openEuler 24.03 系统安装部署openstack antelope版本

admin · 发表于 2025-3-16 22:32:36

在正式部署之前，需要对每个节点做如下配置和检查：

配置 |openEuler 24.03 LTS SP1 官方 yum 源，需要启用 EPOL 软件仓以支持 OpenStack

yum update
yum install openstack-release-antelope
yum clean all && yum makecache
注意：如果你的环境的YUM源没有启用EPOL，需要同时配置EPOL，确保EPOL已配置，如下所示。

vi /etc/yum.repos.d/openEuler.repo

[EPOL]
name=EPOL
baseurl=http://repo.openeuler.org/openEuler-24.03-LTS-SP1/EPOL/main/$basearch/
enabled=1
gpgcheck=1
gpgkey=http://repo.openeuler.org/openEuler-24.03-LTS-SP1/OS/$basearch/RPM-GPG-KEY-openEuler

修改主机名以及映射

每个节点分别修改主机名，以controller为例：

hostnamectl set-hostname controller

vi /etc/hostname
内容修改为controller
然后修改每个节点的/etc/hosts文件，新增如下内容:

192.168.16.2 controller
192.168.16.3 compute1
192.168.16.4 compute2
时钟同步¶
集群环境时刻要求每个节点的时间一致，一般由时钟同步软件保证。本文使用chrony软件。步骤如下：

Controller节点：

安装服务
dnf install chrony
修改/etc/chrony.conf配置文件，新增一行
# 表示允许哪些IP从本节点同步时钟
allow 192.168.16.0/24
重启服务
systemctl restart chronyd
其他节点

安装服务

dnf install chrony
修改/etc/chrony.conf配置文件，新增一行

# NTP_SERVER是controller IP，表示从这个机器获取时间，这里我们填192.168.16.2，或者在`/etc/hosts`里配置好的controller名字即可。
server controller iburst
同时，要把pool pool.ntp.org iburst这一行注释掉，表示不从公网同步时钟。

重启服务

systemctl restart chronyd
配置完成后，检查一下结果，在其他非controller节点执行chronyc sources，返回结果类似如下内容，表示成功从controller同步时钟。

MS Name/IP address       Stratum Poll Reach LastRx Last sample
===============================================================================
^* 192.168.16.2                4 6    7    0  -1406ns[  +55us] +/- 16ms
安装数据库¶
数据库安装在控制节点，这里推荐使用mariadb。

安装软件包

dnf install mysql-config mariadb mariadb-server python3-PyMySQL
新增配置文件/etc/my.cnf.d/openstack.cnf，内容如下

[mysqld]
bind-address = 192.168.16.2
default-storage-engine = innodb
innodb_file_per_table = on
max_connections = 4096
collation-server = utf8_general_ci
character-set-server = utf8
启动服务器

systemctl start mariadb
初始化数据库，根据提示进行即可

mysql_secure_installation
示例如下：

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

Enter current password for root (enter for none):

#这里输入密码，由于我们是初始化DB，直接回车就行

OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

You already have your root account protected, so you can safely answer 'n'.

# 这里根据提示输入N

Switch to unix_socket authentication [Y/n] N

Enabled successfully!
Reloading privilege tables..
... Success!

You already have your root account protected, so you can safely answer 'n'.

# 输入Y，修改密码

Change the root password? [Y/n] Y

New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
... Success!

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

# 输入Y，删除匿名用户

Remove anonymous users? [Y/n] Y
... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

# 输入Y，关闭root远程登录权限

Disallow root login remotely? [Y/n] Y
... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

# 输入Y，删除test数据库

Remove test database and access to it? [Y/n] Y
- Dropping test database...
... Success!
- Removing privileges on test database...
... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

# 输入Y，重载配置

Reload privilege tables now? [Y/n] Y
... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.
验证，根据第四步设置的密码，检查是否能登录mariadb

mysql -uroot -p
即可直接登录数据库

安装消息队列¶
消息队列安装在控制节点，这里推荐使用rabbitmq。

安装软件包
dnf install rabbitmq-server
启动服务
systemctl start rabbitmq-server
配置openstack用户，RABBIT_PASS是openstack服务登录消息队里的密码，需要和后面各个服务的配置保持一致。
rabbitmqctl add_user openstack RABBIT_PASS
rabbitmqctl set_permissions openstack ".*" ".*" ".*"
安装缓存服务¶
消息队列安装在控制节点，这里推荐使用Memcached。

