中小企业openstack私有云布署实践【7.2 keystone + memcache (办公网环境）】

首先登录controller1创建keystone数据库，并赋于远程和本地访问的权限。

mysql -u root -p

CREATE DATABASE keystone;

GRANT ALL PRIVILEGES ON keystone.* TO ‘keystone‘@‘localhost‘   IDENTIFIED BY ‘venic8888‘;

GRANT ALL PRIVILEGES ON keystone.* TO ‘keystone‘@‘%‘  IDENTIFIED BY ‘venic8888‘;

flush PRIVILEGES;

2台controller服务器（kxcontrolelr1 kxcontroller2） 安装其它无状态服务的组件，

yum install openstack-keystone httpd mod_wsgi  memcached python-memcached -y

先开启memcache

systemctl enable memcached.service

systemctl start memcached.service

controller1上

vi  /etc/keystone/keystone.conf

[DEFAULT]

admin_token = venicchina

verbose = True

[database]

connection = mysql://keystone:[email protected]/keystone

[memcache]

servers = controller1:11211

[token]

provider = uuid

driver = memcache

expiration = 86400

caching = true

cache_time = 86400

[revoke]

driver = sql

expiration_buffer = 86400

caching = true

cache_time = 86400

[catalog]

driver = keystone.catalog.backends.sql.Catalog

[identity]

driver = keystone.identity.backends.sql.Identity

controller2上

vi  /etc/keystone/keystone.conf

[DEFAULT]

admin_token = venicchina

verbose = True

[database]

connection = mysql://keystone:[email protected]/keystone

[memcache]

servers = controller2:11211

[token]

provider = uuid

driver = memcache

expiration = 86400

caching = true

cache_time = 86400

[revoke]

driver = sql

expiration_buffer = 86400

caching = true

cache_time = 86400

[catalog]

driver = keystone.catalog.backends.sql.Catalog

[identity]

driver = keystone.identity.backends.sql.Identity

以上的每个配置中两组黄色底86400的是给token定义失效时间，默认30分钟或1小时，因为有时迁移一些很大的实例时，迁移大200G的时候，时间会超过，到时会有token报错，到时实例就废掉了。加大时长是必须，这里我定义1天超时

在其中一台kxcontroller1同步数据库，生成表单

su -s /bin/sh -c "keystone-manage db_sync" keystone

---------------------------------------

修改httpd配置

controller1上

vi /etc/httpd/conf/httpd.conf

ServerName controller1

改

Listen 80 这一条为以下行：

Listen 10.40.42.1:80#与VIP监听的IP不同

controller2上

vi /etc/httpd/conf/httpd.conf

ServerName controller2

改

Listen 80 这一条为以下行：

Listen 10.40.42.2:80#与VIP监听的IP不同

------------------------------------------

controller1上

vi /etc/httpd/conf.d/wsgi-keystone.conf

Listen 10.40.42.1:5000

Listen 10.40.42.1:35357

<VirtualHost *:5000>

WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}

WSGIProcessGroup keystone-public

WSGIScriptAlias / /usr/bin/keystone-wsgi-public

WSGIApplicationGroup %{GLOBAL}

WSGIPassAuthorization On

<IfVersion >= 2.4>

ErrorLogFormat "%{cu}t %M"

</IfVersion>

ErrorLog /var/log/httpd/keystone-error.log

CustomLog /var/log/httpd/keystone-access.log combined

<Directory /usr/bin>

<IfVersion >= 2.4>

Require all granted

</IfVersion>

<IfVersion < 2.4>

Order allow,deny

Allow from all

</IfVersion>

</Directory>

</VirtualHost>

<VirtualHost *:35357>

WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}

WSGIProcessGroup keystone-admin

WSGIScriptAlias / /usr/bin/keystone-wsgi-admin

WSGIApplicationGroup %{GLOBAL}

WSGIPassAuthorization On

<IfVersion >= 2.4>

ErrorLogFormat "%{cu}t %M"

