OpenStack Nova安装说明

Transcription

1 OpenStack 完整安装手册 作者 : yz 联系方式 : Mail: atkisc@gmail.com QQ: 日期 : 版本 : Essex 最终版

2 目录 实验环境... 3 架构部署... 4 服务器系统安装... 5 控制节点安装... 6 前提工作... 6 NTP 时钟服务安装... 6 MYSQL 数据库服务安装... 7 RABBITMQ 消息队列服务安装... 7 PYTHON-NOVACLIENT 库安装... 7 KEYSTONE 身份认证服务安装... 8 PYTHON-KEYSTONECLIENT 库安装... 8 SWIFT 对象存储服务安装... 8 GLANCE 镜像存储服务安装... 9 NOVA 计算服务安装... 9 HORIZON 管理面板安装... 9 NOVNC WEB 访问安装... 9 KEYSTONE 身份认证服务配置 GLANCE 镜像存储服务配置 NOVA 计算服务配置 SWIFT 对象存储服务配置 HORIZON 管理面板配置 NOVNC WEB 访问配置 计算节点安装 前提工作 NTP 时钟同步配置 PYTHON-NOVACLIENT 库安装 GLANCE 镜像存储服务安装 NOVA 计算服务安装 NOVA 计算服务配置... 80

3 实验环境 硬件 : DELL R710(1 台 ) CPU:Intel(R) Xeon(R) CPU 2.40GHz * 2 内存 :48GB 硬盘 :300GB 网卡 :Broadcom Corporation NetXtreme II BCM5716 Gigabit Ethernet * 4 DELL R410(1 台 ) CPU:Intel(R) Xeon(R) CPU 2.13GHz * 2 内存 :8GB 硬盘 :1T * 4 网卡 :Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet * 4 系统 : CentOS 6.2 x64 Openstack 版本 : Essex release(2012.1)

4 架构部署 机器型号 / 主机名 外网 IP 内网 IP 作用 DELL R410/Control 控制节点 DELL R710/Compute 计算节点 实例网段为 /24,Floating IP 为 , 实例网段桥接在内网网卡上, 网络模式采用 FlatDHCP 控制节点 /dev/sda 为系统盘,/dev/sdb 为 nova-volume 盘,/dev/sdc /dev/sdd 为 swift 存储用

5 服务器系统安装 1. CentOS 6.2 x64 使用最小化安装方式 2. 服务器外网使用 eth0 3. 服务器内网使用 eth1 4. 所有服务均监听

6 控制节点安装 前提工作 1. 导入第三方软件源 rpm -Uvh rpm -Uvh 2. 安装依赖包 yum -y install swig libvirt-python libvirt qemu-kvm python-pip gcc make gcc-c++ patch m4 pytho n-devel libxml2-devel libxslt-devel libgsasl-devel openldap-devel sqlite-devel openssl-devel wget tel net gpxe-bootimgs gpxe-roms gpxe-roms-qemu dmidecode git scsi-target-utils kpartx socat vconfig aoetools rpm -Uvh m rpm -Uvh ln -sv /usr/bin/pip-python /usr/bin/pip 1. 安装 NTP 时钟同步服务器 yum install -y ntp NTP 时钟服务安装 2. 编辑 /etc/ntp.conf, 将文件内容替换为如下 : restrict default ignore restrict restrict mask nomodify notrap server ntp.api.bz server fudge stratum 10 driftfile /var/lib/ntp/drift keys /etc/ntp/keys 3. 重启 ntp 服务 /etc/init.d/ntpd start

7 MYSQL 数据库服务安装 1. 安装 MYSQL 数据库服务 yum install -y mysql-server 2. 更改 MYSQL 数据库服务监听内网网卡 IP sed -i '/symbolic-links=0/a bind-address = ' /etc/my.cnf 3. 启动 MYSQL 数据库服务 /etc/init.d/mysqld start 4. 设置 MYSQL 的 root 用户密码为 openstack mysqladmin -uroot password 'openstack';history -c 5. 检测服务是否正常启动 通过 netstat -ltunp 查看是否有 tcp 3306 端口监听 如果没有正常启动请查看 /var/log/mysqld.log 文件排错 1. 安装 RABBITMQ 消息队列服务 yum -y install rabbitmq-server RABBITMQ 消息队列服务安装 2. 启动 RABBITMQ 消息队列服务 /etc/init.d/rabbitmq-server start 3. 更改 RABBITMQ 消息队列服务 guest 用户默认密码为 openstack rabbitmqctl change_password guest openstack 1. 下载源码包 PYTHON-NOVACLIENT 库安装 wget -P /opt 2. 安装依赖包 yum -y install python-simplejson python-prettytable python-argparse python-nose1.1 python-httpli b2 python-virtualenv MySQL-python 3. 解压并安装 PYTHON-NOVACLIENT 库 cd /opt tar xf python-novaclient tar.gz cd python-novaclient python setup.py install rm -f../python-novaclient tar.gz

8 KEYSTONE 身份认证服务安装 1. 下载源码包 wget -P /opt 2. 安装依赖包 yum install -y python-eventlet python-greenlet python-paste python-passlib pip install routes== lxml==2.3 pam==0.1.4 sqlalchemy-migrate==0.7.2 PasteDeploy==1.5.0 S QLAlchemy==0.7.3 WebOb== 解压并安装 KEYSTONE 身份认证服务 cd /opt tar xf keystone tar.gz cd keystone python setup.py install rm -f../keystone tar.gz PYTHON-KEYSTONECLIENT 库安装 1. 下载源码包 /opt wget -P 2. 解压并安装 PYTHON-KEYSTONECLIENT 库 cd /opt tar xf python-keystoneclient tar.gz cd python-keystoneclient python setup.py install rm -f../python-keystoneclient tar.gz SWIFT 对象存储服务安装 1. 下载源码包 wget -P /opt 2. 安装依赖包 yum install -y memcached pip install configobj==4.7.1 netifaces== 解压并安装 SWIFT 对象存储服务 cd /opt

9 tar xf swift tar.gz cd swift python setup.py install rm -f../swift tar.gz GLANCE 镜像存储服务安装 1. 下载源码包 wget -P /opt 2. 安装依赖包 yum install -y python-anyjson python-kombu m2crypto pip install xattr==0.6.0 iso8601==0.1.4 pysendfile==2.0.0 pycrypto==2.3 wsgiref boto== 解压并安装 GLANCE 镜像存储服务 cd /opt tar xf glance tar.gz cd glance python setup.py install rm -f../glance tar.gz 1. 下载源码包 NOVA 计算服务安装 wget -P /opt 2. 安装依赖包 yum install -y python-amqplib python-carrot python-lockfile python-gflags python-netaddr pythonsuds python-paramiko python-feedparser pip install pycrypto==2.3 Cheetah==2.4.4 python-daemon==1.5.5 Babel== 解压并安装 NOVA 计算服务 cd /opt tar xf nova tar.gz cd nova python setup.py install rm -f../nova tar.gz HORIZON 管理面板安装 1. 下载源码包

