：

虚拟机实例（Instance）：在 OpenStack 中，虚拟机实例是基于虚拟化技术创建的虚拟机，用于运行用户的应用程序和服务。
网络（Network）： OpenStack 提供了灵活的网络服务，可以创建和管理虚拟网络，包括子网、路由和安全组等。
块存储（Block Storage）： Cinder 提供了块存储服务，用户可以创建和管理持久化的块存储设备，用于虚拟机实例的数据存储和持久化。
对象存储（Object Storage）： Swift 是一个分布式对象存储系统，用于存储非结构。
镜像（Image）： Glance 提供了镜像服务，用户可以上传、注册和检索镜像。镜像是虚拟机的模板，用于创建虚拟机实例。用户可以选择现有的镜像或创建自定义的镜像。
项目（Project）和租户（Tenant）： OpenStack 中的项目或租户是资源的隔离单位。每个项目都有自己的资源配额和权限控制。用户可以属于一个或多个项目，并在项目中创建和管理资源。
弹性伸缩（Elastic Scaling）： OpenStack 支持自动扩展和弹性伸缩功能。用户可以根据负载情况自动调整计算资源，以适应需求的变化。这允许根据需求增加或减少虚拟机实例的数量。
负载均衡（Load Balancing）： OpenStack 提供了负载均衡服务，允许将流量均匀分配到多个虚拟机实例上，以提高应用程序的可靠性和性能。
计算节点（Compute Node）：计算节点是物理主机或虚拟机，用于运行虚拟机实例。Nova 负责管理和调度计算节点上的计算资源。
控制节点（Control Node）：控制节点是 OpenStack 的管理节点，负责协调和管理整个 OpenStack 环境。它运行各个核心服务组件，如 Nova、Neutron、Keystone 等。
元数据服务（Metadata Service）：元数据服务提供了虚拟机实例的动态信息，如 IP 地址、主机名等。虚拟机实例可以通过元数据服务获取其运行时的信息。
身份提供者（Identity Provider）：身份提供者是用于身份验证和授权的外部系统，如 LDAP、Active Directory 等。Keystone 支持与身份提供者集成，以实现统一的身份管理。

安装openstack脚本

#!/usr/bin/env bash

# openstack pike 单机一键安装

# 环境 centos 7.4.1708 x86_64

[[ $(uname -r) = *el7* ]] && { echo '开启安装openstack pike'; } || {

echo '请在CentOS7.4 环境运行'

exit

}

##########################################

#参数

#获取第一块网卡名、ip地址

Net=$(ip add | grep -E global | awk '{ print $NF }' | head -n 1)

IP=$(ip add | grep global | awk -F'[ /]+' '{ print $3 }' | head -n 1)

echo "网卡名称:$Net"

echo "IP地址: $IP"

#参数

DBPass=elven2017 #SQL root密码

Node=controller #节点名

Netname=$Net #网卡名称

MyIP=$IP #IP地址

VncProxy=$IP #VNC代理外网IP地址

Imgdir=/date/glance #自定义glance镜像目录

VHD=/date/nova #自定义Nova实例路径

Kvm=qemu #QEMU或KVM ,KVM需要硬件支持

##########################################

#1、设置

echo '关闭selinux、防火墙'

systemctl stop firewalld.service

systemctl disable firewalld.service

firewall-cmd --state

sed -i '/^SELINUX=.*/c SELINUX=disabled' /etc/selinux/config

sed -i 's/^SELINUXTYPE=.*/SELINUXTYPE=disabled/g' /etc/selinux/config

grep --color=auto '^SELINUX' /etc/selinux/config

setenforce 0

echo '时间同步'

