CentOS 6.5系统安装配置多节点 OpenStack Grizzly

时间：2015-01-08 来源：服务器在线投稿：泡泡点击：次

最近在CentOS上搭建OpenStack-Grizzly遇到不少问题，网上没有比较齐全的基于CentOS的部署文档（也许是我没找到），官方文档比较混乱。后来按照RedHat的方法去做，在user和tenant的创建步骤由于user-role-add命令的问题，耽搁了很久也不知道原因，有幸沙克大哥为我指出问题所在，一举攻破。

尝试了很多种方法，最后总结了如下比较完整的部署流程。但没有包括quantum和swift，一是因为暂且用不上，而是资源也有限（木有双网卡啊 T.T），希望能给尝试部署Grizzly的朋友一点点帮助：-）

--------------------------------------------------------------------------------------------------

主节点

--------------------------------------------------------------------------------------------------

1- 关闭SELinux

2- 把系统升级到最新软件环境

# yum update

3- 安装数据库并配置MySQL的root密码

# yum install mysql mysql-server MySQL-python

# service mysqld start && chkconfig mysqld on

# mysql_secure_installation

4- 为了安装G版本，需要使用fedora的源

# yum install epel-release-6-8.noarch.rpm

# vim /etc/yum.repos.d/epel-testing.repo

enabled=1

# cp epel-openstack-grizzly.repo /etc/yum.repos.d/

5- 添加host

# vim /etc/hosts

10.2.20.90 grizzly.openstack.zeastion

10.2.20.103 grizzly-host01.openstack.zeastion

6- 修改NTP

# vim /etc/ntp.conf

server 127.127..0

fudge 127.127.1.0 stratum 8

# service ntpd restart && chkconfig ntpd on

7- 配置防火墙

# vim /etc/sysconfig/iptables

# Generated by iptables-save v1.4.7 on Tue Jul 9 10:31:26 2013

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -p tcp -m multiport --dports 3260,8776 -j ACCEPT

-A INPUT -p tcp --dport 443 -j ACCEPT

-A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT

-A INPUT -p tcp -m multiport --dports 5900,5999 -j ACCEPT

-A INPUT -p tcp -m multiport --dports 8773,8774,8775 -j ACCEPT

-A INPUT -p tcp -m multiport --dports 9292 -j ACCEPT

-A INPUT -p tcp -m multiport --dports 5000,35357 -j ACCEPT

-A INPUT -p tcp -m tcp --dport 5672 -j ACCEPT

-A INPUT -p tcp -m multiport --dports 3306 -j ACCEPT

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 6080 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

# service iptables restart

8- 安装消息管理qpid

# yum install openstack-utils memcached qpid-cpp-server

# vim /etc/qpidd.conf

auth=no

# service qpidd start && chkconfig qpidd on

9- 注意要把NetworkManager关闭，不然对nova-network有影响

# service NetworkManager stop

# chkconfig NetworkManager off

[KEYSTONE]

1- 安装身份验证Keystone软件包

# yum install openstack-keystone python-keystoneclient

2- 设置数据库，openstack-db可以自动化的完成数据库设置

# openstack-db --init --service keystone

3- 使用一串随机数作为token

# export SERVICE_TOKEN=$(openssl rand -hex 10)

# echo $SERVICE_TOKEN > ~/ks_admin_token

# openstack-config --set /etc/keystone/keystone.conf DEFAULT admin_token $SERVICE_TOKEN

4- 详细的keystone配置文件

# vim /etc/keystone/keystone.conf

[DEFAULT]

bind_host = 0.0.0.0

public_port = 5000

admin_port = 35357

compute_port = 8774

verbose = True

debug = True

log_file = /var/log/keystone/keystone.log

admin_token = e21513dbe83a9fa9a1dc

# A "shared secret" between keystone and other openstack services

# admin_token = ADMIN

# The IP address of the network inte***ce to listen on

# bind_host = 0.0.0.0

# The port number which the public service listens on

# public_port = 5000

# The port number which the public admin listens on

# admin_port = 35357

# The base endpoint URLs for keystone that are advertised to clients

# (NOTE: this does NOT affect how keystone listens for connections)

# public_endpoint = http://localhost:%(public_port)d/

# admin_endpoint = http://localhost:%(admin_port)d/

# The port number which the OpenStack Compute service listens on

# compute_port = 8774

# Path to your policy definition containing identity actions

# policy_file = policy.json

# Rule to check if no matching policy definition is found

# FIXME(dolph): This should really be defined as [policy] default_rule

# policy_default_rule = admin_required

# Role for migrating membership relationships

# During a SQL upgrade, the following values will be used to create a new role

# that will replace records in the user_tenant_membership table with explicit

# role grants. After migration, the member_role_id will be used in the API

# add_user_to_project, and member_role_name will be ignored.

# member_role_id = 9fe2ff9ee4384b1894a90878d3e92bab

# member_role_name = _member_

# === Logging Options ===

# Print debugging output

# (includes plaintext request logging, potentially including passwords)

# debug = False

# Print more verbose output

# verbose = False

# Name of log file to output to. If not set, logging will go to stdout.

# log_file = keystone.log

# The directory to keep log files in (will be prepended to --logfile)

# log_dir = /var/log/keystone

# Use syslog for logging.

# use_syslog = False

# syslog facility to receive log lines

# syslog_log_facility = LOG_USER

# If this option is specified, the logging configuration file specified is

# used and overrides any other logging options specified. Please see the

# Python logging module documentation for details on logging configuration

# files.

# log_config = logging.conf

# A logging.Formatter log message format string which may use any of the

# available logging.LogRecord attributes.

# log_format = %(asctime)s %(levelname)8s [%(name)s] %(message)s

# Format string for %(asctime)s in log records.

# log_date_format = %Y-%m-%d %H:%M:%S

# onready allows you to send a notification when the process is ready to serve

# For example, to have it notify using systemd, one could set shell command:

# onready = systemd-notify --ready

# or a module with notify() method:

# onready = keystone.common.systemd

[sql]

connection = mysql://keystone:keystone@10.2.20.90/keystone

# The SQLAlchemy connection string used to connect to the database

# connection = sqlite:///keystone.db

# the timeout before idle sql connections are reaped

# idle_timeout = 200

[identity]

driver = keystone.identity.backends.sql.Identity

# driver = keystone.identity.backends.sql.Identity

# This references the domain to use for all Identity API v2 requests (which are

# not aware of domains). A domain with this ID will be created for you by

# keystone-manage db_sync in migration 008. The domain referenced by this ID

# cannot be deleted on the v3 API, to prevent accidentally breaking the v2 API.

# There is nothing special about this domain, other than the fact that it must

# exist to order to maintain support for your v2 clients.

# default_domain_id = default

[trust]

