VIII openstack（2）
操作openstack icehouse：
准备：
控制节点：linux-node1.example.com（eth0：10.96.20.118；eth1：192.168.10.118）；
计算节点：linux-node2.example.com（eth0：10.96.20.119；eth1：192.168.10.119）；
两台主机均开启虚拟化功能：IntelVT-x/EPT或AMD-V/RVI
http://mirrors.aliyun.com/repo/Centos-6.repo
http://mirrors.ustc.edu.cn/epel/6/x86_64/epel-release-6-8.noarch.rpm（或http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm）
https://www.rdoproject.org/repos/rdo-release.rpm
https://repos.fedorapeople.org/repos/openstack/
https://repos.fedorapeople.org/repos/openstack/EOL/ #（openstack yum源位置）
[root@linux-node1 ~]# uname -rm
2.6.32-431.el6.x86_64 x86_64
[root@linux-node1 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 6.5(Santiago)
#yum -y install yum-plugin-priorities #（防止高优先级软件被低优先级软件覆盖）
#yum -y install openstack-selinux #（openstack可自动管理SELinux）
关闭iptables；关闭selinux；时间同步；
两个node均操作：
[root@linux-node1 ~]# rpm -ivh http://mirrors.ustc.edu.cn/epel/6/x86_64/epel-release-6-8.noarch.rpm
[root@linux-node1 ~]# wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-6.repo
[root@linux-node1 ~]# vim /etc/yum.repos.d/CentOS-Base.repo
:%s/$releasever/6/g
[root@linux-node1 ~]# yum clean all
[root@linux-node1 ~]# yum makecache
[root@linux-node1 ~]# yum -y install python-pip gcc gcc-c++ make libtool patch auto-make python-devel libxslt-devel MySQL-python openssl-devel libudev-devel libvirt libvirt-python git wget qemu-kvm gedit python-numdisplay python-eventlet device-mapper bridge-utils libffi-devel libffi
[root@linux-node1 ~]# cd /etc/yum.repos.d
[root@linux-node1 yum.repos.d]# yum install -y https://www.rdoproject.org/repos/rdo-release.rpm
[root@linux-node1 yum.repos.d]# vim rdo-release.repo #（此文件是支持最新版本mitaka，改为icehouse版本的地址）
[openstack-icehouse]
name=OpenStack Icehouse Repository
baseurl=https://repos.fedorapeople.org/repos/openstack/EOL/openstack-icehouse/epel-6/
#baseurl=http://mirror.centos.org/centos/7/cloud/$basearch/openstack-mitaka/
gpgcheck=0
enabled=1
#gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Cloud
[root@linux-node1 yum.repos.d]# yum cleanall
[root@linux-node1 yum.repos.d]# yum makecache
（一）
node1控制节点操作（安装基础软件MySQL、rabbitmq）：
生产中MySQL要做集群，除horizon外openstack的其它组件都要连接MySQL，有nova、neutron、cinder、glance、keystone；
除horizon和keystone外，openstack的其它组件都要连接rabbitmq；openstack常用的消息代理软件有：rabbitmq、qpid、zeromq；
[root@linux-node1 ~]# yum -y install mysql-server
[root@linux-node1 ~]# cp /usr/share/mysql/my-large.cnf /etc/my.cnf
cp: overwrite `/etc/my.cnf‘? y
[root@linux-node1 ~]# vim /etc/my.cnf #（innodb_file_per_table每表一个表空间，默认是共享表空间；在zabbix中要用独享表空间，数据量很大，若用共享表空间后续优化很困难）
[mysqld]
default-storage-engine=InnoDB
innodb_file_per_table=1
init_connect=‘SET NAMESutf8‘
default-character-set=utf8
default-collation=utf8_general_ci
[root@linux-node1 ~]# service mysqld start
Starting mysqld: [ OK ]
[root@linux-node1 ~]# chkconfig mysqld on
[root@linux-node1 ~]# chkconfig --listmysqld
mysqld 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@linux-node1 ~]# netstat -tnulp | grep:3306
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 11215/mysqld
[root@linux-node1 ~]# mysqladmin create nova #（分别为要安装的服务授权本地和远程两个账户）
[root@linux-node1 ~]# mysql -e "grant all on nova.* to ‘nova‘@‘localhost‘ identified by ‘nova‘"
[root@linux-node1 ~]# mysql -e "grant all on nova.* to ‘nova‘@‘%‘ identifiedby ‘nova‘"
[root@linux-node1 ~]# mysqladmin create neutron
[root@linux-node1 ~]# mysql -e "grant all on neutron.* to‘neutron‘@‘localhost‘ identified by ‘neutron‘"
[root@linux-node1 ~]# mysql -e "grant all on neutron.* to ‘neutron‘@‘%‘ identified by ‘neutron‘"
[root@linux-node1 ~]# mysqladmin create cinder
[root@linux-node1 ~]# mysql -e "grant all on cinder.* to ‘cinder‘@‘localhost‘ identified by ‘cinder‘"
[root@linux-node1 ~]# mysql -e "grant all on cinder.* to ‘cinder‘@‘%‘ identified by ‘cinder‘"
[root@linux-node1 ~]# mysqladmin create keystone
[root@linux-node1 ~]# mysql -e "grant all on keystone.* to ‘keystone‘@‘localhost‘ identified by ‘keystone‘"
[root@linux-node1 ~]# mysql -e "grant all on keystone.* to ‘keystone‘@‘%‘ identified by ‘keystone‘"
[root@linux-node1 ~]# mysqladmin create glance
[root@linux-node1 ~]# mysql -e "grant all on glance.* to ‘glance‘@‘localhost‘ identified by ‘glance‘"
[root@linux-node1 ~]# mysql -e "grant all on glance.* to ‘glance‘@‘%‘ identified by ‘glance‘"
[root@linux-node1 ~]# mysqladmin flush-privileges
[root@linux-node1 ~]# mysql -e ‘use mysql;select User,Host from user;‘
+----------+-------------------------+
| User | Host |
+----------+-------------------------+
| cinder | % |
| glance | % |
| keystone | % |
| neutron | % |
| nova | % |
| root | 127.0.0.1 |
| | linux-node1.example.com |
| root | linux-node1.example.com |
| | localhost |
| cinder | localhost |
| glance | localhost |
| keystone | localhost |
| neutron | localhost |
| nova | localhost |
| root | localhost |
+----------+-------------------------+
[root@linux-node1 ~]# yum -y install rabbitmq-server
[root@linux-node1 ~]# service rabbitmq-server start
Starting rabbitmq-server: SUCCESS
rabbitmq-server.
[root@linux-node1 ~]# chkconfig rabbitmq-server on
[root@linux-node1 ~]# chkconfig --list rabbitmq-server
rabbitmq-server 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@linux-node1 ~]# /usr/lib/rabbitmq/bin/rabbitmq-plugins list
[ ] amqp_client 3.1.5
[ ] cowboy 0.5.0-rmq3.1.5-git4b93c2d
[ ] eldap 3.1.5-gite309de4
[ ] mochiweb 2.7.0-rmq3.1.5-git680dba8
[ ] rabbitmq_amqp1_0 3.1.5
[ ] rabbitmq_auth_backend_ldap 3.1.5
[ ] rabbitmq_auth_mechanism_ssl 3.1.5
[ ] rabbitmq_consistent_hash_exchange 3.1.5
[ ] rabbitmq_federation 3.1.5
[ ] rabbitmq_federation_management 3.1.5
[ ] rabbitmq_jsonrpc 3.1.5
[ ] rabbitmq_jsonrpc_channel 3.1.5
[ ] rabbitmq_jsonrpc_channel_examples 3.1.5
[ ]rabbitmq_management 3.1.5
[ ] rabbitmq_management_agent 3.1.5
[ ] rabbitmq_management_visualiser 3.1.5
[ ] rabbitmq_mqtt 3.1.5
[ ] rabbitmq_shovel 3.1.5
[ ] rabbitmq_shovel_management 3.1.5
[ ] rabbitmq_stomp 3.1.5
[ ] rabbitmq_tracing 3.1.5
[ ] rabbitmq_web_dispatch 3.1.5
[ ] rabbitmq_web_stomp 3.1.5
[ ] rabbitmq_web_stomp_examples 3.1.5
[ ] rfc4627_jsonrpc 3.1.5-git5e67120
[ ] sockjs 0.3.4-rmq3.1.5-git3132eb9
[ ] webmachine 1.10.3-rmq3.1.5-gite9359c7
[root@linux-node1 ~]# /usr/lib/rabbitmq/bin/rabbitmq-plugins enable rabbitmq_management #（启用web管理）
The following plugins have been enabled:
mochiweb
webmachine
rabbitmq_web_dispatch
amqp_client
rabbitmq_management_agent
rabbitmq_management
Plugin configuration has changed. RestartRabbitMQ for changes to take effect.