/usr/sbin/ntpdate ntp6.aliyun.com

echo "*/3 * * * * /usr/sbin/ntpdate ntp6.aliyun.com &> /dev/null" >/tmp/crontab

crontab /tmp/crontab

echo '设置hostname'

hostnamectl set-hostname $Node

echo "$SetIP $Node" >>/etc/hosts

echo '自定义openstack源'

wget -O /etc/yum.repos.d/Ali-pike.repo http://elven.vip/ks/openstack/Ali-pike.repo

yum clean all && yum makecache #生成缓存

##########################################

#2 安装

function installrpm() {

echo 'OpenStack tools 安装'

yum install -y python-openstackclient openstack-selinux \

python2-PyMySQL openstack-utils

echo 'MariaDB安装'

yum install mariadb mariadb-server mariadb-galera-server -y

yum install expect -y

echo 'RabbitMQ安装'

yum install rabbitmq-server erlang socat -y

echo 'Keystone安装'

yum install -y openstack-keystone httpd mod_wsgi memcached python-memcached

yum install apr apr-util -y

echo '安装Glance'

yum install -y openstack-glance python-glance

echo '安装nova'

yum install -y openstack-nova-api openstack-nova-conductor \

openstack-nova-console openstack-nova-novncproxy \

openstack-nova-scheduler openstack-nova-placement-api \

openstack-nova-compute

echo '安装neutron'

yum install -y openstack-neutron openstack-neutron-ml2 \

openstack-neutron-linuxbridge python-neutronclient ebtables ipset

echo '安装dashboard'

yum install openstack-dashboard -y

}

echo '安装openstack'

installrpm

echo '再次安装，防止下载失败'

installrpm

##########################################

#3、配置

# #------------------#####################

echo 'SQL数据库配置'

cp /etc/my.cnf.d/openstack.cnf{,.bak}

echo "#

[mysqld]

bind-address = 0.0.0.0

default-storage-engine = innodb

innodb_file_per_table

max_connections = 4096

collation-server = utf8_general_ci

character-set-server = utf8

#" >/etc/my.cnf.d/openstack.cnf

echo '启动数据库服务'

systemctl enable mariadb.service

systemctl start mariadb.service

sleep 5

netstat -antp | grep mysqld

#mysql_secure_installation #初始化设置密码,自动交互

[[ -f /usr/bin/expect ]] || { yum install expect -y; } #若没expect则安装

/usr/bin/expect <<EOF

set timeout 30

spawn mysql_secure_installation

expect {

"enter for none" { send "\r"; exp_continue}

"Y/n" { send "Y\r" ; exp_continue}

"password:" { send "$DBPass\r"; exp_continue}

"new password:" { send "$DBPass\r"; exp_continue}

"Y/n" { send "Y\r" ; exp_continue}

eof { exit }

}

EOF

#测试

mysql -u root -p$DBPass -e "show databases;"

[ $? = 0 ] || {

echo "mariadb初始化失败"

exit

}

echo '创建数据库、用户授权'

mysql -u root -p$DBPass -e "

create database keystone;

grant all privileges on keystone.* to 'keystone'@'localhost' identified by 'keystone';

grant all privileges on keystone.* to 'keystone'@'%' identified by 'keystone';

create database glance;

grant all privileges on glance.* to 'glance'@'localhost' identified by 'glance';

grant all privileges on glance.* to 'glance'@'%' identified by 'glance';

create database nova;

grant all privileges on nova.* to 'nova'@'localhost' identified by 'nova';

grant all privileges on nova.* to 'nova'@'%' identified by 'nova';

create database nova_api;

grant all privileges on nova_api.* to 'nova'@'localhost' identified by 'nova';

grant all privileges on nova_api.* to 'nova'@'%' identified by 'nova';

create database nova_cell0;

grant all privileges on nova_cell0.* to 'nova'@'localhost' identified by 'nova';

grant all privileges on nova_cell0.* to 'nova'@'%' identified by 'nova';

create database neutron;

grant all privileges on neutron.* to 'neutron'@'localhost' identified by 'neutron';

grant all privileges on neutron.* to 'neutron'@'%' identified by 'neutron';

flush privileges;

select user,host from mysql.user;

show databases;

