openStack 王者归来之 trivial matters
tips:制作大部分cloud platforms img准备工作.
http://www.pubyun.com/blog/openstack/%E4%BB%80%E4%B9%88%E6%98%AFopenstack%E7%9A%84-metadata/
www.weiyan.me/2012/10/494
http://www.ibm.com/developerworks/cn/cloud/library/cl-openstack-images/
一台linux系统(最好centOS6 根据当前cloud platform and linux OS compatibility)的机器,作为制作镜像的机器.
1,安装底层支持软件包
yum groupinstall Virtualization libvirt virt-install qemu-kvm;
2,某种类型 的iso文件准备
3,启动libvirtd
开始制作镜像
qemu-img create -f qcow2 ruiyCentOS-openStack.qcow2 30G
chown qemu:qemu*.qcow2 -R
virt-install -n RuiyCnetOSimg -r 4096 --cpu host -c /images/Centos-*iso --disk path=*.qcow2,device=disk,bus=virtio,size=30,format=qcow2 --vnc --vncport=5978 --vnclisten=0.0.0.0 -v
为openStack的镜像而打磨一下我们刚装好的系统
virsh start/destroy/undefine VMInames;
1,delete /etc/udev/rules.d/70-persistent-net.rules (删除以生成的网络设备规则!)
2,删除ifcfg-eth0的HWADDR一行
/etc/sysconfig/network-scripts/ifcfg-eth0内容如下:
DEVICE="eth0"
BOOTPROTO="dhcp"
NM_CONTROLLED="yes"
ONBOOT="yes"
TYPE="Ethernet"
3,关闭firewall和selinux/config
sed -i s/^SELINUX=.*/SELINUX=disabled/g /etc/selinux/config
service iptables stop && chkconfig iptables off;
4,设置系统能自动获取openstack指定的hostname和ssh-key
使用vim编辑/etc/rc.local文件
然后将以下内容输入进去，放在”touch /var/lock/subsys/local”之前
if [ ! -d /root/.ssh ]; then
mkdir -p /root/.ssh
chmod 700 /root/.ssh
fi
# Fetch public key using HTTP
ATTEMPTS=30
FAILED=0 while [ ! -f /root/.ssh/authorized_keys ]; do
curl -f http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key > /tmp/metadata-key 2>/dev/null
if [ $? -eq 0 ]; then
cat /tmp/metadata-key >> /root/.ssh/authorized_keys
chmod 0600 /root/.ssh/authorized_keys
restorecon /root/.ssh/authorized_keys
rm -f /tmp/metadata-key
echo “Successfully retrieved public key from instance metadata”
echo “*****************”
echo “AUTHORIZED KEYS”
echo “*****************”
cat /root/.ssh/authorized_keys
echo “*****************”
curl -f http://169.254.169.254/latest/meta-data/hostname > /tmp/metadata-hostname 2>/dev/null
if [ $? -eq 0 ]; then
TEMP_HOST=`cat /tmp/metadata-hostname`
sed -i “s/^HOSTNAME=.*$/HOSTNAME=$TEMP_HOST/g” /etc/sysconfig/network
/bin/hostname $TEMP_HOST
echo “Successfully retrieved hostname from instance metadata”
echo “*****************”
echo “HOSTNAME CONFIG”
echo “*****************”
cat /etc/sysconfig/network
echo “*****************”
else
echo “Failed to retrieve hostname from instance metadata. This is a soft error so we’ll continue”
fi
rm -f /tmp/metadata-hostname
else
FAILED=$(($FAILED + 1))
if [ $FAILED -ge $ATTEMPTS ]; then
echo “Failed to retrieve public key from instance metadata after $FAILED attempts, quitting”
break
fi
echo “Could not retrieve public key from instance metadata (attempt #$FAILED/$ATTEMPTS), retrying in 5 seconds…”
sleep 5
fi
done
上传镜像，开启实例
如果以上的内容都做完了，那么就可以直接把这个生成的镜像关机了
init 0
之后，我们可以看看之前生成的那个qcow2格式的img，发现不超过2G应该。我们只需要将这个镜像传到Openstack的环境里，然后使用glance add添加即可
glance add name=XXXX is_public=true container_format=ovf disk_format=qcow2 < /tmp/CentOS6.3-openstack.img
再之后，用这个镜像创建一个实例~~启动起来看看吧~~你会发现直接获取的就是Openstack分配的ip ~而且直接可以ssh到哦~！
openStack metadata(public keys)
what openStack metadata ?