[root@linux-node1 ~]# service rabbitmq-server restart
Restarting rabbitmq-server: SUCCESS
rabbitmq-server.
[root@linux-node1 ~]# netstat -tnulp | grep:5672
tcp 0 0 :::5672 :::* LISTEN 11760/beam
[root@linux-node1 ~]# netstat -tnulp | grep5672 #（15672和55672用于web界面，若用55672登录会自动跳转至15672）
tcp 0 0 0.0.0.0:15672 0.0.0.0:* LISTEN 11760/beam
tcp 0 0 0.0.0.0:55672 0.0.0.0:* LISTEN 11760/beam
tcp 0 0 :::5672 :::* LISTEN 11760/beam
http://10.96.20.118:15672/ #（username、password默认均是guest，可通过#rabbitmqctlchange_password guest NEW_PASSWORD更改密码，如果执行修改，同时要修改rabbitmq的配置文件中的rabbit_password，还有openstack各组件服务配置文件中的默认密码；下方HTTP API用于做监控）
（二）
node1控制节点操作（安装配置keystone）：
[root@linux-node1 ~]# yum -y install openstack-keystone python-keystoneclient
[root@linux-node1 ~]# id keystone
uid=163(keystone) gid=163(keystone)groups=163(keystone)
[root@linux-node1 ~]# keystone-manage pki_setup --keystone-user keystone --keystone-group keystone #（常见通用证书的密钥，并限制相关文件的访问权限）
Generating RSA private key, 2048 bit longmodulus
.................................................................................................................+++
.............................................................................................................+++
e is 65537 (0x10001)
Generating RSA private key, 2048 bit longmodulus
...............+++
.....................................................+++
e is 65537 (0x10001)
Using configuration from/etc/keystone/ssl/certs/openssl.conf
Check that the request matches thesignature
Signature ok
The Subject‘s Distinguished Name is asfollows
countryName :PRINTABLE:‘US‘
stateOrProvinceName :ASN.1 12:‘Unset‘
localityName :ASN.1 12:‘Unset‘
organizationName :ASN.1 12:‘Unset‘
commonName :ASN.1 12:‘www.example.com‘
Certificate is to be certified until Sep 2502:29:07 2026 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
[root@linux-node1 ~]# chown -R keystone:keystone /etc/keystone/ssl/
[root@linux-node1 ~]# chmod -R o-rwx /etc/keystone/ssl/
[root@linux-node1 ~]# vim /etc/keystone/keystone.conf #（admin_token为初始管理令牌，生产中admin_token的值要是随机数，#openssl rand -hex 10；connection配置数据库访问；provider配置UUID提供者；driver配置SQL驱动）
[DEFAULT]
admin_token=ADMIN
debug=true
verbose=true
log_file=/var/log/keystone/keystone.log
[database]
connection=mysql://keystone:keystone@localhost/keystone
[token]
provider=keystone.token.providers.uuid.Provider
driver=keystone.token.backends.sql.Token
[root@linux-node1 ~]# keystone-manage db_sync #（建立keystone的表结构，初始化keystone数据库，是用root同步的数据）
[root@linux-node1 ~]# chown -R keystone:keystone /var/log/keystone/ #（同步数据用的是root，日志文件属主要为keystone，否则启动会报错）
[root@linux-node1 ~]# mysql -ukeystone -pkeystone -e ‘use keystone;show tables;‘
+-----------------------+
| Tables_in_keystone |
+-----------------------+
| assignment |
| credential |
| domain |
| endpoint |
| group |
| migrate_version |
| policy |
| project |
| region |
| role |
| service |
| token |
| trust |
| trust_role |
| user |
| user_group_membership |
+-----------------------+
[root@linux-node1 ~]# service openstack-keystone start
Starting keystone: [ OK ]
[root@linux-node1 ~]# chkconfig openstack-keystone on
[root@linux-node1 ~]# chkconfig --list openstack-keystone
openstack-keystone 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@linux-node1 ~]# netstat -tnlp | egrep ‘5000|35357‘ #（35357为keystone的管理port）
tcp 0 0 0.0.0.0:35357 0.0.0.0:* LISTEN 16599/python
tcp 0 0 0.0.0.0:5000 0.0.0.0:* LISTEN 16599/python
[root@linux-node1 ~]# less /var/log/keystone/keystone.log #（public_bind_host为0.0.0.0，admin_bind_host为0.0.0.0，computer_port为8774与nova相关）
[root@linux-node1 ~]# keystone --help
[root@linux-node1 ~]# export OS_SERVICE_TOKEN=ADMIN #（配置初始管理员令牌）
[root@linux-node1 ~]# export OS_SERVICE_ENDPOINT=http://10.96.20.118:35357/v2.0 #（配置端点）
[root@linux-node1 ~]# keystone role-list
+----------------------------------+----------+
| id | name |
+----------------------------------+----------+
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ |
+----------------------------------+----------+
[root@linux-node1 ~]# keystone tenant-create --name admin --description "Admin Tenant" #（创建admin租户）
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | Admin Tenant |
| enabled | True |
| id | d14e4731327047c58a2431e9e2221626 |
| name | admin |
+-------------+----------------------------------+
[root@linux-node1 ~]# keystone user-create --name admin --pass admin --email admin@linux-node1.example.com #（创建admin用户）
+----------+----------------------------------+
| Property | Value |
+----------+----------------------------------+
| email | admin@linux-node1.example.com |
| enabled | True |
| id | 4e907efbf23b42ac8da392d1a201534c|
| name | admin |
| username | admin |
+----------+----------------------------------+
[root@linux-node1 ~]# keystone role-create --name admin #（创建admin角色）
+----------+----------------------------------+
| Property | Value |
+----------+----------------------------------+
| id | f175bdcf962e4ba0a901f9eae1c9b8a1|
| name | admin |
+----------+----------------------------------+
[root@linux-node1 ~]# keystone user-role-add --tenant admin --user admin --role admin #（添加admin用户到admin角色）
[root@linux-node1 ~]# keystone role-create --name _member_
+----------+----------------------------------+
| Property | Value |
+----------+----------------------------------+
| id | 9fe2ff9ee4384b1894a90878d3e92bab |
| name | _member_ |
+----------+----------------------------------+
[root@linux-node1 ~]# keystone user-role-add --tenant admin --user admin --role _member_ #（添加admin租户和用户到_member_角色）
[root@linux-node1 ~]# keystone tenant-create --name demo --description "Demo Tenant" #（创建一个用于演示的demo租户）
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | Demo Tenant |
| enabled | True |
| id | 5ca17bf131f3443c81cf8947a6a2da03 |
| name | demo |
+-------------+----------------------------------+
[root@linux-node1 ~]# keystone user-create --name demo --pass demo --email demo@linux-node1.example.com #（创建demo用户）
+----------+----------------------------------+
| Property | Value |
+----------+----------------------------------+
| email | demo@linux-node1.example.com |
| enabled | True |
| id | 97f5bae389c447bbbe43838470d7427d|
| name | demo |
| username | demo |
+----------+----------------------------------+
[root@linux-node1 ~]# keystone user-role-add --tenant demo --user demo --role admin #（添加demo租户和用户到admin角色）
[root@linux-node1 ~]# keystone user-role-add --tenant demo --user demo --role _member_ #（添加demo租户和用户到_member_角色）
[root@linux-node1 ~]# keystone tenant-create --name service --description "Service Tenant" #（openstack服务也需要一个租户，用户、角色和其它服务进行交互，因此此步创建一个service的租户，任何一个openstack服务都要和它关联）
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | Service Tenant |