10 wget -P /opt 2. 安装依赖包 yum install -y python-django-nose python-dateutil python-cloudfiles python-django python-django -integration-apache httpd 3. 解压并安装 HORIZON 管理面板 cd /opt tar xf horizon tar.gz cd horizon python setup.py install rm -f../horizon tar.gz NOVNC WEB 访问安装 1. 下载源码包 git clone /opt/novnc 2. 安装依赖包 yum install -y python-numdisplay # 建立 KEYSTONE 服务数据库 KEYSTONE 身份认证服务配置 mysql -uroot -popenstack -e 'create database keystone' # 建立 KEYSTONE 服务配置文件存放目录 mkdir /etc/keystone # 建立 KEYSTONE 服务启动用户 useradd -s /sbin/nologin -m -d /var/log/keystone keystone # 在 /etc/keystone 建立 default_catalog.templates 作为 KEYSTONE 服务服务点配置文件, 内容如下 : catalog.regionone.identity.publicurl = catalog.regionone.identity.adminurl = catalog.regionone.identity.internalurl = catalog.regionone.identity.name = Identity Service catalog.regionone.compute.publicurl = catalog.regionone.compute.adminurl = catalog.regionone.compute.internalurl = catalog.regionone.compute.name = Compute Service

11 catalog.regionone.volume.publicurl = catalog.regionone.volume.adminurl = catalog.regionone.volume.internalurl = catalog.regionone.volume.name = Volume Service catalog.regionone.ec2.publicurl = catalog.regionone.ec2.adminurl = catalog.regionone.ec2.internalurl = catalog.regionone.ec2.name = EC2 Service catalog.regionone.s3.publicurl = catalog.regionone.s3.adminurl = catalog.regionone.s3.internalurl = catalog.regionone.s3.name = S3 Service catalog.regionone.image.publicurl = catalog.regionone.image.adminurl = catalog.regionone.image.internalurl = catalog.regionone.image.name = Image Service catalog.regionone.object_store.publicurl = catalog.regionone.object_store.adminurl = catalog.regionone.object_store.internalurl = catalog.regionone.object_store.name = Swift Service # 在 /etc/keystone 建立 policy.json 作为 KEYSTONE 服务策略文件, 内容如下 : { "admin_required": [["role:admin"], ["is_admin:1"]] # 在 /etc/keystone 建立 keystone.conf 作为 KEYSTONE 服务配置文件, 内容如下 : [DEFAULT] public_port = 5000 admin_port = admin_token = ADMIN compute_port = 8774 verbose = True debug = True log_file = /var/log/keystone/keystone.log use_syslog = False syslog_log_facility = LOG_LOCAL0 [sql]

12 connection = mysql://root:openstack@localhost/keystone idle_timeout = 30 min_pool_size = 5 max_pool_size = 10 pool_timeout = 200 [identity] driver = keystone.identity.backends.sql.identity [catalog] driver = keystone.catalog.backends.templated.templatedcatalog template_file = /etc/keystone/default_catalog.templates [token] driver = keystone.token.backends.kvs.token [policy] driver = keystone.policy.backends.simple.simplematch [ec2] driver = keystone.contrib.ec2.backends.sql.ec2 [filter:debug] paste.filter_factory = keystone.common.wsgi:debug.factory [filter:token_auth] paste.filter_factory = keystone.middleware:tokenauthmiddleware.factory [filter:admin_token_auth] paste.filter_factory = keystone.middleware:admintokenauthmiddleware.factory [filter:xml_body] paste.filter_factory = keystone.middleware:xmlbodymiddleware.factory [filter:json_body] paste.filter_factory = keystone.middleware:jsonbodymiddleware.factory [filter:crud_extension] paste.filter_factory = keystone.contrib.admin_crud:crudextension.factory [filter:ec2_extension] paste.filter_factory = keystone.contrib.ec2:ec2extension.factory [filter:s3_extension]

13 paste.filter_factory = keystone.contrib.s3:s3extension.factory [app:public_service] paste.app_factory = keystone.service:public_app_factory [app:admin_service] paste.app_factory = keystone.service:admin_app_factory [pipeline:public_api] pipeline = token_auth admin_token_auth xml_body json_body debug ec2_extension s3_extension p ublic_service [pipeline:admin_api] pipeline = token_auth admin_token_auth xml_body json_body debug ec2_extension crud_extension admin_service [app:public_version_service] paste.app_factory = keystone.service:public_version_app_factory [app:admin_version_service] paste.app_factory = keystone.service:admin_version_app_factory [pipeline:public_version_api] pipeline = xml_body public_version_service [pipeline:admin_version_api] pipeline = xml_body admin_version_service [composite:main] use = egg:paste#urlmap /v2.0 = public_api / = public_version_api [composite:admin] use = egg:paste#urlmap /v2.0 = admin_api / = admin_version_api # 在 /etc/init.d/ 下建立名为 keystone 的 KEYSTONE 服务启动脚本, 内容如下 : #!/bin/sh # # keystone OpenStack Identity Service # # chkconfig:

14 # description: keystone works provide apis to \ # * Authenticate users and provide a token \ # * Validate tokens ### END INIT INFO. /etc/rc.d/init.d/functions prog=keystone prog_exec=keystone-all exec="/usr/bin/$prog_exec" config="/etc/$prog/$prog.conf" pidfile="/var/run/$prog/$prog.pid" [ -e /etc/sysconfig/$prog ] &&. /etc/sysconfig/$prog lockfile=/var/lock/subsys/$prog start() { [ -x $exec ] exit 5 [ -f $config ] exit 6 echo -n $"Starting $prog: " daemon --user keystone --pidfile $pidfile "$exec --config-file=$config & >/dev/null & echo \$! > $pidfile" retval=$? echo [ $retval -eq 0 ] && touch $lockfile return $retval stop() { echo -n $"Stopping $prog: " killproc -p $pidfile $prog retval=$? echo [ $retval -eq 0 ] && rm -f $lockfile return $retval restart() { stop start reload() {

15 restart force_reload() { restart rh_status() { status -p $pidfile $prog rh_status_q() { rh_status >/dev/null 2>&1 case "" in start) rh_status_q && exit 0 stop) rh_status_q exit 0 restart) reload) rh_status_q exit 7 force-reload) force_reload status) rh_status condrestart try-restart) rh_status_q exit 0 restart *) echo $"Usage: $0 {start stop status restart condrestart try-restart reload force-reload"

16 exit 2 esac exit $? # 配置启动脚本 : chmod 755 /etc/init.d/keystone mkdir /var/run/keystone mkdir /var/lock/keystone chown keystone:root /var/run/keystone chown keystone:root /var/lock/keystone # 启动 KEYSTONE 服务 /etc/init.d/keystone start # 检测服务是否正常启动 通过 netstat -ltunp 查看是否有 tcp 5000 和 tcp 端口监听 如果没有正常启动请查看 /var/log/keystone/keystone.log 文件排错 # 建立 KEYSTONE 服务初始化数据脚本 keystone_data.sh, 内容如下 : #!/bin/bash # Variables set before calling this script: # SERVICE_TOKEN - aka admin_token in keystone.conf # SERVICE_ENDPOINT - local Keystone admin endpoint # SERVICE_TENANT_NAME - name of tenant containing service accounts # ENABLED_SERVICES - stack.sh's list of services to start # DEVSTACK_DIR - Top-level DevStack directory ADMIN_PASSWORD=${ADMIN_PASSWORD:-secrete SERVICE_PASSWORD=${SERVICE_PASSWORD:-service export SERVICE_TOKEN=ADMIN export SERVICE_ENDPOINT= SERVICE_TENANT_NAME=${SERVICE_TENANT_NAME:-tenant function get_id () { echo `$@ awk '/ id / { print $4 '` # Tenants ADMIN_TENANT=$(get_id keystone tenant-create --name=admin) SERVICE_TENANT=$(get_id keystone tenant-create --name=$service_tenant_name) DEMO_TENANT=$(get_id keystone tenant-create --name=demo) INVIS_TENANT=$(get_id keystone tenant-create --name=invisible_to_admin) # Users

