Openstack på Fedora 20

1.1   Passord

Genererte passord for alle tjenester på openstack32.uio.no:

for k in KEYSTONE_DBPASS ADMIN_PASS GLANCE_DBPASS \
         GLANCE_PASS NOVA_DBPASS NOVA_PASS DASH_DBPASS \
         CINDER_DBPASS CINDER_PASS NEUTRON_DBPASS \
         NEUTRON_PASS HEAT_DBPASS HEAT_PASS \
         CEILOMETER_DBPASS CEILOMETER_PASS; do
    pw=$(openssl rand -hex 10)
    echo "$f=$pw" >> /root/passwords.sh
done

For å bruke et passord trenger man derfor bare gjøre:

. /root/passwords.sh

og kalle variabelen i shellet.

1.2   MySQL på controller

Installerte MySQL server på openstack32:

yum -y install mysql mysql-server MySQL-python

Satte bind til 129.240.149.35 i /etc/my.cnf:

[mysqld]
...
bind-address=129.240.149.35

Startet MySQL og satte den til å kjøre ved boot:

systemctl start mariadb.service
systemctl enable mariadb.service

Genererte passord for MySQL root:

openssl rand -hex 10 >> mysql_rootpw

Gjør MySQL ekstra sikker:

[root@openstack32 ~]# mysql_secure_installation
/usr/bin/mysql_secure_installation: line 379: find_mysql_client:
command not found

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user.  If you've just installed MariaDB, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.

Set root password? [Y/n] y
New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
 ... Success!


By default, a MariaDB installation has an anonymous user, allowing
anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.
This
ensures that someone cannot guess at the root password from the
network.

Disallow root login remotely? [Y/n] y
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so
far will take effect immediately.

Reload privilege tables now? [Y/n] y
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

1.3   MySQL på compute-noder

Installerte klient-verktøy for MySQL:

yum -y install mysql MySQL-python

1.4   Openstack utils

På alle noder, installert openstack-utils:

yum -y install openstack-utils

1.5   Messaging server på controller

Installerte på openstack32:

yum -y install qpid-cpp-server memcached

Skrudde av autentisering i Qpid ved å editere /etc/qpidd.conf og sette:

auth=no

Slo på Qpid og satte den til å starte ved boot:

systemctl start qpidd.service
systemctl enable qpidd.service

1.6   Til slutt

Rebootet alle noder.

2.1   Installasjon

Installerte pakker:

yum -y install openstack-keystone python-keystoneclient

Konfigurerte til å bruke MySQL-databasen:

openstack-config --set /etc/keystone/keystone.conf \
  sql connection mysql://keystone:${KEYSTONE_DBPASS}@openstack32.uio.no/keystone

Laget database for Keystone:

[root@openstack32 ~]# openstack-db --init --service keystone --password $KEYSTONE_DBPASS
Please enter the password for the 'root' MySQL user:
Verified connectivity to MySQL.
Creating 'keystone' database.
Updating 'keystone' database password in /etc/keystone/keystone.conf
Initializing the keystone database, please wait...
Complete!

Definerte et admin-token som brukes som delt hemmelighet mellom Keystone og andre Openstack-tjenester:

ADMIN_TOKEN=$(openssl rand -hex 10)
openstack-config --set /etc/keystone/keystone.conf DEFAULT \
  admin_token $ADMIN_TOKEN

Laget PKI-sertifikater for Keystone:

[root@openstack32 ~]# keystone-manage pki_setup --keystone-user keystone --keystone-group keystone
2013-12-27 11:19:19.473 22763 INFO keystone.common.openssl [-] openssl genrsa -out /etc/keystone/ssl/certs/cakey.pem 2048
Generating RSA private key, 2048 bit long modulus
.........................+++
.+++
e is 65537 (0x10001)
2013-12-27 11:19:19.563 22763 INFO keystone.common.openssl [-] openssl req -new -x509 -extensions v3_ca -passin pass:None -key
  /etc/keystone/ssl/certs/cakey.pem -out
  /etc/keystone/ssl/certs/ca.pem -days 3650 -config
  /etc/keystone/ssl/certs/openssl.conf -subj
  /C=US/ST=Unset/L=Unset/O=Unset/CN=www.example.com
2013-12-27 11:19:19.578 22763 INFO keystone.common.openssl [-] openssl genrsa -out /etc/keystone/ssl/private/signing_key.pem 2048
Generating RSA private key, 2048 bit long modulus
...........+++
......................+++
e is 65537 (0x10001)
2013-12-27 11:19:19.675 22763 INFO keystone.common.openssl [-] openssl req -key /etc/keystone/ssl/private/signing_key.pem -new -nodes -out
  /etc/keystone/ssl/certs/req.pem -config
  /etc/keystone/ssl/certs/openssl.conf -subj
  /C=US/ST=Unset/L=Unset/O=Unset/CN=www.example.com
2013-12-27 11:19:19.687 22763 INFO keystone.common.openssl [-] openssl ca -batch -out /etc/keystone/ssl/certs/signing_cert.pem -config
  /etc/keystone/ssl/certs/openssl.conf -days 3650d -cert
  /etc/keystone/ssl/certs/ca.pem -keyfile
  /etc/keystone/ssl/certs/cakey.pem -infiles
  /etc/keystone/ssl/certs/req.pem
Using configuration from /etc/keystone/ssl/certs/openssl.conf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'US'
stateOrProvinceName   :ASN.1 12:'Unset'
localityName          :ASN.1 12:'Unset'
organizationName      :ASN.1 12:'Unset'
commonName            :ASN.1 12:'www.example.com'
Certificate is to be certified until Dec 25 10:19:19 2023 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated
[root@openstack32 ~]# chown -R keystone:keystone /etc/keystone/* /var/log/keystone/keystone.log

