回顾下前几节用到的东西
MySQL：为各个服务提供数据存储
RabbitmQ：为各个服务之间提供通信提供交通枢纽
Keystone：为各个服务之间通信提供认证和服务注册
Glance：为虚拟机提供镜像管理
Nova：为虚拟机提供计算资源
Neutron：为虚拟机提供网络
创建一个单一扁平网络和子网
1、创建单一扁平网络
在控制节点上，加载 admin 凭证来获取管理员能执行的命令访问权限：
source admin-openstack.sh ，提供者网络必须使用admin创建，如果source demo-openstack.sh ，不会创建成功
执行命令语法如下
下面命令把provider改成public，表示物理网卡是public这个，这个是映射的那个public，它对应eth0
neutron net-create --shared --provider:physical_network provider --provider:network_type flat provider
执行过程如下
[root@linux-node1 ~]# source admin-openstack.sh [root@linux-node1 ~]# neutron net-create --shared --provider:physical_network public --provider:network_type flat public-net Created a new network: +---------------------------+--------------------------------------+ | Field | Value | +---------------------------+--------------------------------------+ | admin_state_up | True | | availability_zone_hints | | | availability_zones | | | created_at | 2017-02-18T11:33:28 | | description | | | id | ac1b0655-931d-4d6e-ba52-33fd0631e034 | | ipv4_address_scope | | | ipv6_address_scope | | | mtu | 1500 | | name | public-net | | port_security_enabled | True | | provider:network_type | flat | | provider:physical_network | public | | provider:segmentation_id | | | router:external | False | | shared | True | | status | ACTIVE | | subnets | | | tags | | | tenant_id | e88437b3330145e1a713469130b4c3cd | | updated_at | 2017-02-18T11:33:28 | +---------------------------+--------------------------------------+ [root@linux-node1 ~]#
上面的tenant_id 和下面的project的id一致。因为我们是admin创建的，属于admin的
[root@linux-node1 ~]# openstack project list +----------------------------------+---------+ | ID | Name | +----------------------------------+---------+ | e88437b3330145e1a713469130b4c3cd | admin | | ef1575c568a4416c81f4855ae5cfd8eb | demo | | fc29ee0a1c7145de99885bb4a3bef9c1 | service | +----------------------------------+---------+ [root@linux-node1 ~]#
查看创建的网络
[root@linux-node1 ~]# neutron net-list +--------------------------------------+------------+---------+ | id | name | subnets | +--------------------------------------+------------+---------+ | ac1b0655-931d-4d6e-ba52-33fd0631e034 | public-net | | +--------------------------------------+------------+---------+ [root@linux-node1 ~]#
2、创建一个子网
语法如下
neutron subnet-create --name provider --allocation-pool start=START_IP_ADDRESS,end=END_IP_ADDRESS --dns-nameserver DNS_RESOLVER --gateway PROVIDER_NETWORK_GATEWAY provider PROVIDER_NETWORK_CIDR
命令如下
neutron subnet-create --name public-subnet --allocation-pool start=192.168.56.100,end=192.168.56.200 --dns-nameserver 223.5.5.5 --gateway 192.168.56.2 public-net 192.168.56.0/24
执行过程如下
[root@linux-node1 ~]# neutron subnet-create --name public-subnet
> --allocation-pool start=192.168.56.100,end=192.168.56.200
> --dns-nameserver 223.5.5.5 --gateway 192.168.56.2
> public-net 192.168.56.0/24
Created a new subnet:
+-------------------+------------------------------------------------------+
| Field | Value |
+-------------------+------------------------------------------------------+
| allocation_pools | {"start": "192.168.56.100", "end": "192.168.56.200"} |
| cidr | 192.168.56.0/24 |
| created_at | 2017-02-18T11:45:17 |
| description | |
| dns_nameservers | 223.5.5.5 |
| enable_dhcp | True |
| gateway_ip | 192.168.56.2 |
| host_routes | |
| id | fe4dfb57-8032-4614-b1d6-b2133890539b |
