Innhold
- 1 Initielt oppsett
- 2 Installasjon av database
- 3 Installasjon av message broker
- 4 Keystone
- 5 Glance
- 6 Neutron
- 6.1 Lage Database
- 6.2 Lage bruker etc.
- 6.3 Skru av network-manager
- 6.4 Installasjon
- 6.5 Fikse firewall
- 6.6 Konfigurere neutron
- 6.7 Konfigurere message broker (QPID)
- 6.8 Konfigurere plugin (Open vSwitch)
- 6.9 Konfigurere database connection
- 6.10 Starte tjenesten
- 6.11 Konfigurere DHCP-agent
- 6.12 Konfigurere eksternt nettverk
- 6.13 Konfigurere Open vSwitch
- 6.14 Konfigurere L3-agenten
- 7 VNC proxy for Nova
- 8 Installere en compute node (Nova)
- 8.1 Compute-tjenester
- 8.2 Lage database
- 8.3 Lage bruker etc.
- 8.4 Installere
- 8.5 Konfigurere autentisering
- 8.6 Konfigurere database
- 8.7 Konfigurere message broker (QPID)
- 8.8 Konfigurere nettverk
- 8.9 Konfigurere QPID til neutron på compute-node
- 8.10 Konfigurere L2-agenten
- 8.11 Konfigurere Virtual Interface Plugging
- 8.12 Konfigurere firewall
- 8.13 Populere databasen
- 8.14 Starte tjenestene
- 8.15 Konfigurere plugin (Open vSwitch)
- 8.16 Test av Nova
- 9 Horizon
- 10 Telemetri/Ceilometer
- 11 Cinder
- 11.1 Oppsett av RHSS
- 11.2 Lage database
- 11.3 Lage bruker etc.
- 11.4 Installasjon
- 11.5 Konfigurere autentisering
- 11.6 Konfigurere SSL
- 11.7 Konfigurere QPID
- 11.8 Konfigurere database
- 11.9 Firewall
- 11.10 Populere database
- 11.11 Konfigurere SELinux
- 11.12 Konfigurere for RHSS
- 11.13 Konfigurere tgtd
- 11.14 Starte tjenestene
- 11.15 Test av cinder
- 12 Swift
- 13 Glance over til RHSS
- 14 Nova over til RHSS
- 15 Heat
Notat
Dokumentasjon fra Red Hat: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/
1 Initielt oppsett
Involverte maskiner:
- rhos-controller.uio.no (controller)
- rhos-network.uio.no (network)
- rhos-compute01.uio.no (compute)
- rhos-storage01.uio.no (Red Hat Storage)
- rhos-storage02.uio.no (Red Hat Storage)
Involverte nett:
| 129.240.148.192/26 | iaas-mgmt, vlan864 |
| 129.240.149.0/26 | iaas-admin, vlan846 |
| 129.240.149.64/26 | iaas-storage, vlan847 |
| 129.240.149.128/26 | iaas-ekstern, vlan848 |
| 129.240.149.192/26 | iaas-api, vlan849 |
1.1 Nettverk
Konfigurerte API-nett på alle noder, i filen /etc/sysconfig/network-scripts/ifcfg-em2, eksempel fra rhos-controller:
DEVICE="em2" BOOTPROTO="static" DNS1="129.240.2.27" DNS2="129.240.2.40" HWADDR="D0:67:E5:EF:13:44" IPADDR="129.240.149.228" IPV6INIT="yes" NETMASK="255.255.255.192" NM_CONTROLLED="no" ONBOOT="yes" TYPE="Ethernet" UUID="edf5875c-3de4-4108-8e9d-f3026ac1f8c5"
1.2 Installasjon av software requirements
Installerte yum priorities-plugin:
yum install -y yum-plugin-priorities
Legger til openstack-repo rhel-x86_64-server-6-ost-4:
rhn-channel -a -c rhel-x86_64-server-6-ost-4
Legger inn i /etc/yum/pluginconf.d/rhnplugin.conf:
[rhel-x86_64-server-6-ost-4] priority = 1
Oppdaterer:
yum -y update
Rebootet:
reboot
2 Installasjon av database
Viktig
FIXME: Lage eget filsystem for MySQL.
Databasen kjører på controller-noden. På rhos-controller:
yum install -y mysql-server
Konfigurerer iptables:
iptables -A INPUT -p tcp -m multiport --dports 3306 -j ACCEPT iptables-save > /etc/sysconfig/iptables
Starter mysql og sørger for at den kjører ved boot:
service mysqld start chkconfig mysqld on
Sette db-passord:
dbpw=$(openssl rand -hex 10) echo $dbpw > ~/mysql_password /usr/bin/mysqladmin -u root password "$dbpw"
3 Installasjon av message broker
Denne kjører på controller-noden. På rhos-controller:
yum install -y qpid-cpp-server qpid-cpp-server-ssl
Konfigurerer SASL for qpidd:
cinder_saslpw=$(openssl rand -hex 10) neutron_saslpw=$(openssl rand -hex 10) nova_saslpw=$(openssl rand -hex 10) glance_saslpw=$(openssl rand -hex 10) echo $cinder_saslpw | saslpasswd2 -f /var/lib/qpidd/qpidd.sasldb -u QPID cinder -p echo $neutron_saslpw | saslpasswd2 -f /var/lib/qpidd/qpidd.sasldb -u QPID neutron -p echo $nova_saslpw | saslpasswd2 -f /var/lib/qpidd/qpidd.sasldb -u QPID nova -p echo $glance_saslpw | saslpasswd2 -f /var/lib/qpidd/qpidd.sasldb -u QPID glance -p
Tar vare på passord:
echo "CINDER_QPID_SASL=$cinder_saslpw" >> ~/passwords.sh echo "NEUTRON_QPID_SASL=$neutron_saslpw" >> ~/passwords.sh echo "NOVA_QPID_SASL=$nova_saslpw" >> ~/passwords.sh echo "GLANCE_QPID_SASL=$glance_saslpw" >> ~/passwords.sh
Lister opp SASL-brukere:
[root@rhos-controller ~]# sasldblistusers2 -f /var/lib/qpidd/qpidd.sasldb glance@QPID: userPassword nova@QPID: userPassword cinder@QPID: userPassword neutron@QPID: userPassword
Bekrefter at /etc/qpidd.conf inneholder:
auth=yes
FIXME Måtte endre til auth=no pga. problemer med glance.
Fikser iptables:
iptables -A INPUT -p tcp -m tcp --dport 5672 -j ACCEPT iptables-save > /etc/sysconfig/iptables
Starter tjenesten og sørger for at den kjører ved boot:
service qpidd start chkconfig qpidd on
4 Keystone
Denne kjører på controller-noden.
4.1 Installasjon
På rhos-controller:
yum install -y openstack-keystone \
openstack-utils \
openstack-selinux
4.2 Lage database
Lage database for keystone:
Lage passord for keystone-databasen, til keystone-brukeren:
pw=$(openssl rand -hex 10) echo "KEYSTONE_DBPASS=$pw" >> ~/passwords.sh
Koble til mysql som root:
mysql -u root -p
Lage keystone-database:
mysql> CREATE DATABASE keystone; Query OK, 1 row affected (0.00 sec)
Lage bruker for keystone og gi den tilgang til databasen:
mysql> GRANT ALL ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'sensurert'; Query OK, 0 rows affected (0.00 sec) mysql> GRANT ALL ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'sensurert'; Query OK, 0 rows affected (0.00 sec)
Flush for å sørge for at endringen trer i kraft umiddelbart:
mysql> FLUSH PRIVILEGES; Query OK, 0 rows affected (0.00 sec)
Exit:
mysql> quit Bye
4.3 Service token
Lager et service token for tjenesten og konfigurerer keystone til å bruke den:
export SERVICE_TOKEN=$(openssl rand -hex 10) echo $SERVICE_TOKEN > ~/ks_admin_token openstack-config --set /etc/keystone/keystone.conf \ DEFAULT admin_token $SERVICE_TOKEN
4.4 Database-tilgang
Konfigurerer database-tilgang (FIXME: API):
source ~/passwords.sh
openstack-config --set /etc/keystone/keystone.conf \
sql connection mysql://keystone:${KEYSTONE_DBPASS}@localhost/keystone
4.5 Sertifikater
Lager nøkler og sertifikater for keystone (FIXME: Kanskje sette fornuftig commonname etc.):
keystone-manage pki_setup \ --keystone-user keystone \ --keystone-group keystone
Sørger for at ting har riktig eier/gruppe:
chown -R keystone:keystone /var/log/keystone \ /etc/keystone/ssl/
Konfigurerer keystone til å bruke PKI-filene vi nettopp har laget:
openstack-config --set /etc/keystone/keystone.conf \ signing token_format PKI openstack-config --set /etc/keystone/keystone.conf \ signing certfile /etc/keystone/ssl/certs/signing_cert.pem openstack-config --set /etc/keystone/keystone.conf \ signing keyfile /etc/keystone/ssl/private/signing_key.pem openstack-config --set /etc/keystone/keystone.conf \ signing ca_certs /etc/keystone/ssl/certs/ca.pem openstack-config --set /etc/keystone/keystone.conf \ signing key_size 1024 openstack-config --set /etc/keystone/keystone.conf \ signing valid_days 3650 openstack-config --set /etc/keystone/keystone.conf \ signing ca_password None
4.6 Iptables
Fikser iptables:
iptables -A INPUT -p tcp -m multiport --dports 5000,35357 -j ACCEPT iptables-save > /etc/sysconfig/iptables
4.7 Populere databasen
Populerer keystone-databasen:
su keystone -s /bin/sh -c "keystone-manage db_sync"
4.8 Starte tjenesten
Starter keystone og sørger for at den kjører ved boot:
service openstack-keystone start chkconfig openstack-keystone on
4.9 Lage endpoint
Sette variabel for token:
export SERVICE_TOKEN=$(cat ~/ks_admin_token)
Sette variabel for endpoint:
export SERVICE_ENDPOINT="http://rhos-controller-api.uio.no:35357/v2.0"
Lage service-entry:
# keystone service-create --name=keystone --type=identity \ --description="Keystone Identity Service" +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Keystone Identity Service | | id | 0f22480f7c8242c4940507131d4f6cc4 | | name | keystone | | type | identity | +-------------+----------------------------------+Lage endpoint for API:
# keystone endpoint-create \ --service_id 0f22480f7c8242c4940507131d4f6cc4 \ --publicurl 'http://rhos-controller-api.uio.no:5000/v2.0' \ --adminurl 'http://rhos-controller-api.uio.no:35357/v2.0' \ --internalurl 'http://rhos-controller-api.uio.no:5000/v2.0' +-------------+----------------------------------------------+ | Property | Value | +-------------+----------------------------------------------+ | adminurl | http://rhos-controller-api.uio.no:35357/v2.0 | | id | d1e77289e1d447e394d4ff7ad24a4bcd | | internalurl | http://rhos-controller-api.uio.no:5000/v2.0 | | publicurl | http://rhos-controller-api.uio.no:5000/v2.0 | | region | regionOne | | service_id | 0f22480f7c8242c4940507131d4f6cc4 | +-------------+----------------------------------------------+
4.10 Lage admin-konto
Sette variabel for token:
export SERVICE_TOKEN=$(cat ~/ks_admin_token)
Sette variabel for endpoint:
export SERVICE_ENDPOINT="http://rhos-controller-api.uio.no:35357/v2.0"
Generere passord for admin:
ADMIN_PASS=$(openssl rand -hex 10) echo "ADMIN_PASS=$ADMIN_PASS" >> ~/passwords.sh
Lage admin-bruker:
# keystone user-create --name admin --pass $ADMIN_PASS +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | email | | | enabled | True | | id | 76a8fd108d16455da87d31175156bf5f | | name | admin | +----------+----------------------------------+
Lage admin-rolle:
# keystone role-create --name admin +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | id | 5e11ecd2aed6437abed9188abb6f1292 | | name | admin | +----------+----------------------------------+
Lage admin-tenant:
# keystone tenant-create --name admin +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | | | enabled | True | | id | 0b13f50bbb1a4b46b884a69cdc950903 | | name | admin | +-------------+----------------------------------+
Knytte admin-konto sammen med admin-rollen vha. admin-tenant:
# keystone user-role-add \ --user-id 76a8fd108d16455da87d31175156bf5f \ --role-id 5e11ecd2aed6437abed9188abb6f1292 \ --tenant-id 0b13f50bbb1a4b46b884a69cdc950903Lage bash-fil for admin. Laget en fil ~/keystonerc_admin med innhold:
export OS_USERNAME=admin export OS_TENANT_NAME=admin export OS_PASSWORD=<sensurert> export OS_AUTH_URL=http://rhos-controller-api.uio.no:35357/v2.0/ export PS1='[\u@\h \W(keystone_admin)]\$ '
4.11 Lage vanlig bruker
Vi lager en vanlig bruker "user".