Startet Keystone og satte den til å starte ved boot:

systemctl start openstack-keystone.service
systemctl enable openstack-keystone.service

2.2   Definere brukere, tenants og roller

Setter et par variable:

export OS_SERVICE_TOKEN=$ADMIN_TOKEN
export OS_SERVICE_ENDPOINT=http://openstack32.uio.no:35357/v2.0

Lager tenants for admin-bruker og tjenester:

[root@openstack32 ~]# keystone tenant-create --name=admin --description="Admin Tenant"
+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |           Admin Tenant           |
|   enabled   |               True               |
|      id     | 1d29e1f016344ef9867631d4f414b0c7 |
|     name    |              admin               |
+-------------+----------------------------------+

[root@openstack32 ~]# keystone tenant-create --name=service --description="Service Tenant"
+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |          Service Tenant          |
|   enabled   |               True               |
|      id     | be63cafb62564e949bb4a17fb70f0008 |
|     name    |             service              |
+-------------+----------------------------------+

Lager en admin-bruker:

[root@openstack32 ~]# keystone user-create --name=admin --pass=$ADMIN_PASS --email=iaas-core@usit.uio.no
+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |      iaas-core@usit.uio.no       |
| enabled  |               True               |
|    id    | ea35d12002d447b195d0062c1859ea79 |
|   name   |              admin               |
| tenantId |                                  |
+----------+----------------------------------+

Lager en admin-rolle:

[root@openstack32 ~]# keystone role-create --name=admin
+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|    id    | be25483de7c84741bb1bd13dd68707b6 |
|   name   |              admin               |
+----------+----------------------------------+

Knytter admin-brukeren til admin-rollen vha. admin-tenant:

[root@openstack32 ~]# keystone user-role-add --user=admin --tenant=admin --role=admin

2.3   Definere tjenester og endepunkter for API

Lager en service for selve Identity-tjenesten, som bruker normal autentisering istedenfor autorisering via token.

Lager først en service entry for Keystone:

[root@openstack32 ~]# keystone service-create --name=keystone --type=identity --description="Keystone Identity Service"
+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |    Keystone Identity Service     |
|      id     | 554af2e3c02d431bae41d6d39231372e |
|     name    |             keystone             |
|     type    |             identity             |
+-------------+----------------------------------+

Spesifiserer et API-endpoint for Keystone vha. id-en som ble generert over:

[root@openstack32 ~]# keystone endpoint-create --service-id=554af2e3c02d431bae41d6d39231372e --publicurl=http://openstack32.uio.no:5000/v2.0 --internalurl=http://openstack32.uio.no:5000/v2.0 --adminurl=http://openstack32.uio.no:35357/v2.0
+-------------+--------------------------------------+
|   Property  |                Value                 |
+-------------+--------------------------------------+
|   adminurl  | http://openstack32.uio.no:35357/v2.0 |
|      id     |   b0723aa856a84b7681ea7f5b5df44722   |
| internalurl | http://openstack32.uio.no:5000/v2.0  |
|  publicurl  | http://openstack32.uio.no:5000/v2.0  |
|    region   |              regionOne               |
|  service_id |   554af2e3c02d431bae41d6d39231372e   |
+-------------+--------------------------------------+

2.4   Verifiserer

Fjerner først variable satt tidligere:

unset OS_SERVICE_TOKEN OS_SERVICE_ENDPOINT

Ber om et admin-token vha. brukernavn/passord:

keystone --os-username=admin --os-password=$ADMIN_PASS \
  --os-auth-url=http://openstack32.uio.no:35357/v2.0 token-get

Tester autorisering på en tenant:

keystone --os-username=admin --os-password=$ADMIN_PASS \
  --os-tenant-name=admin \
  --os-auth-url=http://openstack32.uio.no:35357/v2.0 token-get

Laget en fil /root/keystonerc:

cat << EOF > /root/keystonerc
export OS_USERNAME=admin
export OS_PASSWORD=$ADMIN_PASS
export OS_TENANT_NAME=admin
export OS_AUTH_URL=http://openstack32.uio.no:35357/v2.0
EOF

Sourcer denne filen:

. ~/keystonerc

Prøver uten argumenter:

keystone token-get

Sjekker at admin-kontoen virker og er satt opp riktig:

[root@openstack32 ~]# keystone user-list
+----------------------------------+-------+---------+-----------------------+
|                id                |  name | enabled |         email         |
+----------------------------------+-------+---------+-----------------------+
| ea35d12002d447b195d0062c1859ea79 | admin |   True  | iaas-core@usit.uio.no |
+----------------------------------+-------+---------+-----------------------+

3.1   Installasjon

Lage eget volum og filsystem til Glance:

lvcreate -L100g -n glance-images internvg
mkfs.ext4 /dev/internvg/glance-images

Dette ble montert opp på /var/lib/glance/images.