</IfVersion>

ErrorLog /var/log/httpd/keystone-error.log

CustomLog /var/log/httpd/keystone-access.log combined

<Directory /usr/bin>

<IfVersion >= 2.4>

Require all granted

</IfVersion>

<IfVersion < 2.4>

Order allow,deny

Allow from all

</IfVersion>

</Directory>

</VirtualHost>

controller2上

vi /etc/httpd/conf.d/wsgi-keystone.conf

Listen 10.40.42.2:5000

Listen 10.40.42.2:35357

<VirtualHost *:5000>

WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}

WSGIProcessGroup keystone-public

WSGIScriptAlias / /usr/bin/keystone-wsgi-public

WSGIApplicationGroup %{GLOBAL}

WSGIPassAuthorization On

<IfVersion >= 2.4>

ErrorLogFormat "%{cu}t %M"

</IfVersion>

ErrorLog /var/log/httpd/keystone-error.log

CustomLog /var/log/httpd/keystone-access.log combined

<Directory /usr/bin>

<IfVersion >= 2.4>

Require all granted

</IfVersion>

<IfVersion < 2.4>

Order allow,deny

Allow from all

</IfVersion>

</Directory>

</VirtualHost>

<VirtualHost *:35357>

WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}

WSGIProcessGroup keystone-admin

WSGIScriptAlias / /usr/bin/keystone-wsgi-admin

WSGIApplicationGroup %{GLOBAL}

WSGIPassAuthorization On

<IfVersion >= 2.4>

ErrorLogFormat "%{cu}t %M"

</IfVersion>

ErrorLog /var/log/httpd/keystone-error.log

CustomLog /var/log/httpd/keystone-access.log combined

<Directory /usr/bin>

<IfVersion >= 2.4>

Require all granted

</IfVersion>

<IfVersion < 2.4>

Order allow,deny

Allow from all

</IfVersion>

</Directory>

</VirtualHost>

2台controller服务启动，加入开机自启

# systemctl enable httpd.service

# systemctl start httpd.service

验证：在haproxy的页面http://10.40.42.10:8888/stats上查看80 5000 35357端口状态转发是否成功

时间： 2024-08-06 17:10:22

中小企业openstack私有云布署实践【7.2 keystone + memcache (办公网环境）】的相关文章

中小企业openstack私有云布署实践【12.2 网络Neutron-controller节点配置（办公网环境）】

网络这一块推荐使用的是 Neutron--LinuxBirdge的Ha高可用,此高可用方案对Public作用不是很大,Public只用到DHCP,而Private则会用到L3 Agent,则此方案是有用的,但要关掉和牺牲一个L3 population的特性--抑制ARP报文广播.原因在下文的配置文件有说明,并因我们布的是私有云,不像公有云的多租户private网络数量之大,这个特性牺牲在中小私有云是可接受的. 一.首先登录controller1创建neutron数据库,并赋于远程和本地访问的权限

中小企业openstack私有云布署实践【15 创建租户网络+实例】

这里以办公网测试环境为例, (一)创建租户demo的网络 使用admin用户 source admin-openrc.sh 创建public公网 neutron net-create 1040100 --shared --provider:physical_network public  --provider:network_type flat  --router:external 声明public网段DHCP等信息 neutron subnet-create 1040100 10.40.100

中小企业openstack私有云布署实践【9.3 主从controller单向同步glance-image目录】

采用Rysnc单向同步,而不用双方实时同步,原因是在历史的运行过程中,我们发现,有些镜像包太大,当在主用的glance将镜像保存时,并不是一时半会就把镜像保存好,当主用在保存时,备用节点又在实时同步那个正常拷贝保存状态中的不完整主用文件,因此我们会看到在备节点上,它删了又拷的方式,非常损耗机器的硬盘. 所以我们采用Rysnc单向同步, 做这一步时,我已布署好了之前的集群.下面的示例是以办公网测试环境为例,科兴的雷同,只是IP和主机名不同而已 使用root用户运行源服务器controller2的进

