OpenStack O版搭建（二）：Controller节点部署

安装Mariadb和RabbitMQ

搭建Mariadb

安装mariadb数据库

yum install -y MariaDB-server MariaDB-client

配置mariadb

vim /etc/my.cnf.d/mariadb-openstack.cnf

在mysqld区块添加如下内容：

[mysqld]
default-storage-engine = innodb
innodb_file_per_table
collation-server = utf8_general_ci
init-connect = 'SET NAMES utf8'
character-set-server = utf8
bind-address = 10.1.1.120

启动数据库及设置mariadb开机启动

systemctl enable mariadb.service
systemctl restart mariadb.service
systemctl status mariadb.service
systemctl list-unit-files |grep mariadb.service

配置mariadb，给mariadb设置密码

mysql_secure_installation

先按回车，然后按Y，设置mysql密码，然后一直按y结束
这里我们设置的密码是devops

安装RabbitMQ

安装erlang

yum install -y erlang

安装RabbitMQ

yum install -y rabbitmq-server

启动rabbitmq及设置开机启动

systemctl enable rabbitmq-server.service
systemctl restart rabbitmq-server.service
systemctl status rabbitmq-server.service
systemctl list-unit-files |grep rabbitmq-server.service

创建openstack用户

注意将密码替换为自己的合适密码，这里密码都是devops

rabbitmqctl add_user openstack devops

将openstack用户赋予权限

rabbitmqctl set_permissions openstack ".*" ".*" ".*"
rabbitmqctl set_user_tags openstack administrator
rabbitmqctl list_users

查看监听端口

rabbitmq用的是5672端口

netstat -ntlp |grep 5672

查看RabbitMQ插件

/usr/lib/rabbitmq/bin/rabbitmq-plugins list

打开RabbitMQ相关插件

/usr/lib/rabbitmq/bin/rabbitmq-plugins enable rabbitmq_management mochiweb webmachine rabbitmq_web_dispatch amqp_client rabbitmq_management_agent

打开相关插件后，重启下rabbitmq服务

systemctl restart rabbitmq-server

浏览器输入：http://192.168.0.120:15672 默认用户名密码：guest/guest,
通过这个界面，我们能很直观的看到rabbitmq的运行和负载情况

安装配置keystone

创建keystone数据库

CREATE DATABASE keystone;

创建数据库keystone用户&root用户及赋予权限

GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'devops';
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'devops';

注意将devops替换为自己的数据库密码

安装keystone和memcached

yum -y install openstack-keystone httpd mod_wsgi python-openstackclient memcached python-memcached openstack-utils

启动memcache服务并设置开机自启动

systemctl enable memcached.service
systemctl restart memcached.service
systemctl status memcached.service

配置/etc/keystone/keystone.conf文件

cp /etc/keystone/keystone.conf /etc/keystone/keystone.conf.bak
>/etc/keystone/keystone.conf
openstack-config --set /etc/keystone/keystone.conf DEFAULT transport_url rabbit://openstack:devops@controller
openstack-config --set /etc/keystone/keystone.conf database connection mysql://keystone:devops@controller/keystone
openstack-config --set /etc/keystone/keystone.conf cache backend oslo_cache.memcache_pool
openstack-config --set /etc/keystone/keystone.conf cache enabled true
openstack-config --set /etc/keystone/keystone.conf cache memcache_servers controller:11211
openstack-config --set /etc/keystone/keystone.conf memcache servers controller:11211
openstack-config --set /etc/keystone/keystone.conf token expiration 3600
openstack-config --set /etc/keystone/keystone.conf token provider fernet

配置httpd.conf文件&memcached文件

sed -i "s/#ServerName www.example.com:80/ServerName controller/" /etc/httpd/conf/httpd.conf
sed -i 's/OPTIONS*.*/OPTIONS="-l 127.0.0.1,::1,10.1.1.120"/' /etc/sysconfig/memcached

配置keystone与httpd结合

ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

数据库同步

su -s /bin/sh -c "keystone-manage db_sync" keystone

初始化fernet

keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

启动httpd，并设置httpd开机启动

systemctl enable httpd.service
systemctl restart httpd.service
systemctl status httpd.service
systemctl list-unit-files |grep httpd.service