Installere Glance:

yum -y install openstack-glance

Konfigurerer:

openstack-config --set /etc/glance/glance-api.conf \
  DEFAULT sql_connection mysql://glance:${GLANCE_DBPASS}@openstack32.uio.no/glance
openstack-config --set /etc/glance/glance-registry.conf \
  DEFAULT sql_connection mysql://glance:${GLANCE_DBPASS}@openstack32.uio.no/glance

Lager database for Glance:

openstack-db --init --service glance --password $GLANCE_DBPASS

Lager en bruker for Glance til bruk mot Keystone:

[root@openstack32 ~]# keystone user-create --name=glance --pass=$GLANCE_PASS --email=iaas-core@usit.uio.no
+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |      iaas-core@usit.uio.no       |
| enabled  |               True               |
|    id    | 7dc097dca16d4aa6bd8710b45ee327f4 |
|   name   |              glance              |
| tenantId |                                  |
+----------+----------------------------------+

[root@openstack32 ~]# keystone user-role-add --user=glance --tenant=service --role=admin

Legger dette til i config-filene til Glance:

openstack-config --set /etc/glance/glance-api.conf keystone_authtoken auth_host openstack32.uio.no
openstack-config --set /etc/glance/glance-api.conf keystone_authtoken admin_user glance
openstack-config --set /etc/glance/glance-api.conf keystone_authtoken admin_tenant_name service
openstack-config --set /etc/glance/glance-api.conf keystone_authtoken admin_password $GLANCE_PASS
openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken auth_host openstack32.uio.no
openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken admin_user glance
openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken admin_tenant_name service
openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken admin_password $GLANCE_PASS

Kopierer config-filer til riktig sted:

cp /usr/share/glance/glance-api-dist-paste.ini /etc/glance/glance-api-paste.ini
cp /usr/share/glance/glance-registry-dist-paste.ini /etc/glance/glance-registry-paste.ini

Editerer /etc/glance/glance-api-paste.ini og /etc/glance/glance-registry-paste.ini og legger til under [filter:authtoken]:

auth_host=openstack32.uio.no
admin_user=glance
admin_tenant_name=service
admin_password=*<GLANCE_PASS>*
flavor=keystone

Registrerer Glance med Keystone:

[root@openstack32 ~]# keystone service-create --name=glance --type=image --description="Glance Image Service"
+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |       Glance Image Service       |
|      id     | 4d2839b037804618978221d4e655ca10 |
|     name    |              glance              |
|     type    |              image               |
+-------------+----------------------------------+

Lager et API-endepunkt:

[root@openstack32 ~]# keystone endpoint-create --service-id=4d2839b037804618978221d4e655ca10 --publicurl=http://openstack32.uio.no:9292 --internalurl=http://openstack32.uio.no:9292 --adminurl=http://openstack32.uio.no:9292
+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
|   adminurl  |  http://openstack32.uio.no:9292  |
|      id     | a07408a72dac418893fa64983a4d7bf4 |
| internalurl |  http://openstack32.uio.no:9292  |
|  publicurl  |  http://openstack32.uio.no:9292  |
|    region   |            regionOne             |
|  service_id | 4d2839b037804618978221d4e655ca10 |
+-------------+----------------------------------+

Starter glance-api og glance-registry og sørger for at de starter ved boot:

systemctl start openstack-glance-api.service
systemctl start openstack-glance-registry.service
systemctl enable openstack-glance-api.service
systemctl enable openstack-glance-registry.service

Sørger for at glance kan skrive til images-filsystemet:

chown glance:glance /var/lib/glance
chown glance:glance /var/lib/glance/images
restorecon -Rv /var/lib/glance

3.2   Verifiserer

Laster ned et image:

cd /tmp
wget http://cdn.download.cirros-cloud.net/0.3.1/cirros-0.3.1-x86_64-disk.img

Laster opp imaget:

[root@openstack32 ~]# glance image-create --name="CirrOS 0.3.1" --disk-format=qcow2 --container-format=bare --is-public=true < /tmp/cirros-0.3.1-x86_64-disk.img
+------------------+--------------------------------------+
| Property         | Value                                |
+------------------+--------------------------------------+
| checksum         | d972013792949d0d3ba628fbe8685bce     |
| container_format | bare                                 |
| created_at       | 2013-12-28T14:16:06                  |
| deleted          | False                                |
| deleted_at       | None                                 |
| disk_format      | qcow2                                |
| id               | 23909183-9d63-4aca-887d-709044277356 |
| is_public        | True                                 |
| min_disk         | 0                                    |
| min_ram          | 0                                    |
| name             | CirrOS 0.3.1                         |
| owner            | None                                 |
| protected        | False                                |
| size             | 13147648                             |
| status           | active                               |
| updated_at       | 2013-12-28T14:16:06                  |
+------------------+--------------------------------------+

Lister opp:

[root@openstack32 ~]# glance image-list
+--------------------------------------+--------------+-------------+------------------+----------+--------+
| ID                                   | Name         | Disk Format | Container Format | Size     | Status |
+--------------------------------------+--------------+-------------+------------------+----------+--------+
| 23909183-9d63-4aca-887d-709044277356 | CirrOS 0.3.1 | qcow2       | bare             | 13147648 | active |
+--------------------------------------+--------------+-------------+------------------+----------+--------+

4.1   Installasjon av Compute controller services

Dette gjøres på controller-noden.