中小企业openstack私有云布署实践【1 网络拓扑说明】

图1说明:办公网的openstack使用2台交换机,10.40.40.2是24口  10.40.40.6是48口,管理网段接10.40.40.2VLAN1002     虚拟机的public网段接10.40.40.6的VLAN1100  .因为10.40.40.6可以支持一个接口配置多个网段,而另一台交换机不支持 也是为了将来可以方便横向扩展. 图2图3说明:科兴交换机是复用之前的6台交换机,两两做堆叠,并且使用trunk打通VLAN,这个配置VLAN 42 和VLAN 1200 VLAN 42

中小企业openstack私有云布署实践【16.3 Windows Server2008 R2 只有C盘分区镜像制作】

之所以要只有C盘分区镜像,是因为在创建VM或者调整云主机的硬盘大小时,它能自动扩容.无需人工介入 参考http://www.iyunv.com/thread-45149-1-1.html的灵感 在原来的物理机10.40.41.1的CentOS 6.7上制作镜像. 宿主机坱要安装KVM相关软件: yum groupinstall Virtualization "Virtualization Client" -y yum install libvirt libguestfs-tools q

中小企业openstack私有云布署实践【11.3 计算nova - compute节点-nova用户免密登录（用于云主机冷迁移+扩展云主机大小）】

云主机迁移+扩展云主机大小 ,官方说它依赖nova用户之间的免密登录.确保每个resion区域的compute节点服务器他们可以相互SSH免密 compute1-7     他们相互SSH免密 kxcompute1-9  他们相互SSH免密 1.注意!是每台机器上的nova用户向另一台机器的nova用户的免密登录 每台compute节点修改ssh配置,目的是为了不让其提示输入yes保存密钥 vi /etc/ssh/ssh_config 尾部添加 StrictHostKeyChecking no

中小企业openstack私有云布署实践【13.2 网络Neutron-compute节点配置（办公网环境）】

所有compute节点 下载安装组件 # yum install openstack-neutron openstack-neutron-linuxbridge ebtables ipset -y 修改新增内核参数: vi /etc/sysctl.conf net.ipv4.conf.default.rp_filter=0 net.ipv4.conf.all.rp_filter=0 net.bridge.bridge-nf-call-iptables=1 net.bridge.bridge-nf

中小企业openstack私有云布署实践【16.2 Ubuntu1404 只有根分区镜像制作】

之所以要只有根分区镜像,是因为在创建VM或者调整云主机的硬盘大小时,它能自动扩容.无需人工介入 在原来的物理机10.40.41.1的CentOS 6.7上制作镜像. 宿主机坱要安装KVM相关软件: yum groupinstall Virtualization "Virtualization Client" -y yum install libvirt libguestfs-tools qemu virt-manager virt-viewer qemu-kvm virt-instal

中小企业openstack私有云布署实践【11.1 计算nova - compute节点配置（科兴环境）】

这里我只使用kxcompute1节点配置为示例,其它节点的配置基本是一样的,只是声明的管理IP不同而已 计算节点 # yum install openstack-nova-compute sysfsutils 修改配置文件 vi /etc/nova/nova.conf [DEFAULT] vcpu_pin_set = 4-31 resume_guests_state_on_host_boot=True rpc_backend = rabbit auth_strategy = keystone m

中小企业openstack私有云布署实践【8.2 身份认证keystone的API创建（办公网环境）】

其中一台controller上面加入环境变量,我选controller1,关注的是endpoint的名称不一样,其它创建的参数与生产环境一致 export OS_TOKEN=venicchina export OS_URL=http://controller:35357/v3 export OS_IDENTITY_API_VERSION=3 其中一台controller开始创建 openstack service create --name keystone --description "Ope