# driver = keystone.trust.backends.sql.Trust

# delegation and impersonation features can be optionally disabled

# enabled = True

[catalog]

template_file = /etc/keystone/default_catalog.templates

driver = keystone.catalog.backends.sql.Catalog

# dynamic, sql-based backend (supports API/CLI-based management commands)

# driver = keystone.catalog.backends.sql.Catalog

# static, file-based backend (does *NOT* support any management commands)

# driver = keystone.catalog.backends.templated.TemplatedCatalog

# template_file = default_catalog.templates

[token]

driver = keystone.token.backends.sql.Token

# driver = keystone.token.backends.kvs.Token

# Amount of time a token should remain valid (in seconds)

expiration = 86400

[policy]

driver = keystone.policy.backends.rules.Policy

# driver = keystone.policy.backends.sql.Policy

[ec2]

driver = keystone.contrib.ec2.backends.sql.Ec2

# driver = keystone.contrib.ec2.backends.kvs.Ec2

[ssl]

#enable = True

#certfile = /etc/keystone/ssl/certs/keystone.pem

#keyfile = /etc/keystone/ssl/private/keystonekey.pem

#ca_certs = /etc/keystone/ssl/certs/ca.pem

#cert_required = True

[signing]

#token_format = PKI

#certfile = /etc/keystone/ssl/certs/signing_cert.pem

#keyfile = /etc/keystone/ssl/private/signing_key.pem

#ca_certs = /etc/keystone/ssl/certs/ca.pem

#key_size = 1024

#valid_days = 3650

#ca_password = None

[ldap]

# url = ldap://localhost

# user = dc=Manager,dc=example,dc=com

# password = None

# suffix = cn=example,cn=com

# use_dumb_member = False

# allow_subtree_delete = False

# dumb_member = cn=dumb,dc=example,dc=com

# Maximum results per page; a value of zero ('0') disables paging (default)

# page_size = 0

# The LDAP dereferencing option for queries. This can be either 'never',

# 'searching', 'always', 'finding' or 'default'. The 'default' option falls

# back to using default dereferencing configured by your ldap.conf.

# alias_dereferencing = default

# The LDAP scope for queries, this can be either 'one'

# (onelevel/singleLevel) or 'sub' (subtree/wholeSubtree)

# query_scope = one

# user_tree_dn = ou=Users,dc=example,dc=com

# user_filter =

# user_objectclass = inetOrgPerson

# user_domain_id_attribute = businessCategory

# user_id_attribute = cn

# user_name_attribute = sn

# user_mail_attribute = email

# user_pass_attribute = userPassword

# user_enabled_attribute = enabled

# user_enabled_mask = 0

# user_enabled_default = True

# user_attribute_ignore = tenant_id,tenants

# user_allow_create = True

# user_allow_update = True

# user_allow_delete = True

# user_enabled_emulation = False

# user_enabled_emulation_dn =

# tenant_tree_dn = ou=Groups,dc=example,dc=com

# tenant_filter =

# tenant_objectclass = groupOfNames

# tenant_domain_id_attribute = businessCategory

# tenant_id_attribute = cn

# tenant_member_attribute = member

# tenant_name_attribute = ou

# tenant_desc_attribute = desc

# tenant_enabled_attribute = enabled

# tenant_attribute_ignore =

# tenant_allow_create = True

# tenant_allow_update = True

# tenant_allow_delete = True

# tenant_enabled_emulation = False

# tenant_enabled_emulation_dn =

# role_tree_dn = ou=Roles,dc=example,dc=com

# role_filter =

# role_objectclass = organizationalRole

# role_id_attribute = cn

# role_name_attribute = ou

# role_member_attribute = roleOccupant

# role_attribute_ignore =

# role_allow_create = True

# role_allow_update = True

# role_allow_delete = True

# group_tree_dn =

# group_filter =

# group_objectclass = groupOfNames

# group_id_attribute = cn

# group_name_attribute = ou

# group_member_attribute = member

# group_desc_attribute = desc

# group_attribute_ignore =

# group_allow_create = True

# group_allow_update = True

# group_allow_delete = True

#[auth]

#methods = password,token

#password = keystone.auth.plugins.password.Password

#token = keystone.auth.plugins.token.Token

[filter:debug]

paste.filter_factory = keystone.common.wsgi:Debug.factory

[filter:token_auth]

paste.filter_factory = keystone.middleware:TokenAuthMiddleware.factory

[filter:admin_token_auth]

paste.filter_factory = keystone.middleware:AdminTokenAuthMiddleware.factory

[filter:xml_body]

paste.filter_factory = keystone.middleware:XmlBodyMiddleware.factory

[filter:json_body]

paste.filter_factory = keystone.middleware:JsonBodyMiddleware.factory

[filter:user_crud_extension]

paste.filter_factory = keystone.contrib.user_crud:CrudExtension.factory

[filter:crud_extension]

paste.filter_factory = keystone.contrib.admin_crud:CrudExtension.factory

[filter:ec2_extension]

paste.filter_factory = keystone.contrib.ec2:Ec2Extension.factory

[filter:s3_extension]

paste.filter_factory = keystone.contrib.s3:S3Extension.factory

[filter:url_normalize]

paste.filter_factory = keystone.middleware:NormalizingFilter.factory

[filter:sizelimit]

paste.filter_factory = keystone.middleware:RequestBodySizeLimiter.factory

[filter:stats_monitoring]

paste.filter_factory = keystone.contrib.stats:StatsMiddleware.factory

[filter:stats_reporting]

paste.filter_factory = keystone.contrib.stats:StatsExtension.factory

[filter:access_log]

paste.filter_factory = keystone.contrib.access:AccessLogMiddleware.factory

[app:public_service]

paste.app_factory = keystone.service:public_app_factory

[app:service_v3]

paste.app_factory = keystone.service:v3_app_factory

[app:admin_service]

paste.app_factory = keystone.service:admin_app_factory

[pipeline:public_api]

pipeline = access_log sizelimit stats_monitoring url_normalize token_auth admin_token_auth xml_body json_body debug ec2_extension user_crud_extension public_service

[pipeline:admin_api]

pipeline = access_log sizelimit stats_monitoring url_normalize token_auth admin_token_auth xml_body json_body debug stats_reporting ec2_extension s3_extension crud_extension admin_service

[pipeline:api_v3]

pipeline = access_log sizelimit stats_monitoring url_normalize token_auth admin_token_auth xml_body json_body debug stats_reporting ec2_extension s3_extension service_v3

[app:public_version_service]

paste.app_factory = keystone.service:public_version_app_factory

[app:admin_version_service]

paste.app_factory = keystone.service:admin_version_app_factory

[pipeline:public_version_api]

pipeline = access_log sizelimit stats_monitoring url_normalize xml_body public_version_service

[pipeline:admin_version_api]

pipeline = access_log sizelimit stats_monitoring url_normalize xml_body admin_version_service