| ip_version | 4 |
| ipv6_address_mode | |
| ipv6_ra_mode | |
| name | public-subnet |
| network_id | ac1b0655-931d-4d6e-ba52-33fd0631e034 |
| subnetpool_id | |
| tenant_id | e88437b3330145e1a713469130b4c3cd |
| updated_at | 2017-02-18T11:45:17 |
+-------------------+------------------------------------------------------+
[root@linux-node1 ~]#
再次执行下面命令，可以看到subnets这里列有值了
[root@linux-node1 ~]# neutron net-list
+--------------------------------------+------------+------------------------------------------------------+
| id | name | subnets |
+--------------------------------------+------------+------------------------------------------------------+
| ac1b0655-931d-4d6e-ba52-33fd0631e034 | public-net | fe4dfb57-8032-4614-b1d6-b2133890539b 192.168.56.0/24 |
+--------------------------------------+------------+------------------------------------------------------+
[root@linux-node1 ~]#
[root@linux-node1 ~]# neutron subnet-list
+--------------------------------------+---------------+-----------------+------------------------------------------------------+
| id | name | cidr | allocation_pools |
+--------------------------------------+---------------+-----------------+------------------------------------------------------+
| fe4dfb57-8032-4614-b1d6-b2133890539b | public-subnet | 192.168.56.0/24 | {"start": "192.168.56.100", "end": "192.168.56.200"} |
+--------------------------------------+---------------+-----------------+------------------------------------------------------+
[root@linux-node1 ~]#
创建一个nano规格的实例
1、创建nano套餐类型
网络创建完毕后，创建一个nano规格的主机
默认的最小规格的主机需要512 MB内存。对于环境中计算节点内存不足4 GB的，我们推荐创建只需要64 MB的m1.nano规格的主机。
若单纯为了测试的目的，请使用m1.nano规格的主机来加载CirrOS镜像
硬盘是1GB，内存64MB，cpu是1个
[root@linux-node1 ~]# openstack flavor create --id 0 --vcpus 1 --ram 64 --disk 1 m1.nano +----------------------------+---------+ | Field | Value | +----------------------------+---------+ | OS-FLV-DISABLED:disabled | False | | OS-FLV-EXT-DATA:ephemeral | 0 | | disk | 1 | | id | 0 | | name | m1.nano | | os-flavor-access:is_public | True | | ram | 64 | | rxtx_factor | 1.0 | | swap | | | vcpus | 1 | +----------------------------+---------+ [root@linux-node1 ~]#
查看主机类型列表
1-5是默认的，0是我创建的
[root@linux-node1 ~]# openstack flavor list +----+-----------+-------+------+-----------+-------+-----------+ | ID | Name | RAM | Disk | Ephemeral | VCPUs | Is Public | +----+-----------+-------+------+-----------+-------+-----------+ | 0 | m1.nano | 64 | 1 | 0 | 1 | True | | 1 | m1.tiny | 512 | 1 | 0 | 1 | True | | 2 | m1.small | 2048 | 20 | 0 | 1 | True | | 3 | m1.medium | 4096 | 40 | 0 | 2 | True | | 4 | m1.large | 8192 | 80 | 0 | 4 | True | | 5 | m1.xlarge | 16384 | 160 | 0 | 8 | True | +----+-----------+-------+------+-----------+-------+-----------+ [root@linux-node1 ~]#
大部分云镜像支持公共密钥认证而不是传统的密码认证。在启动实例前，你必须添加一个公共密钥到计算服务。
创建一个密钥，并把这个密钥加到openstack上
[root@linux-node1 ~]# source demo-openstack.sh [root@linux-node1 ~]# ssh-keygen -q -N "" Enter file in which to save the key (/root/.ssh/id_rsa): [root@linux-node1 ~]# openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey +-------------+-------------------------------------------------+ | Field | Value | +-------------+-------------------------------------------------+ | fingerprint | 5e:eb:97:85:36:77:c3:75:6b:e4:51:d2:58:d1:64:fd | | name | mykey | | user_id | 7a01e2bd239844f183abbb4b0b960647 | +-------------+-------------------------------------------------+ [root@linux-node1 ~]#