创建admin用户角色

keystone-manage bootstrap \
--bootstrap-password devops \
--bootstrap-username admin \
--bootstrap-project-name admin \
--bootstrap-role-name admin \
--bootstrap-service-name keystone \
--bootstrap-region-id RegionOne \
--bootstrap-admin-url http://controller:35357/v3 \
--bootstrap-internal-url http://controller:35357/v3 \
--bootstrap-public-url http://controller:5000/v3

验证：

openstack project list --os-username admin --os-project-name admin --os-user-domain-id default --os-project-domain-id default --os-identity-api-version 3 --os-auth-url http://controller:5000 --os-password devops

返回如下结果说明你的keystone服务就没有问题了

创建admin用户环境变量

创建/root/admin-openrc 文件并写入如下内容：

vim /root/admin-openrc

添加以下内容：

export OS_USER_DOMAIN_ID=default
export OS_PROJECT_DOMAIN_ID=default
export OS_USERNAME=admin
export OS_PROJECT_NAME=admin
export OS_PASSWORD=devops
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
export OS_AUTH_URL=http://controller:35357/v3

创建service项目

source /root/admin-openrc
openstack project create --domain default --description "Service Project" service

创建demo项目

openstack project create --domain default --description "Demo Project" demo

创建demo用户

openstack user create --domain default demo --password devops

注意：devops为demo用户密码

创建user角色

创建user角色将demo用户赋予user角色

openstack role create user
openstack role add --project demo --user demo user

验证keystone

unset OS_TOKEN OS_URL
openstack --os-auth-url http://controller:35357/v3 --os-project-domain-name default --os-user-domain-name default --os-project-name admin --os-username admin token issue --os-password devops
openstack --os-auth-url http://controller:5000/v3 --os-project-domain-name default --os-user-domain-name default --os-project-name demo --os-username demo token issue --os-password devops

安装配置glance

创建glance数据库

CREATE DATABASE glance;

创建数据库用户并赋予权限

GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost' IDENTIFIED BY 'devops';
GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%' IDENTIFIED BY 'devops';

创建glance用户及赋予admin权限

source /root/admin-openrc
openstack user create --domain default glance --password devops
openstack role add --project service --user glance admin

创建image服务

openstack service create --name glance --description "OpenStack Image service" image

创建glance的endpoint

openstack endpoint create --region RegionOne image public http://controller:9292
openstack endpoint create --region RegionOne image internal http://controller:9292
openstack endpoint create --region RegionOne image admin http://controller:9292

安装glance相关rpm包

yum install openstack-glance -y

修改glance配置文件/etc/glance/glance-api.conf

注意将devops的密码设置成你自己的

cp /etc/glance/glance-api.conf /etc/glance/glance-api.conf.bak
>/etc/glance/glance-api.conf
openstack-config --set /etc/glance/glance-api.conf DEFAULT transport_url rabbit://openstack:devops@controller
openstack-config --set /etc/glance/glance-api.conf database connection mysql+pymysql://glance:devops@controller/glance
openstack-config --set /etc/glance/glance-api.conf keystone_authtoken auth_uri http://controller:5000
openstack-config --set /etc/glance/glance-api.conf keystone_authtoken auth_url http://controller:35357
openstack-config --set /etc/glance/glance-api.conf keystone_authtoken memcached_servers controller:11211
openstack-config --set /etc/glance/glance-api.conf keystone_authtoken auth_type password
openstack-config --set /etc/glance/glance-api.conf keystone_authtoken project_domain_name default
openstack-config --set /etc/glance/glance-api.conf keystone_authtoken user_domain_name default
openstack-config --set /etc/glance/glance-api.conf keystone_authtoken username glance
openstack-config --set /etc/glance/glance-api.conf keystone_authtoken password devops
openstack-config --set /etc/glance/glance-api.conf keystone_authtoken project_name service
openstack-config --set /etc/glance/glance-api.conf paste_deploy flavor keystone
openstack-config --set /etc/glance/glance-api.conf glance_store stores file,http
openstack-config --set /etc/glance/glance-api.conf glance_store default_store file
openstack-config --set /etc/glance/glance-api.conf glance_store filesystem_store_datadir /var/lib/glance/images/

