yum install vim iotop bc gcc gcc-c++ glibc glibc-devel pcre pcre-devel openssl openssl-devel zip unzip zlib-devel net-tools lrzsz tree ntpdate telnet lsof tcpdump wget libevent libevent-devel bc systemd-devel bash-completion traceroute bridge-utils vs'f'tpd -y
节点规划
主机名
IP地址
openstack-controller1.ws.local
172.31.7.101
openstack-controller2.ws.local
172.31.7.102
openstack-mysql1.ws.local
172.31.7.103
openstack-mysql2.ws.local
172.31.7.104
openstack-haproxy1.ws.local
172.31.7.105
openstack-haproxy2.ws.local
172.31.7.106
openstack-node1.ws.local
172.31.7.107
openstack-node2.ws.local
172.31.7.108
openstack-node3.ws.local
172.31.7.109
keystone(controller)
数据端
# 安装openstack基本服务
yum install -y centos-release-openstack-train
yum install -y python-openstackclient openstack-selinux
# 安装服务
yum install mariadb mariadb-server
# 配置mysql文件
vim /etc/my.cnf.d/openstack.cnf
[mysqld]
bind-address = 10.0.0.11
default-storage-engine = innodb
innodb_file_per_table = on
max_connections = 4096
collation-server = utf8_general_ci
character-set-server = utf8
# 启动服务
systemctl start mariadb; systemctl enable mariadb
# 初始化数据库
mysql_secure_installation
回车
n
y
n
y
y
mysql -u root -p
CREATE DATABASE keystone;
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone123';
# 部署配置rabbitmq
yum install -y rabbitmq-server
systemctl enable rabbitmq-server.service; systemctl start rabbitmq-server.service
rabbitmqctl add_user openstack openstack123
rabbitmqctl set_permissions openstack ".*" ".*" ".*"
rabbitmq-plugins enable rabbitmq_management rabbitmq_management_agent
# 安装配置mecache
yum install -y memcached
PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="1024"
OPTIONS="-l 0.0.0.0,::1"
systemctl enable memcached.service; systemctl start memcached.service
ha1
# 安装服务
yum -y install haproxy keepalived
]# cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
notification_email {
acassen@firewall.loc
failover@firewall.loc
sysadmin@firewall.loc
}
notification_email_from Alexandre.Cassen@firewall.loc
smtp_server 192.168.200.1
smtp_connect_timeout 30
router_id LVS_DEVEL
vrrp_skip_check_adv_addr
vrrp_strict
vrrp_iptables
vrrp_garp_interval 0
vrrp_gna_interval 0
}
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 58
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
172.31.7.248 dev eth0 label eth0:0
}
}
# 配置反向代理
vim /etc/haproxy/haproxy.cfg
#---------------------------------------------------------------------# Example configuration for a possible web application. See the# full configuration options online.## http://haproxy.1wt.eu/download/1.4/doc/configuration.txt##---------------------------------------------------------------------
#---------------------------------------------------------------------# Global settings#---------------------------------------------------------------------
global
# to have these messages end up in /var/log/haproxy.log you will# need to:## 1) configure syslog to accept network log events. This is done# by adding the '-r' option to the SYSLOGD_OPTIONS in# /etc/sysconfig/syslog## 2) configure local2 events to go to the /var/log/haproxy.log# file. A line like the following can be added to# /etc/sysconfig/syslog## local2.* /var/log/haproxy.log#log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon
# turn on stats unix socket
stats socket /var/lib/haproxy/stats
#---------------------------------------------------------------------# common defaults that all the 'listen' and 'backend' sections will# use if not designated in their block#---------------------------------------------------------------------
defaults
mode http
log global
option httplog
option dontlognull
option http-server-close
option forwardfor except 127.0.0.0/8
option redispatch
retries 3
timeout http-request 10s
timeout queue 1m
timeout connect 10s
timeout client 1m
timeout server 1m
timeout http-keep-alive 10s
timeout check 10s
maxconn 3000
#---------------------------------------------------------------------# main frontend which proxys to the backends#---------------------------------------------------------------------
listen openstack-mysql-3306
bind 172.31.7.248:3306
mode tcp
server 172.31.7.103 172.31.7.103:3306 check inter 3s fall 3 rise 5
listen openstack-rabbitmq-5672
bind 172.31.7.248:5672
mode tcp
server 172.31.7.103 172.31.7.103:5672 check inter 3s fall 3 rise 5
listen openstack-memcache-11211
bind 172.31.7.248:11211
mode tcp
server 172.31.7.103 172.31.7.103:11211 check inter 3s fall 3 rise 5
vim /etc/haproxy/haproxy.cfg
listen openstack-placement-8778
bind 172.31.7.248:8778
mode tcp
server 172.31.7.101 172.31.7.101:8778 check inter 3s fall 3 rise 5
systemctl restart haproxy
controller1端（继续配置服务）
# 安装服务
yum install openstack-placement-api
# 配置文件
vim /etc/placement/placement.conf
[placement_database]