17 ADMIN_USER=$(get_id keystone user-create --name=admin \ --pass="$admin_password" \ -- =admin@example.com) DEMO_USER=$(get_id keystone user-create --name=demo \ --pass="$admin_password" \ -- =demo@example.com) # Roles ADMIN_ROLE=$(get_id keystone role-create --name=admin) KEYSTONEADMIN_ROLE=$(get_id keystone role-create --name=keystoneadmin) KEYSTONESERVICE_ROLE=$(get_id keystone role-create --name=keystoneserviceadmin) ANOTHER_ROLE=$(get_id keystone role-create --name=anotherrole) # Add Roles to Users in Tenants keystone user-role-add --user $ADMIN_USER --role $ADMIN_ROLE --tenant_id $ADMIN_TENANT keystone user-role-add --user $ADMIN_USER --role $ADMIN_ROLE --tenant_id $DEMO_TENANT keystone user-role-add --user $DEMO_USER --role $ANOTHER_ROLE --tenant_id $DEMO_TENANT # TODO(termie): these two might be dubious keystone user-role-add --user $ADMIN_USER --role $KEYSTONEADMIN_ROLE --tenant_id $ADMIN_T ENANT keystone user-role-add --user $ADMIN_USER --role $KEYSTONESERVICE_ROLE --tenant_id $ADMIN_ TENANT # The Member role is used by Horizon and Swift so we need to keep it: MEMBER_ROLE=$(get_id keystone role-create --name=member) keystone user-role-add --user $DEMO_USER --role $MEMBER_ROLE --tenant_id $DEMO_TENANT keystone user-role-add --user $DEMO_USER --role $MEMBER_ROLE --tenant_id $INVIS_TENANT NOVA_USER=$(get_id keystone user-create --name=nova \ --pass="$service_password" \ --tenant_id $SERVICE_TENANT \ -- =nova@example.com) keystone user-role-add --tenant_id $SERVICE_TENANT \ --user $NOVA_USER \ --role $ADMIN_ROLE GLANCE_USER=$(get_id keystone user-create --name=glance \ --pass="$service_password" \ --tenant_id $SERVICE_TENANT \ -- =glance@example.com) keystone user-role-add --tenant_id $SERVICE_TENANT \ --user $GLANCE_USER \ --role $ADMIN_ROLE

18 SWIFT_USER=$(get_id keystone user-create --name=swift \ --pass="$service_password" \ --tenant_id $SERVICE_TENANT \ -- =swift@example.com) keystone user-role-add --tenant_id $SERVICE_TENANT \ --user $SWIFT_USER \ --role $ADMIN_ROLE RESELLER_ROLE=$(get_id keystone role-create --name=reselleradmin) keystone user-role-add --tenant_id $SERVICE_TENANT \ --user $NOVA_USER \ --role $RESELLER_ROLE # 建立 KEYSTONE 服务数据库结构 keystone-manage db_sync # 执行初始化数据脚本 bash keystone_data.sh GLANCE 镜像存储服务配置 # 建立 GLANCE 服务数据库 mysql -uroot -popenstack -e 'create database glance' # 建立 GLANCE 服务配置文件存放目录 mkdir /etc/glance # 建立 GLANCE 服务启动用户 useradd -s /sbin/nologin -m -d /var/log/glance glance # 在 /etc/glance 建立 glance-api.conf 作为 GLANCE-API 服务配置文件, 内容如下 : [DEFAULT] # Show more verbose log output (sets INFO log level output) verbose = True # Show debugging output in logs (sets DEBUG log level output) debug = True # Which backend store should Glance use by default is not specified # in a request to add a new image to Glance? Default: 'file' # Available choices are 'file', 'swift', and 's3' default_store = file

19 # Address to bind the API server bind_host = # Port the bind the API server to bind_port = 9292 # Address to find the registry server registry_host = # Port the registry server is listening on registry_port = 9191 # Log to this file. Make sure you do not set the same log # file for both the API and registry servers! log_file = /var/log/glance/api.log # Send logs to syslog (/dev/log) instead of to file specified by `log_file` use_syslog = False # ============ Notification System Options ===================== # Notifications can be sent when images are create, updated or deleted. # There are three methods of sending notifications, logging (via the # log_file directive), rabbit (via a rabbitmq queue) or noop (no # notifications sent, the default) notifier_strategy = noop # Configuration options if sending notifications via rabbitmq (these are # the defaults) rabbit_host = localhost rabbit_port = 5672 rabbit_use_ssl = false rabbit_userid = guest rabbit_password = openstack rabbit_virtual_host = / rabbit_notification_topic = glance_notifications # ============ Filesystem Store Options ======================== # Directory that the Filesystem backend store # writes image data to filesystem_store_datadir = /var/lib/glance/images/

20 # ============ Swift Store Options ============================= # Address where the Swift authentication service lives swift_store_auth_address = :8080/v1.0/ # User to authenticate against the Swift authentication service swift_store_user = jdoe # Auth key for the user authenticating against the # Swift authentication service swift_store_key = a86850deb2742ec3cb41518e26aa2d89 # Container within the account that the account should use # for storing images in Swift swift_store_container = glance # Do we create the container if it does not exist? swift_store_create_container_on_put = False # What size, in MB, should Glance start chunking image files # and do a large object manifest in Swift? By default, this is # the maximum object size in Swift, which is 5GB swift_store_large_object_size = 5120 # When doing a large object manifest, what size, in MB, should # Glance write chunks to Swift? This amount of data is written # to a temporary disk buffer during the process of chunking # the image file, and the default is 200MB swift_store_large_object_chunk_size = 200 # Whether to use ServiceNET to communicate with the Swift storage servers. # (If you aren't RACKSPACE, leave this False!) # # To use ServiceNET for authentication, prefix hostname of # `swift_store_auth_address` with 'snet-'. # Ex. -> swift_enable_snet = False # ============ S3 Store Options ============================= # Address where the S3 authentication service lives s3_store_host = :8080/v1.0/ # User to authenticate against the S3 authentication service