Installere pakker:

yum -y install openstack-nova python-novaclient

Konfigurerer:

openstack-config --set /etc/nova/nova.conf \
  database connection mysql://nova:${NOVA_DBPASS}@openstack32.uio.no/nova

Konfigurerer for qpid:

openstack-config --set /etc/nova/nova.conf \
  DEFAULT rpc_backend nova.openstack.common.rpc.impl_qpid
openstack-config --set /etc/nova/nova.conf \
  DEFAULT qpid_hostname openstack32.uio.no

Lager database og tabelle for Nova:

.. parsed-literal::

[root@openstack32 ~]# openstack-db --init --service nova --password $NOVA_DBPASS Please enter the password for the 'root' MySQL user: Verified connectivity to MySQL. Creating 'nova' database. Updating 'nova' database password in /etc/nova/nova.conf Initializing the nova database, please wait... Complete!

Konfigurerer my_ip, vncserver_listen, og vncserver_proxyclient_address til å lytte på det interne interfacet til controller-noden:

openstack-config --set /etc/nova/nova.conf \
  DEFAULT my_ip 129.240.149.35
openstack-config --set /etc/nova/nova.conf \
  DEFAULT vncserver_listen 129.240.149.35
openstack-config --set /etc/nova/nova.conf \
  DEFAULT vncserver_proxyclient_address 129.240.149.35

Lager en Keystone-bruker for Nova:

[root@openstack32 ~]# keystone user-create --name=nova --pass=$NOVA_PASS --email=iaas-core@usit.uio.no
+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |      iaas-core@usit.uio.no       |
| enabled  |               True               |
|    id    | 500f375daa574e428938ccebd0b7d664 |
|   name   |               nova               |
| tenantId |                                  |
+----------+----------------------------------+

[root@openstack32 ~]# keystone user-role-add --user=nova --tenant=service --role=admin

Konfigurerer Nova til å bruke denne brukeren:

openstack-config --set /etc/nova/nova.conf DEFAULT auth_strategy keystone
openstack-config --set /etc/nova/nova.conf keystone_authtoken auth_host openstack32.uio.no
openstack-config --set /etc/nova/nova.conf keystone_authtoken auth_protocol http
openstack-config --set /etc/nova/nova.conf keystone_authtoken auth_port 35357
openstack-config --set /etc/nova/nova.conf keystone_authtoken admin_user nova
openstack-config --set /etc/nova/nova.conf keystone_authtoken admin_tenant_name service
openstack-config --set /etc/nova/nova.conf keystone_authtoken admin_password $NOVA_PASS

Legger til i /etc/nova/api-paste.ini, under [filter:authtoken]:

auth_host = openstack32.uio.no
auth_port = 35357
auth_protocol = http
auth_uri = http://openstack32.uio.no:5000/v2.0
admin_tenant_name = service
admin_user = nova
admin_password = <NOVA_PASS>

Patcher /etc/nova/nova.conf:

--- /tmp/nova.conf      2013-12-28 18:47:14.270626128 +0100
+++ /etc/nova/nova.conf 2013-12-28 18:47:34.848640057 +0100
@@ -291,7 +291,7 @@

 # File name for the paste.deploy config for nova-api (string
 # value)
-#api_paste_config=api-paste.ini
+api_paste_config=/etc/nova/api-paste.ini

 # A python format string that is used as the template to
 # generate log lines. The following values can be formatted

Registrerer compute-tjenesten med Keystone (identity):

[root@openstack32 ~]# keystone service-create --name=nova --type=compute --description="Nova Compute service"
+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |       Nova Compute service       |
|      id     | da83e981d6d9433e85d70a74cc24438b |
|     name    |               nova               |
|     type    |             compute              |
+-------------+----------------------------------+

Lager et endepunkt:

[root@openstack32 ~]# keystone endpoint-create --service-id=da83e981d6d9433e85d70a74cc24438b --publicurl=http://openstack32.uio.no:8774/v2/%(tenant_id)s --internalurl=http://openstack32.uio.no:8774/v2/%(tenant_id)s --adminurl=http://openstack32.uio.no:8774/v2/%(tenant_id)s
+-------------+-------------------------------------------------+
|   Property  |                      Value                      |
+-------------+-------------------------------------------------+
|   adminurl  | http://openstack32.uio.no:8774/v2/%(tenant_id)s |
|      id     |         0db753e3845c4b4391c9cf9e9702fcd9        |
| internalurl | http://openstack32.uio.no:8774/v2/%(tenant_id)s |
|  publicurl  | http://openstack32.uio.no:8774/v2/%(tenant_id)s |
|    region   |                    regionOne                    |
|  service_id |         da83e981d6d9433e85d70a74cc24438b        |
+-------------+-------------------------------------------------+

Starter tjenesten og sørger for at den starter ved boot:

systemctl start openstack-nova-api.service
systemctl start openstack-nova-cert.service
systemctl start openstack-nova-consoleauth.service
systemctl start openstack-nova-scheduler.service
systemctl start openstack-nova-conductor.service
systemctl start openstack-nova-novncproxy.service
systemctl enable openstack-nova-api.service
systemctl enable openstack-nova-cert.service
systemctl enable openstack-nova-consoleauth.service
systemctl enable openstack-nova-scheduler.service
systemctl enable openstack-nova-conductor.service
systemctl enable openstack-nova-novncproxy.service

Verifiserer konfigurasjonen:

[root@openstack32 ~]# nova image-list
+--------------------------------------+--------------+--------+--------+
| ID                                   | Name         | Status | Server |
+--------------------------------------+--------------+--------+--------+
| 23909183-9d63-4aca-887d-709044277356 | CirrOS 0.3.1 | ACTIVE |        |
+--------------------------------------+--------------+--------+--------+

4.2   Installasjon på compute-noder

Installerer:

yum -y install openstack-nova-compute

Konfigurerer:

openstack-config --set /etc/nova/nova.conf database connection mysql://nova:${NOVA_DBPASS}@openstack32.uio.no/nova
openstack-config --set /etc/nova/nova.conf DEFAULT auth_strategy keystone
openstack-config --set /etc/nova/nova.conf keystone_authtoken auth_host openstack32.uio.no
openstack-config --set /etc/nova/nova.conf keystone_authtoken auth_protocol http
openstack-config --set /etc/nova/nova.conf keystone_authtoken auth_port 35357
openstack-config --set /etc/nova/nova.conf keystone_authtoken admin_user nova
openstack-config --set /etc/nova/nova.conf keystone_authtoken admin_tenant_name service
openstack-config --set /etc/nova/nova.conf keystone_authtoken admin_password $NOVA_PASS

Konfigurerer til å bruke Qpid message queue:

openstack-config --set /etc/nova/nova.conf DEFAULT rpc_backend nova.openstack.common.rpc.impl_qpid
openstack-config --set /etc/nova/nova.conf DEFAULT qpid_hostname openstack32.uio.no

Konfigurere Compute til å gi remote console aksess til instanser (eksempel for openstack29):

openstack-config --set /etc/nova/nova.conf DEFAULT my_ip 129.240.149.32
openstack-config --set /etc/nova/nova.conf DEFAULT vnc_enabled True
openstack-config --set /etc/nova/nova.conf DEFAULT vncserver_listen 0.0.0.0
openstack-config --set /etc/nova/nova.conf DEFAULT vncserver_proxyclient_address 129.240.149.32
openstack-config --set /etc/nova/nova.conf DEFAULT novncproxy_base_url http://openstack32.uio.no:6080/vnc_auto.html

Spesifiserer hvilken maskin som kjører Image (glance):

openstack-config --set /etc/nova/nova.conf DEFAULT glance_host openstack32.uio.no

Editerer /etc/nova/api-paste.ini og legger til under [filter:authtoken]:

[filter:authtoken]
paste.filter_factory = keystoneclient.middleware.auth_token:filter_factory
auth_host = openstack32.uio.no
auth_port = 35357
auth_protocol = http
admin_tenant_name = service
admin_user = nova
admin_password = <NOVA_PASS>

Editerer /etc/nova/nova.conf, setter:

api_paste_config=/etc/nova/api-paste.ini

Starter Nova og sørger for at den kjører ved boot:

systemctl start libvirtd.service
systemctl enable libvirtd.service
systemctl start openstack-nova-compute.service
systemctl enable openstack-nova-compute.service

5.1   Database, bruker, endpoint

Lager database for Neutron:

[root@openstack32 ~]# mysql -u root -p
Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 39
Server version: 5.5.34-MariaDB MariaDB Server

Copyright (c) 2000, 2013, Oracle, Monty Program Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> CREATE DATABASE neutron;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY '<NEUTRON_DBPASS>';
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY '<NEUTRON_DBPASS>';
Query OK, 0 rows affected (0.00 sec)

Lage bruker for neutron:

[root@openstack32 ~]# keystone user-create --name=neutron --pass=$NEUTRON_PASS --email=iaas-core@usit.uio.no
+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |      iaas-core@usit.uio.no       |
| enabled  |               True               |
|    id    | fef60a05d6ea43fa892352331d6bc762 |
|   name   |             neutron              |
+----------+----------------------------------+

Legger til admin-rollen til neutron-brukeren:

keystone user-role-add --user=neutron --tenant=service --role=admin

Lager Neutron-tjenesten:

[root@openstack32 ~]# keystone service-create --name=neutron --type=network --description="OpenStack Networking Service"
+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |   OpenStack Networking Service   |
|      id     | 49ea07e380e749518635f5bea745e435 |
|     name    |             neutron              |
|     type    |             network              |
+-------------+----------------------------------+

Lager endpoint for networking (bruker id-en over):

[root@openstack32 ~]# keystone endpoint-create --service-id 49ea07e380e749518635f5bea745e435 --publicurl http://openstack32.uio.no:9696 --adminurl http://openstack32.uio.no:9696 --internalurl http://openstack32.uio.no:9696
+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
|   adminurl  |  http://openstack32.uio.no:9696  |
|      id     | ba44948f0ab54cbdaed8ebe1a0963997 |
| internalurl |  http://openstack32.uio.no:9696  |
|  publicurl  |  http://openstack32.uio.no:9696  |
|    region   |            regionOne             |
|  service_id | 49ea07e380e749518635f5bea745e435 |
+-------------+----------------------------------+

5.2   Konfigurasjon av nett

Satte opp interfjes for data på em1.847, i filen /etc/sysconfig/network-scripts/ifcfg-em1.847:

DEVICE="em1.847"
ONBOOT=yes
BOOTPROTO=static
IPADDR=129.240.149.98
NETMASK=255.255.255.192
TYPE=Ethernet
VLAN=yes

Satte opp interfjes for ekstern på em1.848, i filen /etc/sysconfig/network-scripts/ifcfg-em1.848:

DEVICE="em1.848"
ONBOOT=yes
BOOTPROTO=static
IPADDR=129.240.149.162
NETMASK=255.255.255.192
TYPE=Ethernet
VLAN=yes

Satte kjerneparametre i /etc/sysctl.conf:

net.ipv4.ip_forward=1
net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.default.rp_filter=0

Leste inn kjerneparametre:

sysctl -p

Restartet nettet:

service network restart

5.3   Installasjon av Neutron

Installerer Neutron:

yum -y install openstack-neutron

Konfigurerer Neutron i filen /etc/neutron/neutron.conf:

1. For Keystone:

   • Legger til DEFAULT:

     auth_strategy = keystone
     

   • og under keystone_authtoken:

     auth_host = openstack32.uio.no
     auth_port = 35357
     auth_protocol = http
     admin_tenant_name = service
     admin_user = neutron
     admin_password = <NEUTRON_PASS>
     

2. Under agent:

   root_helper = sudo neutron-rootwrap /etc/neutron/rootwrap.conf
   

3. Konfigurerer til å bruke Qpid message queue, under DEFAULT:

   rpc_backend = neutron.openstack.common.rpc.impl_qpid
   qpid_hostname = openstack32.uio.no
   qpid_port = 5672
   qpid_username = guest
   qpid_password = guest
   

4. Konfigurerer database-backend, under database:

   connection = mysql://neutron:<NEUTRON_DBPASS>@openstack32.uio.no/neutron
   

Editere /etc/neutron/api-paste.ini og legger til under [filter:authtoken]:

paste.filter_factory = keystoneclient.middleware.auth_token:filter_factory
auth_host = openstack32.uio.no
auth_uri = http://openstack32.uio.no:5000
admin_tenant_name = service
admin_user = neutron
admin_password = <NEUTRON_PASS>

5.4   Installasjon av plugin (Open vSwitch)

Installerer Open vSwitch og avhengigheter:

yum -y install openstack-neutron-openvswitch

Starter tjenesten og sørger for at den startes ved boot:

systemctl start openvswitch.service
systemctl enable openvswitch.service

Lager br-int integration bridge, som snakker med VM-er, og br-ex external bridge, som kommuniserer med verden utenfor:

ovs-vsctl add-br br-int
ovs-vsctl add-br br-ex

Legger til en port (connection) fra det eksterne interfjeset em1.848:

ovs-vsctl add-port br-ex em1.848

Konfigurerer em1.848 til å være uten IP og i promiscuous mode. Endrer /etc/sysconfig/network-scripts/ifcfg-em1.848 til å inneholde følgende:

DEVICE="em1.848"
ONBOOT=yes
BOOTPROTO=none
TYPE=Ethernet
PROMISC=yes
VLAN=yes

Lager /etc/sysconfig/network-scripts/ifcfg-br-ex med innhold:

DEVICE="br-ex"
TYPE=Bridge
ONBOOT=yes
BOOTPROTO=none
IPADDR=129.240.149.162
NETMASK=255.255.255.192
GATEWAY=129.240.149.129

Editerer L3- og DHCP-agentene til å bruke OVS og namespaces. Editerer /etc/neutron/l3_agent.ini og /etc/neutron/dhcp_agent.ini og setter i begge:

interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
use_namespaces = True

Konfigurerer Neutron til å bruke OVS. Editerer /etc/neutron/neutron.conf og legger til under DEFAULT:

core_plugin = neutron.plugins.openvswitch.ovs_neutron_plugin.OVSNeutronPluginV2

Konfigurerer til å bruke GRE Tunnelling. Editerer /etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini:

[ovs]
tenant_network_type = gre
tunnel_id_ranges = 1:1000
enable_tunneling = True
integration_bridge = br-int
tunnel_bridge = br-tun
local_ip = 129.240.149.98

Konfigurerer en firewall plugin. Editerer /etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini:

[securitygroup]
# Firewall driver for realizing neutron security group function.
firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver

Konfigurerer OVS til å starte ved boot:

systemctl enable neutron-openvswitch-agent.service

5.5   Forts. konfigurasjon av Neutron

Konfigurerer Neutron til å bruke Dnsmasq for DHCP. Editerer /etc/neutron/dhcp_agent.ini:

dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq

Definerer en shared key for metadata mellom Neutron og Nova:

METADATA_PASS=$(openssl rand -hex 10)

Konfigurerer Nova til å bruke denne (gjøres på openstack32):

openstack-config --set /etc/nova/nova.conf DEFAULT \
  neutron_metadata_proxy_shared_secret $METADATA_PASS
openstack-config --set /etc/nova/nova.conf DEFAULT \
  service_neutron_metadata_proxy true

Restarter nova-api på openstack32:

systemctl restart openstack-nova-api.service

Fikser metadata-konfigurasjon på network-noden (openstack31):

openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT \
    auth_url http://openstack32.uio.no:5000/v2.0
openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT \
    auth_region regionOne
openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT \
    admin_tenant_name service
openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT \
    admin_user neutron
openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT \
    admin_password $NEUTRON_PASS
openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT \
    nova_metadata_ip openstack32.uio.no
openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT \
    metadata_proxy_shared_secret $METADATA_PASS

Lager en symlink som Neutron forventer:

cd /etc/neutron
ln -s plugins/openvswitch/ovs_neutron_plugin.ini plugin.ini

Restarter networking-tjenestene:

systemctl restart neutron-server.service
systemctl restart neutron-dhcp-agent.service
systemctl restart neutron-l3-agent.service
systemctl restart neutron-metadata-agent.service