# #------------------#####################

echo 'RabbitMQ配置'

systemctl enable rabbitmq-server.service

systemctl start rabbitmq-server.service

sleep 3

rabbitmq-plugins enable rabbitmq_management #启动web插件端口15672

#添加用户及密码

rabbitmqctl add_user admin admin

rabbitmqctl set_user_tags admin administrator

rabbitmqctl add_user openstack openstack

rabbitmqctl set_permissions openstack ".*" ".*" ".*"

rabbitmqctl set_user_tags openstack administrator

systemctl restart rabbitmq-server.service

sleep 3

netstat -antp | grep '5672'

# #------------------#####################

#Keystone

#memcached启动

cp /etc/sysconfig/memcached{,.bak}

systemctl enable memcached.service

systemctl start memcached.service

netstat -antp | grep 11211

echo 'Keystone 配置'

cp /etc/keystone/keystone.conf{,.bak} #备份默认配置

Keys=$(openssl rand -hex 10) #生成随机密码

echo "$Keys"

echo "kestone $Keys" >/root/openstack.log

echo "

[DEFAULT]

admin_token = $Keys

verbose = true

[database]

connection = mysql+pymysql://keystone:keystone@controller/keystone

[token]

provider = fernet

driver = memcache

[memcache]

servers = controller:11211

" >/etc/keystone/keystone.conf

#初始化身份认证服务的数据库

su -s /bin/sh -c "keystone-manage db_sync" keystone

#检查表是否创建成功

mysql -h controller -ukeystone -pkeystone -e "use keystone;show tables;"

#初始化密钥存储库

keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

#设置admin用户（管理用户）和密码

keystone-manage bootstrap --bootstrap-password admin \

--bootstrap-admin-url http://controller:35357/v3/ \

--bootstrap-internal-url http://controller:5000/v3/ \

--bootstrap-public-url http://controller:5000/v3/ \

--bootstrap-region-id RegionOne

#apache配置

cp /etc/httpd/conf/httpd.conf{,.bak}

echo "ServerName controller" >>/etc/httpd/conf/httpd.conf

ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

#Apache HTTP 启动并设置开机自启动

systemctl enable httpd.service

systemctl restart httpd.service

sleep 3

netstat -antp | grep -E ':5000|:35357|:80'

#创建 OpenStack 客户端环境脚本

#admin环境脚本

echo "

export OS_PROJECT_DOMAIN_NAME=default

export OS_USER_DOMAIN_NAME=default

export OS_PROJECT_NAME=admin

export OS_USERNAME=admin

export OS_PASSWORD=admin

export OS_AUTH_URL=http://controller:35357/v3

export OS_IDENTITY_API_VERSION=3

export OS_IMAGE_API_VERSION=2

" >./admin-openstack.sh

#测试脚本是否生效

source ./admin-openstack.sh

openstack token issue

#创建service项目,创建glance,nova,neutron用户，并授权

openstack project create --domain default --description "Service Project" service

openstack user create --domain default --password=glance glance

openstack role add --project service --user glance admin

openstack user create --domain default --password=nova nova

openstack role add --project service --user nova admin

openstack user create --domain default --password=neutron neutron

openstack role add --project service --user neutron admin

#创建demo项目(普通用户密码及角色)

openstack project create --domain default --description "Demo Project" demo

openstack user create --domain default --password=demo demo

openstack role create user

openstack role add --project demo --user demo user

#demo环境脚本

echo "

export OS_PROJECT_DOMAIN_NAME=default

export OS_USER_DOMAIN_NAME=default

export OS_PROJECT_NAME=demo

export OS_USERNAME=demo

export OS_PASSWORD=demo

export OS_AUTH_URL=http://controller:5000/v3

export OS_IDENTITY_API_VERSION=3

export OS_IMAGE_API_VERSION=2

" >./demo-openstack.sh

#测试脚本是否生效

source ./demo-openstack.sh

openstack token issue

# #------------------#####################

echo 'Glance镜像服务'