[composite:main]

use = egg:Paste#urlmap

/v2.0 = public_api

/v3 = api_v3

/ = public_version_api

[composite:admin]

use = egg:Paste#urlmap

/v2.0 = admin_api

/v3 = api_v3

/ = admin_version_api

5- # keystone-manage pki_setup

# chown -R keystone:keystone /etc/keystone/*

6- # service openstack-keystone start && chkconfig openstack-keystone on

7- # keystone-manage db_sync

8- 很麻烦的一步，创建user/tenant/role/service/endpoint等，OpenStack官网提供了创建脚本。

我在配置过程中完全手打的，如果大家想深入了解Keystone的话，建议还是手动操作。其中需要注意的是先创建tenant，再创建user并且写入tenant_id

例如：

# keystone user-create --tenant-id 917fffbb0bb94aef9bc6ac49b1a14bbb --name cinder --pass cinder

+----------+----------------------------------+

| Property | Value |

+----------+----------------------------------+

| email | |

| enabled | True |

| id | 171277c4f4914a83ada7d0161bc4c944 |

| name | cinder |

| tenantId | 917fffbb0bb94aef9bc6ac49b1a14bbb |

+----------+----------------------------------+

手动操作的过程，官网上也很详细，不赘述了，介绍一下脚本创建方法：

官网下载脚本keystone.sh，简单改几个参数，内容如下，要注意的是其中没有cinder的配置，需要加入脚本中，如果不熟悉Shell也没关系，后面我们可以手动加进去

#!/usr/bin/env bash

# Licensed under the Apache License, Version 2.0 (the "License"); you may

# not use this file except in compliance with the License. You may obtain

# a copy of the License at

# http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT

# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the

# License for the specific language governing permissions and limitations

# under the License.

# Sample initial data for Keystone using python-keystoneclient

# This script is based on the original DevStack keystone_data.sh script.

# It demonstrates how to bootstrap Keystone with an administrative user

# using the SERVICE_TOKEN and SERVICE_ENDPOINT environment variables

# and the administrative API. It will get the admin_token (SERVICE_TOKEN)

# and admin_port from keystone.conf if available.

# Disable creation of endpoints by setting DISABLE_ENDPOINTS environment variable.

# Use this with the Catalog Templated backend.

# A EC2-compatible credential is created for the admin user and

# placed in etc/ec2rc.

# Tenant User Roles

# -------------------------------------------------------

# demo admin admin

# service glance admin

# service nova admin

# service ec2 admin

# service swift admin

# By default, passwords used are those in the OpenStack Install and Deploy Manual.

# One can override these (publicly known, and hence, insecure) passwords by setting the appropriate

# environment variables. A common default password for all the services can be used by

# setting the "SERVICE_PASSWORD" environment variable.

ADMIN_PASSWORD=${ADMIN_PASSWORD:-qwe123}

NOVA_PASSWORD=${NOVA_PASSWORD:-${SERVICE_PASSWORD:-nova}}

GLANCE_PASSWORD=${GLANCE_PASSWORD:-${SERVICE_PASSWORD:-glance}}

EC2_PASSWORD=${EC2_PASSWORD:-${SERVICE_PASSWORD:-ec2}}

SWIFT_PASSWORD=${SWIFT_PASSWORD:-${SERVICE_PASSWORD:-swiftpass}}

CONTROLLER_PUBLIC_ADDRESS=${CONTROLLER_PUBLIC_ADDRESS:-10.2.20.90}

CONTROLLER_ADMIN_ADDRESS=${CONTROLLER_ADMIN_ADDRESS:-10.2.20.90}

CONTROLLER_INTERNAL_ADDRESS=${CONTROLLER_INTERNAL_ADDRESS:-10.2.20.90}

TOOLS_DIR=$(cd $(dirname "$0") && pwd)

KEYSTONE_CONF=${KEYSTONE_CONF:-/etc/keystone/keystone.conf}

if [[ -r "$KEYSTONE_CONF" ]]; then

EC2RC="$(dirname "$KEYSTONE_CONF")/ec2rc"

elif [[ -r "$TOOLS_DIR/../etc/keystone.conf" ]]; then

# assume git checkout

KEYSTONE_CONF="$TOOLS_DIR/../etc/keystone.conf"

EC2RC="$TOOLS_DIR/../etc/ec2rc"

else

KEYSTONE_CONF=""

EC2RC="ec2rc"

# Extract some info from Keystone's configuration file

if [[ -r "$KEYSTONE_CONF" ]]; then

CONFIG_SERVICE_TOKEN=$(sed 's/[[:space:]]//g' $KEYSTONE_CONF | grep ^admin_token= | cut -d'=' -f2)

CONFIG_ADMIN_PORT=$(sed 's/[[:space:]]//g' $KEYSTONE_CONF | grep ^admin_port= | cut -d'=' -f2)

export SERVICE_TOKEN=${SERVICE_TOKEN:-$CONFIG_SERVICE_TOKEN}

if [[ -z "$SERVICE_TOKEN" ]]; then

echo "No service token found."

echo "Set SERVICE_TOKEN manually from keystone.conf admin_token."

exit 1

export SERVICE_ENDPOINT=${SERVICE_ENDPOINT:-http://$CONTROLLER_PUBLIC_ADDRESS:${CONFIG_ADMIN_PORT:-35357}/v2.0}

function get_id () {

echo `"$@" | grep ' id ' | awk '{print $4}'`

}

# Default tenant

DEMO_TENANT=$(get_id keystone tenant-create --name=demo \

--description "Default Tenant")

ADMIN_USER=$(get_id keystone user-create --name=admin \

--pass="${ADMIN_PASSWORD}")

ADMIN_ROLE=$(get_id keystone role-create --name=admin)

keystone user-role-add --user-id $ADMIN_USER \

--role-id $ADMIN_ROLE \

--tenant-id $DEMO_TENANT

# Service tenant

SERVICE_TENANT=$(get_id keystone tenant-create --name=service \

--description "Service Tenant")

GLANCE_USER=$(get_id keystone user-create --name=glance \

--pass="${GLANCE_PASSWORD}")

keystone user-role-add --user-id $GLANCE_USER \

--role-id $ADMIN_ROLE \

--tenant-id $SERVICE_TENANT

NOVA_USER=$(get_id keystone user-create --name=nova \

--pass="${NOVA_PASSWORD}" \

--tenant-id $SERVICE_TENANT)

keystone user-role-add --user-id $NOVA_USER \

--role-id $ADMIN_ROLE \

--tenant-id $SERVICE_TENANT

EC2_USER=$(get_id keystone user-create --name=ec2 \

--pass="${EC2_PASSWORD}" \

--tenant-id $SERVICE_TENANT)

keystone user-role-add --user-id $EC2_USER \

--role-id $ADMIN_ROLE \

--tenant-id $SERVICE_TENANT

SWIFT_USER=$(get_id keystone user-create --name=swift \

--pass="${SWIFT_PASSWORD}" \

--tenant-id $SERVICE_TENANT)

keystone user-role-add --user-id $SWIFT_USER \

--role-id $ADMIN_ROLE \

--tenant-id $SERVICE_TENANT

# Keystone service

KEYSTONE_SERVICE=$(get_id \

keystone service-create --name=keystone \

--type=identity \

--description="Keystone Identity Service")

if [[ -z "$DISABLE_ENDPOINTS" ]]; then

keystone endpoint-create --region RegionOne --service-id $KEYSTONE_SERVICE \

--publicurl "http://$CONTROLLER_PUBLIC_ADDRESS:\$(public_port)s/v2.0" \

--adminurl "http://$CONTROLLER_ADMIN_ADDRESS:\$(admin_port)s/v2.0" \

--internalurl "http://$CONTROLLER_INTERNAL_ADDRESS:\$(public_port)s/v2.0"