Generere passord for "user":
USER_PASS=$(openssl rand -hex 10) echo "USER_PASS=$USER_PASS" >> ~/passwords.sh
Lage bruker:
# keystone user-create --name user --pass $USER_PASS +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | email | | | enabled | True | | id | 632e1c5e207347ff8f68337d0ffb91d0 | | name | user | +----------+----------------------------------+
Lage rollen "Member":
# keystone role-create --name Member +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | id | a062ae1bdd5f4796ad5b50a4f1f587ce | | name | Member | +----------+----------------------------------+
Lage tenant:
# keystone tenant-create --name user +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | | | enabled | True | | id | 00e3bfb9a9734e40b172d79068e7105d | | name | user | +-------------+----------------------------------+
Knytte kontoen sammen med Member-rollen vha. user-tenant:
# keystone user-role-add \ --user-id 632e1c5e207347ff8f68337d0ffb91d0 \ --role-id a062ae1bdd5f4796ad5b50a4f1f587ce \ --tenant-id 00e3bfb9a9734e40b172d79068e7105dLage bash-fil for "user". Laget en fil ~/keystonerc_user med innhold:
export OS_USERNAME=user export OS_TENANT_NAME=user export OS_PASSWORD=<sensurert> export OS_AUTH_URL=http://rhos-controller-api.uio.no:35357/v2.0/ export PS1='[\u@\h \W(keystone_user)]\$ '
4.12 Lage tenant "services"
Lage tenant:
# keystone tenant-create --name services --description "Services Tenant" +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Services Tenant | | enabled | True | | id | 7393281e101649fd88b43ce274e6dd4e | | name | services | +-------------+----------------------------------+
5 Glance
Vi bruker lokal lagring i første omgang. Tjenesten kjører på controller-noden, rhos-controller.uio.no.
5.2 Lage database
Lage database for glance:
Lage passord for glance-databasen, til glance-brukeren:
GLANCE_DBPASS=$(openssl rand -hex 10) echo "GLANCE_DBPASS=$GLANCE_DBPASS" >> ~/passwords.sh
Koble til mysql som root:
mysql -u root -p
Lage glance-database:
mysql> CREATE DATABASE glance; Query OK, 1 row affected (0.00 sec)
Lage bruker for glance og gi den tilgang til databasen:
mysql> GRANT ALL ON glance.* TO 'glance'@'%' IDENTIFIED BY 'sensurert'; Query OK, 0 rows affected (0.00 sec) mysql> GRANT ALL ON glance.* TO 'glance'@'localhost' IDENTIFIED BY 'sensurert'; Query OK, 0 rows affected (0.00 sec)
Flush for å sørge for at endringen trer i kraft umiddelbart:
mysql> FLUSH PRIVILEGES; Query OK, 0 rows affected (0.00 sec)
Exit:
mysql> quit Bye
5.3 Lage bruker etc.
Lage passord for glance:
GLANCE_PASS=$(openssl rand -hex 10) echo "GLANCE_PASS=$GLANCE_PASS" >> ~/passwords.sh
Lage bruker "glance":
# keystone user-create --name glance --pass $GLANCE_PASS +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | email | | | enabled | True | | id | 91ed11332f2c43b0927ebf4cca3d9214 | | name | glance | +----------+----------------------------------+
Finne ID for admin-rollen:
# keystone role-get admin +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | id | 5e11ecd2aed6437abed9188abb6f1292 | | name | admin | +----------+----------------------------------+
Finne ID for services-tenant:
# keystone tenant-list | grep services | 7393281e101649fd88b43ce274e6dd4e | services | True |
Linker glance-brukeren sammen med admin-rollen i tenant "services":
# keystone user-role-add \ --user-id 91ed11332f2c43b0927ebf4cca3d9214 \ --role-id 5e11ecd2aed6437abed9188abb6f1292 \ --tenant-id 7393281e101649fd88b43ce274e6dd4eLage service-entry for glance:
# keystone service-create --name glance \ --type image \ --description "Glance Image Service" +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Glance Image Service | | id | d6e7dd8b6e3447a8a7618b497600e6fc | | name | glance | | type | image | +-------------+----------------------------------+Lage endpoint-entry:
# keystone endpoint-create --service-id d6e7dd8b6e3447a8a7618b497600e6fc \ --publicurl "http://rhos-controller-api.uio.no:9292" \ --adminurl "http://rhos-controller-api.uio.no:9292" \ --internalurl "http://rhos-controller-api.uio.no:9292" +-------------+----------------------------------------+ | Property | Value | +-------------+----------------------------------------+ | adminurl | http://rhos-controller-api.uio.no:9292 | | id | 6cd2c780c6714d9d97bcab4259215ec9 | | internalurl | http://rhos-controller-api.uio.no:9292 | | publicurl | http://rhos-controller-api.uio.no:9292 | | region | regionOne | | service_id | d6e7dd8b6e3447a8a7618b497600e6fc | +-------------+----------------------------------------+
5.4 Konfigurere database connection
Konfigurerer /etc/glance/glance-api.conf:
openstack-config --set /etc/glance/glance-api.conf \ DEFAULT sql_connection \ mysql://glance:${GLANCE_DBPASS}@localhost/glanceKonfigurerer /etc/glance/glance-registry.conf:
openstack-config --set /etc/glance/glance-registry.conf \ DEFAULT sql_connection \ mysql://glance:${GLANCE_DBPASS}@localhost/glance
5.5 Konfigurere til å bruke keystone
Konfigurere tjenesten glance-api:
openstack-config --set /etc/glance/glance-api.conf \ paste_deploy flavor keystone openstack-config --set /etc/glance/glance-api.conf \ keystone_authtoken auth_host rhos-controller-api.uio.no openstack-config --set /etc/glance/glance-api.conf \ keystone_authtoken auth_port 35357 openstack-config --set /etc/glance/glance-api.conf \ keystone_authtoken auth_protocol http openstack-config --set /etc/glance/glance-api.conf \ keystone_authtoken admin_tenant_name services openstack-config --set /etc/glance/glance-api.conf \ keystone_authtoken admin_user glance openstack-config --set /etc/glance/glance-api.conf \ keystone_authtoken admin_password $GLANCE_PASS
Konfigurere tjenesten glance-registry:
openstack-config --set /etc/glance/glance-registry.conf \ paste_deploy flavor keystone openstack-config --set /etc/glance/glance-registry.conf \ keystone_authtoken auth_host rhos-controller-api.uio.no openstack-config --set /etc/glance/glance-registry.conf \ keystone_authtoken auth_port 35357 openstack-config --set /etc/glance/glance-registry.conf \ keystone_authtoken auth_protocol http openstack-config --set /etc/glance/glance-registry.conf \ keystone_authtoken admin_tenant_name services openstack-config --set /etc/glance/glance-registry.conf \ keystone_authtoken admin_user glance openstack-config --set /etc/glance/glance-registry.conf \ keystone_authtoken admin_password $GLANCE_PASS
5.6 Konfigurere autentisering mot QPID
Følgende ble gjort:
openstack-config --set /etc/glance/glance-api.conf \ DEFAULT qpid_username glance openstack-config --set /etc/glance/glance-api.conf \ DEFAULT qpid_password $GLANCE_QPID_SASL
Men dette fungerte ikke, så vi skrudde av autentisering i QPID (FIXME).
5.7 Lage filsystem
Lage filsystem:
lvcreate -L20g -n images internvg mkfs.ext4 /dev/internvg/images
Legge inn i fstab:
/dev/mapper/internvg-images /var/lib/glance/images ext4 defaults 1 2
Lage mountpoint og montere:
mkdir /var/lib/glance/images mount /var/lib/glance/images
chown:
chown glance:glance /var/lib/glance/images restorecon -Rv /var/lib/glance
5.8 Konfigurere firewall
Editere /etc/glance/glance-api.conf, legge inn eller kommentere inn:
bind_host = 0.0.0.0 bind_port = 9292
Fikse iptables:
iptables -A INPUT -p tcp -m multiport --dports 9292 -j ACCEPT iptables-save > /etc/sysconfig/iptables
5.10 Starte tjenesten
Starte tjenesten og sørge for at den kjører ved boot:
service openstack-glance-registry start service openstack-glance-api start chkconfig openstack-glance-registry on chkconfig openstack-glance-api on
5.11 Teste tjenesten
Laster ned et image:
cd /tmp wget http://cdn.download.cirros-cloud.net/0.3.1/cirros-0.3.1-x86_64-disk.img
Laster opp imaget:
# glance image-create --name="CirrOS 0.3.1" \
--disk-format=qcow2 --container-format=bare \
--is-public=true < /tmp/cirros-0.3.1-x86_64-disk.img
6 Neutron
6.1 Lage Database
Lage database for neutron:
Lage passord for neutron-databasen, til neutron-brukeren:
NEUTRON_DBPASS=$(openssl rand -hex 10) echo "NEUTRON_DBPASS=$NEUTRON_DBPASS" >> ~/passwords.sh
Koble til mysql som root:
mysql -u root -p
Lage neutron-database:
mysql> CREATE DATABASE ovs_neutron; Query OK, 1 row affected (0.00 sec)
Lage bruker for neutron og gi den tilgang til databasen:
mysql> GRANT ALL ON ovs_neutron.* TO 'neutron'@'%' IDENTIFIED BY 'sensurert'; Query OK, 0 rows affected (0.00 sec) mysql> GRANT ALL ON ovs_neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'sensurert'; Query OK, 0 rows affected (0.00 sec)
Flush for å sørge for at endringen trer i kraft umiddelbart:
mysql> FLUSH PRIVILEGES; Query OK, 0 rows affected (0.00 sec)
Exit:
mysql> quit Bye
6.2 Lage bruker etc.
Lage passord for neutron:
NEUTRON_PASS=$(openssl rand -hex 10) echo "NEUTRON_PASS=$NEUTRON_PASS" >> ~/passwords.sh
Lage bruker "neutron":
# keystone user-create --name neutron --pass $NEUTRON_PASS +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | email | | | enabled | True | | id | a63db89386504f64b5275dfd26b5a4d0 | | name | neutron | +----------+----------------------------------+
Finne ID for admin-rollen:
# keystone role-get admin +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | id | 5e11ecd2aed6437abed9188abb6f1292 | | name | admin | +----------+----------------------------------+
Finne ID for services-tenant:
# keystone tenant-list | grep services | 7393281e101649fd88b43ce274e6dd4e | services | True |
Linker neutron-brukeren sammen med admin-rollen i tenant "services":
# keystone user-role-add \ --user-id a63db89386504f64b5275dfd26b5a4d0 \ --role-id 5e11ecd2aed6437abed9188abb6f1292 \ --tenant-id 7393281e101649fd88b43ce274e6dd4eLage service-entry for neutron:
# keystone service-create --name neutron \ --type network \ --description "OpenStack Networking Service" +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | OpenStack Networking Service | | id | df631864c07d4ba58fe5371414783a42 | | name | neutron | | type | network | +-------------+----------------------------------+Lage endpoint-entry:
# keystone endpoint-create --service-id df631864c07d4ba58fe5371414783a42 \ --publicurl "http://rhos-network-api.uio.no:9696" \ --adminurl "http://rhos-network-api.uio.no:9696" \ --internalurl "http://rhos-network-api.uio.no:9696" +-------------+-------------------------------------+ | Property | Value | +-------------+-------------------------------------+ | adminurl | http://rhos-network-api.uio.no:9696 | | id | bc72a6f803c946349319dc7a20c50a63 | | internalurl | http://rhos-network-api.uio.no:9696 | | publicurl | http://rhos-network-api.uio.no:9696 | | region | regionOne | | service_id | df631864c07d4ba58fe5371414783a42 | +-------------+-------------------------------------+
6.3 Skru av network-manager
Network Manager var ikke installert.
6.4 Installasjon
Installerte på rhos-network.uio.no:
yum install -y openstack-neutron \ openstack-neutron-openvswitch \ openstack-utils \ openstack-selinux
6.5 Fikse firewall
iptables:
iptables -A INPUT -p tcp -m multiport --dports 9696 -j ACCEPT iptables-save > /etc/sysconfig/iptables
6.6 Konfigurere neutron
Sette auth_strategy:
openstack-config --set /etc/neutron/neutron.conf \ DEFAULT auth_strategy keystone
Sette authentication host:
openstack-config --set /etc/neutron/neutron.conf \ keystone_authtoken auth_host rhos-controller-api.uio.no
Sette admin_tenant_name:
openstack-config --set /etc/neutron/neutron.conf \ keystone_authtoken admin_tenant_name services
Sette admin user name:
openstack-config --set /etc/neutron/neutron.conf \ keystone_authtoken admin_user neutron
Sette passord:
openstack-config --set /etc/neutron/neutron.conf \ keystone_authtoken admin_password <sensurert>
6.7 Konfigurere message broker (QPID)
Sette RPC backend til QPID:
openstack-config --set /etc/neutron/neutron.conf \ DEFAULT rpc_backend neutron.openstack.common.rpc.impl_qpid
Sette QPID hostname:
openstack-config --set /etc/neutron/neutron.conf \ DEFAULT qpid_hostname rhos-controller-api.uio.no
6.8 Konfigurere plugin (Open vSwitch)
Lage symlink:
ln -s /etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini \ /etc/neutron/plugin.iniSette på tunneling, sette type GRE og tunnel id range:
openstack-config --set /etc/neutron/plugin.ini \ OVS enable_tunneling True openstack-config --set /etc/neutron/plugin.ini \ OVS tenant_network_type gre openstack-config --set /etc/neutron/plugin.ini \ OVS tunnel_id_ranges "1:1000"
Sette hvilke bridger som skal brukes til tunnellering:
openstack-config --set /etc/neutron/plugin.ini \ OVS integration_bridge br-int openstack-config --set /etc/neutron/plugin.ini \ OVS tunnel_bridge br-tun
Lokal IP/nett som skal brukes for GRE ut (em1 på hver host):
openstack-config --set /etc/neutron/plugin.ini \ OVS local_ip 129.240.149.37
Sette core_plugin til OVS:
openstack-config --set /etc/neutron/neutron.conf \ DEFAULT core_plugin \ neutron.plugins.openvswitch.ovs_neutron_plugin.OVSNeutronPluginV2
6.9 Konfigurere database connection
Sette database:
openstack-config --set /etc/neutron/plugin.ini \ DATABASE sql_connection \ mysql://neutron:<sensurert>@rhos-controller-api.uio.no/ovs_neutron
6.10 Starte tjenesten
Notat
Dette var ikke dokumentert.