| enabled | True |
| id | 06c47e96dbf7429bbff4f93822222ca9 |
| name | service |
+-------------+----------------------------------+
创建服务实体和api端点：
[root@linux-node1 ~]# keystone service-create --name keystone --type identity --description "OpenStack identity" #（创建服务实体）
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | OpenStack identity |
| enabled | True |
| id | 93adbcc42e6145a39ecab110b3eb1942 |
| name | keystone |
| type | identity |
+-------------+----------------------------------+
[root@linux-node1 ~]# keystone endpoint-create --service-id `keystone service-list | awk ‘/identity/{print $2}‘` --publicurl http://10.96.20.118:5000/v2.0 --internalurl http://10.96.20.118:5000/v2.0 --adminurl http://10.96.20.118:35357/v2.0 --region regionOne #（openstack环境中，identity服务-管理目录及服务相关api端点，服务使用这个目录来沟通其它服务，openstack为每个服务提供了三个api端点：admin、internal、public；此步为identity服务创建api端点）
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| adminurl | http://10.96.20.118:35357/v2.0 |
| id |fd14210787ab44d2b61480598b1c1c82 |
| internalurl | http://10.96.20.118:5000/v2.0 |
| publicurl | http://10.96.20.118:5000/v2.0 |
| region | regionOne |
| service_id | 93adbcc42e6145a39ecab110b3eb1942|
+-------------+----------------------------------+
确认以上操作（分别用admin和demo查看令牌、租户列表、用户列表、角色列表）：
[root@linux-node1 ~]# keystone --os-tenant-name admin --os-username admin--os-password admin --os-auth-url http://10.96.20.118:35357/v2.0 token-get #（使用admin租户和用户请求认证令牌）
+-----------+----------------------------------+
| Property | Value |
+-----------+----------------------------------+
| expires | 2016-09-27T10:21:46Z |
| id | cca2d1f0f8244d848eea0cad0cda7f04 |
| tenant_id | d14e4731327047c58a2431e9e2221626 |
| user_id | 4e907efbf23b42ac8da392d1a201534c|
+-----------+----------------------------------+
[root@linux-node1 ~]# keystone --os-tenant-name admin --os-username admin --os-password admin --os-auth-url http://10.96.20.118:35357/v2.0 tenant-list #（以admin租户和用户的身份查看租户列表）
+----------------------------------+---------+---------+
| id | name | enabled |
+----------------------------------+---------+---------+
| d14e4731327047c58a2431e9e2221626 | admin | True |
| 5ca17bf131f3443c81cf8947a6a2da03 | demo | True |
| 06c47e96dbf7429bbff4f93822222ca9 | service | True |
+----------------------------------+---------+---------+
[root@linux-node1 ~]# keystone --os-tenant-name admin --os-username admin --os-password admin --os-auth-url http://10.96.20.118:35357/v2.0 user-list #（以admin租户和用户的身份查看用户列表）
+----------------------------------+-------+---------+-------------------------------+
| id | name | enabled | email |
+----------------------------------+-------+---------+-------------------------------+
| 4e907efbf23b42ac8da392d1a201534c | admin | True | admin@linux-node1.example.com |
| 97f5bae389c447bbbe43838470d7427d| demo | True | demo@linux-node1.example.com |
+----------------------------------+-------+---------+-------------------------------+
[root@linux-node1 ~]# keystone --os-tenant-name admin --os-username admin --os-password admin --os-auth-url http://10.96.20.118:35357/v2.0 role-list #（以admin租户和用户的身份查看角色列表）
+----------------------------------+----------+
| id | name |
+----------------------------------+----------+
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ |
| f175bdcf962e4ba0a901f9eae1c9b8a1| admin |
+----------------------------------+----------+
使用环境变量直接查询相关操作：
[root@linux-node1 ~]# unsetOS_SERVICE_TOKEN OS_SERVICE_ENDPOINT
[root@linux-node1 ~]# vim keystone-admin.sh #（使用环境变量定义，之后用哪个用户查询，source对应文件即可）
exportOS_TENANT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin
exportOS_AUTH_URL=http://10.96.20.118:35357/v2.0
[root@linux-node1 ~]# vim keystone-demo.sh
export OS_TENANT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo
exportOS_AUTH_URL=http://10.96.20.118:35357/v2.0
[root@linux-node1 ~]# source keystone-admin.sh
[root@linux-node1 ~]# keystone token-get
+-----------+----------------------------------+
| Property | Value |
+-----------+----------------------------------+
| expires | 2016-09-27T10:32:05Z |
| id | 465e30389d2f46a2bea3945bbcff157a |
| tenant_id | d14e4731327047c58a2431e9e2221626 |
| user_id | 4e907efbf23b42ac8da392d1a201534c|
+-----------+----------------------------------+
[root@linux-node1 ~]# keystone role-list
+----------------------------------+----------+
| id | name |
+----------------------------------+----------+
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ |
| f175bdcf962e4ba0a901f9eae1c9b8a1| admin |
+----------------------------------+----------+
[root@linux-node1 ~]# source keystone-demo.sh
[root@linux-node1 ~]# keystone user-list
+----------------------------------+-------+---------+-------------------------------+
| id | name | enabled | email |
+----------------------------------+-------+---------+-------------------------------+
| 4e907efbf23b42ac8da392d1a201534c | admin | True | admin@linux-node1.example.com |
| 97f5bae389c447bbbe43838470d7427d| demo | True | demo@linux-node1.example.com |
+----------------------------------+-------+---------+-------------------------------+
（三）
node1控制节点操作（配置安装glance）：
[root@linux-node1 ~]# yum -y install openstack-glance python-glanceclient python-crypto
[root@linux-node1 ~]# vim /etc/glance/glance-api.conf
[DEFAULT]
verbose=True
debug=true
log_file=/var/log/glance/api.log
# ============ Notification System Options=====================
rabbit_host=10.96.20.118
rabbit_port=5672
rabbit_use_ssl=false
rabbit_userid=guest
rabbit_password=guest
rabbit_virtual_host=/
rabbit_notification_exchange=glance
rabbit_notification_topic=notifications
rabbit_durable_queues=False
[database]
connection=mysql://glance:glance@localhost/glance
[keystone_authtoken]
#auth_host=127.0.0.1
auth_host=10.96.20.118
auth_port=35357
auth_protocol=http
#admin_tenant_name=%SERVICE_TENANT_NAME%
admin_tenant_name=service
#admin_user=%SERVICE_USER%
admin_user=glance
#admin_password=%SERVICE_PASSWORD%
admin_password=glance
[paste_deploy]
flavor=keystone
[root@linux-node1 ~]# vim /etc/glance/glance-registry.conf
[DEFAULT]
verbose=True
debug=true
log_file=/var/log/glance/registry.log
[database]
connection=mysql://glance:glance@localhost/glance
[keystone_authtoken]
#auth_host=127.0.0.1
auth_host=10.96.20.118
auth_port=35357
auth_protocol=http
#admin_tenant_name=%SERVICE_TENANT_NAME%
admin_tenant_name=service
#admin_user=%SERVICE_USER%
admin_user=glance
#admin_password=%SERVICE_PASSWORD%
admin_password=glance
[paste_deploy]
flavor=keystone
[root@linux-node1 ~]# glance-manage db_sync
/usr/lib64/python2.6/site-packages/Crypto/Util/number.py:57:PowmInsecureWarning: Not using mpz_powm_sec. You should rebuild using libgmp >= 5 to avoid timing attackvulnerability.