connection = mysql+pymysql://placement:placement123@openstack-vip.ws.local/placement
[api]
auth_strategy = keystone
[keystone_authtoken]
auth_url = http://openstack-vip.ws.local:5000/v3
memcached_servers = openstack-vip.ws.local:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = placement
password = placement
# 同步数据库
su -s /bin/sh -c "placement-manage db sync" placement
# 解决bug，新版官方没有告诉解决方法（去R版中可用看到官方提示bug信息）# 允许apache大于2.4版本的访问，目前t版已经大于了，如果不写会报错# 由于打包错误，您必须通过将以下配置添加到以下配置来启用对 Placement API 的访问 /etc/httpd/conf.d/00-nova-placement-api.conf
vim /etc/httpd/conf.d/00-placement-api.conf # 追加进去
....
<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
Allow from all # 允许所有
</IfVersion>
</Directory>
# httpd -v 命令可以看到版本已经大于2.4了，所以必须得配置
# 重启服务
systemctl restart httpd
# 验证
placement-status upgrade check
nova-controller
数据端
# 创库授权
CREATE DATABASE nova_api;
CREATE DATABASE nova;
CREATE DATABASE nova_cell0;
GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'%' IDENTIFIED BY 'nova123';
GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' IDENTIFIED BY 'nova123';
GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'%' IDENTIFIED BY 'nova123';
controller端
source admin-openrc
# 创建账号
openstack user create --domain default --password-prompt nova # 设置密码，统一为nova
# 让nova用户在service这个项目中有admin权限
openstack role add --project service --user nova admin
# 创建service实体
openstack service create --name nova --description "OpenStack Compute" compute
# 注册三个端点
openstack endpoint create --region RegionOne compute public http://openstack-vip.ws.local:8774/v2.1
openstack endpoint create --region RegionOne compute internal http://openstack-vip.ws.local:8774/v2.1
openstack endpoint create --region RegionOne compute admin http://openstack-vip.ws.local:8774/v2.1
# openstack endpoint 查看注册是否成功
ha1配置反向代理
vim /etc/haproxy/haproxy.cfg
listen openstack-nova-controller-8774
bind 172.31.7.248:8774
mode tcp
server 172.31.7.101 172.31.7.101:8774 check inter 3s fall 3 rise 5
# 重启
systemctl restart haproxy
vim /etc/neutron/plugins/ml2/ml2_conf.ini
# 官网少了许多的配置项，需要从其它版本中拷贝一份：https://docs.openstack.org/ocata/config-reference/networking/samples/ml2_conf.ini.html
[DEFAULT]
## From oslo.log#
# If set to true, the logging level will be set to DEBUG instead of the default# INFO level. (boolean value)# Note: This option can be changed without restarting.#debug = false
# DEPRECATED: If set to false, the logging level will be set to WARNING instead# of the default INFO level. (boolean value)# This option is deprecated for removal.# Its value may be silently ignored in the future.#verbose = true
# The name of a logging configuration file. This file is appended to any# existing logging configuration files. For details about logging configuration# files, see the Python logging module documentation. Note that when logging# configuration files are used then all logging configuration is setin the# configuration file and other logging configuration options are ignored (for# example, logging_context_format_string). (string value)# Note: This option can be changed without restarting.# Deprecated group/name - [DEFAULT]/log_config#log_config_append = <None>
# Defines the format string for %%(asctime)s inlog records. Default:# %(default)s . This option is ignored if log_config_append is set. (string# value)#log_date_format = %Y-%m-%d %H:%M:%S
# (Optional) Name of log file to send logging output to. If no default is set,# logging will go to stderr as defined by use_stderr. This option is ignored if# log_config_append is set. (string value)# Deprecated group/name - [DEFAULT]/logfile#log_file = <None>
# (Optional) The base directory used for relative log_file paths. This option# is ignored if log_config_append is set. (string value)# Deprecated group/name - [DEFAULT]/logdir#log_dir = <None>
# Uses logging handler designed to watch file system. When log file is moved or# removed this handler will open a new log file with specified path# instantaneously. It makes sense only if log_file option is specified and# Linux platform is used. This option is ignored if log_config_append is set.