21 s3_store_access_key = <20-char AWS access key> # Auth key for the user authenticating against the # S3 authentication service s3_store_secret_key = <40-char AWS secret key> # Container within the account that the account should use # for storing images in S3. Note that S3 has a flat namespace, # so you need a unique bucket name for your glance images. An # easy way to do this is append your AWS access key to "glance". # S3 buckets in AWS *must* be lowercased, so remember to lowercase # your AWS access key if you use it in your bucket name below! s3_store_bucket = <lowercased 20-char aws access key>glance # Do we create the bucket if it does not exist? s3_store_create_bucket_on_put = False # ============ Image Cache Options ======================== image_cache_enabled = False # Directory that the Image Cache writes data to # Make sure this is also set in glance-pruner.conf image_cache_datadir = /var/lib/glance/image-cache/ # Number of seconds after which we should consider an incomplete image to be # stalled and eligible for reaping image_cache_stall_timeout = # ============ Delayed Delete Options ============================= # Turn on/off delayed delete delayed_delete = False # Delayed delete time in seconds scrub_time = # Directory that the scrubber will use to remind itself of what to delete # Make sure this is also set in glance-scrubber.conf scrubber_datadir = /var/lib/glance/scrubber # 在 /etc/glance 建立 glance-api-paste.ini 作为 GLANCE-API 服务认证配置文件, 内容如下 : [pipeline:glance-api] #pipeline = versionnegotiation context apiv1app

22 # NOTE: use the following pipeline for keystone pipeline = versionnegotiation authtoken context apiv1app # To enable Image Cache Management API replace pipeline with below: # pipeline = versionnegotiation context imagecache apiv1app # NOTE: use the following pipeline for keystone auth (with caching) # pipeline = versionnegotiation authtoken auth-context imagecache apiv1app [app:apiv1app] paste.app_factory = glance.common.wsgi:app_factory glance.app_factory = glance.api.v1.router:api [filter:versionnegotiation] paste.filter_factory = glance.common.wsgi:filter_factory glance.filter_factory = glance.api.middleware.version_negotiation:versionnegotiationfilter [filter:cache] paste.filter_factory = glance.common.wsgi:filter_factory glance.filter_factory = glance.api.middleware.cache:cachefilter [filter:cachemanage] paste.filter_factory = glance.common.wsgi:filter_factory glance.filter_factory = glance.api.middleware.cache_manage:cachemanagefilter [filter:context] paste.filter_factory = glance.common.wsgi:filter_factory glance.filter_factory = glance.common.context:contextmiddleware [filter:authtoken] paste.filter_factory = keystone.middleware.auth_token:filter_factory service_host = service_port = 5000 service_protocol = http auth_host = auth_port = auth_protocol = http auth_uri = admin_tenant_name = tenant admin_user = glance admin_password = service # 在 /etc/glance 建立 glance-registry.conf 作为 GLANCE-REGISTRY 服务配置文件, 内容如下 : [DEFAULT] # Show more verbose log output (sets INFO log level output)

23 verbose = True # Show debugging output in logs (sets DEBUG log level output) debug = True # Address to bind the registry server bind_host = # Port the bind the registry server to bind_port = 9191 # Log to this file. Make sure you do not set the same log # file for both the API and registry servers! log_file = /var/log/glance/registry.log # Where to store images filesystem_store_datadir = /var/lib/glance/images # Send logs to syslog (/dev/log) instead of to file specified by `log_file` use_syslog = False # SQLAlchemy connection string for the reference implementation # registry server. Any valid SQLAlchemy connection string is fine. # See: ml#sqlalchemy.create_ engine sql_connection = mysql://root:openstack@localhost/glance # Period in seconds after which SQLAlchemy should reestablish its connection # to the database. # # MySQL uses a default `wait_timeout` of 8 hours, after which it will drop # idle connections. This can result in 'MySQL Gone Away' exceptions. If you # notice this, you can lower this value to ensure that SQLAlchemy reconnects # before MySQL can drop the connection. sql_idle_timeout = 3600 # Limit the api to return `param_limit_max` items in a call to a container. If # a larger `limit` query param is provided, it will be reduced to this value. api_limit_max = 1000 # If a `limit` query param is not provided in an api request, it will # default to `limit_param_default` limit_param_default = 25

24 # 在 /etc/glance 建立 glance-registry-paste.ini 作为 GLANCE-REGISTRY 服务认证配置文件, 内容如下 : [pipeline:glance-registry] #pipeline = context registryapp # NOTE: use the following pipeline for keystone pipeline = authtoken context registryapp [app:registryapp] paste.app_factory = glance.common.wsgi:app_factory glance.app_factory = glance.registry.api.v1:api [filter:context] context_class = glance.registry.context.requestcontext paste.filter_factory = glance.common.wsgi:filter_factory glance.filter_factory = glance.common.context:contextmiddleware [filter:authtoken] paste.filter_factory = keystone.middleware.auth_token:filter_factory service_host = service_port = 5000 service_protocol = http auth_host = auth_port = auth_protocol = http auth_uri = admin_tenant_name = tenant admin_user = glance admin_password = service # 在 /etc/glance 建立 policy.json 作为 GLANCE 服务策略文件, 内容如下 : { "default": [], "manage_image_cache": [["role:admin"]] # 在 /etc/init.d/ 下建立名为 glance-api 的 GLANCE-API 服务启动脚本, 内容如下 : #!/bin/sh # # glance-api OpenStack Image Service API server # # chkconfig: # description: OpenStack Image Service (code-named Glance) API server ### BEGIN INIT INFO # Provides:

25 # Required-Start: $remote_fs $network $syslog # Required-Stop: $remote_fs $syslog # Default-Stop: # Short-Description: Glance API server # Description: OpenStack Image Service (code-named Glance) API server ### END INIT INFO. /etc/rc.d/init.d/functions suffix=api prog=openstack-glance-$suffix exec="/usr/bin/glance-$suffix" config="/etc/glance/glance-$suffix.conf" pidfile="/var/run/glance/glance-$suffix.pid" [ -e /etc/sysconfig/$prog ] &&. /etc/sysconfig/$prog lockfile=/var/lock/subsys/$prog start() { [ -x $exec ] exit 5 [ -f $config ] exit 6 echo -n $"Starting $prog: " daemon --user glance --pidfile $pidfile "$exec --config-file=$config &>/dev/null & echo \$! > $pidfile" retval=$? echo [ $retval -eq 0 ] && touch $lockfile return $retval stop() { echo -n $"Stopping $prog: " killproc -p $pidfile $prog retval=$? echo [ $retval -eq 0 ] && rm -f $lockfile return $retval restart() { stop start

26 reload() { restart force_reload() { restart rh_status() { status -p $pidfile $prog rh_status_q() { rh_status >/dev/null 2>&1 case "" in start) rh_status_q && exit 0 stop) rh_status_q exit 0 restart) reload) rh_status_q exit 7 force-reload) force_reload status) rh_status condrestart try-restart) rh_status_q exit 0 restart