# Nova service

NOVA_SERVICE=$(get_id \

keystone service-create --name=nova \

--type=compute \

--description="Nova Compute Service")

if [[ -z "$DISABLE_ENDPOINTS" ]]; then

keystone endpoint-create --region RegionOne --service-id $NOVA_SERVICE \

--publicurl "http://$CONTROLLER_PUBLIC_ADDRESS:\$(compute_port)s/v1.1/\$(tenant_id)s" \

--adminurl "http://$CONTROLLER_ADMIN_ADDRESS:\$(compute_port)s/v1.1/\$(tenant_id)s" \

--internalurl "http://$CONTROLLER_INTERNAL_ADDRESS:\$(compute_port)s/v1.1/\$(tenant_id)s"

# Volume service

VOLUME_SERVICE=$(get_id \

keystone service-create --name=volume \

--type=volume \

--description="Nova Volume Service")

if [[ -z "$DISABLE_ENDPOINTS" ]]; then

keystone endpoint-create --region RegionOne --service-id $VOLUME_SERVICE \

--publicurl "http://$CONTROLLER_PUBLIC_ADDRESS:8776/v1/\$(tenant_id)s" \

--adminurl "http://$CONTROLLER_ADMIN_ADDRESS:8776/v1/\$(tenant_id)s" \

--internalurl "http://$CONTROLLER_INTERNAL_ADDRESS:8776/v1/\$(tenant_id)s"

# Image service

GLANCE_SERVICE=$(get_id \

keystone service-create --name=glance \

--type=image \

--description="Glance Image Service")

if [[ -z "$DISABLE_ENDPOINTS" ]]; then

keystone endpoint-create --region RegionOne --service-id $GLANCE_SERVICE \

--publicurl "http://$CONTROLLER_PUBLIC_ADDRESS:9292" \

--adminurl "http://$CONTROLLER_ADMIN_ADDRESS:9292" \

--internalurl "http://$CONTROLLER_INTERNAL_ADDRESS:9292"

# EC2 service

EC2_SERVICE=$(get_id \

keystone service-create --name=ec2 \

--type=ec2 \

--description="EC2 Compatibility Layer")

if [[ -z "$DISABLE_ENDPOINTS" ]]; then

keystone endpoint-create --region RegionOne --service-id $EC2_SERVICE \

--publicurl "http://$CONTROLLER_PUBLIC_ADDRESS:8773/services/Cloud" \

--adminurl "http://$CONTROLLER_ADMIN_ADDRESS:8773/services/Admin" \

--internalurl "http://$CONTROLLER_INTERNAL_ADDRESS:8773/services/Cloud"

# Swift service

SWIFT_SERVICE=$(get_id \

keystone service-create --name=swift \

--type="object-store" \

--description="Swift Service")

if [[ -z "$DISABLE_ENDPOINTS" ]]; then

keystone endpoint-create --region RegionOne --service-id $SWIFT_SERVICE \

--publicurl "http://$CONTROLLER_PUBLIC_ADDRESS:8888/v1/AUTH_\$(tenant_id)s" \

--adminurl "http://$CONTROLLER_ADMIN_ADDRESS:8888/v1" \

--internalurl "http://$CONTROLLER_INTERNAL_ADDRESS:8888/v1/AUTH_\$(tenant_id)s"

# create ec2 creds and parse the secret and access key returned

RESULT=$(keystone ec2-credentials-create --tenant-id=$SERVICE_TENANT --user-id=$ADMIN_USER)

ADMIN_ACCESS=`echo "$RESULT" | grep access | awk '{print $4}'`

ADMIN_SECRET=`echo "$RESULT" | grep secret | awk '{print $4}'`

# write the secret and access to ec2rc

cat > $EC2RC <<EOF

ADMIN_ACCESS=$ADMIN_ACCESS

ADMIN_SECRET=$ADMIN_SECRET

EOF

[GLANCE]

1- 安装镜像管理Glance软件包并创建数据库信息

# yum install openstack-glance

# keystone-db --init --service glance

2- # vim /etc/glance/glance-api.conf

[DEFAULT]