# (boolean value)#watch_log_file = false
# Use syslog for logging. Existing syslog format is DEPRECATED and will be# changed later to honor RFC5424. This option is ignored if log_config_append# is set. (boolean value)#use_syslog = false
# Syslog facility to receive log lines. This option is ignored if# log_config_append is set. (string value)#syslog_log_facility = LOG_USER
# Log output to standard error. This option is ignored if log_config_append is# set. (boolean value)#use_stderr = true
# Format string to use forlog messages with context. (string value)#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s
# Format string to use forlog messages when context is undefined. (string# value)#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s
# Additional data to append to log message when logging level for the message# is DEBUG. (string value)#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d
# Prefix each line of exception output with this format. (string value)#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s
# Defines the format string for %(user_identity)s that is used in# logging_context_format_string. (string value)#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s
# List of package logging levels in logger=LEVEL pairs. This option is ignored# if log_config_append is set. (list value)#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO
# Enables or disables publication of error events. (boolean value)#publish_errors = false
# The format for an instance that is passed with the log message. (string# value)#instance_format = "[instance: %(uuid)s] "
# The format for an instance UUID that is passed with the log message. (string# value)#instance_uuid_format = "[instance: %(uuid)s] "
# Enables or disables fatal status of deprecations. (boolean value)#fatal_deprecations = false
[ml2]
## From neutron.ml2#
# List of network type driver entrypoints to be loaded from the# neutron.ml2.type_drivers namespace. (list value)#type_drivers = local,flat,vlan,gre,vxlan,geneve
# Ordered list of network_types to allocate as tenant networks. The default# value 'local' is useful for single-box testing but provides no connectivity# between hosts. (list value)#tenant_network_types = local
# An ordered list of networking mechanism driver entrypoints to be loaded from# the neutron.ml2.mechanism_drivers namespace. (list value)#mechanism_drivers =
# An ordered list of extension driver entrypoints to be loaded from the# neutron.ml2.extension_drivers namespace. For example: extension_drivers =# port_security,qos (list value)#extension_drivers =
# Maximum size of an IP packet (MTU) that can traverse the underlying physical# network infrastructure without fragmentation when using an overlay/tunnel# protocol. This option allows specifying a physical network MTU value that# differs from the default global_physnet_mtu value. (integer value)#path_mtu = 0
# A list of mappings of physical networks to MTU values. The format of the# mapping is <physnet>:<mtu val>. This mapping allows specifying a physical# network MTU value that differs from the default global_physnet_mtu value.# (list value)#physical_network_mtus =
# Default network typefor external networks when no provider attributes are# specified. By default it is None, which means that if provider attributes are# not specified while creating external networks then they will have the same# type as tenant networks. Allowed values for external_network_type config# option depend on the network type values configured in type_drivers config# option. (string value)#external_network_type = <None>
# IP version of all overlay (tunnel) network endpoints. Use a value of 4 for# IPv4 or 6 for IPv6. (integer value)#overlay_ip_version = 4
[ml2_type_flat]
## From neutron.ml2#
# List of physical_network names with which flat networks can be created. Use# default '*' to allow flat networks with arbitrary physical_network names. Use# an empty list to disable flat networks. (list value)#flat_networks = *
[ml2_type_geneve]
## From neutron.ml2#
# Comma-separated list of <vni_min>:<vni_max> tuples enumerating ranges of# Geneve VNI IDs that are available for tenant network allocation (list value)#vni_ranges =
# Geneve encapsulation header size is dynamic, this value is used to calculate# the maximum MTU for the driver. This is the sum of the sizes of the outer ETH# + IP + UDP + GENEVE header sizes. The default size for this field is 50,# which is the size of the Geneve header without any additional option headers.# (integer value)#max_header_size = 30
[ml2_type_gre]
## From neutron.ml2#
# Comma-separated list of <tun_min>:<tun_max> tuples enumerating ranges of GRE# tunnel IDs that are available for tenant network allocation (list value)#tunnel_id_ranges =
[ml2_type_vlan]
## From neutron.ml2#
# List of <physical_network>:<vlan_min>:<vlan_max> or <physical_network># specifying physical_network names usable for VLAN provider and tenant# networks, as well as ranges of VLAN tags on each available for allocation to# tenant networks. (list value)#network_vlan_ranges =
[ml2_type_vxlan]
## From neutron.ml2#
# Comma-separated list of <vni_min>:<vni_max> tuples enumerating ranges of# VXLAN VNI IDs that are available for tenant network allocation (list value)#vni_ranges =
# Multicast group for VXLAN. When configured, will enable sending all broadcast# traffic to this multicast group. When left unconfigured, will disable# multicast VXLAN mode. (string value)#vxlan_group = <None>
[securitygroup]