Su til neutron:
su neutron -s /bin/sh
Initialisere databasen:
$ neutron-db-manage \
--config-file /usr/share/neutron/neutron-dist.conf \
--config-file /etc/neutron/neutron.conf \
--config-file /etc/neutron/plugin.ini stamp havana
No handlers could be found for logger "neutron.common.legacy"
INFO [alembic.migration] Context impl MySQLImpl.
INFO [alembic.migration] Will assume non-transactional DDL.
Starte tjenesten og sørge for at den kjører ved boot:
service neutron-server start chkconfig neutron-server on
6.11 Konfigurere DHCP-agent
6.11.1 Autentisering
Sette auth_strategy:
openstack-config --set /etc/neutron/dhcp_agent.ini \ DEFAULT auth_strategy keystone
Sette authentication host:
openstack-config --set /etc/neutron/dhcp_agent.ini \ keystone_authtoken auth_host rhos-controller-api.uio.no
Sette admin_tenant_name:
openstack-config --set /etc/neutron/dhcp_agent.ini \ keystone_authtoken admin_tenant_name services
Sette admin_user:
openstack-config --set /etc/neutron/dhcp_agent.ini \ keystone_authtoken admin_user neutron
Sette passord:
openstack-config --set /etc/neutron/dhcp_agent.ini \ keystone_authtoken admin_password <sensurert>
6.11.2 Interface driver
Sette interface_driver:
openstack-config --set /etc/neutron/dhcp_agent.ini \ DEFAULT interface_driver \ neutron.agent.linux.interface.OVSInterfaceDriver
6.11.3 Starte DHCP-agenten
Starte DHCP-agenten og sørge for at den kjører ved boot:
service neutron-dhcp-agent start chkconfig neutron-dhcp-agent on
6.12 Konfigurere eksternt nettverk
Lager et eksternt nett:
# neutron net-create ex-net --router:external=True Created a new network: +---------------------------+--------------------------------------+ | Field | Value | +---------------------------+--------------------------------------+ | admin_state_up | True | | id | 33974169-9da3-4460-9d6d-6f9c656294c6 | | name | ex-net | | provider:network_type | gre | | provider:physical_network | | | provider:segmentation_id | 1 | | router:external | True | | shared | False | | status | ACTIVE | | subnets | | | tenant_id | 0b13f50bbb1a4b46b884a69cdc950903 | +---------------------------+--------------------------------------+
Definerer et subnett på det eksterne nettet, med allocation pool:
# neutron subnet-create --gateway 129.240.149.129 \
--allocation-pool start=129.240.149.170,end=129.240.149.179 \
--disable-dhcp ex-net 129.240.149.128/26
Created a new subnet:
+------------------+--------------------------------------------------------+
| Field | Value |
+------------------+--------------------------------------------------------+
| allocation_pools | {"start": "129.240.149.170", "end": "129.240.149.179"} |
| cidr | 129.240.149.128/26 |
| dns_nameservers | |
| enable_dhcp | False |
| gateway_ip | 129.240.149.129 |
| host_routes | |
| id | 4b6d46de-58f8-4e52-bd11-d81151afc43e |
| ip_version | 4 |
| name | |
| network_id | 33974169-9da3-4460-9d6d-6f9c656294c6 |
| tenant_id | 0b13f50bbb1a4b46b884a69cdc950903 |
+------------------+--------------------------------------------------------+
Satte feil gateway (skal være IP-en til br-ex), oppdaterte med:
# neutron subnet-update 4b6d46de-58f8-4e52-bd11-d81151afc43e --gateway_ip 129.240.149.164 Updated subnet: 4b6d46de-58f8-4e52-bd11-d81151afc43e
Satte også navn i etterkant:
# neutron subnet-update 4b6d46de-58f8-4e52-bd11-d81151afc43e --name sub1 Updated subnet: 4b6d46de-58f8-4e52-bd11-d81151afc43e
Lage en router:
# neutron router-create ex-router1 Created a new router: +-----------------------+--------------------------------------+ | Field | Value | +-----------------------+--------------------------------------+ | admin_state_up | True | | external_gateway_info | | | id | a9c981f1-cfd2-4db3-9136-d515cc4a33b2 | | name | ex-router1 | | status | ACTIVE | | tenant_id | 0b13f50bbb1a4b46b884a69cdc950903 | +-----------------------+--------------------------------------+
Sette routeren som gateway til ekstern-nettet:
# neutron router-gateway-set ex-router1 ex-net --disable-snat Set gateway for router ex-router1
FIXME: Har ikke private subnett ennå.
6.13 Konfigurere Open vSwitch
FIXME: Må også gjøres på compute-noder.
Starte tjenesten og sørge for at den kjører ved boot:
service openvswitch start chkconfig openvswitch on
Lager intern bridge:
ovs-vsctl add-br br-int
Lager /etc/sysconfig/network-scripts/ifcfg-br-int med innhold:
DEVICE=br-int DEVICETYPE=ovs TYPE=OVSBridge ONBOOT=yes BOOTPROTO=none
Starte agenten og sørge for at den kjører ved boot:
service neutron-openvswitch-agent start chkconfig neutron-openvswitch-agent on
Sørge for at ovs-cleanup kjører ved boot:
chkconfig neutron-ovs-cleanup on
6.14 Konfigurere L3-agenten
6.14.1 Autentisering
Sette auth_strategy:
openstack-config --set /etc/neutron/metadata_agent.ini \ DEFAULT auth_strategy keystone
Sette authentication host:
openstack-config --set /etc/neutron/metadata_agent.ini \ keystone_authtoken auth_host rhos-controller-api.uio.no
Sette admin_tenant_name:
openstack-config --set /etc/neutron/metadata_agent.ini \ keystone_authtoken admin_tenant_name services
Sette admin_user:
openstack-config --set /etc/neutron/metadata_agent.ini \ keystone_authtoken admin_user neutron
Sette passord:
openstack-config --set /etc/neutron/metadata_agent.ini \ keystone_authtoken admin_password $NEUTRON_PASS
6.14.2 Interface driver
Konfigurere interface driver:
openstack-config --set /etc/neutron/l3_agent.ini \ DEFAULT interface_driver \ neutron.agent.linux.interface.OVSInterfaceDriver
6.14.3 Eksternt nettverk
Lage en ekstern bridge:
ovs-vsctl add-br br-ex
Laget en fil /etc/sysconfig/network-scripts/ifcfg-br-ex:
DEVICE=br-ex DEVICETYPE=ovs TYPE=OVSBridge ONBOOT=yes BOOTPROTO=none IPADDR="129.240.149.164" NETMASK="255.255.255.192"
Endret det fysiske grensesnittet (em3) slik i /etc/sysconfig/network-scripts/ifcfg-em3:
DEVICE="em3" HWADDR="D0:67:E5:EF:19:C6" NM_CONTROLLED="no" ONBOOT="yes" BOOTPROTO=none PROMISC=yes TYPE="Ethernet" UUID="34b6346f-aef9-423a-81a2-2b339f0e31eb" ETHTOOL_OPTS="gro off"
Den siste linja slår av "generic receive offloading" som ikke fungerer skikkelig på interface som er routere, se https://bugs.launchpad.net/neutron/+bug/1252900
Ta ned og opp igjen devicene, koble em3 til en port på bridge br-ex:
ifdown br-ex ifdown em3 ifup em3 ifup br-ex ovs-vsctl add-port br-ex em3
Bekrefter at bridge og porter er korrekte:
ovs-vsctl show
Sette riktig bridge i l3_agent.ini:
openstack-config --set /etc/neutron/l3_agent.ini \ DEFAULT external_network_bridge br-ex
6.14.4 Starte L3-agenten
service neutron-l3-agent start chkconfig neutron-l3-agent on
6.14.5 Starte metadata-agenten
service neutron-metadata-agent start chkconfig neutron-metadata-agent on
7 VNC proxy for Nova
Viktig
FIXME: Vi bør sette opp SSL, iptables etc. for dette.
Vi setter opp rhos-controller.uio.no som en VNC proxy for VM-ene.
7.1 Installere pakker
Installere:
yum install -y openstack-nova-novncproxy yum install -y openstack-nova-console
7.2 Firewall
Fikse iptables:
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 6080 -j ACCEPT iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 6081 -j ACCEPT iptables-save > /etc/sysconfig/iptables
7.3 Konfigurasjon
Sette verdier i /etc/nova/nova.conf.
På rhos-controller:
openstack-config --set /etc/nova/nova.conf \ DEFAULT novncproxy_host 0.0.0.0 openstack-config --set /etc/nova/nova.conf \ DEFAULT novncproxy_base_url http://rhos-controller.uio.no:6080/vnc_auto.html
På rhos-compute01:
openstack-config --set /etc/nova/nova.conf \ DEFAULT vncserver_listen 0.0.0.0 openstack-config --set /etc/nova/nova.conf \ DEFAULT vncserver_proxyclient_address 129.240.149.38 openstack-config --set /etc/nova/nova.conf \ DEFAULT novncproxy_base_url http://rhos-controller.uio.no:6080/vnc_auto.html
Konfigurere libvirtd på rhos-compute01. Editer /etc/libvirt/qemu.conf, kommenter inn:
vnc_listen = "0.0.0.0"
Deretter restart libvirtd:
service libvirtd restart
Notat
Eventuelle instanser som kjører (og hvor qemu kun lytter på localhost for VNC) må restartes med:
nova stop <instans> nova start <instans>
7.4 Restarte nova-compute
Restartet nova-compute på rhos-compute01:
service openstack-nova-compute restart
7.5 Starte tjenesten
På rhos-controller.
Starte tjenestene og sørge for at de kjører ved boot:
service openstack-nova-consoleauth start chkconfig openstack-nova-consoleauth on service openstack-nova-novncproxy start chkconfig openstack-nova-novncproxy on
7.6 Test av VNC
Få URL for en instans med:
# nova get-vnc-console test2 novnc +-------+---------------------------------------------------------------------------------------------+ | Type | Url | +-------+---------------------------------------------------------------------------------------------+ | novnc | http://rhos-controller.uio.no:6080/vnc_auto.html?token=3816b99c-fb19-4614-b1c7-630a239d36a6 | +-------+---------------------------------------------------------------------------------------------+
Paste URL-en inn i en nettleser.
8 Installere en compute node (Nova)
8.1 Compute-tjenester
Compute består av flere tjenester. Compute-noder skal være så dumme som mulig, mens API o.l. kjøres på controller:
| Tjeneste | RPM-pakke | Node |
|---|---|---|
| API | openstack-nova-api | rhos-controller |
| Scheduler | openstack-nova-scheduler | rhos-controller |
| Conductor | openstack-nova-conductor | rhos-controller |
| Compute | openstack-nova-compute | rhos-computeXX |
8.2 Lage database
Lage database for nova:
Lage passord for nova-databasen, til nova-brukeren:
NOVA_DBPASS=$(openssl rand -hex 10) echo "NOVA_DBPASS=$NOVA_DBPASS" >> ~/passwords.sh
Koble til mysql som root:
mysql -u root -p
Lage nova-database:
mysql> CREATE DATABASE nova; Query OK, 1 row affected (0.00 sec)
Lage bruker for nova og gi den tilgang til databasen:
mysql> GRANT ALL ON nova.* TO 'nova'@'%' IDENTIFIED BY 'sensurert'; Query OK, 0 rows affected (0.00 sec) mysql> GRANT ALL ON nova.* TO 'nova'@'localhost' IDENTIFIED BY 'sensurert'; Query OK, 0 rows affected (0.00 sec)
Flush for å sørge for at endringen trer i kraft umiddelbart:
mysql> FLUSH PRIVILEGES; Query OK, 0 rows affected (0.00 sec)
Exit:
mysql> quit Bye
8.3 Lage bruker etc.
Gjøres på rhos-controller.uio.no.
Lage passord for nova:
NOVA_PASS=$(openssl rand -hex 10) echo "NOVA_PASS=$NOVA_PASS" >> ~/passwords.sh
Lage bruker "nova":
# keystone user-create --name nova --pass $NOVA_PASS +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | email | | | enabled | True | | id | 2ff7c43f26fe4b7295795a2390b202e3 | | name | nova | +----------+----------------------------------+
Finne ID for admin-rollen:
# keystone role-get admin +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | id | 5e11ecd2aed6437abed9188abb6f1292 | | name | admin | +----------+----------------------------------+
Finne ID for services-tenant:
# keystone tenant-list | grep services | 7393281e101649fd88b43ce274e6dd4e | services | True |
Linker nova-brukeren sammen med admin-rollen i tenant "services":
# keystone user-role-add \ --user-id 2ff7c43f26fe4b7295795a2390b202e3 \ --role-id 5e11ecd2aed6437abed9188abb6f1292 \ --tenant-id 7393281e101649fd88b43ce274e6dd4eLage service-entry for nova:
# keystone service-create --name nova \ --type compute \ --description "OpenStack Compute Service" +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | OpenStack Compute Service | | id | ad0273d4abe143b1abb7b0cdbf241f04 | | name | nova | | type | compute | +-------------+----------------------------------+Lage endpoint-entry:
# keystone endpoint-create --service-id ad0273d4abe143b1abb7b0cdbf241f04 \ --publicurl "http://rhos-controller-api.uio.no:8774/v2/\$(tenant_id)s" \ --adminurl "http://rhos-controller-api.uio.no:8774/v2/\$(tenant_id)s" \ --internalurl "http://rhos-controller-api.uio.no:8774/v2/\$(tenant_id)s" +-------------+---------------------------------------------------------+ | Property | Value | +-------------+---------------------------------------------------------+ | adminurl | http://rhos-controller-api.uio.no:8774/v2/$(tenant_id)s | | id | b4c339c266b740dab8d476c443823f3a | | internalurl | http://rhos-controller-api.uio.no:8774/v2/$(tenant_id)s | | publicurl | http://rhos-controller-api.uio.no:8774/v2/$(tenant_id)s | | region | regionOne | | service_id | ad0273d4abe143b1abb7b0cdbf241f04 | +-------------+---------------------------------------------------------+
8.4 Installere
På rhos-controller.uio.no:
yum install -y openstack-nova-api \
openstack-nova-conductor \
openstack-nova-scheduler
På rhos-compute01.uio.no:
yum install -y openstack-nova-compute \
python-cinderclient
8.5 Konfigurere autentisering
Dette gjøres på både rhos-controller og rhos-compute01.