# Show more verbose log output (sets INFO log level output)

verbose = True

# Show debugging output in logs (sets DEBUG log level output)

debug = False

# Which backend scheme should Glance use by default is not specified

# in a request to add a new image to Glance? Known schemes are determined

# by the known_stores option below.

# Default: 'file'

default_store = file

# List of which store classes and store class locations are

# currently known to glance at startup.

#known_stores = glance.store.filesystem.Store,

# glance.store.http.Store,

# glance.store.rbd.Store,

# glance.store.s3.Store,

# glance.store.swift.Store,

# Maximum image size (in bytes) that may be uploaded through the

# Glance API server. Defaults to 1 TB.

# WARNING: this value should only be increased after careful consideration

# and must be set to a value under 8 EB (9223372036854775808).

#image_size_cap = 1099511627776

# Address to bind the API server

bind_host = 0.0.0.0

# Port the bind the API server to

bind_port = 9292

# Log to this file. Make sure you do not set the same log

# file for both the API and registry servers!

log_file = /var/log/glance/api.log

# Backlog requests when creating socket

backlog = 4096

# TCP_KEEPIDLE value in seconds when creating socket.

# Not supported on OS X.

#tcp_keepidle = 600

# SQLAlchemy connection string for the reference implementation

# registry server. Any valid SQLAlchemy connection string is fine.

# See: http://www.sqlalchemy.org/docs/05/reference/sqlalchemy/connections.html#sqlalchemy.create_engine

# sql_connection = sqlite:///glance.sqlite

sql_connection = sql_connection = mysql://glance:glance@10.2.20.90/glance

# Period in seconds after which SQLAlchemy should reestablish its connection

# to the database.

# MySQL uses a default `wait_timeout` of 8 hours, after which it will drop

# idle connections. This can result in 'MySQL Gone Away' exceptions. If you

# notice this, you can lower this value to ensure that SQLAlchemy reconnects

# before MySQL can drop the connection.

sql_idle_timeout = 3600

# Number of Glance API worker processes to start.

# On machines with more than one CPU increasing this value

# may improve performance (especially if using SSL with

# compression turned on). It is typically recommended to set

# this value to the number of CPUs present on your machine.

workers = 1

# Role used to identify an authenticated user as administrator

#admin_role = admin

# Allow unauthenticated users to access the API with read-only

# privileges. This only applies when using ContextMiddleware.

#allow_anonymous_access = False

# Allow access to version 1 of glance api

#enable_v1_api = True

# Allow access to version 2 of glance api

#enable_v2_api = True

# ================= Syslog Options ============================

# Send logs to syslog (/dev/log) instead of to file specified

# by `log_file`

use_syslog = False

# Facility to use. If unset defaults to LOG_USER.

#syslog_log_facility = LOG_LOCAL0

# ================= SSL Options ===============================

# Certificate file to use when starting API server securely

#cert_file = /path/to/certfile

# Private key file to use when starting API server securely

#key_file = /path/to/keyfile

# CA certificate file to use to verify connecting clients

#ca_file = /path/to/cafile

# ================= Security Options ==========================

# AES key for encrypting store 'location' metadata, including

# -- if used -- Swift or S3 credentials

# Should be set to a random string of length 16, 24 or 32 bytes

#metadata_encryption_key = <16, 24 or 32 char registry metadata key>

# ============ Registry Options ===============================

# Address to find the registry server

registry_host = 0.0.0.0

# Port the registry server is listening on

registry_port = 9191

# What protocol to use when connecting to the registry server?

# Set to https for secure HTTP communication

registry_client_protocol = http

# The path to the key file to use in SSL connections to the

# registry server, if any. Alternately, you may set the

# GLANCE_CLIENT_KEY_FILE environ variable to a filepath of the key file

#registry_client_key_file = /path/to/key/file

# The path to the cert file to use in SSL connections to the

# registry server, if any. Alternately, you may set the

# GLANCE_CLIENT_CERT_FILE environ variable to a filepath of the cert file

#registry_client_cert_file = /path/to/cert/file

# The path to the certifying authority cert file to use in SSL connections

# to the registry server, if any. Alternately, you may set the

# GLANCE_CLIENT_CA_FILE environ variable to a filepath of the CA cert file

#registry_client_ca_file = /path/to/ca/file

# ============ Notification System Options =====================

# Notifications can be sent when images are create, updated or deleted.

# There are three methods of sending notifications, logging (via the

# log_file directive), rabbit (via a rabbitmq queue), qpid (via a Qpid

# message queue), or noop (no notifications sent, the default)

notifier_strategy = noop

# Configuration options if sending notifications via rabbitmq (these are

# the defaults)

#rabbit_host = localhost

#rabbit_port = 5672

#rabbit_use_ssl = false

#rabbit_userid = guest

#rabbit_password = guest

#rabbit_virtual_host = /

#rabbit_notification_exchange = glance

#rabbit_notification_topic = glance_notifications

#rabbit_durable_queues = False

# Configuration options if sending notifications via Qpid (these are

# the defaults)

qpid_notification_exchange = glance

qpid_notification_topic = glance_notifications

qpid_host = localhost

qpid_port = 5672

qpid_username =

qpid_password =

qpid_sasl_mechanisms =

qpid_reconnect_timeout = 0

qpid_reconnect_limit = 0

qpid_reconnect_interval_min = 0

qpid_reconnect_interval_max = 0

qpid_reconnect_interval = 0

qpid_heartbeat = 5

# Set to 'ssl' to enable SSL

qpid_protocol = tcp

qpid_tcp_nodelay = True

# ============ Filesystem Store Options ========================

# Directory that the Filesystem backend store

# writes image data to

filesystem_store_datadir = /var/lib/glance/images/

# ============ Swift Store Options =============================

# Version of the authentication service to use

# Valid versions are '2' for keystone and '1' for swauth and rackspace

swift_store_auth_version = 2

# Address where the Swift authentication service lives

# Valid schemes are 'http://' and 'https://'

# If no scheme specified, default to 'https://'

# For swauth, use something like '127.0.0.1:8080/v1.0/'

swift_store_auth_address = 127.0.0.1:5000/v2.0/

# User to authenticate against the Swift authentication service

# If you use Swift authentication service, set it to 'account':'user'

# where 'account' is a Swift storage account and 'user'

# is a user in that account

swift_store_user = jdoe:jdoe

# Auth key for the user authenticating against the

# Swift authentication service

swift_store_key = a86850deb2742ec3cb41518e26aa2d89

# Container within the account that the account should use

# for storing images in Swift

swift_store_container = glance

# Do we create the container if it does not exist?

swift_store_create_container_on_put = False

# What size, in MB, should Glance start chunking image files

# and do a large object manifest in Swift? By default, this is

# the maximum object size in Swift, which is 5GB

swift_store_large_object_size = 5120

# When doing a large object manifest, what size, in MB, should

# Glance write chunks to Swift? This amount of data is written

# to a temporary disk buffer during the process of chunking

# the image file, and the default is 200MB

swift_store_large_object_chunk_size = 200

# Whether to use ServiceNET to communicate with the Swift storage servers.

# (If you aren't RACKSPACE, leave this False!)

# To use ServiceNET for authentication, prefix hostname of

# `swift_store_auth_address` with 'snet-'.

# Ex. https://example.com/v1.0/ -> https://snet-example.com/v1.0/

swift_enable_snet = False

# If set to True enables multi-tenant storage mode which causes Glance images

# to be stored in tenant specific Swift accounts.

#swift_store_multi_tenant = False

# A list of tenants that will be granted read/write access on all Swift

# containers created by Glance in multi-tenant mode.

#swift_store_admin_tenants = []

# The region of the swift endpoint to be used for single tenant. This setting

# is only necessary if the tenant has multiple swift endpoints.

#swift_store_region =

# ============ S3 Store Options =============================

# Address where the S3 authentication service lives

# Valid schemes are 'http://' and 'https://'

# If no scheme specified, default to 'http://'

s3_store_host = 127.0.0.1:8080/v1.0/

# User to authenticate against the S3 authentication service

s3_store_access_key = <20-char AWS access key>

# Auth key for the user authenticating against the

# S3 authentication service

s3_store_secret_key = <40-char AWS secret key>

# Container within the account that the account should use

# for storing images in S3. Note that S3 has a flat namespace,

# so you need a unique bucket name for your glance images. An

# easy way to do this is append your AWS access key to "glance".

# S3 buckets in AWS *must* be lowercased, so remember to lowercase

# your AWS access key if you use it in your bucket name below!

s3_store_bucket = glance

# Do we create the bucket if it does not exist?

s3_store_create_bucket_on_put = False

# When sending images to S3, the data will first be written to a

# temporary buffer on disk. By default the platform's temporary directory

# will be used. If required, an alternative directory can be specified here.

#s3_store_object_buffer_dir = /path/to/dir

# When forming a bucket url, boto will either set the bucket name as the

# subdomain or as the first token of the path. Amazon's S3 service will

# accept it as the subdomain, but Swift's S3 middleware requires it be

# in the path. Set this to 'path' or 'subdomain' - defaults to 'subdomain'.

#s3_store_bucket_url_format = subdomain

# ============ RBD Store Options =============================

# Ceph configuration file path

# If using cephx authentication, this file should

# include a reference to the right keyring

# in a client. section

rbd_store_ceph_conf = /etc/ceph/ceph.conf

# RADOS user to authenticate as (only applicable if using cephx)

rbd_store_user = glance

# RADOS pool in which images are stored

rbd_store_pool = images

# Images will be chunked into objects of this size (in megabytes).

# For best performance, this should be a power of two

rbd_store_chunk_size = 8

# ============ Delayed Delete Options =============================

# Turn on/off delayed delete

delayed_delete = False

# Delayed delete time in seconds

scrub_time = 43200

# Directory that the scrubber will use to remind itself of what to delete

# Make sure this is also set in glance-scrubber.conf

scrubber_datadir = /var/lib/glance/scrubber

# =============== Image Cache Options =============================

# Base directory that the Image Cache uses

image_cache_dir = /var/lib/glance/image-cache/

[keystone_authtoken]

auth_host = 10.2.20.90

auth_port = 35357

auth_protocol = http

admin_tenant_name = service

admin_user = glance

admin_password = glance

[paste_deploy]