27 *) echo $"Usage: $0 {start stop status restart condrestart try-restart reload force-reload" exit 2 esac exit $? # 在 /etc/init.d/ 下建立名为 glance-registry 的 GLANCE-REGISTRY 服务启动脚本, 内容如下 : #!/bin/sh # # glance-registry OpenStack Image Service Registry server # # chkconfig: # description: OpenStack Image Service (code-named Glance) Registry server ### BEGIN INIT INFO # Provides: # Required-Start: $remote_fs $network $syslog # Required-Stop: $remote_fs $syslog # Default-Stop: # Short-Description: Glance Registry server # Description: OpenStack Image Service (code-named Glance) Registry server ### END INIT INFO. /etc/rc.d/init.d/functions suffix=registry prog=openstack-glance-$suffix exec="/usr/bin/glance-$suffix" config="/etc/glance/glance-$suffix.conf" pidfile="/var/run/glance/glance-$suffix.pid" [ -e /etc/sysconfig/$prog ] &&. /etc/sysconfig/$prog lockfile=/var/lock/subsys/$prog start() { [ -x $exec ] exit 5 [ -f $config ] exit 6 echo -n $"Starting $prog: " daemon --user glance --pidfile $pidfile "$exec --config-file=$config &>/dev/null & echo \$! > $pidfile" retval=$? echo [ $retval -eq 0 ] && touch $lockfile

28 return $retval stop() { echo -n $"Stopping $prog: " killproc -p $pidfile $prog retval=$? echo [ $retval -eq 0 ] && rm -f $lockfile return $retval restart() { stop start reload() { restart force_reload() { restart rh_status() { status -p $pidfile $prog rh_status_q() { rh_status >/dev/null 2>&1 case "" in start) rh_status_q && exit 0 stop) rh_status_q exit 0 restart)

29 reload) rh_status_q exit 7 force-reload) force_reload status) rh_status condrestart try-restart) rh_status_q exit 0 restart *) echo $"Usage: $0 {start stop status restart condrestart try-restart reload force-reload" exit 2 esac exit $? # 配置启动脚本 : chmod 755 /etc/init.d/glance-api chmod 755 /etc/init.d/glance-registry mkdir /var/run/glance mkdir /var/lock/glance mkdir -p /var/lib/glance/images chown glance:root /var/run/glance chown glance:root /var/lock/glance chown glance:glance /var/lib/glance # 启动 GLANCE-API 和 GLANCE-REGISTRY 服务 /etc/init.d/glance-api start /etc/init.d/glance-registry start # 检测服务是否正常启动 通过 netstat -ltunp 查看是否有 tcp 9292 和 tcp 9191 端口监听 如果没有正常启动请查看 /var/log/glance 目录下相关文件排错 NOVA 计算服务配置 # 建立 NOVA 服务数据库

30 mysql -uroot -popenstack -e 'create database nova' # 建立 NOVA 服务配置文件存放目录 mkdir /etc/nova # 建立 NOVA 服务启动用户 useradd -s /sbin/nologin -m -d /var/log/nova nova # 在 /etc/nova 建立 nova.conf 作为 NOVA 服务配置文件, 内容如下 : [DEFAULT] debug=true log-dir=/var/log/nova pybasedir=/var/lib/nova use_syslog=false verbose=true api_paste_config=/etc/nova/api-paste.ini auth_strategy=keystone bindir=/usr/bin glance_host=$my_ip glance_port=9292 glance_api_servers=$glance_host:$glance_port image_service=nova.image.glance.glanceimageservice lock_path=/var/lock/nova my_ip= rabbit_host=localhost rabbit_password=openstack rabbit_port=5672 rabbit_userid=guest root_helper=sudo sql_connection=mysql://root:gamewave@localhost/nova keystone_ec2_url= novncproxy_base_url= vnc_enabled=true vnc_keymap=en-us vncserver_listen=$my_ip vncserver_proxyclient_address=$my_ip dhcpbridge=$bindir/nova-dhcpbridge dhcpbridge_flagfile=/etc/nova/nova.conf public_interface=eth0 routing_source_ip=$my_ip fixed_range= /24 flat_interface=br1 flat_network_bridge=eth1

31 floating_range= force_dhcp_release=true target_host=$my_ip target_port=3260 console_token_ttl=600 iscsi_helper=ietadm iscsi_ip_address=$my_ip iscsi_num_targets=100 iscsi_port=3260 volume_group=nova-volumes ec2_listen= ec2_listen_port=8773 metadata_listen= metadata_listen_port=8775 osapi_compute_listen= osapi_compute_listen_port=8774 osapi_volume_listen= osapi_volume_listen_port=8776 # 在 /etc/nova 建立 api-paste.ini 作为 NOVA 服务认证配置文件, 内容如下 : ############ # Metadata # ############ [composite:metadata] use = egg:paste#urlmap /: metaversions /latest: meta /1.0: meta / : meta / : meta / : meta / : meta / : meta / : meta / : meta / : meta [pipeline:metaversions] pipeline = ec2faultwrap logrequest metaverapp [pipeline:meta] pipeline = ec2faultwrap logrequest metaapp [app:metaverapp]

32 paste.app_factory = nova.api.metadata.handler:versions.factory [app:metaapp] paste.app_factory = nova.api.metadata.handler:metadatarequesthandler.factory ####### # EC2 # ####### [composite:ec2] use = egg:paste#urlmap /services/cloud: ec2cloud [composite:ec2cloud] use = call:nova.api.auth:pipeline_factory noauth = ec2faultwrap logrequest ec2noauth cloudrequest validator ec2executor deprecated = ec2faultwrap logrequest authenticate cloudrequest validator ec2executor keystone = ec2faultwrap logrequest ec2keystoneauth cloudrequest validator ec2executor [filter:ec2faultwrap] paste.filter_factory = nova.api.ec2:faultwrapper.factory [filter:logrequest] paste.filter_factory = nova.api.ec2:requestlogging.factory [filter:ec2lockout] paste.filter_factory = nova.api.ec2:lockout.factory [filter:totoken] paste.filter_factory = nova.api.ec2:ec2token.factory [filter:ec2keystoneauth] paste.filter_factory = nova.api.ec2:ec2keystoneauth.factory [filter:ec2noauth] paste.filter_factory = nova.api.ec2:noauth.factory [filter:authenticate] paste.filter_factory = nova.api.ec2:authenticate.factory [filter:cloudrequest] controller = nova.api.ec2.cloud.cloudcontroller paste.filter_factory = nova.api.ec2:requestify.factory

33 [filter:authorizer] paste.filter_factory = nova.api.ec2:authorizer.factory [filter:validator] paste.filter_factory = nova.api.ec2:validator.factory [app:ec2executor] paste.app_factory = nova.api.ec2:executor.factory ############# # Openstack # ############# [composite:osapi_compute] use = call:nova.api.openstack.urlmap:urlmap_factory /: oscomputeversions /v1.1: openstack_compute_api_v2 /v2: openstack_compute_api_v2 [composite:osapi_volume] use = call:nova.api.openstack.urlmap:urlmap_factory /: osvolumeversions /v1: openstack_volume_api_v1 [composite:openstack_compute_api_v2] use = call:nova.api.auth:pipeline_factory noauth = faultwrap noauth ratelimit osapi_compute_app_v2 deprecated = faultwrap auth ratelimit osapi_compute_app_v2 keystone = faultwrap authtoken keystonecontext ratelimit osapi_compute_app_v2 keystone_nolimit = faultwrap authtoken keystonecontext osapi_compute_app_v2 [composite:openstack_volume_api_v1] use = call:nova.api.auth:pipeline_factory noauth = faultwrap noauth ratelimit osapi_volume_app_v1 deprecated = faultwrap auth ratelimit osapi_volume_app_v1 keystone = faultwrap authtoken keystonecontext ratelimit osapi_volume_app_v1 keystone_nolimit = faultwrap authtoken keystonecontext osapi_volume_app_v1 [filter:faultwrap] paste.filter_factory = nova.api.openstack:faultwrapper.factory [filter:auth] paste.filter_factory = nova.api.openstack.auth:authmiddleware.factory