修改glance配置文件/etc/glance/glance-registry.conf

cp /etc/glance/glance-registry.conf /etc/glance/glance-registry.conf.bak
>/etc/glance/glance-registry.conf
openstack-config --set /etc/glance/glance-registry.conf DEFAULT transport_url rabbit://openstack:devops@controller
openstack-config --set /etc/glance/glance-registry.conf database connection mysql+pymysql://glance:devops@controller/glance
openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken auth_uri http://controller:5000
openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken auth_url http://controller:35357
openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken memcached_servers controller:11211
openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken auth_type password
openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken project_domain_name default
openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken user_domain_name default
openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken project_name service
openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken username glance
openstack-config --set /etc/glance/glance-registry.conf keystone_authtoken password devops
openstack-config --set /etc/glance/glance-registry.conf paste_deploy flavor keystone

同步glance数据库

su -s /bin/sh -c "glance-manage db_sync" glance

同步成功

启动glance及设置开机启动

systemctl enable openstack-glance-api.service openstack-glance-registry.service
systemctl restart openstack-glance-api.service openstack-glance-registry.service
systemctl status openstack-glance-api.service openstack-glance-registry.service

下载测试镜像文件

wget http://download.cirros-cloud.net/0.3.4/cirros-0.3.4-x86_64-disk.img

上传镜像到glance

source /root/admin-openrc
glance image-create --name "cirros-0.3.4-x86_64" --file cirros-0.3.4-x86_64-disk.img --disk-format qcow2 --container-format bare --visibility public --progress

如果你做好了一个CentOS7.2系统的镜像，也可以用这命令操作，例：

glance image-create --name "CentOS7.2-x86_64" --file CentOS_7.2.qcow2 --disk-format qcow2 --container-format bare --visibility public --progress

查看镜像列表：

glance image-list

安装配置nova

创建nova数据库

CREATE DATABASE nova;
CREATE DATABASE nova_api;
CREATE DATABASE nova_cell0;

创建数据库用户并赋予权限

GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'localhost' IDENTIFIED BY 'devops';
GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' IDENTIFIED BY 'devops';
GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'localhost' IDENTIFIED BY 'devops';
GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'%' IDENTIFIED BY 'devops';
GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'localhost' IDENTIFIED BY 'devops';
GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'%' IDENTIFIED BY 'devops';
GRANT ALL PRIVILEGES ON *.* TO 'root'@'controller' IDENTIFIED BY 'devops';
FLUSH PRIVILEGES;

注：查看授权列表信息 SELECT DISTINCT CONCAT('User: ''',user,'''@''',host,''';') AS query FROM mysql.user;
取消之前某个授权 REVOKE ALTER ON *.* TO 'root'@'controller' IDENTIFIED BY 'devops';

创建nova用户及赋予admin权限

source /root/admin-openrc
openstack user create --domain default nova --password devops
openstack role add --project service --user nova admin

创建computer服务

openstack service create --name nova --description "OpenStack Compute" compute

创建nova的endpoint

openstack endpoint create --region RegionOne compute public http://controller:8774/v2.1/%\(tenant_id\)s
openstack endpoint create --region RegionOne compute internal http://controller:8774/v2.1/%\(tenant_id\)s
openstack endpoint create --region RegionOne compute admin http://controller:8774/v2.1/%\(tenant_id\)s

安装nova相关软件

yum install -y openstack-nova-api openstack-nova-conductor openstack-nova-cert openstack-nova-console openstack-nova-novncproxy openstack-nova-scheduler