_warn("Not using mpz_powm_sec. You should rebuild using libgmp >= 5 to avoid timing attackvulnerability.", PowmInsecureWarning)
针对上面的报错，解决：
[root@linux-node1 ~]# yum -y groupinstall "Development tools"
[root@linux-node1 ~]# yum -y install gcclibgcc glibc libffi-devel libxml2-devel libxslt-devel openssl-devel zlib-devel bzip2-devel ncurses-devel python-devel
[root@linux-node1 ~]# wget https://ftp.gnu.org/gnu/gmp/gmp-6.0.0a.tar.bz2
[root@linux-node1 ~]# tar xf gmp-6.0.0a.tar.bz2
[root@linux-node1 ~]# cd gmp-6.0.0
[root@linux-node1 gmp-6.0.0]#./configure
[root@linux-node1 gmp-6.0.0]# make && make install
[root@linux-node1 gmp-6.0.0]# cd
[root@linux-node1 ~]# pip uninstall PyCrypto
[root@linux-node1 ~]# wget https://ftp.dlitz.net/pub/dlitz/crypto/pycrypto/pycrypto-2.6.1.tar.gz
[root@linux-node1 ~]# tar xf pycrypto-2.6.1.tar.gz
[root@linux-node1 ~]# cd pycrypto-2.6.1
[root@linux-node1 pycrypto-2.6.1]# ./configure
[root@linux-node1 pycrypto-2.6.1]# python setup.py install
[root@linux-node1 pycrypto-2.6.1]# cd
[root@linux-node1 ~]# mysql -uglance -pglance -e ‘use glance;show tables;‘
+------------------+
| Tables_in_glance |
+------------------+
| image_locations |
| image_members |
| image_properties |
| image_tags |
| images |
| migrate_version |
| task_info |
| tasks |
+------------------+
[root@linux-node1 ~]# source keystone-admin.sh
[root@linux-node1 ~]# keystone user-create --name glance --pass glance --email glance@linux-node1.example.com
+----------+----------------------------------+
| Property | Value |
+----------+----------------------------------+
| email | glance@linux-node1.example.com |
| enabled | True |
| id | b3d70ee1067a44f4913f9b6000535b26|
| name | glance |
| username | glance |
+----------+----------------------------------+
[root@linux-node1 ~]# keystone user-role-add --user glance --tenant service --role admin
[root@linux-node1 ~]# keystone service-create --name glance --type image --description "OpenStack image Service"
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | OpenStack image Service |
| enabled | True |
| id | 7f2db750a630474b82740dacb55e70b3|
| name | glance |
| type | image |
+-------------+----------------------------------+
[root@linux-node1 ~]# keystone endpoint-create --service-id `keystone service-list | awk ‘/image/{print $2}‘` --publicurl http://10.96.20.118:9292 --internalurl http://10.96.20.118:9292 --adminurl http://10.96.20.118:9292 --region regionOne
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| adminurl | http://10.96.20.118:9292 |
| id | 9815501af47f464db00cfb2eb30c649d |
| internalurl | http://10.96.20.118:9292 |
| publicurl | http://10.96.20.118:9292 |
| region | regionOne |
| service_id | 7f2db750a630474b82740dacb55e70b3 |
+-------------+----------------------------------+
[root@linux-node1 ~]# keystone service-list
+----------------------------------+----------+----------+-------------------------+
| id | name | type | description |
+----------------------------------+----------+----------+-------------------------+
| 7f2db750a630474b82740dacb55e70b3 | glance | image | OpenStack image Service |
| 93adbcc42e6145a39ecab110b3eb1942 | keystone | identity | OpenStack identity |
+----------------------------------+----------+----------+-------------------------+
[root@linux-node1 ~]# keystone endpoint-list
+----------------------------------+-----------+-------------------------------+-------------------------------+--------------------------------+----------------------------------+
| id | region | publicurl | internalurl | adminurl | service_id |
+----------------------------------+-----------+-------------------------------+-------------------------------+--------------------------------+----------------------------------+
| 9815501af47f464db00cfb2eb30c649d | regionOne | http://10.96.20.118:9292 | http://10.96.20.118:9292 | http://10.96.20.118:9292 | 7f2db750a630474b82740dacb55e70b3 |
| fd14210787ab44d2b61480598b1c1c82| regionOne | http://10.96.20.118:5000/v2.0 | http://10.96.20.118:5000/v2.0 |http://10.96.20.118:35357/v2.0 | 93adbcc42e6145a39ecab110b3eb1942 |
+----------------------------------+-----------+-------------------------------+-------------------------------+--------------------------------+----------------------------------+
[root@linux-node1 ~]# id glance
uid=161(glance) gid=161(glance)groups=161(glance)
[root@linux-node1 ~]# chown -R glance:glance /var/log/glance/*
[root@linux-node1 ~]# service openstack-glance-api start
Starting openstack-glance-api: [FAILED]
启动失败，查看日志得知ImportError:/usr/lib64/python2.6/site-packages/Crypto/Cipher/_AES.so: undefined symbol:rpl_malloc，解决办法：
[root@linux-node1 ~]# cd pycrypto-2.6.1
[root@linux-node1pycrypto-2.6.1]# exportac_cv_func_malloc_0_nonnull=yes
[root@linux-node1pycrypto-2.6.1]# easy_install -U PyCrypto
[root@linux-node1 ~]# service openstack-glance-api start
Starting openstack-glance-api: [ OK ]
[root@linux-node1 ~]# service openstack-glance-registry start
Starting openstack-glance-registry: [ OK ]
[root@linux-node1 ~]# chkconfig openstack-glance-api on
[root@linux-node1 ~]# chkconfig openstack-glance-registry on
[root@linux-node1 ~]# chkconfig --list openstack-glance-api
openstack-glance-api 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@linux-node1 ~]# chkconfig --list openstack-glance-registry
openstack-glance-registry 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@linux-node1 ~]# netstat -tnlp | egrep "9191|9292" #（openstack-glance-api9292；openstack-glance-registry9191）
tcp 0 0 0.0.0.0:9292 0.0.0.0:* LISTEN 50030/python
tcp 0 0 0.0.0.0:9191 0.0.0.0:* LISTEN 50096/python
http://download.cirros-cloud.net/0.3.4/cirros-0.3.4-x86_64-disk.img #（下载镜像文件，cirros是一个小linux镜像，用它来验证镜像服务是否安装成功）
[root@linux-node1 ~]# ll cirros-0.3.4-x86_64-disk.img-h
-rw-r--r--. 1 root root 13M Sep 28 00:58 cirros-0.3.4-x86_64-disk.img
[root@linux-node1 ~]# glance image-create --name "cirros-0.3.4-x86_64" --disk-format qcow2 --container-format bare --is-public True --file /root/cirros-0.3.4-x86_64-disk.img --progress #（--name指定镜像名称；--disk-format镜像的磁盘格式，支持ami|ari|aki|vhd|vmdk|raw|qcow2|vdi|iso；--container-format镜像容器格式，支持ami|ari|aki|bare|ovf；--is-public镜像是否可以被公共访问；--file指定上传文件的位置；--progress显示上传进度）
[=============================>] 100%
+------------------+--------------------------------------+
| Property | Value |
+------------------+--------------------------------------+
| checksum | ee1eca47dc88f4879d8a229cc70a07c6 |
| container_format | bare |
| created_at | 2016-09-28T08:10:19 |
| deleted | False |
| deleted_at |None |
| disk_format | qcow2 |
| id | 22434c1b-f25f-4ee4-bead-dc19c055d763 |
| is_public | True |
| min_disk | 0 |
| min_ram | 0 |
| name | cirros-0.3.4-x86_64 |
| owner | d14e4731327047c58a2431e9e2221626 |
| protected | False |
| size | 13287936 |
| status | active |
| updated_at | 2016-09-28T08:10:19 |
| virtual_size | None |
+------------------+--------------------------------------+
[root@linux-node1 ~]# glance image-list
+--------------------------------------+---------------------+-------------+------------------+----------+--------+
| ID | Name | Disk Format | ContainerFormat | Size | Status |