34 [filter:noauth] paste.filter_factory = nova.api.openstack.auth:noauthmiddleware.factory [filter:ratelimit] paste.filter_factory = nova.api.openstack.compute.limits:ratelimitingmiddleware.factory [app:osapi_compute_app_v2] paste.app_factory = nova.api.openstack.compute:apirouter.factory [pipeline:oscomputeversions] pipeline = faultwrap oscomputeversionapp [app:osapi_volume_app_v1] paste.app_factory = nova.api.openstack.volume:apirouter.factory [app:oscomputeversionapp] paste.app_factory = nova.api.openstack.compute.versions:versions.factory [pipeline:osvolumeversions] pipeline = faultwrap osvolumeversionapp [app:osvolumeversionapp] paste.app_factory = nova.api.openstack.volume.versions:versions.factory ########## # Shared # ########## [filter:keystonecontext] paste.filter_factory = nova.api.auth:novakeystonecontext.factory [filter:authtoken] paste.filter_factory = keystone.middleware.auth_token:filter_factory service_protocol = http service_host = service_port = 5000 auth_host = auth_port = auth_protocol = http auth_uri = admin_tenant_name = tenant admin_user = nova admin_password = service

35 # 在 /etc/nova 建立 policy.json 作为 NOVA 服务策略文件, 内容如下 : { "admin_or_owner": [["role:admin"], ["project_id:%(project_id)s"]], "default": [["rule:admin_or_owner"]], "compute:create": [], "compute:create:attach_network": [], "compute:create:attach_volume": [], "compute:get_all": [], "admin_api": [["role:admin"]], "compute_extension:accounts": [["rule:admin_api"]], "compute_extension:admin_actions": [["rule:admin_api"]], "compute_extension:admin_actions:pause": [["rule:admin_or_owner"]], "compute_extension:admin_actions:unpause": [["rule:admin_or_owner"]], "compute_extension:admin_actions:suspend": [["rule:admin_or_owner"]], "compute_extension:admin_actions:resume": [["rule:admin_or_owner"]], "compute_extension:admin_actions:lock": [["rule:admin_api"]], "compute_extension:admin_actions:unlock": [["rule:admin_api"]], "compute_extension:admin_actions:resetnetwork": [["rule:admin_api"]], "compute_extension:admin_actions:injectnetworkinfo": [["rule:admin_api"]], "compute_extension:admin_actions:createbackup": [["rule:admin_or_owner"]], "compute_extension:admin_actions:migratelive": [["rule:admin_api"]], "compute_extension:admin_actions:migrate": [["rule:admin_api"]], "compute_extension:aggregates": [["rule:admin_api"]], "compute_extension:certificates": [], "compute_extension:cloudpipe": [["rule:admin_api"]], "compute_extension:console_output": [], "compute_extension:consoles": [], "compute_extension:createserverext": [], "compute_extension:deferred_delete": [], "compute_extension:disk_config": [], "compute_extension:extended_server_attributes": [["rule:admin_api"]], "compute_extension:extended_status": [], "compute_extension:flavorextradata": [], "compute_extension:flavorextraspecs": [], "compute_extension:flavormanage": [["rule:admin_api"]], "compute_extension:floating_ip_dns": [], "compute_extension:floating_ip_pools": [], "compute_extension:floating_ips": [], "compute_extension:hosts": [["rule:admin_api"]], "compute_extension:keypairs": [],

36 "compute_extension:multinic": [], "compute_extension:networks": [["rule:admin_api"]], "compute_extension:quotas": [], "compute_extension:rescue": [], "compute_extension:security_groups": [], "compute_extension:server_action_list": [["rule:admin_api"]], "compute_extension:server_diagnostics": [["rule:admin_api"]], "compute_extension:simple_tenant_usage:show": [["rule:admin_or_owner"]], "compute_extension:simple_tenant_usage:list": [["rule:admin_api"]], "compute_extension:users": [["rule:admin_api"]], "compute_extension:virtual_interfaces": [], "compute_extension:virtual_storage_arrays": [], "compute_extension:volumes": [], "compute_extension:volumetypes": [], "volume:create": [], "volume:get_all": [], "volume:get_volume_metadata": [], "volume:get_snapshot": [], "volume:get_all_snapshots": [], "network:get_all_networks": [], "network:get_network": [], "network:delete_network": [], "network:disassociate_network": [], "network:get_vifs_by_instance": [], "network:allocate_for_instance": [], "network:deallocate_for_instance": [], "network:validate_networks": [], "network:get_instance_uuids_by_ip_filter": [], "network:get_floating_ip": [], "network:get_floating_ip_pools": [], "network:get_floating_ip_by_address": [], "network:get_floating_ips_by_project": [], "network:get_floating_ips_by_fixed_address": [], "network:allocate_floating_ip": [], "network:deallocate_floating_ip": [], "network:associate_floating_ip": [], "network:disassociate_floating_ip": [], "network:get_fixed_ip": [],

37 "network:add_fixed_ip_to_instance": [], "network:remove_fixed_ip_from_instance": [], "network:add_network_to_project": [], "network:get_instance_nw_info": [], "network:get_dns_domains": [], "network:add_dns_entry": [], "network:modify_dns_entry": [], "network:delete_dns_entry": [], "network:get_dns_entries_by_address": [], "network:get_dns_entries_by_name": [], "network:create_private_dns_domain": [], "network:create_public_dns_domain": [], "network:delete_dns_domain": [] # 在 /etc/init.d/ 下建立名为 nova-api 的 NOVA-API 服务启动脚本, 内容如下 : #!/bin/sh # # openstack-nova-api OpenStack Nova API Server # # chkconfig: # description: At the heart of the cloud framework is an API Server. \ # This API Server makes command and control of the \ # hypervisor, storage, and networking programmatically \ # available to users in realization of the definition \ # of cloud computing. ### BEGIN INIT INFO # Provides: # Required-Start: $remote_fs $network $syslog # Required-Stop: $remote_fs $syslog # Default-Stop: # Short-Description: OpenStack Nova API Server # Description: At the heart of the cloud framework is an API Server. # This API Server makes command and control of the # hypervisor, storage, and networking programmatically # available to users in realization of the definition # of cloud computing. ### END INIT INFO. /etc/rc.d/init.d/functions suffix=api