安装软件包
dnf install memcached python3-memcached
修改配置文件/etc/sysconfig/memcached
OPTIONS="-l 0.0.0.0,::1,controller"
启动服务
systemctl start memcached
部署服务¶
Keystone¶
Keystone是OpenStack提供的鉴权服务，是整个OpenStack的入口，提供了租户隔离、用户认证、服务发现等功能，必须安装。

创建 keystone 数据库并授权

mysql -u root -p

MariaDB [(none)]> CREATE DATABASE keystone;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \
IDENTIFIED BY 'KEYSTONE_DBPASS';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \
IDENTIFIED BY 'KEYSTONE_DBPASS';
MariaDB [(none)]> exit
注意

替换 KEYSTONE_DBPASS，为 Keystone 数据库设置的密码 (一般可用opessl 或者uuidgen方式生产复杂密码)

安装软件包

dnf install openstack-keystone httpd mod_wsgi
配置keystone相关配置

vim /etc/keystone/keystone.conf

[database]
connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone

[token]
provider = fernet

解释

[database]
部分，配置数据库入口

[token]
部分，配置token provider

同步keystone数据库

su -s /bin/sh -c "keystone-manage db_sync" keystone

初始化Fernet密钥仓库

keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

启动服务
这两种方式都可以：
keystone-manage bootstrap --bootstrap-password ADMIN_PASS --bootstrap-admin-url http://controller:5000/v3/ --bootstrap-internal-url http://controller:5000/v3/ --bootstrap-public-url http://controller:5000/v3/ --bootstrap-region-id RegionOne

keystone-manage bootstrap --bootstrap-password ADMIN_PASS --bootstrap-admin-url http://controller:5000 --bootstrap-internal-url http://controller:5000 --bootstrap-public-url http://controller:5000 --bootstrap-region-id RegionOne
注意

替换 ADMIN_PASS，为 admin 用户设置密码

配置Apache HTTP server

打开httpd.conf并配置

#需要修改的配置文件路径
vim /etc/httpd/conf/httpd.conf

#修改以下项，如果没有则新添加
ServerName controller
创建软链接

ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/
解释

配置 ServerName 项引用控制节点

注意如果 ServerName 项不存在则需要创建

启动Apache HTTP服务

systemctl enable httpd.service
systemctl start httpd.service
创建环境变量配置

cat << EOF >>  .admin-openrc
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=ADMIN_PASS
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
EOF

注意

替换 ADMIN_PASS 为 admin 用户的密码

依次创建domain, projects, users, roles

需要先安装python3-openstackclient

dnf install python3-openstackclient

导入环境变量

source ~/.admin-openrc
创建project service，其中 domain default 在 keystone-manage bootstrap 时已创建

openstack domain create --description "An Example Domain" example

openstack project create --domain default --description "Service Project" service

创建（non-admin）project myproject，user myuser 和 role myrole，为 myproject 和 myuser 添加角色myrole

openstack project create --domain default --description "Demo Project" demo

openstack user create --domain default --password-prompt demo
openstack role create demo
openstack role add --project admin --user demo demo
验证

取消临时环境变量OS_AUTH_URL和OS_PASSWORD：

source  .admin-openrc
unset OS_AUTH_URL OS_PASSWORD
为admin用户请求token：

openstack --os-auth-url http://controller:5000/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name admin --os-username admin token issue

为myuser用户请求token：

openstack --os-auth-url http://controller:5000/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name demo --os-username demo token issue

安装Glance¶
Glance是OpenStack提供的镜像服务，负责虚拟机、裸机镜像的上传与下载，必须安装。

Controller节点：

创建 glance 数据库并授权

mysql -u root -p

MariaDB [(none)]> CREATE DATABASE glance;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost' \
IDENTIFIED BY 'GLANCE_DBPASS';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%' \
IDENTIFIED BY 'GLANCE_DBPASS';
MariaDB [(none)]> exit
注意:

替换 GLANCE_DBPASS，为 glance 数据库设置密码

初始化 glance 资源对象

导入环境变量

source ~/.admin-openrc
创建用户时，命令行会提示输入密码，请输入自定义的密码，下文涉及到GLANCE_PASS的地方替换成该密码即可。

openstack user create --domain default --password-prompt glance
User Password:
Repeat User Password:
添加glance用户到service project并指定admin角色：

openstack role add --project service --user glance admin
创建glance服务实体：

openstack service create --name glance --description "OpenStack Image" image
创建glance API服务：

openstack endpoint create --region RegionOne image public http://controller:9292
openstack endpoint create --region RegionOne image internal http://controller:9292
openstack endpoint create --region RegionOne image admin http://controller:9292
安装软件包

dnf install openstack-glance
修改 glance 配置文件

vim /etc/glance/glance-api.conf

[database]
connection = mysql+pymysql://glance:GLANCE_DBPASS@controller/glance

[keystone_authtoken]
www_authenticate_uri  = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = glance
password = GLANCE_PASS

[paste_deploy]
flavor = keystone

[glance_store]
stores = file,http
default_store = file
filesystem_store_datadir = /var/lib/glance/images/
解释:

[database]部分，配置数据库入口

[keystone_authtoken] [paste_deploy]部分，配置身份认证服务入口

[glance_store]部分，配置本地文件系统存储和镜像文件的位置

同步数据库

su -s /bin/sh -c "glance-manage db_sync" glance
启动服务：

systemctl enable openstack-glance-api.service
systemctl start openstack-glance-api.service
验证

导入环境变量

sorce .admin-openrcu
下载镜像

x86镜像下载：
wget http://download.cirros-cloud.net ... 5.2-x86_64-disk.img

arm镜像下载：
wget http://download.cirros-cloud.net ... .2-aarch64-disk.img
注意

如果您使用的环境是鲲鹏架构，请下载aarch64版本的镜像；已对镜像cirros-0.5.2-aarch64-disk.img进行测试。

向Image服务上传镜像：

openstack image create --disk-format qcow2 --container-format bare --file cirros-0.5.2-x86_64-disk.img --public cirros
确认镜像上传并验证属性：

openstack image list

Placement¶
Placement是OpenStack提供的资源调度组件，一般不面向用户，由Nova等组件调用，安装在控制节点。

安装、配置Placement服务前，需要先创建相应的数据库、服务凭证和API endpoints。

创建数据库

使用root用户访问数据库服务：

mysql -u root -p
创建placement数据库：

MariaDB [(none)]> CREATE DATABASE placement;
授权数据库访问：

MariaDB [(none)]> GRANT ALL PRIVILEGES ON placement.* TO 'placement'@'localhost' \
  IDENTIFIED BY 'PLACEMENT_DBPASS';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON placement.* TO 'placement'@'%' \
  IDENTIFIED BY 'PLACEMENT_DBPASS';
替换PLACEMENT_DBPASS为placement数据库访问密码。

退出数据库访问客户端：

exit
配置用户和Endpoints

source admin凭证，以获取admin命令行权限：

source ~/.admin-openrc
创建placement用户并设置用户密码：

openstack user create --domain default --password-prompt placement

User Password:
Repeat User Password:
添加placement用户到service project并指定admin角色：

openstack role add --project service --user placement admin
创建placement服务实体：

openstack service create --name placement --description "Placement API" placement
创建Placement API服务endpoints：

openstack endpoint create --region RegionOne placement public http://controller:8778
openstack endpoint create --region RegionOne placement internal http://controller:8778
openstack endpoint create --region RegionOne placement admin http://controller:8778
安装及配置组件

安装软件包：

dnf install openstack-placement-api
编辑/etc/placement/placement.conf配置文件，完成如下操作：

在[placement_database]部分，配置数据库入口：

[placement_database]
connection = mysql+pymysql://placement:PLACEMENT_DBPASS@controller/placement
替换PLACEMENT_DBPASS为placement数据库的密码。

在[api]和[keystone_authtoken]部分，配置身份认证服务入口：

[api]
auth_strategy = keystone

[keystone_authtoken]
auth_url = http://controller:5000/v3
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = placement
password = PLACEMENT_PASS
替换PLACEMENT_PASS为placement用户的密码。