## From neutron.ml2#
# Driver for security groups firewall in the L2 agent (string value)#firewall_driver = <None>
# Controls whether the neutron security group API is enabled in the server. It# should be false when using no security groups or using the nova security# group API. (boolean value)#enable_security_group = true
# Use ipset to speed-up the iptables based security groups. Enabling ipset# support requires that ipset is installed on L2 agent node. (boolean value)#enable_ipset = true
=====================================配置信息=======================================
[ml2] # 配置文件中没有 [ml2] 的配置信息，在最后手动加入即可
type_drivers = flat,vlan
[ml2]
tenant_network_types = # 租户不启用网络
[ml2]
mechanism_drivers = linuxbridge # 启用 Linux 桥接机制
[ml2]
extension_drivers = port_security # 启用端口安全扩展驱动程序
[ml2_type_flat]
flat_networks = external # 定义虚拟网络名称，因为这里需要指向外部网络，设置名称就为external，后面要与网卡绑定
[securitygroup]
enable_ipset = true # 启用ipset以提高安全组规则的效率
配置虚拟网络走那张网卡
vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
# 由于原文件不全，去其它版本中拷贝: https://docs.openstack.org/ocata/config-reference/networking/samples/linuxbridge_agent.ini
[DEFAULT]
## From oslo.log#
# If set to true, the logging level will be set to DEBUG instead of the default# INFO level. (boolean value)# Note: This option can be changed without restarting.#debug = false
# DEPRECATED: If set to false, the logging level will be set to WARNING instead# of the default INFO level. (boolean value)# This option is deprecated for removal.# Its value may be silently ignored in the future.#verbose = true
# The name of a logging configuration file. This file is appended to any# existing logging configuration files. For details about logging configuration# files, see the Python logging module documentation. Note that when logging# configuration files are used then all logging configuration is setin the# configuration file and other logging configuration options are ignored (for# example, logging_context_format_string). (string value)# Note: This option can be changed without restarting.# Deprecated group/name - [DEFAULT]/log_config#log_config_append = <None>
# Defines the format string for %%(asctime)s inlog records. Default:# %(default)s . This option is ignored if log_config_append is set. (string# value)#log_date_format = %Y-%m-%d %H:%M:%S
# (Optional) Name of log file to send logging output to. If no default is set,# logging will go to stderr as defined by use_stderr. This option is ignored if# log_config_append is set. (string value)# Deprecated group/name - [DEFAULT]/logfile#log_file = <None>
# (Optional) The base directory used for relative log_file paths. This option# is ignored if log_config_append is set. (string value)# Deprecated group/name - [DEFAULT]/logdir#log_dir = <None>
# Uses logging handler designed to watch file system. When log file is moved or# removed this handler will open a new log file with specified path# instantaneously. It makes sense only if log_file option is specified and# Linux platform is used. This option is ignored if log_config_append is set.# (boolean value)#watch_log_file = false
# Use syslog for logging. Existing syslog format is DEPRECATED and will be# changed later to honor RFC5424. This option is ignored if log_config_append# is set. (boolean value)#use_syslog = false
# Syslog facility to receive log lines. This option is ignored if# log_config_append is set. (string value)#syslog_log_facility = LOG_USER
# Log output to standard error. This option is ignored if log_config_append is# set. (boolean value)#use_stderr = true
# Format string to use forlog messages with context. (string value)#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s
# Format string to use forlog messages when context is undefined. (string# value)#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s
# Additional data to append to log message when logging level for the message# is DEBUG. (string value)#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d
# Prefix each line of exception output with this format. (string value)#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s
# Defines the format string for %(user_identity)s that is used in# logging_context_format_string. (string value)#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s
# List of package logging levels in logger=LEVEL pairs. This option is ignored# if log_config_append is set. (list value)#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO
# Enables or disables publication of error events. (boolean value)#publish_errors = false
# The format for an instance that is passed with the log message. (string# value)#instance_format = "[instance: %(uuid)s] "
# The format for an instance UUID that is passed with the log message. (string# value)#instance_uuid_format = "[instance: %(uuid)s] "
# Enables or disables fatal status of deprecations. (boolean value)#fatal_deprecations = false
[agent]