# Name of the paste configuration file that defines the available pipelines

config_file = /etc/glance/glance-api-paste.ini

# Partial name of a pipeline in your paste configuration file with the

# service name removed. For example, if your paste section name is

# [pipeline:glance-api-keystone], you would configure the flavor below

# as 'keystone'.

flavor=keystone

3- # vim /etc/glance/glance-api-paste.ini

# Use this pipeline for no auth or image caching - DEFAULT

# [pipeline:glance-api]

# pipeline = versionnegotiation unauthenticated-context rootapp

# Use this pipeline for image caching and no auth

# [pipeline:glance-api-caching]

# pipeline = versionnegotiation unauthenticated-context cache rootapp

# Use this pipeline for caching w/ management inte***ce but no auth

# [pipeline:glance-api-cachemanagement]

# pipeline = versionnegotiation unauthenticated-context cache cachemanage rootapp

# Use this pipeline for keystone auth

[pipeline:glance-api-keystone]

pipeline = versionnegotiation authtoken context rootapp

# Use this pipeline for keystone auth with image caching

# [pipeline:glance-api-keystone+caching]

# pipeline = versionnegotiation authtoken context cache rootapp

# Use this pipeline for keystone auth with caching and cache management

# [pipeline:glance-api-keystone+cachemanagement]

# pipeline = versionnegotiation authtoken context cache cachemanage rootapp

[composite:rootapp]

paste.composite_factory = glance.api:root_app_factory

/: apiversions

/v1: apiv1app

/v2: apiv2app

[app:apiversions]

paste.app_factory = glance.api.versions:create_resource

[app:apiv1app]

paste.app_factory = glance.api.v1.router:API.factory

[app:apiv2app]

paste.app_factory = glance.api.v2.router:API.factory

[filter:versionnegotiation]

paste.filter_factory = glance.api.middleware.version_negotiation:VersionNegotiationFilter.factory

[filter:cache]

paste.filter_factory = glance.api.middleware.cache:CacheFilter.factory

[filter:cachemanage]

paste.filter_factory = glance.api.middleware.cache_manage:CacheManageFilter.factory

[filter:context]

paste.filter_factory = glance.api.middleware.context:ContextMiddleware.factory

[filter:unauthenticated-context]

paste.filter_factory = glance.api.middleware.context:UnauthenticatedContextMiddleware.factory

[filter:authtoken]

paste.filter_factory = keystoneclient.middleware.auth_token:filter_factory

delay_auth_decision = true

4- # vim /etc/glance/glance-registry.conf

[DEFAULT]

# Show more verbose log output (sets INFO log level output)

verbose = True

# Show debugging output in logs (sets DEBUG log level output)

debug = False

# Address to bind the registry server

bind_host = 0.0.0.0

# Port the bind the registry server to

bind_port = 9191

# Log to this file. Make sure you do not set the same log

# file for both the API and registry servers!

log_file = /var/log/glance/registry.log

# Backlog requests when creating socket

backlog = 4096

# TCP_KEEPIDLE value in seconds when creating socket.

# Not supported on OS X.

#tcp_keepidle = 600

# SQLAlchemy connection string for the reference implementation

# registry server. Any valid SQLAlchemy connection string is fine.

# See: http://www.sqlalchemy.org/docs/05/reference/sqlalchemy/connections.html#sqlalchemy.create_engine

sql_connection = mysql://glance:glance@10.2.20.90/glance

# Period in seconds after which SQLAlchemy should reestablish its connection

# to the database.

# MySQL uses a default `wait_timeout` of 8 hours, after which it will drop

# idle connections. This can result in 'MySQL Gone Away' exceptions. If you

# notice this, you can lower this value to ensure that SQLAlchemy reconnects

# before MySQL can drop the connection.

sql_idle_timeout = 3600

# Limit the api to return `param_limit_max` items in a call to a container. If

# a larger `limit` query param is provided, it will be reduced to this value.

api_limit_max = 1000

# If a `limit` query param is not provided in an api request, it will

# default to `limit_param_default`

limit_param_default = 25

# Role used to identify an authenticated user as administrator

#admin_role = admin

# ================= Syslog Options ============================

# Send logs to syslog (/dev/log) instead of to file specified

# by `log_file`

use_syslog = False

# Facility to use. If unset defaults to LOG_USER.

#syslog_log_facility = LOG_LOCAL1

# ================= SSL Options ===============================

# Certificate file to use when starting registry server securely

#cert_file = /path/to/certfile

# Private key file to use when starting registry server securely

#key_file = /path/to/keyfile

# CA certificate file to use to verify connecting clients

#ca_file = /path/to/cafile

[keystone_authtoken]

auth_host = 127.0.0.1

auth_port = 35357

auth_protocol = http

admin_tenant_name = service

admin_user = glance

admin_password = glance

[paste_deploy]

# Name of the paste configuration file that defines the available pipelines

config_file = /etc/glance/glance-registry-paste.ini

# Partial name of a pipeline in your paste configuration file with the

# service name removed. For example, if your paste section name is

# [pipeline:glance-api-keystone], you would configure the flavor below

# as 'keystone'.

flavor=keystone

5- # vim /etc/glance/glance-registry-paste.ini

# Use this pipeline for no auth - DEFAULT

# [pipeline:glance-registry]

# pipeline = unauthenticated-context registryapp

# Use this pipeline for keystone auth

[pipeline:glance-registry-keystone]

pipeline = authtoken context registryapp

[filter:authtoken]

paste.filter_factory = keystoneclient.middleware.auth_token:filter_factory

admin_tenant_name = service

admin_user = glance

admin_password = glance

[app:registryapp]

paste.app_factory = glance.registry.api.v1:API.factory

[filter:context]

paste.filter_factory = glance.api.middleware.context:ContextMiddleware.factory

[filter:unauthenticated-context]

paste.filter_factory = glance.api.middleware.context:UnauthenticatedContextMiddleware.factory

[filter:authtoken]

paste.filter_factory = keystoneclient.middleware.auth_token:filter_factory

6- 改完配置文件后启动服务

# service openstack-glance-api start && chkconfig openstack-glance-api on

# service openstack-glance-registry start && chkconfig openstack-glance-registry on

7- 下一步操作需要一些环境变量

# vim keystonerc_admin

export OS_USERNAME=admin

export OS_TENANT_NAME=demo

export OS_PASSWORD=qwe123

export OS_AUTH_URL=http://10.2.20.90:35357/v2.0/

export PS1='[\u@\h \W(keystone_admin)]\$ '

8- 设置环境变量后上传镜像，镜像可以自己制作，也可以在fedora网站下载

# source keysotnerc_admin

# glance image-create --name "F19" --is-public true --disk-format qcow2 --container-format bare --file /root/Fedora-i386-19-20130627-sda.qcow2