Sette auth_strategy:
openstack-config --set /etc/nova/nova.conf \ DEFAULT auth_strategy keystone
Sette authentication host:
openstack-config --set /etc/nova/api-paste.ini \ filter:authtoken auth_host rhos-controller-api.uio.no
Sette admin_tenant_name:
openstack-config --set /etc/nova/api-paste.ini \ filter:authtoken admin_tenant_name services
Sette admin_user:
openstack-config --set /etc/nova/api-paste.ini \ filter:authtoken admin_user nova
Sette passord:
openstack-config --set /etc/nova/api-paste.ini \ filter:authtoken admin_password $NOVA_PASS
8.6 Konfigurere database
Dette gjøres på både rhos-controller og rhos-compute01.
Sette database connection:
openstack-config --set /etc/nova/nova.conf \
DEFAULT sql_connection \
mysql://nova:${NOVA_DBPASS}@rhos-controller-api.uio.no/nova
8.7 Konfigurere message broker (QPID)
Dette gjøres på både rhos-controller og rhos-compute01.
Sette rpc_backend:
openstack-config --set /etc/nova/nova.conf \ DEFAULT rpc_backend nova.openstack.common.rpc.impl_qpid
Sette hostname:
openstack-config --set /etc/nova/nova.conf \ DEFAULT qpid_hostname rhos-controller-api.uio.no
8.8 Konfigurere nettverk
Dette gjøres på både rhos-controller og rhos-compute01.
Sette network api til "neutron":
openstack-config --set /etc/nova/nova.conf \ DEFAULT network_api_class nova.network.neutronv2.api.API
Sette URL for neutron API:
openstack-config --set /etc/nova/nova.conf \ DEFAULT neutron_url http://rhos-network-api.uio.no:9696/
Sette neutron_admin_tenant_name:
openstack-config --set /etc/nova/nova.conf \ DEFAULT neutron_admin_tenant_name services
Sette neutron_admin_username:
openstack-config --set /etc/nova/nova.conf \ DEFAULT neutron_admin_username neutron
Sette neutron_admin_password:
openstack-config --set /etc/nova/nova.conf \ DEFAULT neutron_admin_password $NEUTRON_PASS
Sette neutron_admin_auth_url:
openstack-config --set /etc/nova/nova.conf \ DEFAULT neutron_admin_auth_url http://rhos-controller-api.uio.no:35357/v2.0
Sette security_group_api:
openstack-config --set /etc/nova/nova.conf \ DEFAULT security_group_api neutron
Sette firewall_driver:
openstack-config --set /etc/nova/nova.conf \ DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
8.9 Konfigurere QPID til neutron på compute-node
Sette RPC backend til QPID:
openstack-config --set /etc/neutron/neutron.conf \ DEFAULT rpc_backend neutron.openstack.common.rpc.impl_qpid
Sette QPID hostname:
openstack-config --set /etc/neutron/neutron.conf \ DEFAULT qpid_hostname rhos-controller-api.uio.no
8.10 Konfigurere L2-agenten
Gjøres på rhos-compute01.
Installere:
yum -y install openvswitch openstack-neutron-openvswitch
Starte tjenesten og sørge for at den kjører ved boot:
service openvswitch start chkconfig openvswitch on
Lage br-int:
ovs-vsctl add-br br-int
Lage /etc/sysconfig/network-scripts/ifcfg-br-int:
DEVICE=br-int DEVICETYPE=ovs TYPE=OVSBridge ONBOOT=yes BOOTPROTO=none
Starte agenten og sørge for at den kjører ved boot:
service neutron-openvswitch-agent start chkconfig neutron-openvswitch-agent on
Sørge for at ovs-cleanup kjører ved boot:
chkconfig neutron-ovs-cleanup on
8.11 Konfigurere Virtual Interface Plugging
Gjøres på rhos-compute01.
Konfigurere til å bruke nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver, siden vi bruke Open vSwitch:
openstack-config --set /etc/nova/nova.conf \ DEFAULT libvirt_vif_driver \ nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver
8.12 Konfigurere firewall
Gjøres på rhos-compute01.
Fikse iptables:
iptables -A INPUT -p tcp -m multiport --dports 5900:5999 -j ACCEPT iptables-save > /etc/sysconfig/iptables
8.14 Starte tjenestene
På rhos-compute01:
service messagebus start chkconfig messagebus on service libvirtd start chkconfig libvirtd on
På rhos-controller:
service openstack-nova-api start chkconfig openstack-nova-api on service openstack-nova-scheduler start chkconfig openstack-nova-scheduler on service openstack-nova-conductor start chkconfig openstack-nova-conductor on
På rhos-compute01:
service openstack-nova-compute start chkconfig openstack-nova-compute on
8.15 Konfigurere plugin (Open vSwitch)
Lage symlink:
ln -s /etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini \ /etc/neutron/plugin.iniSette på tunneling, sette type GRE og tunnel id range:
openstack-config --set /etc/neutron/plugin.ini \ OVS enable_tunneling True openstack-config --set /etc/neutron/plugin.ini \ OVS tenant_network_type gre openstack-config --set /etc/neutron/plugin.ini \ OVS tunnel_id_ranges "1:1000"
Sette hvilke bridger som skal brukes til tunnellering:
openstack-config --set /etc/neutron/plugin.ini \ OVS integration_bridge br-int openstack-config --set /etc/neutron/plugin.ini \ OVS tunnel_bridge br-tun
Lokal IP/nett som skal brukes for GRE ut (em1 på hver host):
openstack-config --set /etc/neutron/plugin.ini \ OVS local_ip 129.240.149.38
Sette core_plugin til OVS:
openstack-config --set /etc/neutron/neutron.conf \ DEFAULT core_plugin \ neutron.plugins.openvswitch.ovs_neutron_plugin.OVSNeutronPluginV2
Lage br-tun (FIXME: trenger kanskje ikke dette?):
ovs-vsctl add-br br-tun
8.16 Test av Nova
Dette manglet: På både rhos-network og rhos-compute01:
openstack-config --set /etc/neutron/plugin.ini \ securitygroup firewall_driver \ neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver /etc/init.d/neutron-openvswitch-agent restart
I tillegg på rhos-network:
/etc/init.d/neutron-server restart
Måtte også sette dette på rhos-compute01:
openstack-config --set /etc/nova/nova.conf DEFAULT \ glance_host rhos-controller-api.uio.no
På rhos-network:
Blir "user":
. keystonerc_user
Lager et nett:
# neutron net-create user-net Created a new network: +----------------+--------------------------------------+ | Field | Value | +----------------+--------------------------------------+ | admin_state_up | True | | id | 77d2a6bb-00fb-47d7-86c4-111d9299a2f9 | | name | user-net | | shared | False | | status | ACTIVE | | subnets | | | tenant_id | 00e3bfb9a9734e40b172d79068e7105d | +----------------+--------------------------------------+
Lager et subnett:
# neutron subnet-create --name user-subnett user-net 10.5.5.0/24 Created a new subnet: +------------------+--------------------------------------------+ | Field | Value | +------------------+--------------------------------------------+ | allocation_pools | {"start": "10.5.5.2", "end": "10.5.5.254"} | | cidr | 10.5.5.0/24 | | dns_nameservers | | | enable_dhcp | True | | gateway_ip | 10.5.5.1 | | host_routes | | | id | 429b6c16-8699-42f4-a56b-2ba2c8b589f4 | | ip_version | 4 | | name | user-subnett | | network_id | 77d2a6bb-00fb-47d7-86c4-111d9299a2f9 | | tenant_id | 00e3bfb9a9734e40b172d79068e7105d | +------------------+--------------------------------------------+
På rhos-controller:
Blir "user":
. keystonerc_user
Lager en security group "default" som tillater SSH og ICMP:
# nova secgroup-add-rule default tcp 22 22 0.0.0.0/0 +-------------+-----------+---------+-----------+--------------+ | IP Protocol | From Port | To Port | IP Range | Source Group | +-------------+-----------+---------+-----------+--------------+ | tcp | 22 | 22 | 0.0.0.0/0 | | +-------------+-----------+---------+-----------+--------------+ # nova secgroup-add-rule default icmp -1 -1 0.0.0.0/0 +-------------+-----------+---------+-----------+--------------+ | IP Protocol | From Port | To Port | IP Range | Source Group | +-------------+-----------+---------+-----------+--------------+ | icmp | -1 | -1 | 0.0.0.0/0 | | +-------------+-----------+---------+-----------+--------------+
Finne et image:
# nova image-list +--------------------------------------+--------------+--------+--------+ | ID | Name | Status | Server | +--------------------------------------+--------------+--------+--------+ | 6462bf51-7931-4173-8862-d4cfcaa0b1e4 | CirrOS 0.3.1 | ACTIVE | | +--------------------------------------+--------------+--------+--------+
Boote et image:
# nova boot --flavor 1 \ --image 6462bf51-7931-4173-8862-d4cfcaa0b1e4 \ --security_group default test1 +--------------------------------------+--------------------------------------+ | Property | Value | +--------------------------------------+--------------------------------------+ | status | BUILD | | updated | 2014-02-21T10:51:10Z | | OS-EXT-STS:task_state | scheduling | | key_name | None | | image | CirrOS 0.3.1 | | hostId | | | OS-EXT-STS:vm_state | building | | OS-SRV-USG:launched_at | None | | flavor | m1.tiny | | id | 26db419a-8ead-48ac-b5d8-2c1dbfeaac2d | | security_groups | [{u'name': u'default'}] | | OS-SRV-USG:terminated_at | None | | user_id | 632e1c5e207347ff8f68337d0ffb91d0 | | name | test1 | | adminPass | MiWtbCb3i2b7 | | tenant_id | 00e3bfb9a9734e40b172d79068e7105d | | created | 2014-02-21T10:51:09Z | | OS-DCF:diskConfig | MANUAL | | metadata | {} | | os-extended-volumes:volumes_attached | [] | | accessIPv4 | | | accessIPv6 | | | progress | 0 | | OS-EXT-STS:power_state | 0 | | OS-EXT-AZ:availability_zone | nova | | config_drive | | +--------------------------------------+--------------------------------------+
Som admin:
Liste opp routere:
# neutron router-list +--------------------------------------+------------+-----------------------------------------------------------------------------+ | id | name | external_gateway_info | +--------------------------------------+------------+-----------------------------------------------------------------------------+ | a9c981f1-cfd2-4db3-9136-d515cc4a33b2 | ex-router1 | {"network_id": "33974169-9da3-4460-9d6d-6f9c656294c6", "enable_snat": true} | +--------------------------------------+------------+-----------------------------------------------------------------------------+
Som user:
Liste opp instanser:
# nova list +--------------------------------------+-------+--------+------------+-------------+-------------------+ | ID | Name | Status | Task State | Power State | Networks | +--------------------------------------+-------+--------+------------+-------------+-------------------+ | 8d815742-b985-470e-91ac-94dacc0bed29 | test2 | ACTIVE | None | Running | user-net=10.5.5.2 | +--------------------------------------+-------+--------+------------+-------------+-------------------+
Finne porten til instansen:
# neutron port-list --device_id=8d815742-b985-470e-91ac-94dacc0bed29 +--------------------------------------+------+-------------------+---------------------------------------------------------------------------------+ | id | name | mac_address | fixed_ips | +--------------------------------------+------+-------------------+---------------------------------------------------------------------------------+ | a595187b-6965-4895-9e85-28b0d2a5f2c7 | | fa:16:3e:66:45:05 | {"subnet_id": "429b6c16-8699-42f4-a56b-2ba2c8b589f4", "ip_address": "10.5.5.2"} | +--------------------------------------+------+-------------------+---------------------------------------------------------------------------------+
Som admin:
Liste opp subnett:
# neutron subnet-list +--------------------------------------+--------------+--------------------+--------------------------------------------------------+ | id | name | cidr | allocation_pools | +--------------------------------------+--------------+--------------------+--------------------------------------------------------+ | 429b6c16-8699-42f4-a56b-2ba2c8b589f4 | user-subnett | 10.5.5.0/24 | {"start": "10.5.5.2", "end": "10.5.5.254"} | | 4b6d46de-58f8-4e52-bd11-d81151afc43e | sub1 | 129.240.149.128/26 | {"start": "129.240.149.170", "end": "129.240.149.179"} | +--------------------------------------+--------------+--------------------+--------------------------------------------------------+Lage interface på router:
# neutron router-interface-add ex-router1 user-subnett Added interface e25eb712-4de3-4f0e-98af-b026660fe946 to router ex-router1.