数据库同步，填充Placement数据库：

su -s /bin/sh -c "placement-manage db sync" placement
启动服务

重启httpd服务：

systemctl restart httpd
验证

source admin凭证，以获取admin命令行权限

source .admin-openrc
执行状态检查：

placement-status upgrade check
+----------------------------------------------------------------------+
| Upgrade Check Results                                              |
+----------------------------------------------------------------------+
| Check: Missing Root Provider IDs                                  |
| Result: Success                                                    |
| Details: None                                                       |
+----------------------------------------------------------------------+
| Check: Incomplete Consumers                                        |
| Result: Success                                                    |
| Details: None                                                       |
+----------------------------------------------------------------------+
| Check: Policy File JSON to YAML Migration                         |
| Result: Failure                                                    |
| Details: Your policy file is JSON-formatted which is deprecated. You |
| need to switch to YAML-formatted file. Use the                   |
| ``oslopolicy-convert-json-to-yaml`` tool to convert the          |
| existing JSON-formatted files to YAML in a backwards-             |
| compatible manner: https://docs.openstack.org/oslo.policy/       |
| latest/cli/oslopolicy-convert-json-to-yaml.html.                |
+----------------------------------------------------------------------+
这里可以看到Policy File JSON to YAML Migration的结果为Failure。这是因为在Placement中，JSON格式的policy文件从Wallaby版本开始已处于deprecated状态。可以参考提示，使用oslopolicy-convert-json-to-yaml工具将现有的JSON格式policy文件转化为YAML格式。

oslopolicy-convert-json-to-yaml  --namespace placement \
  --policy-file /etc/placement/policy.json \
  --output-file /etc/placement/policy.yaml
mv /etc/placement/policy.json{,.bak}

注：当前环境中此问题可忽略，不影响运行。

Nova¶
Nova是OpenStack的计算服务，负责虚拟机的创建、发放等功能。

Controller节点

在控制节点执行以下操作。

创建数据库

使用root用户访问数据库服务：

mysql -u root -p
创建nova_api、nova和nova_cell0数据库：

MariaDB [(none)]> CREATE DATABASE nova_api;
MariaDB [(none)]> CREATE DATABASE nova;
MariaDB [(none)]> CREATE DATABASE nova_cell0;
授权数据库访问：

MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'localhost' IDENTIFIED BY 'NOVA_DBPASS';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'%' IDENTIFIED BY 'NOVA_DBPASS';

MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'localhost' IDENTIFIED BY 'NOVA_DBPASS';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' IDENTIFIED BY 'NOVA_DBPASS';

MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'localhost' IDENTIFIED BY 'NOVA_DBPASS';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'%' IDENTIFIED BY 'NOVA_DBPASS';

替换NOVA_DBPASS为nova相关数据库访问密码。

退出数据库访问客户端：

exit
配置用户和Endpoints

source admin凭证，以获取admin命令行权限：

source ~/.admin-openrc
创建nova用户并设置用户密码：

openstack user create --domain default --password-prompt nova

User Password:
Repeat User Password:
添加nova用户到service project并指定admin角色：

openstack role add --project service --user nova admin
创建nova服务实体：

openstack service create --name nova --description "OpenStack Compute" compute
创建Nova API服务endpoints：

openstack endpoint create --region RegionOne compute public http://controller:8774/v2.1
openstack endpoint create --region RegionOne compute internal http://controller:8774/v2.1
openstack endpoint create --region RegionOne compute admin http://controller:8774/v2.1

安装及配置组件

安装软件包：

dnf install openstack-nova-api openstack-nova-conductor openstack-nova-novncproxy openstack-nova-scheduler
编辑/etc/nova/nova.conf配置文件，完成如下操作：

在[default]部分，启用计算和元数据的API，配置RabbitMQ消息队列入口，使用controller节点管理IP配置my_ip，显式定义log_dir：

[DEFAULT]
enabled_apis = osapi_compute,metadata
transport_url = rabbit://openstack:RABBIT_PASS@controller:5672/
my_ip = 192.168.16.2
log_dir = /var/log/nova
state_path = /var/lib/nova

替换RABBIT_PASS为RabbitMQ中openstack账户的密码。

在[api_database]和[database]部分，配置数据库入口：

[api_database]
connection = mysql+pymysql://nova:NOVA_DBPASS@controller/nova_api

[database]
connection = mysql+pymysql://nova:NOVA_DBPASS@controller/nova
替换NOVA_DBPASS为nova相关数据库的密码。

在[api]和[keystone_authtoken]部分，配置身份认证服务入口：

[api]
auth_strategy = keystone

[keystone_authtoken]
auth_url = http://controller:5000/v3
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = nova
password = NOVA_PASS
替换NOVA_PASS为nova用户的密码。