# glance index

ID Name Disk Format Container Format Size

------------------------------------ ------------------------------ -------------------- -------------------- --------------

3d151fa0-b32c-4d27-ac51-75eec4e7face F19 qcow2 bare 235536384

[CINDER]

1- 块存储部分使用Cinder，安装所需软件包

# yum install openstack-cinder iscsi-initiator-utils scsi-target-utils openstack-cinder-doc

2- 创建cinder数据库

# openstack-db --init --service cinder

3- 刚才脚本中没有cinder配置，这里补上

# keystone user-create --tenant-id 917fffbb0bb94aef9bc6ac49b1a14bbb --name cinder --pass cinder

+----------+----------------------------------+

| Property | Value |

+----------+----------------------------------+

| email | |

| enabled | True |

| id | 171277c4f4914a83ada7d0161bc4c944 |

| name | cinder |

| tenantId | 917fffbb0bb94aef9bc6ac49b1a14bbb |

+----------+----------------------------------+

# keystone role-get admin

+----------+----------------------------------+

| Property | Value |

+----------+----------------------------------+

| id | 2ed6280bf6e04a31b4801d0a6ff1f290 |

| name | admin |

+----------+----------------------------------+

# keystone user-role-add --user-id 171277c4f4914a83ada7d0161bc4c944 --role-id 2ed6280bf6e04a31b4801d0a6ff1f290 --tenant-id 917fffbb0bb94aef9bc6ac49b1a14bbb

# keystone service-create --name cinder --type volume --description "Cinder Volume Service"

+-------------+----------------------------------+

| Property | Value |

+-------------+----------------------------------+

| description | Cinder Volume Service |

| id | a3c04ab297e14512b129d4a8f3e7967e |

| name | cinder |

| type | volume |

+-------------+----------------------------------+

# keystone endpoint-create --service-id a3c04ab297e14512b129d4a8f3e7967e --publicurl "http://10.2.20.90:8776/v1/\$(tenant_id)s" --adminurl "http://10.2.20.90:8776/v1/\$(tenant_id)s" --internalurl "http://10.2.20.90:8776/v1/\$(tenant_id)s"

+-------------+-----------------------------------------+

| Property | Value |

+-------------+-----------------------------------------+

| adminurl | http://10.2.20.90:8776/v1/$(tenant_id)s |

| id | c03dd901e0fb46289fe5e84424063c05 |

| internalurl | http://10.2.20.90:8776/v1/$(tenant_id)s |

| publicurl | http://10.2.20.90:8776/v1/$(tenant_id)s |

| region | regionOne |

| service_id | a3c04ab297e14512b129d4a8f3e7967e |

+-------------+-----------------------------------------+

4- 修改Cinder配置文件

# openstack-config --set /etc/cinder/cinder.conf DEFAULT auth_strategy keystone

# openstack-config --set /etc/cinder/cinder.conf keystone_authtoken auth_host 10.2.20.90

# openstack-config --set /etc/cinder/cinder.conf keystone_authtoken admin_tenant_name service

# openstack-config --set /etc/cinder/cinder.conf keystone_authtoken admin_user cinder

# openstack-config --set /etc/cinder/cinder.conf keystone_authtoken admin_password cinder

# openstack-config --set /etc/cinder/cinder.conf DEFAULT rpc_backend cinder.openstack.common.rpc.impl_qpid

# openstack-config --set /etc/cinder/cinder.conf DEFAULT qpid_hostname 10.2.20.90

# openstack-config --set /etc/cinder/cinder.conf DEFAULT sql_connection mysql://cinder:cinder@10.2.20.90/cinder

# openstack-config --set /etc/cinder/cinder.conf DEFAULT volume_group cinder-volumes

# openstack-config --set /etc/cinder/cinder.conf DEFAULT volume_driver cinder.volume.drivers.lvm.LVMISCSIDriver

5- # cinder-manage db sync

6- # vim /etc/tgt/targets.conf

include /etc/cinder/volumes/*

7- 配置完成启动服务

# service openstack-cinder-api start && # chkconfig openstack-cinder-api on

# service openstack-cinder-scheduler start && # chkconfig openstack-cinder-scheduler on

# service tgtd start && # chkconfig tgtd on

# service openstack-cinder-volume start && # chkconfig openstack-cinder-volume on

[NOVA]

1- # yum install openstack-nova openstack-nova-novncproxy dnsmasq-utils

2- # openstack-db --init --service nova

3- # service openstack-nova-novncproxy start && # chkconfig openstack-nova-novncproxy on

4- # vim /etc/nova/nova.conf

[DEFAULT]

# LOGS/STATE

verbose=True

logdir=/var/log/nova

state_path=/var/lib/nova

lock_path=/var/lock/nova

rootwrap_config=/etc/nova/rootwrap.conf

# SCHEDULER

compute_scheduler_driver=nova.scheduler.filter_scheduler.FilterScheduler

# VOLUMES

volume_api_class=nova.volume.cinder.API

volume_driver=nova.volume.driver.ISCSIDriver

volume_group=cinder-volumes

volume_name_template=volume-%s

iscsi_helper=tgtadm

# DATABASE

sql_connection=mysql://nova:nova@10.2.20.90/nova

# COMPUTE

libvirt_type=kvm

compute_driver=libvirt.LibvirtDriver

instance_name_template=instance-x

api_paste_config=/etc/nova/api-paste.ini

# COMPUTE/APIS: if you have separate configs for separate services

# this flag is required for both nova-api and nova-compute

allow_resize_to_same_host=True

# APIS

osapi_compute_extension=nova.api.openstack.compute.contrib.standard_extensions

ec2_dmz_host=10.2.20.90

s3_host=10.2.20.90

enabled_apis=ec2,osapi_compute,metadata

# QPID

qpid_hostname=10.2.20.90

# GLANCE

image_service=nova.image.glance.GlanceImageService

glance_api_servers=10.2.20.90:9292

# NETWORK

network_manager=nova.network.manager.FlatDHCPManager

force_dhcp_release=True

dhcpbridge_flagfile=/etc/nova/nova.conf

firewall_driver=nova.virt.libvirt.firewall.IptablesFirewallDriver

# Change my_ip to match each host

my_ip=10.2.20.90

public_inte***ce=eth100

vlan_inte***ce=eth0

flat_network_bridge=br100

flat_inte***ce=eth0

fixed_range=192.168.100.0/24

# NOVNC CONSOLE

novncproxy_base_url=http://10.2.20.90:6080/vnc_auto.html

# Change vncserver_proxyclient_address and vncserver_listen to match each compute host

vncserver_proxyclient_address=10.2.20.90

vncserver_listen=10.2.20.90

# AUTHENTICATION

auth_strategy=keystone

rpc_backend = nova.openstack.common.rpc.impl_qpid

[keystone_authtoken]

auth_host = 127.0.0.1

auth_port = 35357

auth_protocol = http

admin_tenant_name = service

admin_user = nova

admin_password = nova

signing_dirname = /tmp/keystone-signing-nova

5- # nova-manage db sync

6- # service messagebus start && # chkconfig messagebus on

-------------------------------------------------------------------------------------------