+--------------------------------------+---------------------+-------------+------------------+----------+--------+
| 22434c1b-f25f-4ee4-bead-dc19c055d763 | cirros-0.3.4-x86_64| qcow2 | bare | 13287936 | active |
+--------------------------------------+---------------------+-------------+------------------+----------+--------+
（四）
node1控制节点操作如下（安装配置nova）：
[root@linux-node1 ~]# yum -y install openstack-nova-api openstack-nova-cert openstack-nova-conductor openstack-nova-console openstack-nova-novncproxy openstack-nova-scheduler python-novaclient
[root@linux-node1 ~]# vim /etc/nova/nova.conf
#---------------------file start----------------
[DEFAULT]
rabbit_host=10.96.20.118
rabbit_port=5672
rabbit_use_ssl=false
rabbit_userid=guest
rabbit_password=guest
rpc_backend=rabbit
auth_strategy=keystone
novncproxy_base_url=http://10.96.20.118:6080/vnc_auto.html
vncserver_listen=0.0.0.0
vncserver_proxyclient_address=10.96.20.118
vnc_enabled=true
vnc_keymap=en-us
my_ip=10.96.20.118
glance_host=$my_ip
glance_port=9292
lock_path=/var/lib/nova/tmp
state_path=/var/lib/nova
instances_path=$state_path/instances
compute_driver=libvirt.LibvirtDriver
verbose=true
[keystone_authtoken]
auth_host=10.96.20.118
auth_port=35357
auth_protocol=http
auth_uri=http://10.96.20.118:5000
auth_version=v2.0
admin_user=nova
admin_password=nova
admin_tenant_name=service
[database]
connection=mysql://nova:nova@localhost/nova
#---------------------file end---------------
[root@linux-node1 ~]# nova-manage db sync
[root@linux-node1 ~]# mysql -unova -pnova -hlocalhost -e ‘use nova;show tables;‘
+--------------------------------------------+
| Tables_in_nova |
+--------------------------------------------+
| agent_builds |
| aggregate_hosts |
| aggregate_metadata |
| aggregates |
| block_device_mapping |
| bw_usage_cache |
| cells |
| certificates |
| compute_nodes |
| console_pools |
| consoles |
| dns_domains |
| fixed_ips |
| floating_ips |
| instance_actions |
| instance_actions_events |
| instance_faults |
| instance_group_member |
| instance_group_metadata |
| instance_group_policy |
| instance_groups |
| instance_id_mappings |
| instance_info_caches |
| instance_metadata |
| instance_system_metadata |
| instance_type_extra_specs |
| instance_type_projects |
| instance_types |
| instances |
| iscsi_targets |
| key_pairs |
| migrate_version |
| migrations |
| networks |
| pci_devices |
| project_user_quotas |
| provider_fw_rules |
| quota_classes |
| quota_usages |
| quotas |
| reservations |
| s3_images |
| security_group_default_rules |
| security_group_instance_association |
| security_group_rules |
| security_groups |
| services |
| shadow_agent_builds |
| shadow_aggregate_hosts |
| shadow_aggregate_metadata |
| shadow_aggregates |
| shadow_block_device_mapping |
| shadow_bw_usage_cache |
| shadow_cells |
| shadow_certificates |
| shadow_compute_nodes |
| shadow_console_pools |
| shadow_consoles |
| shadow_dns_domains |
| shadow_fixed_ips |
| shadow_floating_ips |
| shadow_instance_actions |
| shadow_instance_actions_events |
| shadow_instance_faults |
| shadow_instance_group_member |
| shadow_instance_group_metadata |
| shadow_instance_group_policy |
| shadow_instance_groups |
| shadow_instance_id_mappings |
| shadow_instance_info_caches |
| shadow_instance_metadata |
| shadow_instance_system_metadata |
| shadow_instance_type_extra_specs |
| shadow_instance_type_projects |
| shadow_instance_types |
| shadow_instances |
| shadow_iscsi_targets |
| shadow_key_pairs |
| shadow_migrate_version |
| shadow_migrations |
| shadow_networks |
| shadow_pci_devices |
| shadow_project_user_quotas |
| shadow_provider_fw_rules |
| shadow_quota_classes |
| shadow_quota_usages |
| shadow_quotas |
| shadow_reservations |
| shadow_s3_images |
| shadow_security_group_default_rules |
|shadow_security_group_instance_association |
| shadow_security_group_rules |
| shadow_security_groups |
| shadow_services |
| shadow_snapshot_id_mappings |
| shadow_snapshots |
| shadow_task_log |
| shadow_virtual_interfaces |
| shadow_volume_id_mappings |
| shadow_volume_usage_cache |
| shadow_volumes |
| snapshot_id_mappings |
| snapshots |
| task_log |
| virtual_interfaces |
| volume_id_mappings |
| volume_usage_cache |
| volumes |
+--------------------------------------------+
[root@linux-node1 ~]# source keystone-admin.sh
[root@linux-node1 ~]# keystone user-create --name nova --pass nova --email nova@linux-node1.example.com
+----------+----------------------------------+
| Property | Value |
+----------+----------------------------------+
| email | nova@linux-node1.example.com |
| enabled | True |
| id | f21848326192439fa7482a78a4cf9203 |
| name | nova |
| username | nova |
+----------+----------------------------------+
[root@linux-node1 ~]# keystone user-role-add --user nova --tenant service --role admin
[root@linux-node1 ~]# keystone service-create --name nova --type compute --description "OpenStack Compute"
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | OpenStack Compute |
| enabled | True |
| id | 484cf61f5c2b464eb61407b6ef394046|
| name | nova |
| type | compute |
+-------------+----------------------------------+
[root@linux-node1 ~]# keystone endpoint-create --service-id `keystone service-list | awk ‘/compute/{print $2}‘` --publicurl http://10.96.20.118:8774/v2/%\(tenant_id\)s --internalurl http://10.96.20.118:8774/v2/%\(tenant_id\)s --adminurl http://10.96.20.118:8774/v2/%\(tenant_id\)s --region regionOne
+-------------+-------------------------------------------+
| Property | Value |
+-------------+-------------------------------------------+
| adminurl |http://10.96.20.118:8774/v2/%(tenant_id)s |
| id | fab29981641741a3a4ab4767d9868722 |
| internalurl | http://10.96.20.118:8774/v2/%(tenant_id)s|
| publicurl |http://10.96.20.118:8774/v2/%(tenant_id)s |
| region | regionOne |
| service_id | 484cf61f5c2b464eb61407b6ef394046 |
+-------------+-------------------------------------------+
[root@linux-node1 ~]# for i in {api,cert,conductor,consoleauth,novncproxy,scheduler} ; do service openstack-nova-$i start ; done
Starting openstack-nova-api: [ OK ]
Starting openstack-nova-cert: [ OK ]
Starting openstack-nova-conductor: [ OK ]
Starting openstack-nova-consoleauth: [ OK ]
Starting openstack-nova-novncproxy: [ OK ]
Starting openstack-nova-scheduler: [ OK ]
[root@linux-node1 ~]# for i in {api,cert,conductor,consoleauth,novncproxy,scheduler} ; do chkconfig openstack-nova-$i on ; chkconfig
--list openstack-nova-$i; done
openstack-nova-api 0:off 1:off 2:on 3:on 4:on 5:on 6:off
openstack-nova-cert 0:off 1:off 2:on 3:on 4:on 5:on 6:off
openstack-nova-conductor 0:off 1:off 2:on 3:on 4:on 5:on 6:off
openstack-nova-consoleauth 0:off 1:off 2:on 3:on 4:on 5:on 6:off
openstack-nova-novncproxy 0:off 1:off 2:on 3:on 4:on 5:on 6:off
openstack-nova-scheduler 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@linux-node1 ~]# nova host-list #（service有4个，cert、consoleauth、conductor、scheduler）
+-------------------------+-------------+----------+
| host_name | service | zone |
+-------------------------+-------------+----------+
| linux-node1.example.com | conductor | internal |
| linux-node1.example.com | consoleauth |internal |
| linux-node1.example.com | cert | internal |