## From neutron.ml2.linuxbridge.agent#
# The number of seconds the agent will wait between polling forlocal device# changes. (integer value)#polling_interval = 2
# Set new timeoutin seconds for new rpc calls after agent receives SIGTERM. If# value is set to 0, rpc timeout won't be changed (integer value)#quitting_rpc_timeout = 10
# DEPRECATED: Enable suppression of ARP responses that don't match an IP# address that belongs to the port from which they originate. Note: This# prevents the VMs attached to this agent from spoofing, it doesn't protect# them from other devices which have the capability to spoof (e.g. bare metal# or VMs attached to agents without this flag set to True). Spoofing rules will# not be added to any ports that have port security disabled. For LinuxBridge,# this requires ebtables. For OVS, it requires a version that supports matching# ARP headers. This option will be removed in Ocata so the only way to disable# protection will be via the port security extension. (boolean value)# This option is deprecated for removal.# Its value may be silently ignored in the future.#prevent_arp_spoofing = true
# Extensions list to use (list value)#extensions =
[linux_bridge]
#
# From neutron.ml2.linuxbridge.agent#
# Comma-separated list of <physical_network>:<physical_interface> tuples# mapping physical network names to the agent's node-specific physical network# interfaces to be used for flat and VLAN networks. All physical networks# listed in network_vlan_ranges on the server should have mappings to# appropriate interfaces on each agent. (list value)#physical_interface_mappings =
# List of <physical_network>:<physical_bridge> (list value)#bridge_mappings =
[securitygroup]
## From neutron.ml2.linuxbridge.agent#
# Driver for security groups firewall in the L2 agent (string value)#firewall_driver = <None>
# Controls whether the neutron security group API is enabled in the server. It# should be false when using no security groups or using the nova security# group API. (boolean value)#enable_security_group = true
# Use ipset to speed-up the iptables based security groups. Enabling ipset# support requires that ipset is installed on L2 agent node. (boolean value)#enable_ipset = true
[vxlan]
## From neutron.ml2.linuxbridge.agent#
# Enable VXLAN on the agent. Can be enabled when agent is managed by ml2 plugin# using linuxbridge mechanism driver (boolean value)#enable_vxlan = true
# TTL for vxlan interface protocol packets. (integer value)#ttl = <None>
# TOS for vxlan interface protocol packets. (integer value)#tos = <None>
# Multicast group(s) for vxlan interface. A range of group addresses may be# specified by using CIDR notation. Specifying a range allows different VNIs to# use different group addresses, reducing or eliminating spurious broadcast# traffic to the tunnel endpoints. To reserve a unique group for each possible# (24-bit) VNI, use a /8 such as 239.0.0.0/8. This setting must be the same on# all the agents. (string value)#vxlan_group = 224.0.0.1
# IP address of local overlay (tunnel) network endpoint. Use either an IPv4 or# IPv6 address that resides on one of the host network interfaces. The IP# version of this value must match the value of the 'overlay_ip_version' option# in the ML2 plug-in configuration file on the neutron server node(s). (IP# address value)#local_ip = <None>
# Extension to use alongside ml2 plugin's l2population mechanism driver. It# enables the plugin to populate VXLAN forwarding table. (boolean value)#l2_population = false
# Enable local ARP responder which provides local responses instead of# performing ARP broadcast into the overlay. Enabling local ARP responder is# not fully compatible with the allowed-address-pairs extension. (boolean# value)#arp_responder = false
==================================================配置信息==================================================
[linux_bridge]
physical_interface_mappings = external:eth0 # 在定义的网络名称绑定某张网卡
[vxlan]
enable_vxlan = false
[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
# 配置内核# Linux 操作系统内核支持网桥过滤器
vim /etc/sysctl.conf
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
# 加载模块
modprobe br_netfilter
# 生效内核
sysctl -p
vim /etc/neutron/plugins/ml2/linuxbridge_agent.ini
# 配置文件补全，去其它版本拷贝
[DEFAULT]