38 prog=openstack-nova-$suffix exec="/usr/bin/nova-$suffix" config="/etc/nova/nova.conf" pidfile="/var/run/nova/nova-$suffix.pid" logfile="/var/log/nova/$suffix.log" [ -e /etc/sysconfig/$prog ] &&. /etc/sysconfig/$prog lockfile=/var/lock/nova/$prog start() { [ -x $exec ] exit 5 [ -f $config ] exit 6 echo -n $"Starting $prog: " daemon --user nova --pidfile $pidfile "$exec --config-file=$config --logfile=$logfile &>/dev/nu ll & echo \$! > $pidfile" retval=$? echo [ $retval -eq 0 ] && touch $lockfile return $retval stop() { echo -n $"Stopping $prog: " killproc -p $pidfile $prog retval=$? echo [ $retval -eq 0 ] && rm -f $lockfile return $retval restart() { stop start reload() { restart force_reload() { restart

39 rh_status() { status -p $pidfile $prog rh_status_q() { rh_status >/dev/null 2>&1 case "" in start) rh_status_q && exit 0 stop) rh_status_q exit 0 restart) reload) rh_status_q exit 7 force-reload) force_reload status) rh_status condrestart try-restart) rh_status_q exit 0 restart *) echo $"Usage: $0 {start stop status restart condrestart try-restart reload force-reload" exit 2 esac exit $? # 在 /etc/init.d/ 下建立名为 nova-network 的 NOVA-NETWORK 服务启动脚本, 内容如下 : #!/bin/sh #

40 # openstack-nova-network OpenStack Nova Network Controller # # chkconfig: # description: The Network Controller manages the networking resources \ # on host machines. The API server dispatches commands \ # through the message queue, which are subsequently \ # processed by Network Controllers. \ # Specific operations include: \ # * Allocate Fixed IP Addresses \ # * Configuring VLANs for projects \ # * Configuring networks for compute nodes \ ### BEGIN INIT INFO # Provides: # Required-Start: $remote_fs $network $syslog # Required-Stop: $remote_fs $syslog # Default-Stop: # Short-Description: OpenStack Nova Network Controller # Description: The Network Controller manages the networking resources # on host machines. The API server dispatches commands # through the message queue, which are subsequently # processed by Network Controllers. # Specific operations include: # * Allocate Fixed IP Addresses # * Configuring VLANs for projects # * Configuring networks for compute nodes ### END INIT INFO. /etc/rc.d/init.d/functions suffix=network prog=openstack-nova-$suffix exec="/usr/bin/nova-$suffix" config="/etc/nova/nova.conf" pidfile="/var/run/nova/nova-$suffix.pid" logfile="/var/log/nova/$suffix.log" [ -e /etc/sysconfig/$prog ] &&. /etc/sysconfig/$prog lockfile=/var/lock/nova/$prog start() { [ -x $exec ] exit 5 [ -f $config ] exit 6

41 echo -n $"Starting $prog: " daemon --user nova --pidfile $pidfile "$exec --config-file=$config --logfile=$logfile &>/dev/nu ll & echo \$! > $pidfile" retval=$? echo [ $retval -eq 0 ] && touch $lockfile return $retval stop() { echo -n $"Stopping $prog: " killproc -p $pidfile $prog retval=$? echo [ $retval -eq 0 ] && rm -f $lockfile return $retval restart() { stop start reload() { restart force_reload() { restart rh_status() { status -p $pidfile $prog rh_status_q() { rh_status >/dev/null 2>&1 case "" in start) rh_status_q && exit 0

42 stop) rh_status_q exit 0 restart) reload) rh_status_q exit 7 force-reload) force_reload status) rh_status condrestart try-restart) rh_status_q exit 0 restart *) echo $"Usage: $0 {start stop status restart condrestart try-restart reload force-reload" exit 2 esac exit $? # 在 /etc/init.d/ 下建立名为 nova-objectstore 的 NOVA-OBJECTSTORE 服务启动脚本, 内容如下 : #!/bin/sh # # openstack-nova-objectstore OpenStack Nova Object Storage # # chkconfig: # description: Implementation of an S3-like storage server based on local files. ### BEGIN INIT INFO # Provides: # Required-Start: $remote_fs $network $syslog # Required-Stop: $remote_fs $syslog # Default-Stop: # Short-Description: OpenStack Nova Object Storage # Description: Implementation of an S3-like storage server based on local files. ### END INIT INFO

43 . /etc/rc.d/init.d/functions suffix=objectstore prog=openstack-nova-$suffix exec="/usr/bin/nova-$suffix" config="/etc/nova/nova.conf" pidfile="/var/run/nova/nova-$suffix.pid" logfile="/var/log/nova/$suffix.log" [ -e /etc/sysconfig/$prog ] &&. /etc/sysconfig/$prog lockfile=/var/lock/nova/$prog start() { [ -x $exec ] exit 5 [ -f $config ] exit 6 echo -n $"Starting $prog: " daemon --user nova --pidfile $pidfile "$exec --config-file=$config --logfile=$logfile &>/dev/nu ll & echo \$! > $pidfile" retval=$? echo [ $retval -eq 0 ] && touch $lockfile return $retval stop() { echo -n $"Stopping $prog: " killproc -p $pidfile $prog retval=$? echo [ $retval -eq 0 ] && rm -f $lockfile return $retval restart() { stop start reload() { restart

44 force_reload() { restart rh_status() { status -p $pidfile $prog rh_status_q() { rh_status >/dev/null 2>&1 case "" in start) rh_status_q && exit 0 stop) rh_status_q exit 0 restart) reload) rh_status_q exit 7 force-reload) force_reload status) rh_status condrestart try-restart) rh_status_q exit 0 restart *) echo $"Usage: $0 {start stop status restart condrestart try-restart reload force-reload" exit 2 esac exit $?

45 # 在 /etc/init.d/ 下建立名为 nova-scheduler 的 NOVA-SCHEDULER 服务启动脚本, 内容如下 : #!/bin/sh # # openstack-nova-scheduler OpenStack Nova Scheduler # # chkconfig: # description: Determines which physical hardware to allocate to a virtual resource ### BEGIN INIT INFO # Provides: # Required-Start: $remote_fs $network $syslog # Required-Stop: $remote_fs $syslog # Default-Stop: # Short-Description: OpenStack Nova Scheduler # Description: Determines which physical hardware to allocate to a virtual resource ### END INIT INFO. /etc/rc.d/init.d/functions suffix=scheduler prog=openstack-nova-$suffix exec="/usr/bin/nova-$suffix" config="/etc/nova/nova.conf" pidfile="/var/run/nova/nova-$suffix.pid" logfile="/var/log/nova/$suffix.log" [ -e /etc/sysconfig/$prog ] &&. /etc/sysconfig/$prog lockfile=/var/lock/nova/$prog start() { [ -x $exec ] exit 5 [ -f $config ] exit 6 echo -n $"Starting $prog: " daemon --user nova --pidfile $pidfile "$exec --config-file=$config --logfile=$logfile &>/dev/nu ll & echo \$! > $pidfile" retval=$? echo [ $retval -eq 0 ] && touch $lockfile return $retval stop() {

46 echo -n $"Stopping $prog: " killproc -p $pidfile $prog retval=$? echo [ $retval -eq 0 ] && rm -f $lockfile return $retval restart() { stop start reload() { restart force_reload() { restart rh_status() { status -p $pidfile $prog rh_status_q() { rh_status >/dev/null 2>&1 case "" in start) rh_status_q && exit 0 stop) rh_status_q exit 0 restart) reload) rh_status_q exit 7