Restarter Open VSwitch:

systemctl restart neutron-openvswitch-agent.service

5.6   Oppsett på compute-noder

Satte opp interfjes for data på em1.847, i filen /etc/sysconfig/network-scripts/ifcfg-em1.847 (eksempel fra openstack29):

DEVICE="em1.847"
ONBOOT=yes
BOOTPROTO=static
IPADDR=129.240.149.96
NETMASK=255.255.255.192
TYPE=Ethernet
VLAN=yes

Tar opp interfjeset:

ifup em1.847

Skrur av packet destination filtering vha. kjerneparametre. Legger inn i /etc/sysctl.conf:

net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.default.rp_filter=0

Oppdaterer:

sysctl -p

Installerer Open VSwitch:

yum -y install openstack-neutron-openvswitch

Starter tjenesten og sørger for at den kjører ved boot:

systemctl start openvswitch.service
systemctl enable openvswitch.service

Legger til br-int bridge som brukes til å snakke med VM-er:

ovs-vsctl add-br br-int

Legger til i /etc/neutron/neutron.conf:

core_plugin = neutron.plugins.openvswitch.ovs_neutron_plugin.OVSNeutronPluginV2
api_paste_config = /etc/neutron/api-paste.ini
rpc_backend = neutron.openstack.common.rpc.impl_qpid

Konfigurerer til å bruke GRE i filen /etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini (eksempel fra openstack29):

[ovs]
tenant_network_type = gre
tunnel_id_ranges = 1:1000
enable_tunneling = True
integration_bridge = br-int
tunnel_bridge = br-tun
local_ip = 129.240.149.96

Konfigurerer firewall i filen /etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini under [securitygroup]:

firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver

Konfigurerer OVS til å starte ved boot:

systemctl enable neutron-openvswitch-agent.service

5.7   Oppsett på controller-noden

Installerer pakker:

yum -y install openstack-neutron python-neutron python-neutronclient

Legger til i /etc/neutron/neutron.conf, under [DEFAULT]:

auth_host = openstack32.uio.no
admin_tenant_name = service
admin_user = neutron
admin_password = <NEUTRON_PASS>
auth_url = http://openstack32.uio.no:35357/v2.0
auth_strategy = keystone

rpc_backend = neutron.openstack.common.rpc.impl_qpid
qpid_hostname = openstack32.uio.no
qpid_port = 5672
qpid_username = guest
qpid_password = guest

Legger til i /etc/neutron/neutron.conf, under [agent]:

root_helper = sudo neutron-rootwrap /etc/neutron/rootwrap.conf

Legger til i /etc/neutron/neutron.conf, under [database]:

connection = mysql://neutron:<NEUTRON_DBPASS>@openstack32.uio.no/neutron

Legger til i /etc/neutron/api-paste.ini, under [filter:authtoken]:

paste.filter_factory = keystoneclient.middleware.auth_token:filter_factory
admin_tenant_name = service
admin_user = neutron
admin_password = <NEUTRON_PASS>

Installerer Open VSwitch:

yum -y install openstack-neutron-openvswitch

Legger til i /etc/neutron/neutron.conf:

core_plugin = neutron.plugins.openvswitch.ovs_neutron_plugin.OVSNeutronPluginV2

Konfigurerer til å bruke GRE. Legger til i /etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini:

[ovs]
tenant_network_type = gre
tunnel_id_ranges = 1:1000
enable_tunneling = True

Forteller Nova om Neutron. Editerer /etc/nova/nova.conf:

network_api_class=nova.network.neutronv2.api.API
neutron_url=http://openstack32.uio.no:9696
neutron_auth_strategy=keystone
neutron_admin_tenant_name=service
neutron_admin_username=neutron
neutron_admin_password=<NEUTRON_PASS>
neutron_admin_auth_url=http://openstack32.uio.no:35357/v2.0
linuxnet_interface_driver = nova.network.linux_net.LinuxOVSInterfaceDriver
firewall_driver=nova.virt.firewall.NoopFirewallDriver
security_group_api=neutron

Konfigurerer firewall i Neutron, i /etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini under [securitygroup]:

firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver

Lager symlink som Neutron trenger:

cd /etc/neutron
ln -s plugins/openvswitch/ovs_neutron_plugin.ini plugin.ini

Starter neutron-server og sørger for at den kjører ved boot:

systemctl start neutron-server.service
systemctl enable neutron-server.service

5.8   Lage Neutron basis nettverk

1. Rebootet openstack31 slik at alt av Neutron fikk en frisk start

2. Laget et eksternt nettverk ext-net:

   [root@openstack31 ~]# neutron net-create ext-net -- --router:external=True --provider:network_type gre --provider:segmentation_id 2
   Created a new network:
   +---------------------------+--------------------------------------+
   | Field                     | Value                                |
   +---------------------------+--------------------------------------+
   | admin_state_up            | True                                 |
   | id                        | ebf89e09-e3b0-45ec-886e-7f1ec487f1cf |
   | name                      | ext-net                              |
   | provider:network_type     | gre                                  |
   | provider:physical_network |                                      |
   | provider:segmentation_id  | 2                                    |
   | router:external           | True                                 |
   | shared                    | False                                |
   | status                    | ACTIVE                               |
   | subnets                   |                                      |
   | tenant_id                 | 1d29e1f016344ef9867631d4f414b0c7     |
   +---------------------------+--------------------------------------+
   