## From oslo.log#
# If set to true, the logging level will be set to DEBUG instead of the default# INFO level. (boolean value)# Note: This option can be changed without restarting.#debug = false
# DEPRECATED: If set to false, the logging level will be set to WARNING instead# of the default INFO level. (boolean value)# This option is deprecated for removal.# Its value may be silently ignored in the future.#verbose = true
# The name of a logging configuration file. This file is appended to any# existing logging configuration files. For details about logging configuration# files, see the Python logging module documentation. Note that when logging# configuration files are used then all logging configuration is setin the# configuration file and other logging configuration options are ignored (for# example, logging_context_format_string). (string value)# Note: This option can be changed without restarting.# Deprecated group/name - [DEFAULT]/log_config#log_config_append = <None>
# Defines the format string for %%(asctime)s inlog records. Default:# %(default)s . This option is ignored if log_config_append is set. (string# value)#log_date_format = %Y-%m-%d %H:%M:%S
# (Optional) Name of log file to send logging output to. If no default is set,# logging will go to stderr as defined by use_stderr. This option is ignored if# log_config_append is set. (string value)# Deprecated group/name - [DEFAULT]/logfile#log_file = <None>
# (Optional) The base directory used for relative log_file paths. This option# is ignored if log_config_append is set. (string value)# Deprecated group/name - [DEFAULT]/logdir#log_dir = <None>
# Uses logging handler designed to watch file system. When log file is moved or# removed this handler will open a new log file with specified path# instantaneously. It makes sense only if log_file option is specified and# Linux platform is used. This option is ignored if log_config_append is set.# (boolean value)#watch_log_file = false
# Use syslog for logging. Existing syslog format is DEPRECATED and will be# changed later to honor RFC5424. This option is ignored if log_config_append# is set. (boolean value)#use_syslog = false
# Syslog facility to receive log lines. This option is ignored if# log_config_append is set. (string value)#syslog_log_facility = LOG_USER
# Log output to standard error. This option is ignored if log_config_append is# set. (boolean value)#use_stderr = true
# Format string to use forlog messages with context. (string value)#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s
# Format string to use forlog messages when context is undefined. (string# value)#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s
# Additional data to append to log message when logging level for the message# is DEBUG. (string value)#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d
# Prefix each line of exception output with this format. (string value)#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s
# Defines the format string for %(user_identity)s that is used in# logging_context_format_string. (string value)#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s
# List of package logging levels in logger=LEVEL pairs. This option is ignored# if log_config_append is set. (list value)#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO
# Enables or disables publication of error events. (boolean value)#publish_errors = false
# The format for an instance that is passed with the log message. (string# value)#instance_format = "[instance: %(uuid)s] "
# The format for an instance UUID that is passed with the log message. (string# value)#instance_uuid_format = "[instance: %(uuid)s] "
# Enables or disables fatal status of deprecations. (boolean value)#fatal_deprecations = false
[agent]
## From neutron.ml2.linuxbridge.agent#
# The number of seconds the agent will wait between polling forlocal device# changes. (integer value)#polling_interval = 2
# Set new timeoutin seconds for new rpc calls after agent receives SIGTERM. If# value is set to 0, rpc timeout won't be changed (integer value)#quitting_rpc_timeout = 10
# DEPRECATED: Enable suppression of ARP responses that don't match an IP# address that belongs to the port from which they originate. Note: This# prevents the VMs attached to this agent from spoofing, it doesn't protect# them from other devices which have the capability to spoof (e.g. bare metal# or VMs attached to agents without this flag set to True). Spoofing rules will# not be added to any ports that have port security disabled. For LinuxBridge,# this requires ebtables. For OVS, it requires a version that supports matching# ARP headers. This option will be removed in Ocata so the only way to disable# protection will be via the port security extension. (boolean value)# This option is deprecated for removal.# Its value may be silently ignored in the future.#prevent_arp_spoofing = true
# Extensions list to use (list value)#extensions =
[linux_bridge]