Som user:
Liste opp floating IP-er:
# nova floating-ip-pool-list +--------+ | name | +--------+ | ex-net | +--------+
Få tildelt en floating IP:
# nova floating-ip-create ex-net +-----------------+-----------+----------+--------+ | Ip | Server Id | Fixed Ip | Pool | +-----------------+-----------+----------+--------+ | 129.240.149.171 | | None | ex-net | +-----------------+-----------+----------+--------+
Liste opp på nytt:
# nova floating-ip-list +-----------------+-----------+----------+--------+ | Ip | Server Id | Fixed Ip | Pool | +-----------------+-----------+----------+--------+ | 129.240.149.171 | | None | ex-net | +-----------------+-----------+----------+--------+
Liste opp instanser:
# nova list +--------------------------------------+-------+--------+------------+-------------+-------------------+ | ID | Name | Status | Task State | Power State | Networks | +--------------------------------------+-------+--------+------------+-------------+-------------------+ | 8d815742-b985-470e-91ac-94dacc0bed29 | test2 | ACTIVE | None | Running | user-net=10.5.5.2 | +--------------------------------------+-------+--------+------------+-------------+-------------------+
Liste opp floating IP-er:
# neutron floatingip-list +--------------------------------------+------------------+---------------------+---------+ | id | fixed_ip_address | floating_ip_address | port_id | +--------------------------------------+------------------+---------------------+---------+ | c6933357-fd92-4a17-9d50-6fa9f9d83b97 | | 129.240.149.171 | | +--------------------------------------+------------------+---------------------+---------+
Assosisere IP-en med instansen:
# neutron floatingip-associate \ c6933357-fd92-4a17-9d50-6fa9f9d83b97 \ a595187b-6965-4895-9e85-28b0d2a5f2c7 Associated floatingip c6933357-fd92-4a17-9d50-6fa9f9d83b97Inspisere instansen:
# nova show test2 +--------------------------------------+----------------------------------------------------------+ | Property | Value | +--------------------------------------+----------------------------------------------------------+ | status | ACTIVE | | updated | 2014-02-21T11:19:32Z | | OS-EXT-STS:task_state | None | | key_name | None | | image | CirrOS 0.3.1 (6462bf51-7931-4173-8862-d4cfcaa0b1e4) | | hostId | 0161e06942938f63608fc25472758501b3065d9b018ab75bc4a0375a | | OS-EXT-STS:vm_state | active | | OS-SRV-USG:launched_at | 2014-02-21T11:00:35.000000 | | flavor | m1.tiny (1) | | id | 8d815742-b985-470e-91ac-94dacc0bed29 | | security_groups | [{u'name': u'default'}] | | OS-SRV-USG:terminated_at | None | | user_id | 632e1c5e207347ff8f68337d0ffb91d0 | | name | test2 | | user-net network | 10.5.5.2, 129.240.149.171 | | created | 2014-02-21T11:00:09Z | | tenant_id | 00e3bfb9a9734e40b172d79068e7105d | | OS-DCF:diskConfig | MANUAL | | metadata | {} | | os-extended-volumes:volumes_attached | [] | | accessIPv4 | | | accessIPv6 | | | progress | 0 | | OS-EXT-STS:power_state | 1 | | OS-EXT-AZ:availability_zone | nova | | config_drive | | +--------------------------------------+----------------------------------------------------------+
Nå fungerer SSH og PING mot instansen, via den eksterne IP-en.
9 Horizon
9.1 Installere
Installere avhengigheter:
yum install -y mod_wsgi httpd mod_ssl
Installere dashboard:
yum install -y openstack-dashboard
9.3 Konfigurere
Sette følgende i /etc/openstack-dashboard/local_settings:
Openstack host:
OPENSTACK_HOST="127.0.0.1"
Tidssone:
TIME_ZONE="CET"
Etterpå, restarte apache:
service httpd restart
9.4 SSL
FIXME: Hopper over dette.
9.5 Lage bruker etc.
Vi bruker rollen "Member", og denne finnes allerede:
# keystone role-list +----------------------------------+----------+ | id | name | +----------------------------------+----------+ | a062ae1bdd5f4796ad5b50a4f1f587ce | Member | | 9fe2ff9ee4384b1894a90878d3e92bab | _member_ | | 5e11ecd2aed6437abed9188abb6f1292 | admin | +----------------------------------+----------+
9.7 Firewall
iptables -A INPUT -p tcp --dport 443 -j ACCEPT iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT iptables-save > /etc/sysconfig/iptables
9.8 Konfigurere session storage i database
Lage database for dash:
Lage passord for dash-databasen, til dash-brukeren:
DASH_DBPASS=$(openssl rand -hex 10) echo "DASH_DBPASS=$DASH_DBPASS" >> ~/passwords.sh
Koble til mysql som root:
mysql -u root -p
Lage dash-database:
mysql> CREATE DATABASE dash; Query OK, 1 row affected (0.00 sec)
Lage bruker for dash og gi den tilgang til databasen:
mysql> GRANT ALL ON dash.* TO 'dash'@'%' IDENTIFIED BY 'sensurert'; Query OK, 0 rows affected (0.00 sec) mysql> GRANT ALL ON dash.* TO 'dash'@'localhost' IDENTIFIED BY 'sensurert'; Query OK, 0 rows affected (0.00 sec)
Flush for å sørge for at endringen trer i kraft umiddelbart:
mysql> FLUSH PRIVILEGES; Query OK, 0 rows affected (0.00 sec)
Exit:
mysql> quit Bye
Editere /etc/openstack-dashboard/local_settings, sette:
SESSION_ENGINE = 'django.contrib.sessions.backends.cached_db'
DATABASES = {
'default': {
# Database configuration here
'ENGINE': 'django.db.backends.mysql',
'NAME': 'dash',
'USER': 'dash',
'PASSWORD': 'sensurert',
'HOST': '127.0.0.1',
'default-character-set': 'utf8'
}
}
Populere databasen:
# cd /usr/share/openstack-dashboard # python manage.py syncdb /usr/lib/python2.6/site-packages/swiftclient/version.py:17: UserWarning: Module openstack_dashboard was already imported from /usr/share/openstack-dashboard/openstack_dashboard/__init__.pyc, but /usr/lib/python2.6/site-packages is being added to sys.path import pkg_resources DeprecationWarning: Translations in the project directory aren't supported anymore. Use the LOCALE_PATHS setting instead.Creating tables ... Creating table django_content_type Creating table auth_permission Creating table auth_group_permissions Creating table auth_group Creating table auth_user_user_permissions Creating table auth_user_groups Creating table auth_user Creating table django_session You just installed Django's auth system, which means you don't have any superusers defined. Would you like to create one now? (yes/no): no Installing custom SQL ... Installing indexes ... Installed 0 object(s) from 0 fixture(s)
Restarte apache:
service httpd restart
Restarte nova-api:
service openstack-nova-api restart
Notat
Dette var ikke dokumentert:
Fikse rettigheter:
chown -R apache:apache /var/lib/openstack-dashboard
Editere /etc/openstack-dashboard/local_settings:
ALLOWED_HOSTS = ['rhos-controller.uio.no', 'rhos-controller', 'localhost']
10 Telemetri/Ceilometer
10.1 Installere
Installere avhengigheter:
yum install -y mongodb-server
Notat
Denne funksjonen bruker altså mongodb!
Installere ceilometer:
yum install -y openstack-ceilometer-api \ openstack-ceilometer-central openstack-ceilometer-collector \ openstack-ceilometer-common openstack-ceilometer-compute \ openstack-ceilometer-alarm python-ceilometer python-ceilometerclient
10.2 Lage brukere og roller
Finne ID til services-tenant:
# keystone tenant-list | grep services | 7393281e101649fd88b43ce274e6dd4e | services | True |
Finne ID til admin-bruker:
# keystone role-list | grep admin | 5e11ecd2aed6437abed9188abb6f1292 | admin |
Lage passord til brukeren:
# Lage passord for nova:: CEILOMETER_PASS=$(openssl rand -hex 10) echo "CEILOMETER_PASS=$CEILOMETER_PASS" >> ~/passwords.sh
Lage brukeren ceilometer:
# keystone user-create --name=ceilometer \ --pass=$CEILOMETER_PASS \ --tenant_id=7393281e101649fd88b43ce274e6dd4e +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | email | | | enabled | True | | id | 26e5cf9db1f443f8a8707921e28a7a5e | | name | ceilometer | | tenantId | 7393281e101649fd88b43ce274e6dd4e | +----------+----------------------------------+Lage en ny spesialrolle for formålet:
# keystone role-create --name=ResellerAdmin +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | id | eca092cc265b406fab4f1380f6a690f8 | | name | ResellerAdmin | +----------+----------------------------------+
Koble sammen brukeren, tenant og denne nye rollen:
# keystone user-role-add --tenant_id 7393281e101649fd88b43ce274e6dd4e \ --user_id 26e5cf9db1f443f8a8707921e28a7a5e \ --role_id eca092cc265b406fab4f1380f6a690f8Koble brukeren mot admin-rollen:
# keystone user-role-add --tenant_id 7393281e101649fd88b43ce274e6dd4e \ --user_id 26e5cf9db1f443f8a8707921e28a7a5e \ --role_id 5e11ecd2aed6437abed9188abb6f1292Lage service-entry:
# keystone service-create --name=ceilometer \ --type=metering \ --description="OpenStack Telemetry Service" +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | OpenStack Telemetry Service | | id | 8610e3a53bcf49df80bd48632a1f2e9d | | name | ceilometer | | type | metering | +-------------+----------------------------------+Lage endpoint-entry:
# keystone endpoint-create \ --service_id 8610e3a53bcf49df80bd48632a1f2e9d \ --publicurl "http://rhos-controller-api.uio.no:8777" \ --adminurl "http://rhos-controller-api.uio.no:8777" \ --internalurl "http://rhos-controller-api.uio.no:8777" +-------------+----------------------------------------+ | Property | Value | +-------------+----------------------------------------+ | adminurl | http://rhos-controller-api.uio.no:8777 | | id | 1aa8c20e6bc04c3ea8487d13c529b0ae | | internalurl | http://rhos-controller-api.uio.no:8777 | | publicurl | http://rhos-controller-api.uio.no:8777 | | region | regionOne | | service_id | 8610e3a53bcf49df80bd48632a1f2e9d | +-------------+----------------------------------------+
10.3 Sette opp autentisering
Sette authentication host:
openstack-config --set /etc/ceilometer/ceilometer.conf \ keystone_authtoken auth_host rhos-controller-api.uio.no
Sette autenthication port:
openstack-config --set /etc/ceilometer/ceilometer.conf \ keystone_authtoken auth_port 35357
Sette opp til å bruke korrekt protokoll:
openstack-config --set /etc/ceilometer/ceilometer.conf \ keystone_authtoken auth_protocol http
Notat
Dokumentasjon skrev her PORT istedtfor PROTO (http)!
Sette admin_tenant_name:
openstack-config --set /etc/ceilometer/ceilometer.conf \ keystone_authtoken admin_tenant_name services
Sette admin user name:
openstack-config --set /etc/ceilometer/ceilometer.conf \ keystone_authtoken admin_user ceilometer
Sette passord:
openstack-config --set /etc/ceilometer/ceilometer.conf \ keystone_authtoken admin_password $CEILOMETER_PASS
Sette secret som skal brukes mellom telemtri-agent og server:
CEILOMETER_SECRET=$(openssl rand -hex 10) echo "CEILOMETER_SECRET=$CEILOMETER_SECRET" >> ~/passwords.sh openstack-config --set /etc/ceilometer/ceilometer.conf \ publisher_rpc metering_secret $CEILOMETER_SECRET
Sette opp alle agenter til å bruke den endpoint entry som nå er installert:
openstack-config --set /etc/ceilometer/ceilometer.conf \ DEFAULT os_auth_url http://rhos-controller-api.uio.no:35357/v2.0 openstack-config --set /etc/ceilometer/ceilometer.conf \ DEFAULT os_username ceilometer openstack-config --set /etc/ceilometer/ceilometer.conf \ DEFAULT os_tenant_name services openstack-config --set /etc/ceilometer/ceilometer.conf \ DEFAULT os_password $CEILOMETER_PASS
Notat
Dette siste punktet må utføres på alle servere som kjører telemtetri-agent!
10.4 Sette opp databasen
Av ressurshensyn så brukes her default mongodb som database-backend, og ikke den databsen som forøvrig brukes i OpenStack.
Setter database-tilkoblingsparametre:
openstack-config --set /etc/ceilometer/ceilometer.conf \ database connection mongodb://localhost:27017/ceilometerKonfigurere mongodb til å bruke små filer ved å editere /etc/sysconfig/mongod slik at opsjonen '--smallfies' settes:
MONGODB_OPTIONS="--smallfiles --quiet /etc/mongodb.conf"
Starter databasen:
service mongod start
Notat
Er en bug i hvordan mongod startes. Dels så sjekker init-skript etter "MONGODB_OPTIONS" og ikke "OPTIONS" som det står i default /etc/sysconfig/mongod og dels så starter initskript databasen med --quiet som også er med i default opsjonslinje. mongodb takler ikke at samme opsjon forekommer flere ganger.
Rettet OPTIONS til MONGODB_OPTIONS og fjernet --quiet.
10.5 Starte databasen
Starte og sørge for at den kjører ved boot:
service mongod start chkconfig mongod on
10.6 Sette opp telemtri-tjenesten på compute-host
Dette gjøres på rhos-compute01 (og evt. andre compute-hoster).
