Openstack Mitaka for Centos7.2 部署指南（一）

uiyujyht

官方文档
把上面的Ubuntu 换成Centos，其他详情请看上面的部署指南

---

4.1配置OpenStack

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

yum install centos-release-openstack-mitaka 安装OpenStack client： yum install python-openstackclient 安装MariaDB yum install mariadb mariadb-server python2-PyMySQL [iyunv@controller ~]# vim /etc/my.cnf.d/openstack.cnf [mysqld] bind-address = 10.0.0.11 default-storage-engine = innodb innodb_file_per_table max_connections = 4096 collation-server = utf8_general_ci character-set-server = utf8 systemctl enable  mariadb.service systemctl start  mariadb.service mysql_secure_installation  ##设置密码

安装NoSQL数据库（MongoDB）
注：只有计量服务（Telemetry Service）用到
Controller Node

1 2 3 4 5 6 7

① 安装MongoDB yum install mongodb-server mongodb [iyunv@controller ~]# vim /etc/mongod.conf bind_ip = 10.0.0.11 smallfiles = true systemctl enable mongod.service systemctl start mongod.service

安装消息队列服务（RabbitMQ）
Controller Node
① 安装RabbitMQ

1 2 3 4 5 6 7

yum install rabbitmq-server systemctl enable rabbitmq-server.service systemctl start rabbitmq-server.service rabbitmqctl add_user openstack  openstack ##密码 Creating user "openstack" ... rabbitmqctl set_permissions openstack ".*" ".*" ".*" ##权限 Setting permissions for user "openstack" in vhost "/" ...

安装Memcached
身份服务（Identity Service）认证机制需要使用Memcached缓存令牌（Token）
Controller Node
① 安装Memcached

1 2 3

yum install memcached python-memcached systemctl enable memcached.service systemctl start memcached.service

4.2 身份服务配置（Identity Service Keystone）
Identity服务采用RESTful设计，使用REST API提供Web服务接口。
注：常见的Web Service 方式有SOAP 、WSDL 、REST 。
部署节点：Controller Node
在MariaDB（MySQL）中创建Keystone数据库

1 2 3 4 5 6 7 8

mysql -uroot -p123456 CREATE DATABASE keystone; GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY  'keystone'; GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone'; flush privileges; quit; % 则代表了所有的host都能远程访问该mysql。但MySQL官方文档指出， % 并不包括localhost 。因此需要对localhost 和% 都进行授权。

生成临时管理身份认证令牌（ADMIN_TOKEN）
生成一个随机值，作为keystone初始配置时的ADMIN_TOKEN

1 2	openssl rand  -hex 10 2d3c132acf773c01838e

安装Keystone和Apache HTTP Server with mod_wsgi
本文采用Apache HTTP server with mod_wsgi 监听端口5000 和35357 提供身份服务。默认keystone 服务已经监听端口5000 和35357 ，为避免冲突，需首先关闭keystone服务

1 2 3 4 5 6 7 8 9

yum install openstack-keystone httpd mod_wsgi vim  /etc/keystone/keystone.conf admin_token = ADMIN_TOKEN connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone provider = fernet #####Fernet令牌提供者 将配置信息写入到身份服务数据库keystone ： su -s /bin/sh  -c "keystone-manage db_sync" keystone 初始化Fernet keys: keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

vim /etc/httpd/conf/httpd.conf
ServerName controller
vim /etc/httpd/conf.d/wsgi-keystone.conf
Listen 5000Listen 35357

<VirtualHost *:5000>
    WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-public
    WSGIScriptAlias / /usr/bin/keystone-wsgi-public
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    ErrorLogFormat "%{cu}t %M"
    ErrorLog /var/log/httpd/keystone-error.log
    CustomLog /var/log/httpd/keystone-access.log combined

    <Directory /usr/bin>
        Require all granted
    </Directory></VirtualHost>

<VirtualHost *:35357>
    WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-admin
    WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    ErrorLogFormat "%{cu}t %M"
    ErrorLog /var/log/httpd/keystone-error.log
    CustomLog /var/log/httpd/keystone-access.log combined

    <Directory /usr/bin>
        Require all granted
    </Directory></VirtualHost>

1 2	systemctl enable httpd.service systemctl start httpd.service

创建服务实体（Service Entity）和API路径（API Endpoints）

1 2 3 4 5

vim admin ##设置环境变量 export OS_TOKEN=2d3c132acf773c01838e export OS_URL=http://controller:35357/v3 export OS_IDENTITY_API_VERSION=3 source admin

创建服务实体
身份服务管理着一个OpenStack的服务目录，通过服务目录确定其他服务是否可用

1	openstack service create --name keystone --description "OpenStack Identity" identity

创建API路径
OpenStack每个服务可使用三种API路径变体： admin ， internal 和public 。默认情况， admin 类型的
API路径可修改用户（user）和租户（tenant），而internal 和public 类型的API路径不允许该操作。

1 2 3

openstack endpoint create --region RegionOne  identity public http://controller:5000/v3 openstack endpoint create --region RegionOne  identity internal http://controller:5000/v3 openstack endpoint create --region RegionOne identity admin http://controller:35357/v3

创建域（Domain）、计划（Project）、用户（User）、角色（Role）：

1 2 3 4

openstack domain create --description "Default Domain" default openstack project create --domain default  --description "Admin Project" admin openstack user create --domain default  --password-prompt admin openstack role create admin