在[vnc]部分，启用并配置远程控制台入口：

[vnc]
enabled = true
server_listen = $my_ip  controller
server_proxyclient_address = $my_ip  controller

在[glance]部分，配置镜像服务API的地址：

[glance]
api_servers = http://controller:9292

在[oslo_concurrency]部分，配置lock path：

[oslo_concurrency]
lock_path = /var/lib/nova/tmp
[placement]部分，配置placement服务的入口：

[placement]
region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://controller:5000/v3
username = placement
password = PLACEMENT_PASS
替换PLACEMENT_PASS为placement用户的密码。

数据库同步：

同步nova-api数据库：

su -s /bin/sh -c "nova-manage api_db sync" nova
注册cell0数据库：

su -s /bin/sh -c "nova-manage cell_v2 map_cell0" nova
创建cell1 cell：

su -s /bin/sh -c "nova-manage cell_v2 create_cell --name=cell1 --verbose" nova
同步nova数据库：

su -s /bin/sh -c "nova-manage db sync" nova
验证cell0和cell1注册正确：

su -s /bin/sh -c "nova-manage cell_v2 list_cells" nova
启动服务

systemctl enable openstack-nova-api.service openstack-nova-scheduler.service openstack-nova-conductor.service  openstack-nova-novncproxy.service

systemctl start  openstack-nova-api.service openstack-nova-scheduler.service openstack-nova-conductor.service openstack-nova-novncproxy.service

Compute节点

在计算节点执行以下操作。

安装软件包

dnf install openstack-nova-compute
编辑/etc/nova/nova.conf配置文件

在[default]部分，启用计算和元数据的API，配置RabbitMQ消息队列入口，使用Compute节点管理IP配置my_ip，显式定义compute_driver、instances_path、log_dir：

[DEFAULT]
enabled_apis = osapi_compute,metadata
transport_url = rabbit://openstack:RABBIT_PASS@controller:5672/
my_ip = 192.168.0.3
compute_driver = libvirt.LibvirtDriver
instances_path = /var/lib/nova/instances
log_dir = /var/log/nova
替换RABBIT_PASS为RabbitMQ中openstack账户的密码。

在[api]和[keystone_authtoken]部分，配置身份认证服务入口：

[api]
auth_strategy = keystone

[keystone_authtoken]
auth_url = http://controller:5000/v3
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = nova
password = NOVA_PASS
替换NOVA_PASS为nova用户的密码。

在[vnc]部分，启用并配置远程控制台入口：

[vnc]
enabled = true
server_listen = $my_ip
server_proxyclient_address = $my_ip
novncproxy_base_url = http://controller:6080/vnc_auto.html
在[glance]部分，配置镜像服务API的地址：

[glance]
api_servers = http://controller:9292
在[oslo_concurrency]部分，配置lock path：

[oslo_concurrency]
lock_path = /var/lib/nova/tmp
[placement]部分，配置placement服务的入口：

[placement]
region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://controller:5000/v3
username = placement
password = PLACEMENT_PASS
替换PLACEMENT_PASS为placement用户的密码。

确认计算节点是否支持虚拟机硬件加速（x86_64）

处理器为x86_64架构时，可通过运行如下命令确认是否支持硬件加速：

egrep -c '(vmx|svm)' /proc/cpuinfo
如果返回值为0则不支持硬件加速，需要配置libvirt使用QEMU而不是默认的KVM。编辑/etc/nova/nova.conf的[libvirt]部分：

[libvirt]
virt_type = qemu
如果返回值为1或更大的值，则支持硬件加速，不需要进行额外的配置。

确认计算节点是否支持虚拟机硬件加速（arm64）

处理器为arm64架构时，可通过运行如下命令确认是否支持硬件加速：

virt-host-validate
# 该命令由libvirt提供，此时libvirt应已作为openstack-nova-compute依赖被安装，环境中已有此命令
显示FAIL时，表示不支持硬件加速，需要配置libvirt使用QEMU而不是默认的KVM。

QEMU: Checking if device /dev/kvm exists: FAIL (Check that CPU and firmware supports virtualization and kvm module is loaded)
编辑/etc/nova/nova.conf的[libvirt]部分：