# Installerer agenten:
yum install -y openstack-ceilometer-compute
Enable auditing:
openstack-config --set /etc/nova/nova.conf \ DEFAULT instance_usage_audit True
Sette opp innsamlingsfrekvens:
openstack-config --set /etc/nova/nova.conf \ DEFAULT instance_usage_audit_period hour
Sette opp hvilke tilstandsendringer som skal sende notifikasjoner:
openstack-config --set /etc/nova/nova.conf \ DEFAULT notify_on_state_change vm_and_task_state
Sette opp hvilken driver som skal brukes i Nova:
openstack-config --set /etc/nova/nova.conf \ DEFAULT notification_driver nova.openstack.common.notifier.rpc_notifier openstack-config --set /etc/nova/nova.conf \ DEFAULT notification_driver ceilometer.compute.nova_notifier
Notat
Dette siste fungerer ikke da det overskriver det første. Det må editeres inn i fila manuelt i stedet!
Definere message broker:
Sette rpc_backend:: openstack-config --set /etc/ceilometer/ceilometer.conf \ DEFAULT rpc_backend nova.openstack.common.rpc.impl_qpid Definere "hemmelighet":: openstack-config --set /etc/ceilometer/ceilometer.conf \ publisher_rpc metering_secret $CEILOMETER_SECRET Sette hostname:: openstack-config --set /etc/ceilometer/ceilometer.conf \ DEFAULT qpid_hostname rhos-controller-api.uio.noNotat
Dette punktet var heller ikke dokumentert!
Definere credentials:
openstack-config --set /etc/ceilometer/ceilometer.conf \ keystone_authtoken auth_host rhos-controller-api.uio.no openstack-config --set /etc/ceilometer/ceilometer.conf \ keystone_authtoken admin_user ceilometer openstack-config --set /etc/ceilometer/ceilometer.conf \ keystone_authtoken admin_tenant_name services openstack-config --set /etc/ceilometer/ceilometer.conf \ keystone_authtoken auth_protocol http openstack-config --set /etc/ceilometer/ceilometer.conf \ keystone_authtoken admin_password $CEILOMETER_PASS openstack-config --set /etc/ceilometer/ceilometer.conf \ service_credentials os_username ceilometer openstack-config --set /etc/ceilometer/ceilometer.conf \ service_credentials os_tenant_name services openstack-config --set /etc/ceilometer/ceilometer.conf \ service_credentials os_password $CEILOMETER_PASS openstack-config --set /etc/ceilometer/ceilometer.conf \ service_credentials os_auth_url http://rhos-controller-api.uio.no:5000/v2.0
Starte compute-agenten og sørge for at den starter ved boot:
service openstack-ceilometer-compute restart chkconfig openstack-ceilometer-compute on
Restarte nova-tjenesten for å effektuere alle endringer i nova.conf:
service openstack-nova-compute restart
10.7 Øvrige tjenester
Sette opp glance til å rapportere data (på rhos-controller.uio.no):
openstack-config --set /etc/glance/glance-api.conf \ DEFAULT notifier_strategy qpid service openstack-glance-registry restart service openstack-glance-api restart
Sette opp neutron til å rapportere data (på rhos-network.uio.no):
openstack-config --set /etc/neutron/neutron.conf \ DEFAULT notification_driver neutron.openstack.common.notifier.rpc_notifier service neutron-server restart
Sette opp cinder til å rapportere data (på rhos-controller.uio.no):
openstack-config --set /etc/cinder/cinder.conf \ DEFAULT notification_driver cinder.openstack.common.notifier.rpc_notifier openstack-config --set /etc/cinder/cinder.conf \ DEFAULT rpc_backend cinder.openstack.common.rpc.impl_qpid openstack-config --set /etc/cinder/cinder.conf \ DEFAULT control_exchange cinder service openstack-cinder-api restart service openstack-cinder-volume restart
10.8 Starte API og agenter
Dette kjøres på controller-noden.
Starter alle tjenester og agenter:
service openstack-ceilometer-compute start service openstack-ceilometer-central start service openstack-ceilometer-collector start service openstack-ceilometer-api start service openstack-ceilometer-alarm-evaluator start service openstack-ceilometer-alarm-notifier start
Sørger for at de starter ved boot:
chkconfig openstack-ceilometer-compute on chkconfig openstack-ceilometer-central on chkconfig openstack-ceilometer-collector on chkconfig openstack-ceilometer-api on chkconfig openstack-ceilometer-alarm-evaluator on chkconfig openstack-ceilometer-alarm-notifier on
11 Cinder
Notat
Cinder settes opp til å bruke Red Hat Storage Server, som kjører på rhos-storage01 og rhos-storage02. Disse maskinene er satt opp som et 2-node cluster med gluster. Se RHSS dokumentasjon
11.1 Oppsett av RHSS
Gjøres på rhos-storage01.
Lage volum for Cinder på RHSS:
# gluster volume create cinder-volume replica 2 transport tcp \
rhos-storage01-data:/exp1/bricksrv \
rhos-storage02-data:/exp1/bricksrv
volume create: cinder-volume: success: please start the volume to access data
Tuning for Openstack (UID/GID 165 er for cinder-brukeren):
# gluster vol set cinder-volume group virt volume set: success # gluster vol set cinder-volume storage.owner-uid 165 volume set: success # gluster vol set cinder-volume storage.owner-gid 165 volume set: success
Verifiserer:
# gluster vol info cinder-volume Volume Name: cinder-volume Type: Replicate Volume ID: bdef3ffb-895f-4f24-b746-d8cda5b77d65 Status: Created Number of Bricks: 1 x 2 = 2 Transport-type: tcp Bricks: Brick1: rhos-storage01-data:/exp1/bricksrv Brick2: rhos-storage02-data:/exp1/bricksrv Options Reconfigured: storage.owner-gid: 165 storage.owner-uid: 165 cluster.server-quorum-type: server cluster.quorum-type: auto network.remote-dio: enable cluster.eager-lock: enable performance.stat-prefetch: off performance.io-cache: off performance.read-ahead: off performance.quick-read: off
Starte volumet:
# gluster volume start cinder-volume volume start: cinder-volume: success
Skru av NFS for volumet:
# gluster volume set cinder-volume nfs.disable on volume set: success
11.2 Lage database
Lage database for cinder:
Lage passord for cinder-databasen, til cinder-brukeren:
CINDER_DBPASS=$(openssl rand -hex 10) echo "CINDER_DBPASS=$CINDER_DBPASS" >> ~/passwords.sh
Koble til mysql som root:
mysql -u root -p
Lage cinder-database:
mysql> CREATE DATABASE cinder; Query OK, 1 row affected (0.00 sec)
Lage bruker for cinder og gi den tilgang til databasen:
mysql> GRANT ALL ON cinder.* TO 'cinder'@'%' IDENTIFIED BY 'sensurert'; Query OK, 0 rows affected (0.00 sec) mysql> GRANT ALL ON cinder.* TO 'cinder'@'localhost' IDENTIFIED BY 'sensurert'; Query OK, 0 rows affected (0.00 sec)
Flush for å sørge for at endringen trer i kraft umiddelbart:
mysql> FLUSH PRIVILEGES; Query OK, 0 rows affected (0.00 sec)
Exit:
mysql> quit Bye
11.3 Lage bruker etc.
Gjøres på rhos-controller.uio.no.
Lage passord for cinder:
CINDER_PASS=$(openssl rand -hex 10) echo "CINDER_PASS=$CINDER_PASS" >> ~/passwords.sh
Lage bruker "cinder":
# keystone user-create --name cinder --pass $CINDER_PASS +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | email | | | enabled | True | | id | 625f7d2ece16458eb52110e08a139370 | | name | cinder | +----------+----------------------------------+
Finne ID for admin-rollen:
# keystone role-get admin +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | id | 5e11ecd2aed6437abed9188abb6f1292 | | name | admin | +----------+----------------------------------+
Finne ID for services-tenant:
# keystone tenant-list | grep services | 7393281e101649fd88b43ce274e6dd4e | services | True |
Linker cinder-brukeren sammen med admin-rollen i tenant "services":
# keystone user-role-add \ --user-id 625f7d2ece16458eb52110e08a139370 \ --role-id 5e11ecd2aed6437abed9188abb6f1292 \ --tenant-id 7393281e101649fd88b43ce274e6dd4eLage service-entry for cinder:
# keystone service-create --name cinder \ --type volume \ --description "Cinder Volume Service" +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Cinder Volume Service | | id | b0b13b3fb64e41778e082b31a9cee1bd | | name | cinder | | type | volume | +-------------+----------------------------------+Lage endpoint-entry:
# keystone endpoint-create --service-id b0b13b3fb64e41778e082b31a9cee1bd \ --publicurl "http://rhos-controller-api.uio.no:8776/v1/\$(tenant_id)s" \ --adminurl "http://rhos-controller-api.uio.no:8776/v1/\$(tenant_id)s" \ --internalurl "http://rhos-controller-api.uio.no:8776/v1/\$(tenant_id)s" +-------------+---------------------------------------------------------+ | Property | Value | +-------------+---------------------------------------------------------+ | adminurl | http://rhos-controller-api.uio.no:8776/v1/$(tenant_id)s | | id | 8947e6e589444b58900356fafb8962ad | | internalurl | http://rhos-controller-api.uio.no:8776/v1/$(tenant_id)s | | publicurl | http://rhos-controller-api.uio.no:8776/v1/$(tenant_id)s | | region | regionOne | | service_id | b0b13b3fb64e41778e082b31a9cee1bd | +-------------+---------------------------------------------------------+
11.4 Installasjon
Velger å kjøre alle tjenester (API, scheduler, volume service) på rhos-controller.uio.no.
Installere pakker:
yum install -y openstack-cinder openstack-utils openstack-selinux
Installerte gluster-ting:
yum -y install glusterfs-api glusterfs-libs glusterfs-fuse glusterfs
11.5 Konfigurere autentisering
Sette auth_strategy:
openstack-config --set /etc/cinder/cinder.conf \ DEFAULT auth_strategy keystone
Sette authentication host:
openstack-config --set /etc/cinder/cinder.conf \ keystone_authtoken auth_host rhos-controller-api.uio.no
Sette admin_tenant_name:
openstack-config --set /etc/cinder/cinder.conf \ keystone_authtoken admin_tenant_name services
Sette admin_user:
openstack-config --set /etc/cinder/cinder.conf \ keystone_authtoken admin_user cinder
Sette passord:
openstack-config --set /etc/cinder/cinder.conf \ keystone_authtoken admin_password $CINDER_PASS
11.6 Konfigurere SSL
FIXME: Droppet dette.
11.7 Konfigurere QPID
Sette rpc_backend:
openstack-config --set /etc/cinder/cinder.conf \ DEFAULT rpc_backend cinder.openstack.common.rpc.impl_qpid
Sette qpid_hostname:
openstack-config --set /etc/cinder/cinder.conf \ DEFAULT qpid_hostname rhos-controller-api.uio.no
FIXME: Droppet autentisering og SSL.
11.8 Konfigurere database
Sette database connection:
openstack-config --set /etc/cinder/cinder.conf \
DEFAULT sql_connection mysql://cinder:${CINDER_DBPASS}@rhos-controller-api.uio.no/cinder
11.9 Firewall
Fikse iptables:
iptables -A INPUT -p tcp -m multiport --dports 3260,8776 -j ACCEPT iptables-save > /etc/sysconfig/iptables
11.12 Konfigurere for RHSS
Notat
Dokumentasjon: Configuring for Red Hat Storage Backend
Dette gjøres på rhos-controller (som skal kjøre volume service).