配置nova的配置文件/etc/nova/nova.conf

cp /etc/nova/nova.conf /etc/nova/nova.conf.bak
>/etc/nova/nova.conf
openstack-config --set /etc/nova/nova.conf DEFAULT enabled_apis osapi_compute,metadata
openstack-config --set /etc/nova/nova.conf DEFAULT auth_strategy keystone
openstack-config --set /etc/nova/nova.conf DEFAULT my_ip 10.1.1.120
openstack-config --set /etc/nova/nova.conf DEFAULT use_neutron True
openstack-config --set /etc/nova/nova.conf DEFAULT firewall_driver nova.virt.firewall.NoopFirewallDriver
openstack-config --set /etc/nova/nova.conf DEFAULT transport_url rabbit://openstack:devops@controller
openstack-config --set /etc/nova/nova.conf database connection mysql+pymysql://nova:devops@controller/nova
openstack-config --set /etc/nova/nova.conf api_database connection mysql+pymysql://nova:devops@controller/nova_api
openstack-config --set /etc/nova/nova.conf scheduler discover_hosts_in_cells_interval -1
openstack-config --set /etc/nova/nova.conf keystone_authtoken auth_uri http://controller:5000
openstack-config --set /etc/nova/nova.conf keystone_authtoken auth_url http://controller:35357
openstack-config --set /etc/nova/nova.conf keystone_authtoken memcached_servers controller:11211
openstack-config --set /etc/nova/nova.conf keystone_authtoken auth_type password
openstack-config --set /etc/nova/nova.conf keystone_authtoken project_domain_name default
openstack-config --set /etc/nova/nova.conf keystone_authtoken user_domain_name default
openstack-config --set /etc/nova/nova.conf keystone_authtoken project_name service
openstack-config --set /etc/nova/nova.conf keystone_authtoken username nova
openstack-config --set /etc/nova/nova.conf keystone_authtoken password devops
openstack-config --set /etc/nova/nova.conf keystone_authtoken service_token_roles_required True
openstack-config --set /etc/nova/nova.conf vnc vncserver_listen 10.1.1.120
openstack-config --set /etc/nova/nova.conf vnc vncserver_proxyclient_address 10.1.1.120
openstack-config --set /etc/nova/nova.conf glance api_servers http://controller:9292
openstack-config --set /etc/nova/nova.conf oslo_concurrency lock_path /var/lib/nova/tmp

注意：其他节点上记得替换IP，还有密码。

设置cell（单元格）

关于cell（单元格）的介绍，引用出自于九州云分享的《Ocata组件Nova Cell V2 详解》& 有云的《引入Cells功能最核心要解决的问题就是OpenStack集群的扩展性》两篇文章的整合介绍：
OpenStack 在控制平面上的性能瓶颈主要在 Message Queue 和 Database 。尤其是 Message Queue , 随着计算节点的增加，性能变的越来越差，因为openstack里每个资源和接口都是通过消息队列来通信的，有测试表明，当集群规模到了200，一个消息可能要在十几秒后才会响应；为了应对这种情况，引入Cells功能以解决OpenStack集群的扩展性。

同步下nova数据库

su -s /bin/sh -c "nova-manage api_db sync" nova
su -s /bin/sh -c "nova-manage db sync" nova

不用管这个报警

设置cell_v2关联上创建好的数据库nova_cell0

nova-manage cell_v2 map_cell0 --database_connection mysql+pymysql://root:devops@controller/nova_cell0

创建一个常规cell，名字叫cell1，这个单元格里面将会包含计算节点

nova-manage cell_v2 create_cell --verbose --name cell1 --database_connection mysql+pymysql://root:devops@controller/nova_cell0 --transport-url rabbit://openstack:devops@controller:5672/

检查部署是否正常

nova-status upgrade check

如有报错请先运行下面的命令
创建和映射cell0，并将现有计算主机和实例映射到单元格中

nova-manage cell_v2 simple_cell_setup

查看已经创建好的单元格列表

nova-manage cell_v2 list_cells --verbose

注意，如果有新添加的计算节点，需要运行下面命令来发现，并且添加到单元格中

nova-manage cell_v2 discover_hosts

当然，你可以在控制节点的nova.conf文件里[scheduler]模块下添加discover_hosts_in_cells_interval=-1 这个设置来自动发现

安装placement

从Ocata开始，需要安装配置placement参与nova调度了，不然虚拟机将无法创建！

yum install -y openstack-nova-placement-api

创建placement用户和placement 服务

openstack user create --domain default placement --password devops
openstack role add --project service --user placement admin
openstack service create --name placement --description "OpenStack Placement" placement

创建placement endpoint

openstack endpoint create --region RegionOne placement public http://controller:8778
openstack endpoint create --region RegionOne placement admin http://controller:8778
openstack endpoint create --region RegionOne placement internal http://controller:8778