[libvirt]
virt_type = qemu
显示PASS时，表示支持硬件加速，不需要进行额外的配置。

QEMU: Checking if device /dev/kvm exists: PASS
配置qemu（仅arm64）

仅当处理器为arm64架构时需要执行此操作。

编辑/etc/libvirt/qemu.conf:

nvram = ["/usr/share/AAVMF/AAVMF_CODE.fd: \
      /usr/share/AAVMF/AAVMF_VARS.fd", \
      "/usr/share/edk2/aarch64/QEMU_EFI-pflash.raw: \
      /usr/share/edk2/aarch64/vars-template-pflash.raw"]
编辑/etc/qemu/firmware/edk2-aarch64.json

{
"description": "UEFI firmware for ARM64 virtual machines",
"interface-types": [
      "uefi"
],
"mapping": {
      "device": "flash",
      "executable": {
         "filename": "/usr/share/edk2/aarch64/QEMU_EFI-pflash.raw",
         "format": "raw"
      },
      "nvram-template": {
         "filename": "/usr/share/edk2/aarch64/vars-template-pflash.raw",
         "format": "raw"
      }
},
"targets": [
      {
         "architecture": "aarch64",
         "machines": [
            "virt-*"
         ]
      }
],
"features": [

],
"tags": [

]
}
启动服务

systemctl enable libvirtd.service openstack-nova-compute.service
systemctl start libvirtd.service openstack-nova-compute.service
Controller节点

在控制节点执行以下操作。

添加计算节点到openstack集群

source admin凭证，以获取admin命令行权限：

source ~/.admin-openrc
确认nova-compute服务已识别到数据库中：

openstack compute service list --service nova-compute
发现计算节点，将计算节点添加到cell数据库：

su -s /bin/sh -c "nova-manage cell_v2 discover_hosts --verbose" nova
结果如下：
Modules with known eventlet monkey patching issues were imported prior to eventlet monkey patching: urllib3. This warning can usually be ignored if the caller is only importing and not executing nova code.
Found 2 cell mappings.
Skipping cell0 since it does not contain hosts.
Getting computes from cell 'cell1': 6dae034e-b2d9-4a6c-b6f0-60ada6a6ddc2
Checking host mapping for compute host 'compute': 6286a86f-09d7-4786-9137-1185654c9e2e
Creating host mapping for compute host 'compute': 6286a86f-09d7-4786-9137-1185654c9e2e
Found 1 unmapped computes in cell: 6dae034e-b2d9-4a6c-b6f0-60ada6a6ddc2
验证

列出服务组件，验证每个流程都成功启动和注册：
openstack compute service list
列出身份服务中的API端点，验证与身份服务的连接：
openstack catalog list
列出镜像服务中的镜像，验证与镜像服务的连接：
openstack image list
检查cells是否运作成功，以及其他必要条件是否已具备。
nova-status upgrade check
Neutron¶
Neutron是OpenStack的网络服务，提供虚拟交换机、IP路由、DHCP等功能。

Controller节点

创建数据库、服务凭证和 API 服务端点

创建数据库：

mysql -u root -p

MariaDB [(none)]> CREATE DATABASE neutron;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'NEUTRON_DBPASS';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'NEUTRON_DBPASS';
MariaDB [(none)]> exit;
创建用户和服务，并记住创建neutron用户时输入的密码，用于配置NEUTRON_PASS：

source ~/.admin-openrc
openstack user create --domain default --password-prompt neutron
openstack role add --project service --user neutron admin
openstack service create --name neutron --description "OpenStack Networking" network
部署 Neutron API 服务：

openstack endpoint create --region RegionOne network public http://controller:9696
openstack endpoint create --region RegionOne network internal http://controller:9696
openstack endpoint create --region RegionOne network admin http://controller:9696
安装软件包

dnf install -y openstack-neutron openstack-neutron-linuxbridge ebtables ipset openstack-neutron-ml2
3. 配置Neutron
修改/etc/neutron/neutron.conf

[database]
connection = mysql+pymysql://neutron:NEUTRON_DBPASS@controller/neutron

[DEFAULT]
core_plugin = ml2
service_plugins = router
allow_overlapping_ips = true
transport_url = rabbit://openstack:RABBIT_PASS@controller
auth_strategy = keystone
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true

[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = neutron
password = NEUTRON_PASS