创建的任何角色都必须映射到OpenStack配置文件policy.json 指定的角色：

1	openstack role add --project admin --user admin admin

创建服务计划

1	openstack project create --domain default --description "Service Project" service

常规（非管理员）的任务应该使用一个普通的项目和用户。

1 2 3

openstack project create --domain default  --description "Demo Project" demo openstack user create --domain default  --password-prompt demo openstack role create user

将普通用户角色授予示例计划和示例用户：

1	openstack role add --project demo --user demo user

处于安全考虑，禁用临时身份认证令牌机制
修改文件vi /etc/keystone/keystone‐paste.ini ，从
[pipeline:public_api] 、[pipeline:admin_api] ， [pipeline:api_v3] 处移除admin_token_auth 配置信息。
取消环境变量OS_TOKEN 和OS_URL

1	unset OS_TOKEN OS_URL

为admin 用户申请一个身份认证令牌

1 2 3 4 5

openstack ‐‐os‐auth‐url http://controller:35357/v3 ‐‐os‐project‐domain‐name default ‐‐osuser‐domain‐name default ‐‐os‐project‐name admin ‐‐os‐username admin token issue 为demo 用户申请一个身份认证令牌 openstack --os-auth-url http://controller:5000/v3   --os-project-domain-name default --os-user-domain-name       default   --os-project-name demo --os-username demo  token issue

其他申请方法：
创建OpenStack客户端环境脚本方法

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

vim   admin-openrc export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=admin export OS_USERNAME=admin export OS_PASSWORD=admin export OS_AUTH_URL=http://controller:35357/v3 export OS_AUTH_TYPE=password export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 source   admin-openrc openstack token issue vim  demo-openrc export OS_PROJECT_DOMAIN_NAME=default export OS_USER_DOMAIN_NAME=default export OS_PROJECT_NAME=demo export OS_USERNAME=demo export OS_PASSWORD=demo export OS_AUTH_URL=http://controller:5000/v3 export OS_AUTH_TYPE=password export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 source   demo-openrc openstack token issue

4.3 镜像服务配置（Image Service Glance）
用户可使用OpenStack镜像服务提供的REST API 查询、注册、恢复虚拟机镜像。
部署节点：Controller Node

1 2 3 4 5

mysql -uroot -p123456 CREATE DATABASE glance; GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost'  IDENTIFIED BY 'glance'; GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%'   IDENTIFIED BY 'glance'; flush privileges;

. admin-openrc
在OpenStack中创建一个glance用户

1 2 3

openstack user create --domain default --password-prompt glance User Password: glance Repeat User Password:glance

将admin 角色授予glance 用户和service 计划

1	openstack role add --project service --user glance admin

创建glance服务实体

1	openstack service create --name glance --description "OpenStack Image" image

创建镜像服务API路径

1 2 3

openstack endpoint create --region RegionOne   image public http://controller:9292 openstack endpoint create --region RegionOne   image internal http://controller:9292 openstack endpoint create --region RegionOne   image admin http://controller:9292

安装和配置Glance服务组件

1 2	yum install openstack-glance vim /etc/glance/glance-api.conf

connection = mysql+pymysql://glance:GLANCE_DBPASS@controller/glance
在[keystone_authtoken] 和[paste_deploy] 处，配置身份服务访问。
注：注释掉[keystone_authtoken] 处所有默认内容  M版默认是全注释掉的
[keystone_authtoken]
...
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = glance
password = GLANCE_PASS

[paste_deploy]
...
flavor = keystone
在[glance_store]处配置本地文件系统存储和镜像文件存储位置。
stores = file,http
default_store = file
filesystem_store_datadir = /var/lib/glance/images/

1 2 3 4 5 6 7 8 9 10 11 12 13 14

vim /etc/glance/glance-registry.conf connection = mysql+pymysql://glance:GLANCE_DBPASS@controller/glance [keystone_authtoken] auth_uri = http://controller:5000 auth_url = http://controller:35357 memcached_servers = controller:11211 auth_type = password project_domain_name = default user_domain_name = default project_name = service username = glance password = GLANCE_PASS [paste_deploy] flavor = keystone

将配置信息写入glance数据库

1	su -s /bin/sh -c "glance-manage  db_sync" glance

忽略所有有关’弃用’（deprecate）的输出
Option "verbose" from group "DEFAULT" is deprecated for removal.  Its value may be silently ignored in the future.
/usr/lib/python2.7/site-packages/oslo_db/sqlalchemy/enginefacade.py:1056: OsloDBDeprecationWarning: EngineFacade is deprecated; please use oslo_db.sqlalchemy.enginefacade
expire_on_commit=expire_on_commit, _conf=conf)

1 2 3 4 5 6 7 8 9 10

systemctl enable openstack-glance-api.service   openstack-glance-registry.service systemctl start openstack-glance-api.service   openstack-glance-registry.service wget http://download.cirros-cloud.net ... 3.4-x86_64-disk.img openstack image create "cirros"   --file cirros-0.3.4-x86_64-disk.img  --disk-format qcow2 --container-format bare   --public [iyunv@controller ~]# openstack image list +--------------------------------------+--------+--------+ | ID                                   | Name   | Status | +--------------------------------------+--------+--------+ | 9866bbe8-5efb-43e4-9c22-3984a63276c8 | cirros | active | +--------------------------------------+--------+--------+