把placement 整合到nova.conf里

openstack-config --set /etc/nova/nova.conf placement auth_url http://controller:35357
openstack-config --set /etc/nova/nova.conf placement memcached_servers controller:11211
openstack-config --set /etc/nova/nova.conf placement auth_type password
openstack-config --set /etc/nova/nova.conf placement project_domain_name default
openstack-config --set /etc/nova/nova.conf placement user_domain_name default
openstack-config --set /etc/nova/nova.conf placement project_name service
openstack-config --set /etc/nova/nova.conf placement username placement
openstack-config --set /etc/nova/nova.conf placement password devops
openstack-config --set /etc/nova/nova.conf placement os_region_name RegionOne

配置修改00-nova-placement-api.conf文件，这步没做创建虚拟机的时候会出现禁止访问资源的问题

cd /etc/httpd/conf.d/
cp 00-nova-placement-api.conf 00-nova-placement-api.conf.bak
>00-nova-placement-api.conf
vim 00-nova-placement-api.conf

添加以下内容：

Listen 8778


WSGIProcessGroup nova-placement-api
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
WSGIDaemonProcess nova-placement-api processes=3 threads=1 user=nova group=nova
WSGIScriptAlias / /usr/bin/nova-placement-api

    Order allow,deny
    Allow from all
    Require all granted

= 2.4>
  ErrorLogFormat "%M"

  ErrorLog /var/log/nova/nova-placement-api.log


Alias /nova-placement-api /usr/bin/nova-placement-api

  SetHandler wsgi-script
  Options +ExecCGI
  WSGIProcessGroup nova-placement-api
  WSGIApplicationGroup %{GLOBAL}
  WSGIPassAuthorization On

重启下httpd服务

systemctl restart httpd

检查下是否配置成功

nova-status upgrade check

设置nova相关服务开机启动

systemctl enable openstack-nova-api.service openstack-nova-cert.service     openstack-nova-consoleauth.service openstack-nova-scheduler.service     openstack-nova-conductor.service openstack-nova-novncproxy.service

启动nova服务：

systemctl restart openstack-nova-api.service openstack-nova-cert.service openstack-nova-consoleauth.service openstack-nova-scheduler.service openstack-nova-conductor.service openstack-nova-novncproxy.service

查看nova服务：

systemctl status openstack-nova-api.service openstack-nova-cert.service openstack-nova-consoleauth.service openstack-nova-scheduler.service openstack-nova-conductor.service openstack-nova-novncproxy.service

systemctl list-unit-files |grep openstack-nova-*

验证nova服务

unset OS_TOKEN OS_URL
source /root/admin-openrc
nova service-list

openstack endpoint list 查看endpoint list
看是否有结果正确输出

安装配置neutron

创建neutron数据库

CREATE DATABASE neutron;

创建数据库用户并赋予权限

GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'devops';
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'devops';

创建neutron用户及赋予admin权限

source /root/admin-openrc
openstack user create --domain default neutron --password devops
openstack role add --project service --user neutron admin

创建network服务

openstack service create --name neutron --description "OpenStack Networking" network

创建endpoint

openstack endpoint create --region RegionOne network public http://controller:9696
openstack endpoint create --region RegionOne network internal http://controller:9696
openstack endpoint create --region RegionOne network admin http://controller:9696