验证公钥的添加：
[root@linux-node1 ~]# openstack keypair list +-------+-------------------------------------------------+ | Name | Fingerprint | +-------+-------------------------------------------------+ | mykey | 5e:eb:97:85:36:77:c3:75:6b:e4:51:d2:58:d1:64:fd | +-------+-------------------------------------------------+ [root@linux-node1 ~]#
2、增加安全组规则
默认情况下，它有一个default安全组，这个安全组阻止了所有访问，这里添加icmp和ssh
[root@linux-node1 ~]# openstack security group rule create --proto icmp default +-----------------------+--------------------------------------+ | Field | Value | +-----------------------+--------------------------------------+ | id | 4063731b-25e6-448b-afd5-85b2ba1c7d30 | | ip_protocol | icmp | | ip_range | 0.0.0.0/0 | | parent_group_id | 650dcdc5-75e0-46ca-b0a0-9a683de9398c | | port_range | | | remote_security_group | | +-----------------------+--------------------------------------+ [root@linux-node1 ~]# openstack security group rule create --proto tcp --dst-port 22 default +-----------------------+--------------------------------------+ | Field | Value | +-----------------------+--------------------------------------+ | id | c6299dc5-26cd-43f8-b7f7-1f5e26fbd7cb | | ip_protocol | tcp | | ip_range | 0.0.0.0/0 | | parent_group_id | 650dcdc5-75e0-46ca-b0a0-9a683de9398c | | port_range | 22:22 | | remote_security_group | | +-----------------------+--------------------------------------+ [root@linux-node1 ~]#
3、列出可用镜像、网络、安全组等
创建之前先列出可用类型和列出可用镜像：
[root@linux-node1 ~]# source demo-openstack.sh [root@linux-node1 ~]# openstack flavor list +----+-----------+-------+------+-----------+-------+-----------+ | ID | Name | RAM | Disk | Ephemeral | VCPUs | Is Public | +----+-----------+-------+------+-----------+-------+-----------+ | 0 | m1.nano | 64 | 1 | 0 | 1 | True | | 1 | m1.tiny | 512 | 1 | 0 | 1 | True | | 2 | m1.small | 2048 | 20 | 0 | 1 | True | | 3 | m1.medium | 4096 | 40 | 0 | 2 | True | | 4 | m1.large | 8192 | 80 | 0 | 4 | True | | 5 | m1.xlarge | 16384 | 160 | 0 | 8 | True | +----+-----------+-------+------+-----------+-------+-----------+ [root@linux-node1 ~]# openstack image list +--------------------------------------+--------+--------+ | ID | Name | Status | +--------------------------------------+--------+--------+ | 9969eaa3-0296-48cc-a42e-a02251b778a6 | cirros | active | +--------------------------------------+--------+--------+ [root@linux-node1 ~]#
列出可用网络
[root@linux-node1 ~]# openstack network list +--------------------------------------+------------+--------------------------------------+ | ID | Name | Subnets | +--------------------------------------+------------+--------------------------------------+ | ac1b0655-931d-4d6e-ba52-33fd0631e034 | public-net | fe4dfb57-8032-4614-b1d6-b2133890539b | +--------------------------------------+------------+--------------------------------------+ [root@linux-node1 ~]#
列出可用的安全组
[root@linux-node1 ~]# openstack security group list +--------------------------------------+---------+------------------------+----------------------------------+ | ID | Name | Description | Project | +--------------------------------------+---------+------------------------+----------------------------------+ | 650dcdc5-75e0-46ca-b0a0-9a683de9398c | default | Default security group | ef1575c568a4416c81f4855ae5cfd8eb | +--------------------------------------+---------+------------------------+----------------------------------+ [root@linux-node1 ~]#