# keystone上服务注册 ,创建glance服务实体,API端点（公有、私有、admin）

source ./admin-openstack.sh || {

echo "加载前面设置的admin-openstack.sh环境变量脚本"

exit

}

openstack service create --name glance --description "OpenStack Image" image

openstack endpoint create --region RegionOne image public http://controller:9292

openstack endpoint create --region RegionOne image internal http://controller:9292

openstack endpoint create --region RegionOne image admin http://controller:9292

cp /etc/glance/glance-api.conf{,.bak}

cp /etc/glance/glance-registry.conf{,.bak}

# images默认/var/lib/glance/images/

#Imgdir=/date/glance

mkdir -p $Imgdir

chown glance:nobody $Imgdir

echo "镜像目录： $Imgdir"

echo "#

[database]

connection = mysql+pymysql://glance:glance@controller/glance

[keystone_authtoken]

auth_uri = http://controller:5000/v3

auth_url = http://controller:35357/v3

memcached_servers = controller:11211

auth_type = password

project_domain_name = default

user_domain_name = default

project_name = service

username = glance

password = glance

[paste_deploy]

flavor = keystone

[glance_store]

stores = file,http

default_store = file

filesystem_store_datadir = $Imgdir

#" >/etc/glance/glance-api.conf

echo "#

[database]

connection = mysql+pymysql://glance:glance@controller/glance

[keystone_authtoken]

auth_uri = http://controller:5000/v3

auth_url = http://controller:35357/v3

memcached_servers = controller:11211

auth_type = password

project_domain_name = default

user_domain_name = default

project_name = service

username = glance

password = glance

[paste_deploy]

flavor = keystone

#" >/etc/glance/glance-registry.conf

#同步数据库,检查数据库

su -s /bin/sh -c "glance-manage db_sync" glance

mysql -h controller -u glance -pglance -e "use glance;show tables;"

#启动服务并设置开机自启动

systemctl enable openstack-glance-api openstack-glance-registry

systemctl start openstack-glance-api openstack-glance-registry

netstat -antp | grep -E '9292|9191' #检测服务端口

# #------------------#####################

#创建Nova数据库、用户、认证，前面已设置

source ./admin-openstack.sh

# keystone上服务注册 ,创建nova用户、服务、API

# nova用户前面已建

openstack service create --name nova --description "OpenStack Compute" compute

openstack endpoint create --region RegionOne compute public http://controller:8774/v2.1

openstack endpoint create --region RegionOne compute internal http://controller:8774/v2.1

openstack endpoint create --region RegionOne compute admin http://controller:8774/v2.1

#创建placement用户、服务、API

openstack user create --domain default --password=placement placement

openstack role add --project service --user placement admin

openstack service create --name placement --description "Placement API" placement

openstack endpoint create --region RegionOne placement public http://controller:8778

openstack endpoint create --region RegionOne placement internal http://controller:8778

openstack endpoint create --region RegionOne placement admin http://controller:8778

mkdir -p $VHD

chown -R nova:nova $VHD

echo 'nova配置'

echo '#

[DEFAULT]

instances_path='$VHD'

enabled_apis = osapi_compute,metadata

transport_url = rabbit://openstack:openstack@controller

my_ip = '"$MyIP"'

use_neutron = True

firewall_driver = nova.virt.firewall.NoopFirewallDriver

osapi_compute_listen_port=8774

[api_database]

connection = mysql+pymysql://nova:nova@controller/nova_api

[database]

connection = mysql+pymysql://nova:nova@controller/nova

[api]

auth_strategy = keystone

[keystone_authtoken]

auth_uri = http://controller:5000

auth_url = http://controller:35357

memcached_servers = controller:11211

auth_type = password

project_domain_name = default

user_domain_name = default

project_name = service

username = nova

password = nova

[vnc]

