OpenStack 私有云学习手册

1. OpenStack 架构与理论#

1.1 云计算架构四层模型#

基础设施层
云平台层
业务应用层
业务管理层

1.2 云计算三种服务模型#

模型	说明
IaaS	基础架构即服务
PaaS	平台即服务
SaaS	软件即服务

1.3 OpenStack 核心组件#

组件	服务类型	说明
Keystone	Identity Service	认证服务
Glance	Image Service	镜像服务
Nova	Compute	计算服务
Neutron	Networking	网络服务
Horizon	Dashboard	Web 前端服务
Swift	Object Storage	对象存储服务
Cinder	Block Storage	块存储服务
Ceilometer	Telemetry	监控服务
Heat	Orchestration	编排服务
Trove	Database Service	数据库服务

1.4 Neutron 网络#

Linux bridge 与 Open vSwitch 两种 plugin 对比：

Open vSwitch：SDN 集中管控、更多网络特性支持
Linux bridge：稳定性好、大规模网络部署更优

VxLAN（虚拟扩展局域网）类型网络是常用的 Overlay 网络方案。

1.5 Keystone Bootstrap 自动创建内容#

Default Domain — 默认域
Admin Project — 管理员项目
Admin User — 管理员用户
Admin Role — 管理员角色
Member Role — 成员角色
Reader Role — 只读角色
Keystone Service — 身份服务
Identity Endpoint — 身份端点

2. OpenStack 基础搭建（脚本方式）#

2.1 环境要求#

双节点（controller + compute）
每节点：4vCPU、8G 内存、双网卡（内/外）、双磁盘各 60G
基于 chinaskills-iaas-v2.0.3.iso

2.2 搭建步骤#

1
# 1. 修改主机名
2
hostnamectl set-hostname controller   # 控制节点
3
hostnamectl set-hostname compute      # 计算节点
4

5
# 2. 关闭防火墙和 SELinux
6
systemctl stop firewalld && systemctl disable firewalld
7
setenforce 0
8
sed -i 's/SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
9

10
# 3. 配置 /etc/hosts
11
echo "controller_IP controller" >> /etc/hosts
12
echo "compute_IP compute" >> /etc/hosts
13

14
# 4. 配置离线 YUM 仓库并搭建 FTP
15
# /etc/yum.repos.d/local.repo
16
yum clean all && yum makecache
17
yum install -y vsftpd
18
systemctl start vsftpd && systemctl enable vsftpd
19

20
# 5. 计算节点配置磁盘（两个 9G 分区）
21
fdisk /dev/vdb
22

23
# 6. 安装 iaas 脚本包
24
yum install -y openstack-iaas
25

26
# 7. 配置 openrc 并执行预处理
27
bash iaas-pre-host.sh
28
reboot

2.3 Controller 节点安装顺序#

1
iaas-install-mysql.sh
2
iaas-install-keystone.sh
3
iaas-install-glance.sh
4
iaas-install-placement.sh
5
iaas-install-nova-controller.sh
6
iaas-install-neutron-controller.sh
7
iaas-install-dashboard.sh
8
iaas-install-cinder-controller.sh
9
iaas-install-swift-controller.sh

2.4 Compute 节点安装顺序#

1
iaas-install-nova-compute.sh
2
iaas-install-neutron-compute.sh
3
iaas-install-cinder-compute.sh
4
iaas-install-swift-compute.sh

3. OpenStack Rocky 版手动搭建#

想要更快跑起来，可以参考 [[posts/openstack-rdo-allinone/index.md]]，使用 Packstack 一键部署单节点版本。本章是逐组件手动部署，适合理解 OpenStack 的内部分工。部署完成后做 Python 运维开发见 [[posts/openstack-python-ops/index.md]]。

参考：https://blog.csdn.net/HYXRX/article/details/113876162

3.1 NTP 时间同步#

Controller 节点：

1
yum install chrony -y
2
vi /etc/chrony.conf
3
# server 0.centos.pool.ntp.org iburst
4
# allow 192.168.22.0/24
5
systemctl enable chronyd && systemctl start chronyd
6
chronyc sources

Compute 节点：

1
vi /etc/chrony.conf
2
# server controller iburst
3
systemctl enable chronyd && systemctl start chronyd

3.2 配置 YUM 仓库#

1
yum install centos-release-openstack-rocky -y
2
yum upgrade -y
3
yum install python-openstackclient -y
4
yum install openstack-selinux -y

3.3 MySQL 数据库（Controller）#

1
yum install mariadb mariadb-server python2-PyMySQL -y
2
vi /etc/my.cnf.d/openstack.cnf