| linux-node1.example.com | scheduler | internal |
+-------------------------+-------------+----------+
[root@linux-node1 ~]# nova service-list
+------------------+-------------------------+----------+---------+-------+----------------------------+-----------------+
| Binary | Host | Zone | Status | State | Updated_at | Disabled Reason |
+------------------+-------------------------+----------+---------+-------+----------------------------+-----------------+
| nova-conductor | linux-node1.example.com | internal |enabled | up | 2016-09-29T08:32:36.000000| - |
| nova-consoleauth |linux-node1.example.com | internal | enabled | up | 2016-09-29T08:32:35.000000| - |
| nova-cert | linux-node1.example.com | internal |enabled | up | 2016-09-29T08:32:37.000000| - |
| nova-scheduler | linux-node1.example.com | internal |enabled | up | 2016-09-29T08:32:29.000000| - |
+------------------+-------------------------+----------+---------+-------+----------------------------+-----------------+
node2在计算节点操作：
[root@linux-node2 ~]# egrep --color ‘vmx|svm‘ /proc/cpuinfo #（若硬件不支持虚拟化virt_type=qemu；若硬件支持虚拟化virt_type=kvm）
flags :fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflushdts mmx fxsr sse sse2 ss syscall nx pdpe1gb rdtscp lm constant_tsc uparch_perfmon pebs bts xtopology tsc_reliable nonstop_tsc aperfmperfunfair_spinlock pni pclmulqdq vmx ssse3 fma cx16pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm ida aratxsaveopt pln pts dts tpr_shadow vnmi ept vpid fsgsbase bmi1 avx2 smep bmi2invpcid
[root@linux-node2 ~]# yum -y install openstack-nova-compute python-novaclient libvirt qemu-kvm virt-manager
[root@linux-node2 ~]# scp 10.96.20.118:/etc/nova/nova.conf /etc/nova/ #（从控制节点拷至计算节点）
root@10.96.20.118‘s password:
nova.conf 100% 97KB 97.1KB/s 00:00
[root@linux-node2 ~]# vim /etc/nova/nova.conf #（使用salt自动部署时，vncserver_proxyclient_address此处用janjia模板）
vncserver_proxyclient_address=10.96.20.119
[root@linux-node2 ~]# service libvirtdstart
Starting libvirtd daemon: libvirtd:relocation error: libvirtd: symbol dm_task_get_info_with_deferred_remove, version Base not defined in file libdevmapper.so.1.02 withlink time reference
[FAILED]
[root@linux-node2 ~]# yum -y install device-mapper
[root@linux-node2 ~]# service libvirtd start
Starting libvirtd daemon: [ OK ]
[root@linux-node2 ~]# service messagebus start
Starting system message bus: [ OK ]
[root@linux-node2 ~]# service openstack-nova-compute start
Starting openstack-nova-compute: [ OK ]
[root@linux-node2 ~]# chkconfig libvirtd on
[root@linux-node2 ~]# chkconfig messagebus on
[root@linux-node2 ~]# chkconfig openstack-nova-compute on
[root@linux-node2 ~]# chkconfig --list libvirtd
libvirtd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@linux-node2 ~]# chkconfig --list messagebus
messagebus 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@linux-node2 ~]# chkconfig --list openstack-nova-compute
openstack-nova-compute 0:off 1:off 2:on 3:on 4:on 5:on 6:off
在node1上再次查看：
[root@linux-node1 ~]# source keystone-admin.sh
[root@linux-node1 ~]# nova host-list
+-------------------------+-------------+----------+
| host_name | service | zone |
+-------------------------+-------------+----------+
| linux-node1.example.com | conductor | internal |
| linux-node1.example.com | consoleauth |internal |
| linux-node1.example.com | cert | internal |
| linux-node1.example.com | scheduler | internal |
| linux-node2.example.com| compute | nova |
+-------------------------+-------------+----------+
[root@linux-node1 ~]# nova service-list
+------------------+-------------------------+----------+---------+-------+----------------------------+-----------------+
| Binary | Host | Zone | Status | State | Updated_at | Disabled Reason |
+------------------+-------------------------+----------+---------+-------+----------------------------+-----------------+
| nova-conductor | linux-node1.example.com | internal |enabled | up | 2016-09-29T08:45:06.000000| - |
| nova-consoleauth |linux-node1.example.com | internal | enabled | up | 2016-09-29T08:45:05.000000| - |
| nova-cert | linux-node1.example.com | internal |enabled | up | 2016-09-29T08:45:07.000000| - |
| nova-scheduler | linux-node1.example.com | internal |enabled | up | 2016-09-29T08:45:10.000000| - |
| nova-compute | linux-node2.example.com | nova | enabled | up | 2016-09-29T08:45:07.000000| - |
+------------------+-------------------------+----------+---------+-------+----------------------------+-----------------+
（五）neutron在控制节点和计算节点都要安装
node1控制节点上操作：
[root@linux-node1 ~]# yum -y install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge python-neutronclient
[root@linux-node1 ~]# vim /etc/neutron/neutron.conf
#-----------------file start----------------
[DEFAULT]
verbose = True
debug = True
state_path = /var/lib/neutron
lock_path = $state_path/lock
core_plugin = ml2
service_plugins = router,firewall,lbaas
api_paste_config =/usr/share/neutron/api-paste.ini
auth_strategy = keystone
rabbit_host = 10.96.20.118
rabbit_password = guest
rabbit_port = 5672
rabbit_userid = guest
rabbit_virtual_host = /
notify_nova_on_port_status_changes = True
notify_nova_on_port_data_changes = True
nova_url = http://10.96.20.118:8774/v2
nova_admin_username = nova
nova_admin_tenant_id = 06c47e96dbf7429bbff4f93822222ca9
nova_admin_password = nova
nova_admin_auth_url =http://10.96.20.118:35357/v2.0
[agent]
root_helper = sudo neutron-rootwrap/etc/neutron/rootwrap.conf
[keystone_authtoken]
# auth_host = 127.0.0.1
auth_host = 10.96.20.118
auth_port = 35357
auth_protocol = http
# admin_tenant_name = %SERVICE_TENANT_NAME%
admin_tenant_name = service
# admin_user = %SERVICE_USER%
admin_user = neutron
# admin_password = %SERVICE_PASSWORD%
admin_password = neutron
[database]
connection =mysql://neutron:neutron@localhost:3306/neutron
[service_providers]
service_provider=LOADBALANCER:Haproxy:neutron.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
service_provider=VPN:openswan:neutron.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
#--------------------file end------------------------
[root@linux-node1 ~]# vim /etc/neutron/plugins/ml2/ml2_conf.ini
[ml2]
type_drivers = flat,vlan,gre,vxlan
tenant_network_types = flat,vlan,gre,vxlan
mechanism_drivers = linuxbridge,openvswitch
[ml2_type_flat]
flat_networks = physnet1
[securitygroup]
enable_security_group = True
[root@linux-node1 ~]# vim /etc/neutron/plugins/linuxbridge/linuxbridge_conf.ini
[vlans]
network_vlan_ranges = physnet1
[linux_bridge]
physical_interface_mappings = physnet1:eth0
[securitygroup]
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
enable_security_group = True
[root@linux-node1 ~]# vim /etc/nova/nova.conf #（在nova中配置neutron）
[DEFAULT]
neutron_url=http://10.96.20.118:9696
neutron_admin_username=neutron
neutron_admin_password=neutron
neutron_admin_tenant_id=06c47e96dbf7429bbff4f93822222ca9
neutron_admin_tenant_name=service
neutron_admin_auth_url=http://10.96.20.118:5000/v2.0
neutron_auth_strategy=keystone
network_api_class=nova.network.neutronv2.api.API
linuxnet_interface_driver=nova.network.linux_net.LinuxBridgeInterfaceDriver
security_group_api=neutron
firewall_driver=nova.virt.firewall.NoopFirewallDriver