enabled = true

vncserver_listen = $my_ip

vncserver_proxyclient_address = $my_ip

novncproxy_base_url = http://'"$VncProxy"':6080/vnc_auto.html

[glance]

api_servers = http://controller:9292

[oslo_concurrency]

lock_path = /var/lib/nova/tmp

[placement]

os_region_name = RegionOne

project_domain_name = Default

project_name = service

auth_type = password

user_domain_name = Default

auth_url = http://controller:35357/v3

username = placement

password = placement

[scheduler]

discover_hosts_in_cells_interval = 300

[libvirt]

virt_type = '$Kvm'

#' >/etc/nova/nova.conf

echo "

#Placement API

Require all granted

</IfVersion>

Order allow,deny

Allow from all

</IfVersion>

</Directory>

" >>/etc/httpd/conf.d/00-nova-placement-api.conf

systemctl restart httpd

sleep 5

#同步数据库

su -s /bin/sh -c "nova-manage api_db sync" nova

su -s /bin/sh -c "nova-manage cell_v2 map_cell0" nova

su -s /bin/sh -c "nova-manage cell_v2 create_cell --name=cell1 --verbose" nova

su -s /bin/sh -c "nova-manage db sync" nova

#检测数据

nova-manage cell_v2 list_cells

mysql -h controller -u nova -pnova -e "use nova_api;show tables;"

mysql -h controller -u nova -pnova -e "use nova;show tables;"

mysql -h controller -u nova -pnova -e "use nova_cell0;show tables;"

# #------------------#####################

echo 'Neutron服务'

source ./admin-openstack.sh

# 创建Neutron服务实体,API端点

openstack service create --name neutron --description "OpenStack Networking" network

openstack endpoint create --region RegionOne network public http://controller:9696

openstack endpoint create --region RegionOne network internal http://controller:9696

openstack endpoint create --region RegionOne network admin http://controller:9696

#Neutron 备份配置

cp /etc/neutron/neutron.conf{,.bak2}

cp /etc/neutron/plugins/ml2/ml2_conf.ini{,.bak}

ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

cp /etc/neutron/plugins/ml2/linuxbridge_agent.ini{,.bak}

cp /etc/neutron/dhcp_agent.ini{,.bak}

cp /etc/neutron/metadata_agent.ini{,.bak}

cp /etc/neutron/l3_agent.ini{,.bak}

#配置

echo '

[neutron]

url = http://controller:9696

auth_url = http://controller:35357

auth_type = password

project_domain_name = default

user_domain_name = default

region_name = RegionOne

project_name = service

username = neutron

password = neutron

service_metadata_proxy = true

metadata_proxy_shared_secret = metadata

#' >>/etc/nova/nova.conf

echo '

[DEFAULT]

nova_metadata_ip = controller

metadata_proxy_shared_secret = metadata

#' >/etc/neutron/metadata_agent.ini

echo '#

[ml2]

tenant_network_types =

type_drivers = vlan,flat

mechanism_drivers = linuxbridge

extension_drivers = port_security

[ml2_type_flat]

flat_networks = provider

[securitygroup]

enable_ipset = True

#' >/etc/neutron/plugins/ml2/ml2_conf.ini

echo '#

[linux_bridge]

physical_interface_mappings = provider:'"$Netname"'

[vxlan]

enable_vxlan = false

[agent]

prevent_arp_spoofing = True

[securitygroup]

firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

enable_security_group = True

#' >/etc/neutron/plugins/ml2/linuxbridge_agent.ini

echo '#

[DEFAULT]

interface_driver = linuxbridge

dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq

enable_isolated_metadata = true

#' >/etc/neutron/dhcp_agent.ini

echo '