安装neutron相关软件

yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-linuxbridge ebtables -y

配置neutron配置文件/etc/neutron/neutron.conf

cp /etc/neutron/neutron.conf /etc/neutron/neutron.conf.bak
>/etc/neutron/neutron.conf
openstack-config --set /etc/neutron/neutron.conf DEFAULT core_plugin ml2
openstack-config --set /etc/neutron/neutron.conf DEFAULT service_plugins router
openstack-config --set /etc/neutron/neutron.conf DEFAULT allow_overlapping_ips True
openstack-config --set /etc/neutron/neutron.conf DEFAULT auth_strategy keystone
openstack-config --set /etc/neutron/neutron.conf DEFAULT transport_url rabbit://openstack:devops@controller
openstack-config --set /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_status_changes True
openstack-config --set /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_data_changes True
openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_uri http://controller:5000
openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_url http://controller:35357
openstack-config --set /etc/neutron/neutron.conf keystone_authtoken memcached_servers controller:11211
openstack-config --set /etc/neutron/neutron.conf keystone_authtoken auth_type password
openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_domain_name default
openstack-config --set /etc/neutron/neutron.conf keystone_authtoken user_domain_name default
openstack-config --set /etc/neutron/neutron.conf keystone_authtoken project_name service
openstack-config --set /etc/neutron/neutron.conf keystone_authtoken username neutron
openstack-config --set /etc/neutron/neutron.conf keystone_authtoken password devops
openstack-config --set /etc/neutron/neutron.conf database connection mysql+pymysql://neutron:devops@controller/neutron
openstack-config --set /etc/neutron/neutron.conf nova auth_url http://controller:35357
openstack-config --set /etc/neutron/neutron.conf nova auth_type password
openstack-config --set /etc/neutron/neutron.conf nova project_domain_name default
openstack-config --set /etc/neutron/neutron.conf nova user_domain_name default
openstack-config --set /etc/neutron/neutron.conf nova region_name RegionOne
openstack-config --set /etc/neutron/neutron.conf nova project_name service
openstack-config --set /etc/neutron/neutron.conf nova username nova
openstack-config --set /etc/neutron/neutron.conf nova password devops
openstack-config --set /etc/neutron/neutron.conf oslo_concurrency lock_path /var/lib/neutron/tmp

配置/etc/neutron/plugins/ml2/ml2_conf.ini

openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 type_drivers flat,vlan,vxlan
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 mechanism_drivers linuxbridge,l2population
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 extension_drivers port_security
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types vxlan
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 path_mtu 1500
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_flat flat_networks provider
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vxlan vni_ranges 1:1000
openstack-config --set /etc/neutron/plugins/ml2/ml2_conf.ini securitygroup enable_ipset True

配置/etc/neutron/plugins/ml2/linuxbridge_agent.ini

openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini DEFAULT debug false
openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini linux_bridge physical_interface_mappings provider:eth0
openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan enable_vxlan True
openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan local_ip 10.2.2.120
openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini vxlan l2_population True
openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini agent prevent_arp_spoofing True
openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup enable_security_group True
openstack-config --set /etc/neutron/plugins/ml2/linuxbridge_agent.ini securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

• 注意eth0是外网网卡，一般这里写的网卡名都是能访问外网的，如果不是外网网卡，那么VM就会与外界网络隔离。local_ip 定义的是隧道网络，vxLan下 vm-linuxbridge->vxlan ------tun-----vxlan->linuxbridge-vm

配置 /etc/neutron/l3_agent.ini

openstack-config --set /etc/neutron/l3_agent.ini DEFAULT interface_driver neutron.agent.linux.interface.BridgeInterfaceDriver
openstack-config --set /etc/neutron/l3_agent.ini DEFAULT external_network_bridge
openstack-config --set /etc/neutron/l3_agent.ini DEFAULT debug false

配置/etc/neutron/dhcp_agent.ini

openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT interface_driver neutron.agent.linux.interface.BridgeInterfaceDriver
openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT dhcp_driver neutron.agent.linux.dhcp.Dnsmasq
openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT enable_isolated_metadata True
openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT verbose True
openstack-config --set /etc/neutron/dhcp_agent.ini DEFAULT debug false

重新配置/etc/nova/nova.conf

配置这步的目的是让compute节点能使用上neutron网络

openstack-config --set /etc/nova/nova.conf neutron url http://controller:9696
openstack-config --set /etc/nova/nova.conf neutron auth_url http://controller:35357
openstack-config --set /etc/nova/nova.conf neutron auth_plugin password
openstack-config --set /etc/nova/nova.conf neutron project_domain_id default
openstack-config --set /etc/nova/nova.conf neutron user_domain_id default
openstack-config --set /etc/nova/nova.conf neutron region_name RegionOne
openstack-config --set /etc/nova/nova.conf neutron project_name service
openstack-config --set /etc/nova/nova.conf neutron username neutron
openstack-config --set /etc/nova/nova.conf neutron password devops
openstack-config --set /etc/nova/nova.conf neutron service_metadata_proxy True
openstack-config --set /etc/nova/nova.conf neutron metadata_proxy_shared_secret devops

dnsmasq-neutron.conf配置

echo "dhcp-option-force=26,1450" >/etc/neutron/dnsmasq-neutron.conf

配置/etc/neutron/metadata_agent.ini

openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT nova_metadata_ip controller
openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT metadata_proxy_shared_secret devops
openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT metadata_workers 4
openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT verbose True
openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT debug false
openstack-config --set /etc/neutron/metadata_agent.ini DEFAULT nova_metadata_protocol http