vif_driver=nova.virt.libvirt.vif.NeutronLinuxBridgeVIFDriver
[root@linux-node1 ~]# for i in {api,conductor,scheduler} ; do service openstack-nova-$i restart ; done
Stopping openstack-nova-api: [ OK ]
Starting openstack-nova-api: [ OK ]
Stopping openstack-nova-conductor: [ OK ]
Starting openstack-nova-conductor: [ OK ]
Stopping openstack-nova-scheduler: [ OK ]
Starting openstack-nova-scheduler: [ OK ]
[root@linux-node1 ~]# keystone user-create --name neutron --pass neutron --email neutron@linux-node1.example.com
+----------+----------------------------------+
| Property | Value |
+----------+----------------------------------+
| email | neutron@linux-node1.example.com |
| enabled | True |
| id | b4ece50c887848b4a1d7ff54c799fd4d|
| name | neutron |
| username | neutron |
+----------+----------------------------------+
[root@linux-node1 ~]# keystone user-role-add --user neutron --tenant service --role admin
[root@linux-node1 ~]# keystone service-create --name neutron --type network --description "OpenStack Networking"
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | OpenStack Networking |
| enabled | True |
| id |e967e7b3589647e68e26cabd587ebef4 |
| name | neutron |
| type | network |
+-------------+----------------------------------+
[root@linux-node1 ~]# keystone endpoint-create --service-id `keystone service-list | awk ‘/network/{print $2}‘` --publicurl http://10.96.20.118:9696 --internalurl http://10.96.20.118:9696 --adminurl http://10.96.20.118:9696 --region regionOne
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| adminurl | http://10.96.20.118:9696 |
| id |b16b9392d8344fd5bbe01cc83be954d8 |
| internalurl | http://10.96.20.118:9696 |
| publicurl | http://10.96.20.118:9696 |
| region | regionOne |
| service_id | e967e7b3589647e68e26cabd587ebef4 |
+-------------+----------------------------------+
[root@linux-node1 ~]# keystone service-list
+----------------------------------+----------+----------+-------------------------+
| id | name | type | description |
+----------------------------------+----------+----------+-------------------------+
| 7f2db750a630474b82740dacb55e70b3 | glance | image | OpenStack image Service |
| 93adbcc42e6145a39ecab110b3eb1942 | keystone | identity | OpenStack identity |
| e967e7b3589647e68e26cabd587ebef4 |neutron | network | OpenStack Networking |
| 484cf61f5c2b464eb61407b6ef394046| nova | compute | OpenStack Compute |
+----------------------------------+----------+----------+-------------------------+
[root@linux-node1 ~]# keystone endpoint-list
+----------------------------------+-----------+-------------------------------------------+-------------------------------------------+-------------------------------------------+----------------------------------+
| id | region | publicurl | internalurl | adminurl | service_id |
+----------------------------------+-----------+-------------------------------------------+-------------------------------------------+-------------------------------------------+----------------------------------+
| 9815501af47f464db00cfb2eb30c649d | regionOne | http://10.96.20.118:9292 | http://10.96.20.118:9292 | http://10.96.20.118:9292 | 7f2db750a630474b82740dacb55e70b3|
| b16b9392d8344fd5bbe01cc83be954d8 |regionOne | http://10.96.20.118:9696 | http://10.96.20.118:9696 | http://10.96.20.118:9696 |e967e7b3589647e68e26cabd587ebef4 |
| fab29981641741a3a4ab4767d9868722 | regionOne | http://10.96.20.118:8774/v2/%(tenant_id)s| http://10.96.20.118:8774/v2/%(tenant_id)s |http://10.96.20.118:8774/v2/%(tenant_id)s | 484cf61f5c2b464eb61407b6ef394046|
| fd14210787ab44d2b61480598b1c1c82| regionOne | http://10.96.20.118:5000/v2.0 | http://10.96.20.118:5000/v2.0 | http://10.96.20.118:35357/v2.0 | 93adbcc42e6145a39ecab110b3eb1942|
+----------------------------------+-----------+-------------------------------------------+-------------------------------------------+-------------------------------------------+----------------------------------+
[root@linux-node1 ~]# neutron-server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --config-file /etc/neutron/plugins/linuxbridge/linuxbridge_conf.ini #（在前台启动）
……
2016-09-29 23:09:37.035 69080 DEBUGneutron.service [-]********************************************************************************log_opt_values /usr/lib/python2.6/site-packages/oslo/config/cfg.py:1955
2016-09-29 23:09:37.035 69080 INFOneutron.service [-] Neutron service started, listeningon 0.0.0.0:9696
2016-09-29 23:09:37.044 69080 INFOneutron.openstack.common.rpc.common [-] Connected to AMQP server on10.96.20.118:5672
2016-09-29 23:09:37.046 69080 INFOneutron.wsgi [-] (69080) wsgi starting up on http://0.0.0.0:9696/
[root@linux-node1 ~]# vim /etc/init.d/neutron-server #（修改脚本配置文件位置，注意config中定义的内容，不能有多余空格）
configs=(
"/etc/neutron/neutron.conf" \
"/etc/neutron/plugins/ml2/ml2_conf.ini" \
"/etc/neutron/plugins/linuxbridge/linuxbridge_conf.ini" \
)
[root@linux-node1 ~]# service neutron-server start #（控制节点启动两个：neutron-server和neutron-linuxbridge-agent；计算节点仅启动neutron-linuxbridge-agent）
Starting neutron: [ OK ]
[root@linux-node1 ~]# service neutron-linuxbridge-agent start
Starting neutron-linuxbridge-agent: [ OK ]
[root@linux-node1 ~]# chkconfig neutron-server on
[root@linux-node1 ~]# chkconfig neutron-linuxbridge-agent on
[root@linux-node1 ~]# chkconfig --list neutron-server
neutron-server 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@linux-node1 ~]# chkconfig --list neutron-linuxbridge-agent
neutron-linuxbridge-agent 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@linux-node1 ~]# netstat -tnlp | grep:9696
tcp 0 0 0.0.0.0:9696 0.0.0.0:* LISTEN 69154/python
[root@linux-node1 ~]# . keystone-admin.sh
[root@linux-node1 ~]# neutron ext-list #（列出加载的扩展模块，确认成功启动neutron-server）
+-----------------------+-----------------------------------------------+
| alias | name |
+-----------------------+-----------------------------------------------+
| service-type | Neutron Service TypeManagement |
| ext-gw-mode | Neutron L3 Configurable externalgateway mode |
| security-group | security-group |
| l3_agent_scheduler | L3 Agent Scheduler |
| lbaas_agent_scheduler | LoadbalancerAgent Scheduler |
| fwaas | Firewall service |
| binding | Port Binding |
| provider | Provider Network |
| agent | agent |
| quotas | Quota management support |
| dhcp_agent_scheduler | DHCP Agent Scheduler |
| multi-provider | Multi Provider Network |
| external-net | Neutron external network |
| router | Neutron L3 Router |
| allowed-address-pairs | Allowed AddressPairs |
| extra_dhcp_opt | Neutron Extra DHCP opts |
| lbaas | LoadBalancing service |
| extraroute | Neutron Extra Route |
+-----------------------+-----------------------------------------------+
[root@linux-node1 ~]# neutron agent-list #（待计算节点成功启动后，才有）
+--------------------------------------+--------------------+-------------------------+-------+----------------+
| id |agent_type | host | alive | admin_state_up |
+--------------------------------------+--------------------+-------------------------+-------+----------------+
| 1283a47d-4d1b-4403-9d0e-241da803762b | Linux bridgeagent | linux-node1.example.com | :-) |True |