[DEFAULT]

core_plugin = ml2

service_plugins = router

allow_overlapping_ips = true

transport_url = rabbit://openstack:openstack@controller

auth_strategy = keystone

notify_nova_on_port_status_changes = true

notify_nova_on_port_data_changes = true

[keystone_authtoken]

auth_uri = http://controller:5000

auth_url = http://controller:35357

memcached_servers = controller:11211

auth_type = password

project_domain_name = default

user_domain_name = default

project_name = service

username = neutron

password = neutron

[nova]

auth_url = http://controller:35357

auth_plugin = password

project_domain_id = default

user_domain_id = default

region_name = RegionOne

project_name = service

username = nova

password = nova

[database]

connection = mysql://neutron:neutron@controller:3306/neutron

[oslo_concurrency]

lock_path = /var/lib/neutron/tmp

#' >/etc/neutron/neutron.conf

echo '

[DEFAULT]

interface_driver = linuxbridge

#' >/etc/neutron/l3_agent.ini

#同步数据库

su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \

--config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

#检测数据

mysql -h controller -u neutron -pneutron -e "use neutron;show tables;"

# #------------------#####################

#dashboard

echo '配置openstack Web'

cp /etc/openstack-dashboard/local_settings{,.bak}

Setfiles=/etc/openstack-dashboard/local_settings

sed -i 's#_member_#user#g' $Setfiles

sed -i 's#OPENSTACK_HOST = "127.0.0.1"#OPENSTACK_HOST = "controller"#' $Setfiles

##允许所有主机访问#

sed -i "/ALLOWED_HOSTS/cALLOWED_HOSTS = ['*', ]" $Setfiles

#去掉memcached注释#

sed -in '153,158s/#//' $Setfiles

sed -in '160,164s/.*/#&/' $Setfiles

sed -i 's#UTC#Asia/Shanghai#g' $Setfiles

sed -i 's#%s:5000/v2.0#%s:5000/v3#' $Setfiles

sed -i '/ULTIDOMAIN_SUPPORT/cOPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True' $Setfiles

sed -i "s@^#OPENSTACK_KEYSTONE_DEFAULT@OPENSTACK_KEYSTONE_DEFAULT@" $Setfiles

echo '

#set

OPENSTACK_API_VERSIONS = {

"identity": 3,

"image": 2,

"volume": 2,

}

#' >>$Setfiles

systemctl restart httpd

sleep 5

##########################################

echo '启动服务'

#Apache

systemctl enable httpd.service

#systemctl restart httpd haproxy

#netstat -antp|egrep 'httpd'

#glance服务

systemctl enable openstack-glance-api openstack-glance-registry

systemctl restart openstack-glance-api openstack-glance-registry

#nova服务

systemctl enable openstack-nova-api.service \

openstack-nova-consoleauth.service openstack-nova-scheduler.service \

openstack-nova-conductor.service openstack-nova-novncproxy.service \

libvirtd.service openstack-nova-compute.service

#启动

systemctl start openstack-nova-api.service \

openstack-nova-consoleauth.service openstack-nova-scheduler.service \

openstack-nova-conductor.service openstack-nova-novncproxy.service \

libvirtd.service openstack-nova-compute.service

#neutron服务

systemctl enable neutron-server.service \

neutron-linuxbridge-agent.service neutron-dhcp-agent.service \

neutron-metadata-agent.service neutron-l3-agent.service

systemctl start neutron-server.service \

neutron-linuxbridge-agent.service neutron-dhcp-agent.service \

neutron-metadata-agent.service neutron-l3-agent.service

##########################################

#cheack

echo "查看节点"

source ./admin-openstack.sh

openstack compute service list

openstack network agent list

##########################################

#end

echo '

安装完毕！

数据库root密码 '$DBPass'

登录Web管理 http://'"$MyIP"'/dashboard

域 default

用户 admin

密码 admin

一	二	三	四	五	六	日
						1
2	3	4	5	6	7	8
9	10	11	12	13	14	15
16	17	18	19	20	21	22
23	24	25	26	27	28	29
30	31

HQY 一个和谐有爱的空间

HQY

23

2024
05
18:33:10