metadata 字面理解元数据,在除了openStack的其他场合也经常遇到,在openStack环境中metadata是提供一个机制给用户(可以设定每一个VMI instance参数)
eg,你想给instance设置某个属性,(主机名,ip,public keys pairs)
metadata的一个一个重要应用是设置每个instance 的ssh public keys
公钥的设置有两种方式
1,创建instance 时注入文件镜像
2,启动instance后,通过metadata获取,用脚本写入
# Fetch public key using HTTP
ATTEMPTS=10
while [ ! -f /root/.ssh/authorized_keys ]; do
curl -f http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key > /tmp/aws-key 2>/dev/null
if [ \$? -eq 0 ]; then
cat /tmp/aws-key >> /root/.ssh/authorized_keys
chmod 0600 /root/.ssh/authorized_keys
restorecon /root/.ssh/authorized_keys
rm -f /tmp/aws-key
echo "Successfully retrieved AWS public key from instance metadata"
else
FAILED=\$((\$FAILED + 1))
if [ \$FAILED -ge \$ATTEMPTS ]; then
echo "Failed to retrieve AWS public key after \$FAILED attempts, quitting"
break
fi
echo "Could not retrieve AWS public key (attempt #\$FAILED/\$ATTEMPTS), retrying in 5 seconds..."
sleep 5
fi
done
可以看到,获取metadata及主机名的api接口分别是
http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
http://169.254.169.254/latest/meta-data/hostname
注意,169.254.169.254这个ip地址在openStack中是不存在的,为什么可以获取metadata?
这个是Amazon原因,最早metadata是亚马逊提出的,很多人给亚马逊定制了操作系统的一些镜像,而且将里面获取metadata的api地址写死了,openStack为了兼容性,保留了这个ip,然后通过iptables nat 映射到真实的api上!这个很重要了!相信搞过manual deploy openStack production ENV 的大牛都知道,openStack的网络节点iptables 是不关闭的哦,下面的计算节点的iptables是需要关闭的!
iptables -A nova-network-PREROUTING -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination ip(10.114.100.118):8775
8775端口也很重要,有时会死掉,你需要使用lsof -p:8775 找到首进程pid 将其kill -all pid 重启nova-api即可;
使用metadata会带来便利,但是经常会碰到的问题是metadata获取不成功,导致instance启动很慢，并且获取失效会导致ssh key等功能设置失效
1,在network上,正确设置相关参数/etc/nova/nova.conf
metadata_host = ip
2,由于api判断instance是通过fixed ip(就是我们在配置openStack时创建的tenant 网络)来判断的
1,quick guide to creating a OpenStack bootable image;
1.1 wget os iso
wget http://releases.ubuntu.com/14.04/ubuntu-14.04-server-adm64.iso
1.2 create disk image:
qemu-img create -f qcow2 ubuntu-14.04-server.qcow2 30G
1.3 using KVM,launch an instance using iso and disk image (4096Mb ram and 2 processors)
kvm -hda ubuntu-14.04-server.qcow2 -cdrom ubuntu-14.04-server-adm64.iso -m 4096 -smp 2
1.4 upload the image to glance:
glance image-create --name ubuntu-14.04-server --disk-format=qcow2 --container-format=bare --is-public=True < ubuntu-14.04-server.qcow2
1.5 boot
nova boot --image ubuntu-14.04-server --flavor 3 VMI001
(Tips:delete /etc/udev/rules.d/70-persistent-net.rules (beforce uploading the image to glance))
in order for the nic interface ordering to start at eth0,otherwise it will start eth1.... which might not automatically start a dhcp-client on the interface.
# Fetch public key using HTTP
ATTEMPTS=10
while [ ! -f /root/.ssh/authorized_keys ]; do
curl -f http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key > /tmp/aws-key 2>/dev/null
if [ \$? -eq 0 ]; then
cat /tmp/aws-key >> /root/.ssh/authorized_keys
chmod 0600 /root/.ssh/authorized_keys
restorecon /root/.ssh/authorized_keys
rm -f /tmp/aws-key
echo "Successfully retrieved AWS public key from instance metadata"
else
FAILED=\$((\$FAILED + 1))
if [ \$FAILED -ge \$ATTEMPTS ]; then
echo "Failed to retrieve AWS public key after \$FAILED attempts, quitting"
break
fi
echo "Could not retrieve AWS public key (attempt #\$FAILED/\$ATTEMPTS), retrying in 5 seconds..."
sleep 5
fi
done
页:
[1]