[nova]
auth_url = http://controller:5000
auth_type = password
project_domain_name = Default
user_domain_name = Default
region_name = RegionOne
project_name = service
username = nova
password = NOVA_PASS

[oslo_concurrency]
lock_path = /var/lib/neutron/tmp

[experimental]
linuxbridge = true
配置ML2，ML2具体配置可以根据用户需求自行修改，本文使用的是provider network + linuxbridge**

修改/etc/neutron/plugins/ml2/ml2_conf.ini

[ml2]
type_drivers = flat,vlan,vxlan
tenant_network_types = vxlan
mechanism_drivers = linuxbridge,l2population
extension_drivers = port_security

[ml2_type_flat]
flat_networks = provider

[ml2_type_vxlan]
vni_ranges = 1:1000

[securitygroup]
enable_ipset = true
修改/etc/neutron/plugins/ml2/linuxbridge_agent.ini

[linux_bridge]
physical_interface_mappings = provider:PROVIDER_INTERFACE_NAME

[vxlan]
enable_vxlan = true
local_ip = OVERLAY_INTERFACE_IP_ADDRESS
l2_population = true

[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
配置Layer-3代理

修改/etc/neutron/l3_agent.ini

[DEFAULT]
interface_driver = linuxbridge
配置DHCP代理修改/etc/neutron/dhcp_agent.ini

[DEFAULT]
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true
配置metadata代理

修改/etc/neutron/metadata_agent.ini

[DEFAULT]
nova_metadata_host = controller
metadata_proxy_shared_secret = METADATA_SECRET
配置nova服务使用neutron，修改/etc/nova/nova.conf
[neutron]
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = NEUTRON_PASS
service_metadata_proxy = true
metadata_proxy_shared_secret = METADATA_SECRET
创建/etc/neutron/plugin.ini的符号链接

ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
同步数据库

su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
重启nova api服务
systemctl restart openstack-nova-api
启动网络服务

systemctl enable neutron-server.service neutron-linuxbridge-agent.service \
neutron-dhcp-agent.service neutron-metadata-agent.service neutron-l3-agent.service
systemctl start neutron-server.service neutron-linuxbridge-agent.service \
neutron-dhcp-agent.service neutron-metadata-agent.service neutron-l3-agent.service
Compute节点

安装软件包
dnf install openstack-neutron-linuxbridge ebtables ipset -y
配置Neutron

修改/etc/neutron/neutron.conf

[DEFAULT]
transport_url = rabbit://openstack:RABBIT_PASS@controller
auth_strategy = keystone

[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = neutron
password = NEUTRON_PASS

[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
修改/etc/neutron/plugins/ml2/linuxbridge_agent.ini

[linux_bridge]
physical_interface_mappings = provider:PROVIDER_INTERFACE_NAME

[vxlan]
enable_vxlan = true
local_ip = OVERLAY_INTERFACE_IP_ADDRESS
l2_population = true

[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
配置nova compute服务使用neutron，修改/etc/nova/nova.conf

[neutron]
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = NEUTRON_PASS
重启nova-compute服务
systemctl restart openstack-nova-compute.service
启动Neutron linuxbridge agent服务
systemctl enable neutron-linuxbridge-agent
systemctl start neutron-linuxbridge-agent
Cinder¶
Cinder是OpenStack的存储服务，提供块设备的创建、发放、备份等功能。

Controller节点：

初始化数据库

CINDER_DBPASS是用户自定义的cinder数据库密码。

mysql -u root -p

MariaDB [(none)]> CREATE DATABASE cinder;
MariaDB [(none)]> GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'localhost' IDENTIFIED BY 'CINDER_DBPASS';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'%' IDENTIFIED BY 'CINDER_DBPASS';
MariaDB [(none)]> exit
初始化Keystone资源对象

source ~/.admin-openrc

#创建用户时，命令行会提示输入密码，请输入自定义的密码，下文涉及到`CINDER_PASS`的地方替换成该密码即可。
openstack user create --domain default --password-prompt cinder

openstack role add --project service --user cinder admin
openstack service create --name cinderv3 --description "OpenStack Block Storage" volumev3

openstack endpoint create --region RegionOne volumev3 public http://controller:8776/v3/%$project_id$s
openstack endpoint create --region RegionOne volumev3 internal http://controller:8776/v3/%$project_id$s
openstack endpoint create --region RegionOne volumev3 admin http://controller:8776/v3/%$project_id$s
3. 安装软件包
dnf install openstack-cinder-api openstack-cinder-scheduler
修改cinder配置文件/etc/cinder/cinder.conf