+--------------------------------------+--------------------+-------------------------+-------+----------------+
node2计算节点操作：
[root@linux-node2 ~]# vim /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter= 1
net.ipv4.conf.all.rp_filter= 1
[root@linux-node2 ~]# sysctl -p
[root@linux-node2 ~]# yum -y install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge python-neutronclient #（与控制节点安装一样）
[root@linux-node2 ~]# scp 10.96.20.118:/etc/neutron/neutron.conf /etc/neutron/
root@10.96.20.118‘s password:
neutron.conf 100% 18KB 18.1KB/s 00:00
[root@linux-node2 ~]# scp 10.96.20.118:/etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugins/ml2/
root@10.96.20.118‘s password:
ml2_conf.ini 100% 2447 2.4KB/s 00:00
[root@linux-node2 ~]# scp 10.96.20.118:/etc/neutron/plugins/linuxbridge/linuxbridge_conf.ini /etc/neutron/plugins/linuxbridge/
root@10.96.20.118‘s password:
linuxbridge_conf.ini 100%3238 3.2KB/s 00:00
[root@linux-node2 ~]# scp 10.96.20.118:/etc/init.d/neutron-server /etc/init.d/
root@10.96.20.118‘s password:
neutron-server 100%1861 1.8KB/s 00:00
[root@linux-node2 ~]# scp 10.96.20.118:/etc/init.d/neutron-linuxbridge-agent /etc/init.d/
root@10.96.20.118‘s password:
neutron-linuxbridge-agent 100%1824 1.8KB/s 00:00
[root@linux-node2 ~]# service neutron-linuxbridge-agent start #（计算节点只启动neutron-linuxbridge-agent）
Starting neutron-linuxbridge-agent: [ OK ]
[root@linux-node2 ~]# chkconfig neutron-linuxbridge-agent on
[root@linux-node2 ~]# chkconfig --listneutron-linuxbridge-agent
neutron-linuxbridge-agent 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@linux-node1 ~]# neutron agent-list #（在控制节点上查看）
+--------------------------------------+--------------------+-------------------------+-------+----------------+
| id |agent_type | host | alive | admin_state_up |
+--------------------------------------+--------------------+-------------------------+-------+----------------+
| 1283a47d-4d1b-4403-9d0e-241da803762b | Linuxbridge agent | linux-node1.example.com | :-) | True |
|8d061358-ddfa-4979-bf2e-5d8c1c7a7f65 | Linux bridge agent |linux-node2.example.com | :-) |True |
+--------------------------------------+--------------------+-------------------------+-------+----------------+
（六）配置安装horizon（openstack-dashboard）
在node1控制节点上操作：
[root@linux-node1 ~]# yum -y install openstack-dashboard httpd mod_wsgi memcached python-memcached
[root@linux-node1 ~]# vim /etc/openstack-dashboard/local_settings #（第15行ALLOWED_HOSTS；启用第98-103行CACHES=；第128行OPENSTACK_HOST=）
ALLOWED_HOSTS = [‘horizon.example.com‘,‘localhost‘, ‘10.96.20.118‘]
CACHES = {
‘default‘: {
‘BACKEND‘ : ‘django.core.cache.backends.memcached.MemcachedCache‘,
‘LOCATION‘ : ‘127.0.0.1:11211‘,
}
}
OPENSTACK_HOST = "10.96.20.118"
[root@linux-node1 ~]# scp /etc/nova/nova.conf 10.96.20.119:/etc/nova/
root@10.96.20.119‘s password:
nova.conf 100% 98KB 97.6KB/s 00:00
在node2计算节点操作如下：
[root@linux-node2 ~]# vim /etc/nova/nova.conf #（在计算节点更改vncserver_proxyclient_address为本地ip）
vncserver_proxyclient_address=10.96.20.119
[root@linux-node2 ~]# ps aux | egrep "nova-compute|neutron-linuxbridge-agent" | grep -v grep
neutron 27827 0.0 2.9 268448 29600 ? S Sep29 0:00 /usr/bin/python /usr/bin/neutron-linuxbridge-agent --log-file/var/log/neutron/linuxbridge-agent.log --config-file/usr/share/neutron/neutron-dist.conf --config-file /etc/neutron/neutron.conf--config-file /etc/neutron/plugins/linuxbridge/linuxbridge_conf.ini
nova 28211 0.9 5.6 1120828 56460 ? Sl 00:12 0:00 /usr/bin/python /usr/bin/nova-compute --logfile/var/log/nova/compute.log
在node1控制节点：
[root@linux-node1 ~]# ps aux | egrep "mysqld|rabbitmq|nova|keystone|glance|neutron" #（确保这些服务正常运行）
……
[root@linux-node1 ~]# . keystone-admin.sh
[root@linux-node1 ~]# nova host-list #（有5个）
+-------------------------+-------------+----------+
| host_name | service | zone |
+-------------------------+-------------+----------+
| linux-node1.example.com | conductor | internal |
| linux-node1.example.com | consoleauth |internal |
| linux-node1.example.com | cert | internal |
| linux-node1.example.com | scheduler | internal |
| linux-node2.example.com | compute | nova |
+-------------------------+-------------+----------+
[root@linux-node1 ~]# neutron agent-list #（有2个）
+--------------------------------------+--------------------+-------------------------+-------+----------------+
| id | agent_type | host | alive | admin_state_up |
+--------------------------------------+--------------------+-------------------------+-------+----------------+
| 1283a47d-4d1b-4403-9d0e-241da803762b | Linux bridgeagent | linux-node1.example.com | :-) |True |
| 8d061358-ddfa-4979-bf2e-5d8c1c7a7f65| Linux bridge agent | linux-node2.example.com | :-) | True |
+--------------------------------------+--------------------+-------------------------+-------+----------------+
[root@linux-node1 ~]# service memcached start
Starting memcached: [ OK ]
[root@linux-node1 ~]# service httpd start
Starting httpd: [ OK ]
[root@linux-node1 ~]# chkconfig memcached on
[root@linux-node1 ~]# chkconfig httpd on
[root@linux-node1 ~]# chkconfig --listmemcached
memcached 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@linux-node1 ~]# chkconfig --listhttpd
httpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
测试：
http://10.96.20.118/dashboard，用户名admin密码admin；
在控制节点操作（创建网络）：
[root@linux-node1 ~]# . keystone-demo.sh
[root@linux-node1 ~]# keystone tenant-list #（记录demo的id）
+----------------------------------+---------+---------+
| id | name | enabled |
+----------------------------------+---------+---------+
| d14e4731327047c58a2431e9e2221626 | admin | True |
| 5ca17bf131f3443c81cf8947a6a2da03 | demo | True |
| 06c47e96dbf7429bbff4f93822222ca9 | service | True |
+----------------------------------+---------+---------+
[root@linux-node1 ~]# neutron net-create --tenant-id 5ca17bf131f3443c81cf8947a6a2da03 falt_net --shared --provider:network_typeflat --provider:physical_network physnet1 #（为demo创建网络，在CLI下创建网络，在web界面下创建子网）
Created a new network:
+---------------------------+--------------------------------------+
| Field | Value |
+---------------------------+--------------------------------------+
| admin_state_up | True |
| id |e80860ec-1be6-4d11-b8e2-bcb3ea29822b |
| name | falt_net |
| provider:network_type | flat |
| provider:physical_network | physnet1 |
| provider:segmentation_id | |
| shared | True |
| status | ACTIVE |
| subnets | |
| tenant_id | 5ca17bf131f3443c81cf8947a6a2da03 |
+---------------------------+--------------------------------------+
[root@linux-node1 ~]# neutron net-list
+--------------------------------------+----------+---------+
| id | name | subnets |
+--------------------------------------+----------+---------+
| e80860ec-1be6-4d11-b8e2-bcb3ea29822b |falt_net | |
+--------------------------------------+----------+---------+
在web界面下创建子网：
管理员-->系统面板-->网络-->点网络名称（flat_net）-->点创建子网，如图：子网名称flat_subnet，网络地址10.96.20.0/24，IP版本IPv4，网关IP10.96.20.1-->下一步-->子网详情：分配地址池10.96.20.120,10.96.20.130；DNS域名解析服务123.125.81.6-->创建
web界面右上角点退出，用demo用户登录：
项目-->Compute-->实例-->启动云主机-->云主机名称demo，云主机类型m1.tiny，云主机启动源从镜像启动，镜像名称cirros-0.3.4-x86_64(12.7MB)-->运行
本文出自 “Linux运维重难点学习笔记” 博客，请务必保留此出处http://jowin.blog.51cto.com/10090021/1858250
原文地址：http://jowin.blog.51cto.com/10090021/1858250