4、创建实例
创建实例的语法如下
openstack server create --flavor m1.tiny --image cirros --nic net-id=PROVIDER_NET_ID --security-group default --key-name mykey provider-instance
如果你选择选项1并且你的环境只有一个网络，你可以省去–nic 选项因为OpenStack会自动选择这个唯一可用的网络。
net-id就是openstack network list 显示的id， 不是subnet的id
修改后的创建命令如下
openstack server create --flavor m1.nano --image cirros --nic net-id=ac1b0655-931d-4d6e-ba52-33fd0631e034 --security-group default --key-name mykey provider-instance
执行过程如下
[root@linux-node1 ~]# openstack server create --flavor m1.nano --image cirros
> --nic net-id=ac1b0655-931d-4d6e-ba52-33fd0631e034 --security-group default
> --key-name mykey provider-instance
+--------------------------------------+-----------------------------------------------+
| Field | Value |
+--------------------------------------+-----------------------------------------------+
| OS-DCF:diskConfig | MANUAL |
| OS-EXT-AZ:availability_zone | |
| OS-EXT-STS:power_state | 0 |
| OS-EXT-STS:task_state | scheduling |
| OS-EXT-STS:vm_state | building |
| OS-SRV-USG:launched_at | None |
| OS-SRV-USG:terminated_at | None |
| accessIPv4 | |
| accessIPv6 | |
| addresses | |
| adminPass | nd8EcgwxiAph |
| config_drive | |
| created | 2017-02-18T12:16:08Z |
| flavor | m1.nano (0) |
| hostId | |
| id | ad696d58-9998-46da-85a4-64479b171421 |
| image | cirros (9969eaa3-0296-48cc-a42e-a02251b778a6) |
| key_name | mykey |
| name | provider-instance |
| os-extended-volumes:volumes_attached | [] |
| progress | 0 |
| project_id | ef1575c568a4416c81f4855ae5cfd8eb |
| properties | |
| security_groups | [{u'name': u'default'}] |
| status | BUILD |
| updated | 2017-02-18T12:16:08Z |
| user_id | 7a01e2bd239844f183abbb4b0b960647 |
+--------------------------------------+-----------------------------------------------+
[root@linux-node1 ~]#
5、检查实例的状态和登录实例
[root@linux-node1 ~]# openstack server list +--------------------------------------+-------------------+--------+---------------------------+ | ID | Name | Status | Networks | +--------------------------------------+-------------------+--------+---------------------------+ | ad696d58-9998-46da-85a4-64479b171421 | provider-instance | ACTIVE | public-net=192.168.56.101 | +--------------------------------------+-------------------+--------+---------------------------+ [root@linux-node1 ~]#
计算节点可以看到kvm起来了
[root@linux-node2 ~]# virsh list Id Name State ---------------------------------------------------- 1 instance-00000001 running [root@linux-node2 ~]#
登录机器成功。因为密钥传进去了。不用密码
[root@linux-node1 ~]# ssh cirros@192.168.56.101
$
$
$ ip ad li
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether fa:16:3e:4b:42:f1 brd ff:ff:ff:ff:ff:ff
inet 192.168.56.101/24 brd 192.168.56.255 scope global eth0
inet6 fe80::f816:3eff:fe4b:42f1/64 scope link
valid_lft forever preferred_lft forever
$
创建过程中可以查看计算节点的日志，因为是计算节点创建的虚拟机
[root@linux-node2 ~]# tail -f /var/log/nova/nova-compute.log 2017-02-18 20:16:22.979 6502 INFO nova.compute.resource_tracker [req-62816801-8204-49f8-8a6a-9f0b92c56fef - - - - -] Final resource view: name=linux-node2.nmap.com phys_ram=4095MB used_ram=576MB