#
# From neutron.ml2.linuxbridge.agent#
# Comma-separated list of <physical_network>:<physical_interface> tuples# mapping physical network names to the agent's node-specific physical network# interfaces to be used for flat and VLAN networks. All physical networks# listed in network_vlan_ranges on the server should have mappings to# appropriate interfaces on each agent. (list value)#physical_interface_mappings =
# List of <physical_network>:<physical_bridge> (list value)#bridge_mappings =
[securitygroup]
## From neutron.ml2.linuxbridge.agent#
# Driver for security groups firewall in the L2 agent (string value)#firewall_driver = <None>
# Controls whether the neutron security group API is enabled in the server. It# should be false when using no security groups or using the nova security# group API. (boolean value)#enable_security_group = true
# Use ipset to speed-up the iptables based security groups. Enabling ipset# support requires that ipset is installed on L2 agent node. (boolean value)#enable_ipset = true
[vxlan]
## From neutron.ml2.linuxbridge.agent#
# Enable VXLAN on the agent. Can be enabled when agent is managed by ml2 plugin# using linuxbridge mechanism driver (boolean value)#enable_vxlan = true
# TTL for vxlan interface protocol packets. (integer value)#ttl = <None>
# TOS for vxlan interface protocol packets. (integer value)#tos = <None>
# Multicast group(s) for vxlan interface. A range of group addresses may be# specified by using CIDR notation. Specifying a range allows different VNIs to# use different group addresses, reducing or eliminating spurious broadcast# traffic to the tunnel endpoints. To reserve a unique group for each possible# (24-bit) VNI, use a /8 such as 239.0.0.0/8. This setting must be the same on# all the agents. (string value)#vxlan_group = 224.0.0.1
# IP address of local overlay (tunnel) network endpoint. Use either an IPv4 or# IPv6 address that resides on one of the host network interfaces. The IP# version of this value must match the value of the 'overlay_ip_version' option# in the ML2 plug-in configuration file on the neutron server node(s). (IP# address value)#local_ip = <None>
# Extension to use alongside ml2 plugin's l2population mechanism driver. It# enables the plugin to populate VXLAN forwarding table. (boolean value)#l2_population = false
# Enable local ARP responder which provides local responses instead of# performing ARP broadcast into the overlay. Enabling local ARP responder is# not fully compatible with the allowed-address-pairs extension. (boolean# value)#arp_responder = false
==================================================配置信息==============================================
[linux_bridge]
physical_interface_mappings = external:eth0
[vxlan]
enable_vxlan = false
[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
# 配置桥接内核
vim /etc/sysctl.conf
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
vim /etc/haproxy/haproxy.cfg
listen openstack-dashboard-80
bind 172.31.7.248:80
mode tcp
server 172.31.7.101 172.31.7.101:80 check inter 3s fall 3 rise 5
tar zcvf openstack-compute-install.tar.gz openstack-compute-install/
# 删除在controller节点上创建neutron的注册信息
neutron agent-list # 可查看ID
neutron agent-delete ID
# 删除在controller节点上创建nova的注册信息
nova service-list # 可查看ID
nova service-delete ID
vim /etc/haproxy/haproxy.cfg
listen openstack-keystone-5000
bind 172.31.7.248:5000
mode tcp
server 172.31.7.101 172.31.7.101:5000 check inter 3s fall 3 rise 5
server 172.31.7.102 172.31.7.102:5000 check inter 3s fall 3 rise 5
systemctl restart haproxy
glance
# 创建数据库，创建账号，同步数据库都不需要操作，已经在openstack里已经注册好了，数据库也初始化好了，能访问即可
# 安装服务
yum install -y openstack-glance
# 配置共享存储
mkdir /var/lib/glance/images
chown -R glance.glance /var/lib/glance/images
vim /etc/fstab
172.31.7.105:/data/glance /var/lib/glance/images nfs defaults,_netdev 0 0
mount -a
# 在controller1节点打包配置文件拷贝过来# controller1
cd /etc/glance
tar zcvf glance-controller1.tar.gz ./*
scp glance-controller1.tar.gz 172.31.7.102:/etc/glance
# 回到controller2
cd /etc/glance
tar zxvf glance-controller1.tar.gz
# 启动自启
systemctl enable openstack-glance-api.service; systemctl start openstack-glance-api.service
ha1
vim /etc/haproxy/haproxy.cfg
listen openstack-glance-9292
bind 172.31.7.248:9292
mode tcp
server 172.31.7.101 172.31.7.101:9292 check inter 3s fall 3 rise 5
server 172.31.7.102 172.31.7.102:9292 check inter 3s fall 3 rise 5
systemctl restart haproxy
placement
# 因为openstack已经注册了账号和端点等信息，不需要配置。数据库已经有，不需要创建和初始化操作
# 安装服务
yum install -y openstack-placement-api
# 打包controller1节点的配置文件# controller1节点
cd /etc/placement/
tar zcvf placement-controller1.tar.gz ./*
scp placement-controller1.tar.gz 172.31.7.102:/etc/placement/
# 回到controller2节点
cd /etc/placement/
tar zxvf placement-controller1.tar.gz
# 检查是否有IP以前值,有则改为本机ip
grep 172 ./* -R
# 解决bug（允许apache大于2.4版本的访问，目前t版已经大于了，如果不写会报错）
vim /etc/httpd/conf.d/00-placement-api.conf # 追加进去
....