47 force-reload) force_reload status) rh_status condrestart try-restart) rh_status_q exit 0 restart *) echo $"Usage: $0 {start stop status restart condrestart try-restart reload force-reload" exit 2 esac exit $? # 在 /etc/init.d/ 下建立名为 nova-volume 的 NOVA-VOLUME 服务启动脚本, 内容如下 : #!/bin/sh # # openstack-nova-volume OpenStack Nova Volume Worker # # chkconfig: # description: Volume Workers interact with iscsi storage to manage \ # LVM-based instance volumes. Specific functions include: \ # * Create Volumes \ # * Delete Volumes \ # * Establish Compute volumes ### BEGIN INIT INFO # Provides: # Required-Start: $remote_fs $network $syslog # Required-Stop: $remote_fs $syslog # Default-Stop: # Short-Description: OpenStack Nova Volume Worker # Description: Volume Workers interact with iscsi storage to manage # LVM-based instance volumes. Specific functions include: # * Create Volumes # * Delete Volumes # * Establish Compute volumes ### END INIT INFO. /etc/rc.d/init.d/functions

48 suffix=volume prog=openstack-nova-$suffix exec="/usr/bin/nova-$suffix" config="/etc/nova/nova.conf" pidfile="/var/run/nova/nova-$suffix.pid" logfile="/var/log/nova/$suffix.log" [ -e /etc/sysconfig/$prog ] &&. /etc/sysconfig/$prog lockfile=/var/lock/nova/$prog start() { [ -x $exec ] exit 5 [ -f $config ] exit 6 echo -n $"Starting $prog: " daemon --user nova --pidfile $pidfile "$exec --config-file=$config --logfile=$logfile &>/dev/nu ll & echo \$! > $pidfile" retval=$? echo [ $retval -eq 0 ] && touch $lockfile return $retval stop() { echo -n $"Stopping $prog: " killproc -p $pidfile $prog retval=$? echo [ $retval -eq 0 ] && rm -f $lockfile return $retval restart() { stop start reload() { restart force_reload() { restart

49 rh_status() { status -p $pidfile $prog rh_status_q() { rh_status >/dev/null 2>&1 case "" in start) rh_status_q && exit 0 stop) rh_status_q exit 0 restart) reload) rh_status_q exit 7 force-reload) force_reload status) rh_status condrestart try-restart) rh_status_q exit 0 restart *) echo $"Usage: $0 {start stop status restart condrestart try-restart reload force-reload" exit 2 esac exit $? # 配置启动脚本 :

50 chmod 755 /etc/init.d/nova-api chmod 755 /etc/init.d/nova-network chmod 755 /etc/init.d/nova-objectstore chmod 755 /etc/init.d/nova-scheduler chmod 755 /etc/init.d/nova-volume mkdir /var/run/nova mkdir -p /var/lib/nova/instances mkdir /var/lock/nova chown nova:root /var/run/nova chown -R nova:nova /var/lib/nova chown nova:root /var/lock/nova # 配置 sudo 在 /etc/sudoers.d/ 建立 nova 文件, 内容如下 : Defaults:nova!requiretty Cmnd_Alias NOVACMDS = /bin/aoe-stat, \ /bin/chmod, \ /bin/chmod /var/lib/nova/tmp/*/root/.ssh, \ /bin/chown, \ /bin/chown /var/lib/nova/tmp/*/root/.ssh, \ /bin/dd, \ /bin/kill, \ /bin/mkdir, \ /bin/mount, \ /bin/umount, \ /sbin/aoe-discover, \ /sbin/ifconfig, \ /sbin/ip, \ /sbin/ip6tables-restore, \ /sbin/ip6tables-save, \ /sbin/iptables, \ /sbin/iptables-restore, \ /sbin/iptables-save, \ /sbin/iscsiadm, \ /sbin/kpartx, \ /sbin/losetup, \ /sbin/lvcreate, \ /sbin/lvdisplay, \ /sbin/lvremove, \ /sbin/pvcreate, \ /sbin/route, \ /sbin/tune2fs, \ /sbin/vconfig, \

51 /sbin/vgcreate, \ /sbin/vgs, \ /usr/bin/fusermount, \ /usr/bin/guestmount, \ /usr/bin/socat, \ /bin/cat, \ /usr/bin/tee, \ /usr/bin/qemu-nbd, \ /usr/bin/virsh, \ /usr/sbin/brctl, \ /usr/sbin/dnsmasq, \ /usr/sbin/ietadm, \ /usr/sbin/radvd, \ /usr/sbin/tgtadm, \ /usr/sbin/vblade-persist nova ALL = (root) NOPASSWD: SETENV: NOVACMDS chmod 0440 /etc/sudoers.d/nova # 配置 polkit 策略在 /etc/polkit-1/localauthority/50-local.d/ 建立 50-nova.pkla, 内容如下 : [Allow nova libvirt management permissions] Identity=unix-user:nova Action=org.libvirt.unix.manage ResultAny=yes ResultInactive=yes ResultActive=yes # 建立 NOVA 服务数据库结构 nova-manage db sync # 安装 iscsitarget wget forge.net/projects/iscsitarget/files/iscsitarget/ /iscsitarget tar.gz/dow nload -P /opt cd /opt tar xf iscsitarget tar.gz cd iscsitarget make make install /etc/init.d/iscsi-target start netstat -ltnp 查看是否有 tcp 3260 端口监听 # 建立 nova-volumes 卷 fdisk /dev/sdb

52 n p 1 两次回车 t 83 w mkfs.ext4 /dev/sdb1 vgcreate nova-volumes /dev/sdb1 # 启动 NOVA 相关服务 /etc/init.d/nova-api start /etc/init.d/nova-network start /etc/init.d/nova-objectstore start /etc/init.d/nova-scheduler start /etc/init.d/nova-volume start # 检测服务是否正常启动 通过 netstat -ltunp 查看是否有 tcp 端口监听 如果没有正常启动请查看 /var/log/nova 目录下相关文件排错 # 建立 SWIFT 服务配置文件存放目录 mkdir /etc/swift SWIFT 对象存储服务配置 # 建立 SWIFT 服务启动用户 useradd -s /sbin/nologin -m -d /var/log/swift swift # 格式化硬盘及挂载 yum -y install xfsprogs mkfs.xfs -f -i size=1024 /dev/sdc mkfs.xfs -f -i size=1024 /dev/sdd mkdir -p /swift/drivers/sd{c,d mount -t xfs -o noatime,nodiratime,nobarrier,logbufs=8 /dev/sdc /swift/drivers/sdc mount -t xfs -o noatime,nodiratime,nobarrier,logbufs=8 /dev/sdd /swift/drivers/sdd echo -e '/dev/sdc\t/swift/drivers/sdc\txfs\tnoatime,nodiratime,nobarrier,logbufs=8\t0 0' >>/etc/fstab echo -e '/dev/sdd\t/swift/drivers/sdd\txfs\tnoatime,nodiratime,nobarrier,logbufs=8\t0 0' >>/etc/fstab # swift 同步相关配置 mkdir -p /swift/node/sd{c,d ln -sv /swift/drivers/sdc /swift/node/