说明：由于环境所限，目前还没有使用quantum租间，仍然用的nova-network,以下步骤仅针对使用

nova-network的情况

-------------------------------------------------------------------------------------------

7- # ip link set eth0 promisc on

8- # vim /etc/sysconfig/network-scripts/ifcfg-br100

DEVICE=br100

TYPE=Bridge

ONBOOT=yes

DELAY=0

BOOTPROTO=static

IPADDR=192.168.100.1

NETMASK=255.255.255.0

9- # sudo brctl addbr br100

# service network restart

10- 此时启动nova-network会报错，需要手动添加如下目录及文件

# mkdir /var/lock/nova

# chmod 777 /var/lock/nova

# mkdir /usr/lib/python2.6/site-packages/bin

# touch /usr/lib/python2.6/site-packages/bin/nova-dhcpbridge

# chmod 777 -R /usr/lib/python2.6/site-packages/bin/

11- 启动所有服务，如果有没起来的，请查看日志排错

# for svc in api scheduler conductor network cert compute; do service openstack-nova-$svc start; done

# for svc in api scheduler conductor network cert compute; do chkconfig openstack-nova-$svc on; done

12- 增添fixedIP

# nova network-create private --fixed-range-v4=192.168.100.0/24 --bridge-inte***ce=br100

13- 修改安全策略

# source keystonerc_admin

# nova secgroup-list

+---------+-------------+

| Name | Description |

+---------+-------------+

| default | default |

+---------+-------------+

# nova secgroup-add-rule default tcp 22 22 0.0.0.0/0

+-------------+-----------+---------+-----------+--------------+

+-------------+-----------+---------+-----------+--------------+

| tcp | 22 | 22 | 0.0.0.0/0 | |

+-------------+-----------+---------+-----------+--------------+

# nova secgroup-add-rule default icmp -1 -1 0.0.0.0/0

+-------------+-----------+---------+-----------+--------------+

+-------------+-----------+---------+-----------+--------------+

| icmp | -1 | -1 | 0.0.0.0/0 | |

+-------------+-----------+---------+-----------+--------------+

[DASHBOARD]

1- # yum install httpd mod_wsgi mod_ssl openstack-dashboard

2- # service httpd start && # chkconfig httpd on

3- # vim /etc/openstack-dashboard/local_settings

CACHES = {

'default': {

'BACKEND' : 'django.core.cache.backends.memcached.MemcachedCache',

'LOCATION' : '10.2.20.90:11211',

}

# service httpd restart

--------------------------------------------------------------------------------------------------

计算节点

--------------------------------------------------------------------------------------------------

1- 重复主节点第一部分1、2、4、5、6、7、9 步骤

2- # ip link set eth0 promisc on

3- # vim /etc/sysconfig/network-scripts/ifcfg-br100

DEVICE=br100

TYPE=Bridge

ONBOOT=yes

DELAY=0

BOOTPROTO=static

IPADDR=192.168.100.1

NETMASK=255.255.255.0

4- # sudo brctl addbr br100

# service network restart

5- 安装nova计算组件

# yum install openstack-nova-compute

6- 更改nova配置文件

# vim /etc/nova/nova.conf

[DEFAULT]

# LOGS/STATE

verbose=True

logdir=/var/log/nova

state_path=/var/lib/nova

lock_path=/var/lock/nova

rootwrap_config=/etc/nova/rootwrap.conf

# SCHEDULER

compute_scheduler_driver=nova.scheduler.filter_scheduler.FilterScheduler

# VOLUMES

volume_api_class=nova.volume.cinder.API

volume_driver=nova.volume.driver.ISCSIDriver

volume_group=cinder-volumes

volume_name_template=volume-%s

iscsi_helper=tgtadm

# DATABASE

sql_connection=mysql://nova:nova@10.2.20.90/nova

# COMPUTE

libvirt_type=kvm

compute_driver=libvirt.LibvirtDriver

instance_name_template=instance-x

api_paste_config=/etc/nova/api-paste.ini

# COMPUTE/APIS: if you have separate configs for separate services

# this flag is required for both nova-api and nova-compute

allow_resize_to_same_host=True

# APIS

osapi_compute_extension=nova.api.openstack.compute.contrib.standard_extensions

ec2_dmz_host=10.2.20.90

s3_host=10.2.20.90

enabled_apis=ec2,osapi_compute,metadata

# QPID

qpid_hostname=10.2.20.90

# GLANCE

image_service=nova.image.glance.GlanceImageService

glance_api_servers=10.2.20.90:9292

# NETWORK

network_manager=nova.network.manager.FlatDHCPManager

force_dhcp_release=True

dhcpbridge_flagfile=/etc/nova/nova.conf

firewall_driver=nova.virt.libvirt.firewall.IptablesFirewallDriver

# Change my_ip to match each host

my_ip=10.2.20.103

public_inte***ce=eth100

vlan_inte***ce=eth0

flat_network_bridge=br100

flat_inte***ce=eth0

fixed_range=192.168.100.0/24

# NOVNC CONSOLE

novncproxy_base_url=http://10.2.20.90:6080/vnc_auto.html

# Change vncserver_proxyclient_address and vncserver_listen to match each compute host

vncserver_proxyclient_address=10.2.20.103

vncserver_listen=10.2.20.103

# AUTHENTICATION

auth_strategy=keystone

rpc_backend = nova.openstack.common.rpc.impl_qpid

[keystone_authtoken]

auth_host = 10.2.20.90

auth_port = 35357

auth_protocol = http

admin_tenant_name = service

admin_user = nova

admin_password = nova

signing_dirname = /tmp/keystone-signing-nova

7- 配置NTP服务，保持和主节点时间同步,如果同步出问题，可以暂时关闭防火墙

# vim /etc/ntp.conf

server grizzly.openstack.cs2c

# service ntpd stop

# ntpdate grizzly.openstack.cs2c

# service ntpd restart

8- 启动计算节点服务

# service openstack-nova-compute restart && chkconfig openstack-nova-compute on

9- 查看

# nova-manage service list

Binary Host Zone Status State Updated_At

nova-conductor grizzly.openstack.cs2c internal enabled :-) 2013-07-22 05:42:28

nova-scheduler grizzly.openstack.cs2c internal enabled :-) 2013-07-22 05:42:27

nova-cert grizzly.openstack.cs2c internal enabled :-) 2013-07-22 05:42:28

nova-compute grizzly.openstack.cs2c nova enabled :-) 2013-07-22 05:42:24

nova-network grizzly.openstack.cs2c internal enabled :-) 2013-07-22 05:42:22

nova-compute grizzly-h1.openstack.cs2c nova enabled :-) 2013-07-22 05:42:20

--------------------------------------------------------------------------------------------------

[完成]

--------------------------------------------------------------------------------------------------

现在所有步骤均已完成，在浏览器打开http://localhost/dashboard可以看到登录窗口。

用户名amdin

密码qwe123

如果您的问题仍未解决，还可以加入服务器在线技术交流QQ群:8017413寻求帮助。

上一篇：CentOS 6.4安装多节点Openstack Havana（OVS+VLAN）
下一篇：OpenStack Glance安装配置过程记录