phys_disk=35GB used_disk=1GB total_vcpus=4 used_vcpus=1 pci_stats=[] 2017-02-18 20:16:23.030 6502 INFO nova.compute.resource_tracker [req-62816801-8204-49f8-8a6a-9f0b92c56fef - - - - -] Compute_service record updated for linux-node2.nmap.com:linux-node2.nmap.com 2017-02-18 20:17:22.135 6502 INFO nova.compute.resource_tracker [req-62816801-8204-49f8-8a6a-9f0b92c56fef - - - - -] Auditing locally available compute resources for node linux-node2.nmap.com 2017-02-18 20:17:22.769 6502 INFO nova.compute.resour
虚拟机创建失败，需要看所有服务的所有日志，根据时间查看可疑的原因
[root@linux-node1 ~]# grep 'ERROR' /var/log/glance/* [root@linux-node1 ~]# grep 'ERROR' /var/log/keystone/* [root@linux-node1 ~]# [root@linux-node1 ~]# grep 'ERROR' /var/log/nova/* [root@linux-node1 ~]# [root@linux-node1 ~]# grep 'ERROR' /var/log/neutron/*
我的下面两个目录都有点报错，但是虚拟机创建成功了
[root@linux-node1 ~]# grep 'ERROR' /var/log/neutron/* [root@linux-node1 ~]# grep 'ERROR' /var/log/glance/*
要使用demo用户才能查看创建的主机,因为本来就是demo用户创建的
[root@linux-node1 ~]# source admin-openstack.sh [root@linux-node1 ~]# openstack server list [root@linux-node1 ~]# source demo-openstack.sh [root@linux-node1 ~]# openstack server list +--------------------------------------+-------------------+--------+---------------------------+ | ID | Name | Status | Networks | +--------------------------------------+-------------------+--------+---------------------------+ | ad696d58-9998-46da-85a4-64479b171421 | provider-instance | ACTIVE | public-net=192.168.56.101 | +--------------------------------------+-------------------+--------+---------------------------+ [root@linux-node1 ~]#
获取它控制台的地址
[root@linux-node1 ~]# openstack console url show provider-instance +-------+------------------------------------------------------------------------------------+ | Field | Value | +-------+------------------------------------------------------------------------------------+ | type | novnc | | url | http://192.168.56.11:6080/vnc_auto.html?token=e4e15645-5cfe-4a99-908f-9865b3552132 | +-------+------------------------------------------------------------------------------------+ [root@linux-node1 ~]#
把上面这一串复制到浏览器。可以以网页方式打开一个vnc窗口,上面链接的token是有时间有效期的，会变的
上面的6080端口映射到了192.168.56.12的5900端口
浏览器页面可以登录
查看计算节点端口启动情况，有个5900端口，就是vnc的
[root@linux-node2 ~]# netstat -lntp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:5900 0.0.0.0:* LISTEN 7936/qemu-kvm tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/systemd tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN 3916/dnsmasq tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1155/sshd tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1250/master tcp6 0 0 :::111 :::* LISTEN 1/systemd tcp6 0 0 :::22 :::* LISTEN 1155/sshd tcp6 0 0 ::1:25 :::* LISTEN 1250/master [root@linux-node2 ~]#
查看下连接情况
计算节点的5900端口和控制节点的6080端口
[root@linux-node2 ~]# lsof -i:5900 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME qemu-kvm 7936 qemu 18u IPv4 40843 0t0 TCP *:rfb (LISTEN) qemu-kvm 7936 qemu 25u IPv4 46305 0t0 TCP linux-node2:rfb->linux-node1:47511 (ESTABLISHED) [root@linux-node2 ~]# [root@linux-node1 ~]# lsof -i:6080 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME nova-novn 13967 nova 4u IPv4 40352 0t0 TCP *:6080 (LISTEN) nova-novn 27347 nova 4u IPv4 40352 0t0 TCP *:6080 (LISTEN) nova-novn 27347 nova 6u IPv4 77765 0t0 TCP linux-node1:6080->192.168.56.1:57139 (ESTABLISHED) [root@linux-node1 ~]#