[DEFAULT]
transport_url = rabbit://openstack:RABBIT_PASS@controller
auth_strategy = keystone
my_ip = 192.168.16.2

[database]
connection = mysql+pymysql://cinder:CINDER_DBPASS@controller/cinder

[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = cinder
password = CINDER_PASS

[oslo_concurrency]
lock_path = /var/lib/cinder/tmp
数据库同步

su -s /bin/sh -c "cinder-manage db sync" cinder
修改nova配置/etc/nova/nova.conf

[cinder]
os_region_name = RegionOne
启动服务

systemctl restart openstack-nova-api
systemctl start openstack-cinder-api openstack-cinder-scheduler
Storage节点：

Storage节点要提前准备至少一块硬盘，作为cinder的存储后端，下文默认storage节点已经存在一块未使用的硬盘，设备名称为/dev/sdb，用户在配置过程中，请按照真实环境信息进行名称替换。

Cinder支持很多类型的后端存储，本指导使用最简单的lvm为参考，如果您想使用如ceph等其他后端，请自行配置。

安装软件包

dnf install lvm2 device-mapper-persistent-data scsi-target-utils rpcbind nfs-utils openstack-cinder-volume openstack-cinder-backup
配置lvm卷组

pvcreate /dev/sdb
vgcreate cinder-volumes /dev/sdb
修改cinder配置/etc/cinder/cinder.conf

[DEFAULT]
transport_url = rabbit://openstack:RABBIT_PASS@controller
auth_strategy = keystone
my_ip = 192.168.16.4
enabled_backends = lvm
glance_api_servers = http://controller:9292

[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = cinder
password = CINDER_PASS

[database]
connection = mysql+pymysql://cinder:CINDER_DBPASS@controller/cinder

[lvm]
volume_driver = cinder.volume.drivers.lvm.LVMVolumeDriver
volume_group = cinder-volumes
target_protocol = iscsi
target_helper = lioadm

[oslo_concurrency]
lock_path = /var/lib/cinder/tmp
配置cinder backup （可选）

cinder-backup是可选的备份服务，cinder同样支持很多种备份后端，本文使用swift存储，如果您想使用如NFS等后端，请自行配置，例如可以参考OpenStack官方文档对NFS的配置说明。

修改/etc/cinder/cinder.conf，在[DEFAULT]中新增

[DEFAULT]
backup_driver = cinder.backup.drivers.swift.SwiftBackupDriver
backup_swift_url = SWIFT_URL
这里的SWIFT_URL是指环境中swift服务的URL，在部署完swift服务后，执行openstack catalog show object-store命令获取。

启动服务

systemctl start openstack-cinder-volume target
systemctl start openstack-cinder-backup (可选)
至此，Cinder服务的部署已全部完成，可以在controller通过以下命令进行简单的验证

source ~/.admin-openrc
openstack storage service list
openstack volume list
Horizon¶
Horizon是OpenStack提供的前端页面，可以让用户通过网页鼠标的操作来控制OpenStack集群，而不用繁琐的CLI命令行。Horizon一般部署在控制节点。

安装软件包

dnf install openstack-dashboard
修改配置文件/etc/openstack-dashboard/local_settings

OPENSTACK_HOST = "controller"
ALLOWED_HOSTS = ['*', ]
OPENSTACK_KEYSTONE_URL =  "http://controller:5000/v3"
SESSION_ENGINE = 'django.contrib.sessions.backends.cache'
CACHES = {
'default': {
'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
'LOCATION': 'controller:11211',
}
}
OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True
OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = "Default"
OPENSTACK_KEYSTONE_DEFAULT_ROLE = "member"
WEBROOT = '/dashboard'
POLICY_FILES_PATH = "/etc/openstack-dashboard"

OPENSTACK_API_VERSIONS = {
"identity": 3,
"image": 2,
"volume": 3,
}
重启服务

systemctl restart httpd
至此，horizon服务的部署已全部完成，打开浏览器，输入http://192.168.16.2/dashboard，打开horizon登录页面。

		自动登录	找回密码
密码			注册

openEuler 24.03 系统安装部署openstack antelope版本

浏览过的版块