<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
Allow from all
</IfVersion>
</Directory>
# 重启服务
systemctl restart httpd
ha1配置反向代理
vim /etc/haproxy/haproxy.cfg
listen openstack-placement-8878
bind 172.31.7.248:8878
mode tcp
server 172.31.7.101 172.31.7.101:8878 check inter 3s fall 3 rise 5
server 172.31.7.102 172.31.7.102:8878 check inter 3s fall 3 rise 5
systemctl restart haproxy
# 到controller2验证
placement-status upgrade check
vim /etc/haproxy/haproxy.cfg
listen openstack-nova-8774
bind 172.31.7.248:8774
mode tcp
server 172.31.7.101 172.31.7.101:8774 check inter 3s fall 3 rise 5
server 172.31.7.102 172.31.7.102:8774 check inter 3s fall 3 rise 5
listen openstack-nova-novncproxy-6080
bind 172.31.7.248:6080
mode tcp
server 172.31.7.101 172.31.7.101:6080 check inter 3s fall 3 rise 5
server 172.31.7.102 172.31.7.102:6080 check inter 3s fall 3 rise 5
systemctl restart haproxy
# 到controller2验证
source admin.openrc.sh
nova service-list
vim /etc/haproxy/haproxy.cfg
listen openstack-neutron-9696
bind 172.31.7.248:9696
mode tcp
server 172.31.7.101 172.31.7.101:9696 check inter 3s fall 3 rise 5
server 172.31.7.102 172.31.7.102:9696 check inter 3s fall 3 rise 5
systemctl reload haproxy
dashboard
# 安装服务
yum install -y openstack-dashboard
# 到controller1节点打包配置文件拷贝# controller1
cd /etc/openstack-dashboard/
tar zcvf openstack-dashboard-controller1.tar.gz ./
scp openstack-dashboard-controller1.tar.gz 172.31.7.102:/etc/openstack-dashboard/
# 回到controller2上解压并配置文件
cd /etc/openstack-dashboard/
tar zxvf openstack-dashboard-controller1.tar.gz
# 查看是否有之前配置信息
grep 172 ./* -R
# 修改配置文件
vim local_settings
'''
ALLOWED_HOSTS = [ '172.31.7.102', 'openstack-vip.ws.local' ]
OPENSTACK_HOST = '172.31.7.102'
# 重启服务
systemctl restart httpd.service
配置反向代理
# dashboard
vim /etc/haproxy/haproxy.cfg
listen openstack-dashboard-80
bind 172.31.7.248:80
mode tcp
server 172.31.7.101 172.31.7.101:80 check inter 3s fall 3 rise 5
server 172.31.7.102 172.31.7.102:80 check inter 3s fall 3 rise 5
vim /etc/haproxy/haproxy.cfg
listen openstack-cinder-8776
bind 172.31.7.248:8776
mode tcp
server 172.31.7.101 172.31.7.101:8776 check inter 3s fall 3 rise 5
server 172.31.7.102 172.31.7.102:8776 check inter 3s fall 3 rise 5
systemctl reload haproxy
【推荐】国内首个AI IDE，深度理解中文开发场景，立即下载体验Trae
【推荐】编程新体验，更懂你的AI，立即体验豆包MarsCode编程助手
【推荐】抖音旗下AI助手豆包，你的智能百科全书，全免费不限次数
【推荐】轻量又高性能的 SSH 工具 IShell：AI 加持，快人一步
· 无需6万激活码！GitHub神秘组织3小时极速复刻Manus，手把手教你使用OpenManus搭建本
· Manus爆火，是硬核还是营销？
· 终于写完轮子一部分：tcp代理 了，记录一下
· 别再用vector＜bool＞了！Google高级工程师：这可能是STL最大的设计失误
· 单元测试从入门到精通