Lage en fil /etc/cinder/shares.conf:
echo 'rhos-storage01-data.uio.no:/cinder-volume' \ > /etc/cinder/shares.conf
Chown og chown på filen:
chown root:cinder /etc/cinder/gluster-shares.txt chmod 0640 /etc/cinder/shares.conf
Sette glusterfs_shares_config:
openstack-config --set /etc/cinder/cinder.conf \ DEFAULT glusterfs_shares_config \ /etc/cinder/shares.conf
Sette glusterfs_sparsed_volumes:
openstack-config --set /etc/cinder/cinder.conf \ DEFAULT glusterfs_sparsed_volumes true
Sette volume_driver:
openstack-config --set /etc/cinder/cinder.conf \ DEFAULT volume_driver \ cinder.volume.drivers.glusterfs.GlusterfsDriver
11.14 Starte tjenestene
api:
service openstack-cinder-api start chkconfig openstack-cinder-api on
scheduler:
service openstack-cinder-scheduler start chkconfig openstack-cinder-scheduler on
volume og tgtd:
service openstack-cinder-volume start service tgtd start chkconfig openstack-cinder-volume on chkconfig tgtd on
11.15 Test av cinder
Som "admin"
Liste opp volumer:
# cinder list +----+--------+--------------+------+-------------+----------+-------------+ | ID | Status | Display Name | Size | Volume Type | Bootable | Attached to | +----+--------+--------------+------+-------------+----------+-------------+ +----+--------+--------------+------+-------------+----------+-------------+
Lage nytt volum på 1GB:
# cinder create 1 +---------------------+--------------------------------------+ | Property | Value | +---------------------+--------------------------------------+ | attachments | [] | | availability_zone | nova | | bootable | false | | created_at | 2014-03-06T14:44:57.229829 | | display_description | None | | display_name | None | | id | d542b26c-2bb4-46e2-b841-579ef6cc64c5 | | metadata | {} | | size | 1 | | snapshot_id | None | | source_volid | None | | status | creating | | volume_type | None | +---------------------+--------------------------------------+Liste opp på nytt:
# cinder list +--------------------------------------+-----------+--------------+------+-------------+----------+-------------+ | ID | Status | Display Name | Size | Volume Type | Bootable | Attached to | +--------------------------------------+-----------+--------------+------+-------------+----------+-------------+ | d542b26c-2bb4-46e2-b841-579ef6cc64c5 | available | None | 1 | None | false | | +--------------------------------------+-----------+--------------+------+-------------+----------+-------------+
Som "user":
Lage et volum:
# cinder create 1 +---------------------+--------------------------------------+ | Property | Value | +---------------------+--------------------------------------+ | attachments | [] | | availability_zone | nova | | bootable | false | | created_at | 2014-03-11T12:06:25.001260 | | display_description | None | | display_name | None | | id | 3e23baa0-9693-4fb4-a721-df65a979f3c5 | | metadata | {} | | size | 1 | | snapshot_id | None | | source_volid | None | | status | creating | | volume_type | None | +---------------------+--------------------------------------+Liste opp:
# cinder list +--------------------------------------+-----------+--------------+------+-------------+----------+-------------+ | ID | Status | Display Name | Size | Volume Type | Bootable | Attached to | +--------------------------------------+-----------+--------------+------+-------------+----------+-------------+ | 3e23baa0-9693-4fb4-a721-df65a979f3c5 | available | None | 1 | None | false | | +--------------------------------------+-----------+--------------+------+-------------+----------+-------------+
Knytte volumet til en VM:
# nova volume-attach fedora_1 3e23baa0-9693-4fb4-a721-df65a979f3c5 auto +----------+--------------------------------------+ | Property | Value | +----------+--------------------------------------+ | device | /dev/vdb | | serverId | 724c8802-2dd9-4939-b1af-fc893b7c401c | | id | 3e23baa0-9693-4fb4-a721-df65a979f3c5 | | volumeId | 3e23baa0-9693-4fb4-a721-df65a979f3c5 | +----------+--------------------------------------+
SSH til VM-en:
# ssh -i f20.pem 129.240.149.173
Vi kan se volumet som /dev/vdb:
[root@host-10-5-5-6 ~]# fdisk -l Disk /dev/vda: 40 GiB, 42949672960 bytes, 83886080 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x000afe8f Device Boot Start End Blocks Id System /dev/vda1 * 1953 83885979 41942013+ 83 Linux Disk /dev/vdb: 1 GiB, 1073741824 bytes, 2097152 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes
12 Swift
Notat
Vi bruker Red Hat Storage sin native Swift istedenfor vanlig Openstack-swift.
12.2 Konfigurere proxy-server
Gjøres på alle storage-nodene.
Lage en fil /etc/swift/proxy-server.conf ved å bruke /etc/swift/proxy-server.conf-gluster som mal:
cp /etc/swift/proxy-server.conf-gluster /etc/swift/proxy-server.conf
12.3 Konfigurere for SSL
Notat
DROPPET
Dette ble gjort, men ble endret til å ikke bruke SSL etterpå. For å bruke SSL med Swift bør sertifikatet være signert av 3.part, ellers må man alltid angi opsjonen "--insecure" til swift.
Lage SSL-sertifikat:
# cd /etc/swift # openssl req -new -x509 -nodes -out cert.crt -keyout cert.key Generating a 2048 bit RSA private key ................................................+++ ........................................................................+++ writing new private key to 'cert.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:NO State or Province Name (full name) []:Oslo Locality Name (eg, city) [Default City]:Oslo Organization Name (eg, company) [Default Company Ltd]:UiO Organizational Unit Name (eg, section) []:USIT Common Name (eg, your name or your server's hostname) []:rhos-storage01.uio.no Email Address []:iaas-core@usit.uio.no
Legge til i /etc/swift/proxy-server.conf under [DEFAULT]:
bind_port = 443 cert_file = /etc/swift/cert.crt key_file = /etc/swift/cert.key
12.4 Konfigurere memcache
Editere /etc/swift/proxy-server.conf under [filter:cache]:
[filter:cache] use = egg:swift#memcache memcache_servers = 129.240.149.39:11211,129.240.149.40:11211
12.5 Lage bruker etc. for swift
Notat
Gjøres på rhos-controller.
Lage passord for swift:
SWIFT_PASS=$(openssl rand -hex 10) echo "SWIFT_PASS=$SWIFT_PASS" >> ~/passwords.sh
Lage bruker "swift":
# keystone user-create --name swift --pass $SWIFT_PASS +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | email | | | enabled | True | | id | ce01358391ef46c8a1c16262dfe9fcfa | | name | swift | +----------+----------------------------------+
Linker swift-brukeren sammen med admin-rollen i tenant "services":
# keystone user-role-add \ --user swift --role admin --tenant servicesLage service-entry for swift:
# keystone service-create --name swift \ --type object-store \ --description "Swift Storage Service" +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Swift Storage Service | | id | 5ce4ca62725b458d8804d5f4cc6dfb36 | | name | swift | | type | object-store | +-------------+----------------------------------+Lage endpoint-entry:
# keystone endpoint-create \ --service swift \ --publicurl "http://rhos-storage01.uio.no:8080/v1/AUTH_\$(tenant_id)s" \ --adminurl "http://rhos-storage01.uio.no:8080/v1" \ --internalurl "http://rhos-storage01.uio.no:8080/v1/AUTH_\$(tenant_id)s" +-------------+---------------------------------------------------------+ | Property | Value | +-------------+---------------------------------------------------------+ | adminurl | http://rhos-storage01.uio.no:8080/v1 | | id | 3b1cb1e34e4f4c86a019297b6e81afd8 | | internalurl | http://rhos-storage01.uio.no:8080/v1/AUTH_$(tenant_id)s | | publicurl | http://rhos-storage01.uio.no:8080/v1/AUTH_$(tenant_id)s | | region | regionOne | | service_id | 5ce4ca62725b458d8804d5f4cc6dfb36 | +-------------+---------------------------------------------------------+
12.6 Konfigurere for Keystone
Editere /etc/swift/proxy-server.conf, endre:
[pipeline:main] pipeline = catch_errors healthcheck proxy-logging cache authtoken keystoneauth proxy-logging proxy-server
Editere /etc/swift/proxy-server.conf, legg til:
[filter:authtoken] paste.filter_factory = keystoneclient.middleware.auth_token:filter_factory signing_dir = /etc/swift auth_host = rhos-controller-api.uio.no auth_port = 35357 auth_protocol = http auth_uri = http://rhos-controller-api.uio.no:5000 # if its defined admin_tenant_name = services admin_user = swift admin_password = <sensurert> delay_auth_decision = 1 [filter:keystoneauth] use = egg:swift#keystoneauth operator_roles = admin, SwiftOperator is_admin = true cache = swift.cache
12.7 Konfigurasjon for andre swift-tjenester
Lage /etc/swift/object.server.conf:
cp /etc/swift/object-server.conf-gluster /etc/swift/object-server.conf
Lage /etc/swift/container-server.conf:
cp /etc/swift/container-server.conf-gluster /etc/swift/container-server.conf
Lage /etc/swift/account-server.conf:
cp /etc/swift/account-server.conf-gluster /etc/swift/account-server.conf
Lage /etc/swift/swift.conf:
cp /etc/swift/swift.conf-gluster /etc/swift/swift.conf
12.8 Lage volum for "user"
Lage nye bricks:
# lvcreate -L100g -n exp2 vg_bricks
Logical volume "exp2" created
# mkfs.xfs -i size=512 /dev/vg_bricks/exp2
meta-data=/dev/vg_bricks/exp2 isize=512 agcount=4, agsize=6553600 blks
= sectsz=512 attr=2, projid32bit=0
data = bsize=4096 blocks=26214400, imaxpct=25
= sunit=0 swidth=0 blks
naming =version 2 bsize=4096 ascii-ci=0
log =internal log bsize=4096 blocks=12800, version=2
= sectsz=512 sunit=0 blks, lazy-count=1
realtime =none extsz=4096 blocks=0, rtextents=0
# blkid /dev/vg_bricks/exp2
/dev/vg_bricks/exp2: UUID="d7c0f25d-18e2-4736-9fc7-63f5899426cc" TYPE="xfs"
# mkdir /exp2
Lage entry i fstab:
UUID=d7c0f25d-18e2-4736-9fc7-63f5899426cc /exp2 xfs defaults 1 2
Montere og lage dir:
mount /exp2 mkdir /exp2/bricksrv
Lage nytt volum med navn "user", samme som tenant_id (ikke tenant_name) for brukeren "user":
# gluster volume create 00e3bfb9a9734e40b172d79068e7105d replica 2 transport tcp \
rhos-storage01-data:/exp2/bricksrv \
rhos-storage02-data:/exp2/bricksrv
volume create: 00e3bfb9a9734e40b172d79068e7105d: success: please start the volume to access data
Starte volumet:
# gluster volume start 00e3bfb9a9734e40b172d79068e7105d volume start: 00e3bfb9a9734e40b172d79068e7105d: success
Skru av NFS for volumet:
# gluster volume set 00e3bfb9a9734e40b172d79068e7105d nfs.disable on volume set: success
12.9 Lage Ring
Kjører på begge nodene:
# chmod 0700 /etc/swift # cd /etc/swift # gluster-swift-gen-builders 00e3bfb9a9734e40b172d79068e7105d Ring files are prepared in /etc/swift. Please restart object store services
12.10 Starte Swift
Starter tjenestene:
# swift-init main restart Signal proxy-server pid: 23789 signal: 15 Signal container-server pid: 22218 signal: 15 Signal account-server pid: 22219 signal: 15 Signal object-server pid: 22812 signal: 15 proxy-server (23789) appears to have stopped container-server (22218) appears to have stopped account-server (22219) appears to have stopped object-server (22812) appears to have stopped Starting proxy-server...(/etc/swift/proxy-server.conf) Starting container-server...(/etc/swift/container-server.conf) Starting account-server...(/etc/swift/account-server.conf) Starting object-server...(/etc/swift/object-server.conf)
Sørge for at de starter ved boot:
chkconfig openstack-swift-proxy on chkconfig openstack-swift-account on chkconfig openstack-swift-container on chkconfig openstack-swift-object on
12.11 Test av Swift
Kjører på f.eks. rhos-controller:
# swift -V 2 -A http://rhos-controller-api.uio.no:5000/v2.0 -U user:user -K $USER_PASS stat
Account: AUTH_00e3bfb9a9734e40b172d79068e7105d
Containers: 0
Objects: 0
Bytes: 0
Accept-Ranges: bytes
X-Bytes-Used: 0
X-Object-Count: 0
X-Timestamp: 1395415194.37158
X-Trans-Id: tx99bb0704024d4f5fae9e6-00532c5948
X-Type: Account
Content-Type: text/plain; charset=utf-8
X-Container-Count: 0
Tilsvarende ved å bruke ENV-variable:
# source ~/keystonerc_user # swift stat
Lager noen filer:
# cd /tmp # head -c 1024 /dev/urandom > data1.file # head -c 1024 /dev/urandom > data2.file # head -c 1024 /dev/urandom > data3.file
Uploader filene:
# cd /tmp # swift upload c1 data1.file data1.file # swift upload c1 data2.file data2.file # swift upload c1 data3.file data3.file
Lister opp:
# swift list c1 # swift list c1 data1.file data2.file data3.file
Nedlasting:
# cd /root # swift download c1 data1.file data1.file [headers 0.366s, total 0.371s, 0.003 MB/s] # md5sum /tmp/data1.file data1.file 9efd1b6ea0aab42e30598a1f4277a0ba /tmp/data1.file 9efd1b6ea0aab42e30598a1f4277a0ba data1.file
13 Glance over til RHSS
Notat
Flytte Glance fra LVM-backend til Red Hat Storage. Dokumentasjon fra Red Hat: https://access.redhat.com/site/documentation/en-US/Red_Hat_Storage/2.1/html-single/Configuring_Red_Hat_OpenStack_with_Red_Hat_Storage/index.html#idm70946416
Først: Slettet alle Nova-instanser og Glance-images som var lagt inn.
13.1 Lage volum for Glance
Lage nye bricks:
# lvcreate -L50g -n exp3 vg_bricks
Logical volume "exp3" created
# mkfs.xfs -i size=512 /dev/vg_bricks/exp3
meta-data=/dev/vg_bricks/exp3 isize=512 agcount=4, agsize=3276800 blks
= sectsz=512 attr=2, projid32bit=0
data = bsize=4096 blocks=13107200, imaxpct=25
= sunit=0 swidth=0 blks
naming =version 2 bsize=4096 ascii-ci=0
log =internal log bsize=4096 blocks=6400, version=2
= sectsz=512 sunit=0 blks, lazy-count=1
realtime =none extsz=4096 blocks=0, rtextents=0
# blkid /dev/vg_bricks/exp3
/dev/vg_bricks/exp3: UUID="29989fd1-21d5-4126-b169-9159ac5906b5" TYPE="xfs"
# mkdir /exp3
Lage entry i fstab:
UUID=29989fd1-21d5-4126-b169-9159ac5906b5 /exp3 xfs defaults 1 2
Montere og lage dir:
mount /exp3 mkdir /exp3/bricksrv
Lage nytt volum:
# gluster volume create glance-vol replica 2 transport tcp \
rhos-storage01-data:/exp3/bricksrv \
rhos-storage02-data:/exp3/bricksrv
volume create: glance-vol: success: please start the volume to access data
Starte volumet:
# gluster volume start glance-vol volume start: glance-vol: success
Skru av NFS for volumet:
# gluster volume set glance-vol nfs.disable on volume set: success
13.2 Konfigurere Glance
På rhos-controller.uio.no.