3. Laget et subnett av det eksterne nettet:

   [root@openstack31 ~]# neutron subnet-create ext-net --allocation-pool start=129.240.149.55,end=129.240.149.60 --gateway=129.240.149.1 --enable_dhcp=False 129.240.149.0/26
   Created a new subnet:
   +------------------+------------------------------------------------------+
   | Field            | Value                                                |
   +------------------+------------------------------------------------------+
   | allocation_pools | {"start": "129.240.149.55", "end": "129.240.149.60"} |
   | cidr             | 129.240.149.0/26                                     |
   | dns_nameservers  |                                                      |
   | enable_dhcp      | False                                                |
   | gateway_ip       | 129.240.149.1                                        |
   | host_routes      |                                                      |
   | id               | c538187f-0d96-488d-bcaa-f4aa09aad7c3                 |
   | ip_version       | 4                                                    |
   | name             |                                                      |
   | network_id       | ebf89e09-e3b0-45ec-886e-7f1ec487f1cf                 |
   | tenant_id        | 1d29e1f016344ef9867631d4f414b0c7                     |
   +------------------+------------------------------------------------------+
   

4. Laget en tenant "demo":

   [root@openstack31 ~]# keystone tenant-create --name demo
   +-------------+----------------------------------+
   |   Property  |              Value               |
   +-------------+----------------------------------+
   | description |                                  |
   |   enabled   |               True               |
   |      id     | 3957b5da38a94fb0a8115fc143941d7b |
   |     name    |               demo               |
   +-------------+----------------------------------+
   

5. Lage en router knyttet til det eksterne nettet, under tenant "demo" ved å bruke ID-en over:

   [root@openstack31 ~]# neutron router-create ext-to-int --tenant-id 3957b5da38a94fb0a8115fc143941d7b
   Created a new router:
   +-----------------------+--------------------------------------+
   | Field                 | Value                                |
   +-----------------------+--------------------------------------+
   | admin_state_up        | True                                 |
   | external_gateway_info |                                      |
   | id                    | 021a1ee6-1e42-4f0b-a403-6e9fe20832d6 |
   | name                  | ext-to-int                           |
   | status                | ACTIVE                               |
   | tenant_id             | 3957b5da38a94fb0a8115fc143941d7b     |
   +-----------------------+--------------------------------------+
   

6. Knyttet routeren til ext-net ved å definere en gateway lik ext-net. Brukerer ID-en til ext-to-int og ext-net:

   [root@openstack31 ~]# neutron router-gateway-set 021a1ee6-1e42-4f0b-a403-6e9fe20832d6 ebf89e09-e3b0-45ec-886e-7f1ec487f1cf
   Set gateway for router 021a1ee6-1e42-4f0b-a403-6e9fe20832d6
   

7. Lager et internt nettverk for "demo", med et assosiert subnet over en intern IP-range (velger 10.5.5.0/24 som eksemplet i dokumentasjonen), og knytter det interne subnettet til routeren ved å sette det som en port:

   [root@openstack31 ~]# neutron net-create --tenant-id 3957b5da38a94fb0a8115fc143941d7b demo-net --provider:network_type gre --provider:segmentation_id 4
   Created a new network:
   +---------------------------+--------------------------------------+
   | Field                     | Value                                |
   +---------------------------+--------------------------------------+
   | admin_state_up            | True                                 |
   | id                        | bd4d3448-8df5-4c53-9038-fef586e2eedc |
   | name                      | demo-net                             |
   | provider:network_type     | gre                                  |
   | provider:physical_network |                                      |
   | provider:segmentation_id  | 4                                    |
   | shared                    | False                                |
   | status                    | ACTIVE                               |
   | subnets                   |                                      |
   | tenant_id                 | 3957b5da38a94fb0a8115fc143941d7b     |
   +---------------------------+--------------------------------------+
   
   [root@openstack31 ~]# neutron subnet-create --tenant-id 3957b5da38a94fb0a8115fc143941d7b demo-net 10.5.5.0/24 --gateway 10.5.5.1
   Created a new subnet:
   +------------------+--------------------------------------------+
   | Field            | Value                                      |
   +------------------+--------------------------------------------+
   | allocation_pools | {"start": "10.5.5.2", "end": "10.5.5.254"} |
   | cidr             | 10.5.5.0/24                                |
   | dns_nameservers  |                                            |
   | enable_dhcp      | True                                       |
   | gateway_ip       | 10.5.5.1                                   |
   | host_routes      |                                            |
   | id               | 5f47c934-5feb-4ada-8860-bcbfd0741d7b       |
   | ip_version       | 4                                          |
   | name             |                                            |
   | network_id       | bd4d3448-8df5-4c53-9038-fef586e2eedc       |
   | tenant_id        | 3957b5da38a94fb0a8115fc143941d7b           |
   +------------------+--------------------------------------------+
   
   [root@openstack31 ~]# neutron router-interface-add 021a1ee6-1e42-4f0b-a403-6e9fe20832d6 5f47c934-5feb-4ada-8860-bcbfd0741d7b
   Added interface 19eda7db-84ab-4797-ae16-4e1bc051418c to router 021a1ee6-1e42-4f0b-a403-6e9fe20832d6.