创建硬链接

ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

同步数据库

su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

重启nova服务，因为刚才改了nova.conf

systemctl restart openstack-nova-api.service
systemctl status openstack-nova-api.service

重启neutron服务并设置开机启动

systemctl enable neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
systemctl restart neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service
systemctl status neutron-server.service neutron-linuxbridge-agent.service neutron-dhcp-agent.service neutron-metadata-agent.service

启动neutron-l3-agent.service并设置开机启动

systemctl enable neutron-l3-agent.service
systemctl restart neutron-l3-agent.service
systemctl status neutron-l3-agent.service

执行验证

source /root/admin-openrc
neutron ext-list
neutron agent-list

创建vxLan模式网络，让虚拟机能外出

a）首先先执行环境变量

source /root/admin-openrc

b）创建flat模式的public网络，注意这个public是外出网络，必须是flat模式的

neutron --debug net-create --shared provider --router:external True --provider:network_type flat --provider:physical_network provider

执行完这步，在界面里进行操作，把public网络设置为共享和外部网络。

c）创建public网络子网，名为public-sub，网段就是192.168.0.1，并且IP范围是50-90（这个一般是给VM用的floating IP了），dns设置为192.168.0.1，网关为192.168.0.1

neutron subnet-create provider 192.168.0.1/24 --name provider-sub --allocation-pool start=192.168.0.50,end=192.168.0.90 --dns-nameserver 192.168.0.1 --gateway 192.168.0.1

d）创建名为private的私有网络, 网络模式为vxlan

neutron net-create private --provider:network_type vxlan --router:external False --shared

e）创建名为private-subnet的私有网络子网，网段为192.168.1.0, 这个网段就是虚拟机获取的私有的IP地址

neutron subnet-create private --name private-subnet --gateway 192.168.1.1 192.168.1.0/24

假如你们公司的私有云环境是用于不同的业务，比如行政、销售、技术等，那么你可以创建3个不同名称的私有网络

neutron net-create private-office --provider:network_type vxlan --router:external False --shared
neutron subnet-create private-office --name office-net --gateway 192.168.2.1 192.168.2.0/24

neutron net-create private-sale --provider:network_type vxlan --router:external False --shared
neutron subnet-create private-sale --name sale-net --gateway 192.168.3.1 192.168.3.0/24

neutron net-create private-technology --provider:network_type vxlan --router:external False --shared
neutron subnet-create private-technology --name technology-net --gateway 192.168.4.1 192.168.4.0/24

f）创建路由，我们在界面上操作

点击项目-->网络-->路由-->新建路由

路由名称随便命名，我这里写"router", 管理员状态，选择"上"(up)，外部网络选择"provider"

点击"新建路由"后，提示创建router创建成功

接着点击"接口"-->"增加接口"

添加一个连接私网的接口，选中"private-office: 192.168.2.0/24"

点击"增加接口"成功后，我们可以看到两个接口先是down的状态，过一会儿刷新下就是running状态（注意，一定得是运行running状态，不然到时候虚拟机网络会出不去）

检查网络服务

neutron agent-list

看服务是否是笑脸

安装Dashboard

安装dashboard相关软件包

yum install openstack-dashboard -y

修改配置文件/etc/openstack-dashboard/local_settings

vim /etc/openstack-dashboard/local_settings

直接覆盖我给的local_settings文件也行（为了减少出错，用我提供的local_settings文件替换覆盖）

百度云盘链接 密码：e4p9

启动dashboard服务并设置开机启动

systemctl restart httpd.service memcached.service
systemctl status httpd.service memcached.service

到此，Controller节点搭建完毕，打开firefox浏览器即可访问 http://192.168.0.120/dashboard/ 可进入openstack界面！