Editere /etc/glance/glance-api.conf, sette:
# ============ Filesystem Store Options ======================== # Directory that the Filesystem backend store # writes image data to filesystem_store_datadir=/gluster/glance/images/
Lage mountpoint:
mkdir -p /gluster/glance/images
Montere:
mount -t glusterfs rhos-storage01-data:/glance-vol /gluster/glance/images
Endre eierskap (BUG i dok.: må gjøres etter montering):
chown -R glance:glance /gluster/glance/
Legge til i fstab:
rhos-storage01-data:/glance-vol /gluster/glance/images glusterfs defaults,_netdev 0 0
Restarte glance-tjenesten:
service openstack-glance-api restart
13.3 Teste tjenesten
Laster ned et image:
cd /tmp wget http://cdn.download.cirros-cloud.net/0.3.1/cirros-0.3.1-x86_64-disk.img
Laster opp imaget:
# glance image-create --name="CirrOS 0.3.1" \
--disk-format=qcow2 --container-format=bare \
--is-public=true < /tmp/cirros-0.3.1-x86_64-disk.img
+------------------+--------------------------------------+
| Property | Value |
+------------------+--------------------------------------+
| checksum | d972013792949d0d3ba628fbe8685bce |
| container_format | bare |
| created_at | 2014-04-01T12:01:08 |
| deleted | False |
| deleted_at | None |
| disk_format | qcow2 |
| id | 63dcb5c2-2612-4a3f-b3b4-ac9ebcd15a51 |
| is_public | True |
| min_disk | 0 |
| min_ram | 0 |
| name | CirrOS 0.3.1 |
| owner | 0b13f50bbb1a4b46b884a69cdc950903 |
| protected | False |
| size | 13147648 |
| status | active |
| updated_at | 2014-04-01T12:01:09 |
+------------------+--------------------------------------+
14 Nova over til RHSS
Notat
Flytte Nova fra lokalt filsystem til Red Hat Storage. Dokumentasjon fra Red Hat: https://access.redhat.com/site/documentation/en-US/Red_Hat_Storage/2.1/html-single/Configuring_Red_Hat_OpenStack_with_Red_Hat_Storage/index.html#idm73313664
Først: Slettet alle Nova-instanser og Glance-images som var lagt inn.
14.1 Lage volum for Nova
Lage nye bricks:
# lvcreate -L50g -n exp4 vg_bricks
Logical volume "exp4" created
# mkfs.xfs -i size=512 /dev/vg_bricks/exp4
# blkid /dev/vg_bricks/exp4
/dev/vg_bricks/exp4: UUID="1c5539a1-99ad-4663-9c62-1cf55e7fdda0" TYPE="xfs"
# mkdir /exp4
Lage entry i fstab:
UUID= /exp4 xfs defaults 1 2
Montere og lage dir:
mount /exp4 mkdir /exp4/bricksrv
Lage nytt volum:
# gluster volume create nova-vol replica 2 transport tcp \
rhos-storage01-data:/exp4/bricksrv \
rhos-storage02-data:/exp4/bricksrv
volume create: nova-vol: success: please start the volume to access data
Starte volumet:
# gluster volume start nova-vol volume start: nova-vol: success
Skru av NFS for volumet:
# gluster volume set nova-vol nfs.disable on volume set: success
14.2 Konfigurere Nova
På rhos-compute01.uio.no.
Editere /etc/nova/nova.conf, sette:
instances_path=/gluster/nova/instances
Lage mountpoint:
mkdir -p /gluster/nova/instances
Montere:
mount -t glusterfs rhos-storage01-data:/nova-vol /gluster/nova/instances
Endre eierskap (BUG i dok.: må gjøres etter montering):
chown -R nova:nova /gluster/nova/
Legge til i fstab:
rhos-storage01-data:/nova-vol /gluster/nova/instances glusterfs defaults,_netdev 0 0
Restarte nova-tjenesten:
service openstack-nova-compute restart
14.3 Teste tjenesten
Som user.
Finne et image:
# nova image-list +--------------------------------------+--------------+--------+--------+ | ID | Name | Status | Server | +--------------------------------------+--------------+--------+--------+ | 63dcb5c2-2612-4a3f-b3b4-ac9ebcd15a51 | CirrOS 0.3.1 | ACTIVE | | +--------------------------------------+--------------+--------+--------+
Finne nett-ID:
# nova net-list +--------------------------------------+-------------+------+ | ID | Label | CIDR | +--------------------------------------+-------------+------+ | 33974169-9da3-4460-9d6d-6f9c656294c6 | ex-net | None | | 77d2a6bb-00fb-47d7-86c4-111d9299a2f9 | user-net | None | | dbf7eaf7-e3a2-4e31-9ea7-88e1af36c4ad | mikaeld-net | None | | ef29743c-9159-4481-9bce-464d4438bd11 | Foreman | None | +--------------------------------------+-------------+------+
Boote et image:
# nova boot --flavor 1 \ --image 63dcb5c2-2612-4a3f-b3b4-ac9ebcd15a51 \ --security_group default test1 \ --nic net-id=77d2a6bb-00fb-47d7-86c4-111d9299a2f9 +--------------------------------------+--------------------------------------+ | Property | Value | +--------------------------------------+--------------------------------------+ | status | BUILD | | updated | 2014-04-01T12:21:49Z | | OS-EXT-STS:task_state | scheduling | | key_name | None | | image | CirrOS 0.3.1 | | hostId | | | OS-EXT-STS:vm_state | building | | OS-SRV-USG:launched_at | None | | flavor | m1.tiny | | id | aeb9737a-169f-4e28-853d-5f891ed6c696 | | security_groups | [{u'name': u'default'}] | | OS-SRV-USG:terminated_at | None | | user_id | 632e1c5e207347ff8f68337d0ffb91d0 | | name | test1 | | adminPass | J3YNSENuT87S | | tenant_id | 00e3bfb9a9734e40b172d79068e7105d | | created | 2014-04-01T12:21:49Z | | OS-DCF:diskConfig | MANUAL | | metadata | {} | | os-extended-volumes:volumes_attached | [] | | accessIPv4 | | | accessIPv6 | | | progress | 0 | | OS-EXT-STS:power_state | 0 | | OS-EXT-AZ:availability_zone | nova | | config_drive | | +--------------------------------------+--------------------------------------+
15 Heat
Notat
Kjøres på rhos-controller
Installasjon av pakker:
yum install -y openstack-heat-* python-heatclient openstack-utils
15.1 Lage database
Lage database for heat:
Lage passord for heat-databasen, til heat-brukeren:
HEAT_DBPASS=$(openssl rand -hex 10) echo "HEAT_DBPASS=$HEAT_DBPASS" >> ~/passwords.sh
Koble til mysql som root:
mysql -u root -p
Lage heat-database:
mysql> CREATE DATABASE heat; Query OK, 1 row affected (0.00 sec)
Lage bruker for heat og gi den tilgang til databasen:
mysql> GRANT ALL ON heat.* TO 'heat'@'%' IDENTIFIED BY 'sensurert'; Query OK, 0 rows affected (0.00 sec) mysql> GRANT ALL ON heat.* TO 'heat'@'localhost' IDENTIFIED BY 'sensurert'; Query OK, 0 rows affected (0.00 sec)
Flush for å sørge for at endringen trer i kraft umiddelbart:
mysql> FLUSH PRIVILEGES; Query OK, 0 rows affected (0.00 sec)
Exit:
mysql> quit Bye
15.2 Konfigurere db-passord
Kjører:
openstack-config --set /etc/heat/heat.conf \
DEFAULT sql_connection mysql://heat:${HEAT_DBPASS}@rhos-controller-api.uio.no/heat
15.4 Konfigurere bind-adresse
API:
openstack-config --set /etc/heat/heat.conf \ heat_api bind_host 129.240.149.228
Cloud formation:
openstack-config --set /etc/heat/heat.conf \ heat_api_cfn bind_host 129.240.149.228
Cloudwatch:
openstack-config --set /etc/heat/heat.conf \ heat_api_cloudwatch bind_host 129.240.149.228
15.5 Lage bruker etc.
Lage passord for heat:
HEAT_PASS=$(openssl rand -hex 10) echo "HEAT_PASS=$HEAT_PASS" >> ~/passwords.sh
Lage bruker "heat":
# keystone user-create --name heat --pass $HEAT_PASS +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | email | | | enabled | True | | id | 5b89835cf2e94af39e5c18fc8c68dd0b | | name | heat | +----------+----------------------------------+
Linker heat-brukeren sammen med admin-rollen i tenant "services":
# keystone user-role-add --user heat \ --role admin \ --tenant servicesLage service-entry for heat og heat-cfn:
# keystone service-create --name heat \ --type orchestration \ --description "Heat Orchestration Service" +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Heat Orchestration Service | | id | 71f9128e87ef4042b2cb5b6f5ffa06aa | | name | heat | | type | orchestration | +-------------+----------------------------------+ # keystone service-create --name heat-cfn \ --type cloudformation \ --description "Heat Cloud Formation Service" +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Heat Cloud Formation Service | | id | 631de64019ed4bcdb03d9619c1a3ca42 | | name | heat-cfn | | type | cloudformation | +-------------+----------------------------------+Lage endpoint-entry for heat og heat-cfn:
# keystone endpoint-create \ --service heat \ --publicurl "http://rhos-controller-api.uio.no:8004/v1/%(tenant_id)s" \ --adminurl "http://rhos-controller-api.uio.no:8004/v1/%(tenant_id)s" \ --internalurl "http://rhos-controller-api.uio.no:8004/v1/%(tenant_id)s" +-------------+---------------------------------------------------------+ | Property | Value | +-------------+---------------------------------------------------------+ | adminurl | http://rhos-controller-api.uio.no:8004/v1/%(tenant_id)s | | id | 4d510371f08241618b4a65136e4723c6 | | internalurl | http://rhos-controller-api.uio.no:8004/v1/%(tenant_id)s | | publicurl | http://rhos-controller-api.uio.no:8004/v1/%(tenant_id)s | | region | regionOne | | service_id | 71f9128e87ef4042b2cb5b6f5ffa06aa | +-------------+---------------------------------------------------------+ # keystone endpoint-create \ --service heat-cfn \ --publicurl "http://rhos-controller-api.uio.no:8000/v1" \ --adminurl "http://rhos-controller-api.uio.no:8000/v1" \ --internalurl "http://rhos-controller-api.uio.no:8000/v1" +-------------+-------------------------------------------+ | Property | Value | +-------------+-------------------------------------------+ | adminurl | http://rhos-controller-api.uio.no:8000/v1 | | id | 8d3929d4b0b245e8bbe68fb0eb966143 | | internalurl | http://rhos-controller-api.uio.no:8000/v1 | | publicurl | http://rhos-controller-api.uio.no:8000/v1 | | region | regionOne | | service_id | 631de64019ed4bcdb03d9619c1a3ca42 | +-------------+-------------------------------------------+
15.6 Konfigurere
Autentisering:
openstack-config --set /etc/heat/heat.conf \ keystone_authtoken admin_tenant_name services
Sette admin_user:
openstack-config --set /etc/heat/heat.conf \ keystone_authtoken admin_user heat
Sette passord:
openstack-config --set /etc/heat/heat.conf \ keystone_authtoken admin_password $HEAT_PASS
Sette identity service:
openstack-config --set /etc/heat/heat.conf \ keystone_authtoken service_host rhos-controller-api.uio.no openstack-config --set /etc/heat/heat.conf \ keystone_authtoken auth_host rhos-controller-api.uio.no openstack-config --set /etc/heat/heat.conf \ keystone_authtoken auth_uri http://rhos-controller-api.uio.no:35357/v2.0 \ openstack-config --set /etc/heat/heat.conf \ keystone_authtoken keystone_ec2_uri http://rhos-controller-api.uio.no:35357/v2.0
Sette hostname for heat-cfn og heat-api-cloudwatch:
openstack-config --set /etc/heat/heat.conf \ DEFAULT heat_metadata_server_url rhos-controller-api.uio.no:8000 openstack-config --set /etc/heat/heat.conf \ DEFAULT heat_waitcondition_server_url rhos-controller-api.uio.no:8000/v1/waitcondition openstack-config --set /etc/heat/heat.conf \ DEFAULT heat_watch_server_url rhos-controller-api.uio.no:8003
Sette rolle for heat-brukere:
openstack-config --set /etc/heat/heat.conf \ DEFAULT heat_stack_user_role heat_stack_user
15.7 Konfigurere QPID
Sette rpc_backend:
openstack-config --set /etc/heat/heat.conf \ DEFAULT rpc_backend heat.openstack.common.rpc.impl_qpid
Sette qpid_hostname:
openstack-config --set /etc/heat/heat.conf \ DEFAULT qpid_hostname rhos-controller-api.uio.no
15.8 Starte tjenesten
Starter tjenestene og sørger for at de starter ved boot:
service openstack-heat-api start service openstack-heat-api-cfn start service openstack-heat-api-cloudwatch start service openstack-heat-engine start chkconfig openstack-heat-api on chkconfig openstack-heat-api-cfn on chkconfig openstack-heat-api-cloudwatch on chkconfig openstack-heat-engine on
15.10 Firewall
Fikse iptables:
iptables -A INPUT -i BR -p tcp --dport 8003 -j ACCEPT iptables -A INPUT -i BR -p tcp --dport 8000 -j ACCEPT iptables-save > /etc/sysconfig/iptables