1
[mysqld]
2
bind-address = 本机IP
3
default-storage-engine = innodb
4
innodb_file_per_table = on
5
max_connections = 4096
6
collation-server = utf8_general_ci
7
character-set-server = utf8

1
systemctl enable mariadb && systemctl start mariadb
2
mysql_secure_installation  # 回车-Y密码-Y-Y-Y-Y
3
mysql -uroot -p密码 -e "grant all privileges on *.* to 'root'@'%' identified by '密码';flush privileges;"

3.4 RabbitMQ 消息队列（Controller）#

1
yum install rabbitmq-server -y
2
systemctl enable rabbitmq-server && systemctl start rabbitmq-server
3
rabbitmqctl add_user openstack 密码
4
rabbitmqctl set_permissions openstack ".*" ".*" ".*"
5
rabbitmq-plugins enable rabbitmq_management
6
systemctl restart rabbitmq-server
7
# 浏览器访问 IP:15672，guest/guest 登录后修改 openstack 用户属性

3.5 Memcached 缓存（Controller）#

1
yum install memcached python-memcached -y
2
vi /etc/sysconfig/memcached
3
# OPTIONS="-l 127.0.0.1,::1,controller"
4
systemctl enable memcached && systemctl start memcached

3.6 Etcd（Controller）#

1
yum install etcd -y
2
vi /etc/etcd/etcd.conf

1
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
2
ETCD_LISTEN_PEER_URLS="http://Controller_IP:2380"
3
ETCD_LISTEN_CLIENT_URLS="http://Controller_IP:2379"
4
ETCD_NAME="controller"
5
ETCD_INITIAL_ADVERTISE_PEER_URLS="http://Controller_IP:2380"
6
ETCD_ADVERTISE_CLIENT_URLS="http://Controller_IP:2379"
7
ETCD_INITIAL_CLUSTER="controller=http://Controller_IP:2380"
8
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster-01"
9
ETCD_INITIAL_CLUSTER_STATE="new"

1
systemctl enable etcd && systemctl start etcd

3.7 Keystone 认证服务（Controller）#

1
yum install openstack-keystone httpd mod_wsgi -y
2
vi /etc/keystone/keystone.conf

1
[database]
2
connection = mysql+pymysql://keystone:密码@controller/keystone
3
[token]
4
provider = fernet

1
# 创建数据库
2
mysql -uroot -p密码 -e "CREATE DATABASE keystone;"
3
mysql -uroot -p密码 -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY '密码';"
4
mysql -uroot -p密码 -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY '密码';"
5

6
# 初始化
7
su -s /bin/sh -c "keystone-manage db_sync" keystone
8
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
9
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
10

11
# Bootstrap
12
keystone-manage bootstrap --bootstrap-password 密码 \
13
  --bootstrap-admin-url http://controller:5000/v3/ \
14
  --bootstrap-internal-url http://controller:5000/v3/ \
15
  --bootstrap-public-url http://controller:5000/v3/ \
16
  --bootstrap-region-id RegionOne
17

18
# 配置 Apache
19
ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/
20
vi /etc/httpd/conf/httpd.conf  # ServerName controller
21
systemctl enable httpd && systemctl start httpd
22

23
# 创建环境变量脚本
24
vi openrc
25
export OS_PROJECT_DOMAIN_NAME=Default
26
export OS_USER_DOMAIN_NAME=Default
27
export OS_PROJECT_NAME=admin
28
export OS_USERNAME=admin
29
export OS_PASSWORD=密码
30
export OS_AUTH_URL=http://controller:5000/v3
31
export OS_IDENTITY_API_VERSION=3
32
export OS_IMAGE_API_VERSION=2
33

34
source openrc
35
openstack user list
36
openstack project create --domain default --description "Service Project" service

3.8 Glance 镜像服务（Controller）#

1
openstack service create --name glance --description "OpenStack Image" image
2
openstack user create --domain default --password 密码 glance
3
openstack role add --project service --user glance admin
4
openstack endpoint create --region RegionOne image public http://controller:9292
5
openstack endpoint create --region RegionOne image internal http://controller:9292
6
openstack endpoint create --region RegionOne image admin http://controller:9292
7
yum install openstack-glance -y

配置 /etc/glance/glance-api.conf 和 /etc/glance/glance-registry.conf（数据库连接、Keystone 认证、存储路径）。

1
# 创建数据库并初始化
2
su -s /bin/sh -c "glance-manage db_sync" glance
3
systemctl enable openstack-glance-api openstack-glance-registry
4
systemctl start openstack-glance-api openstack-glance-registry
5

6
# 上传镜像
7
openstack image create "cirros" --file cirros-0.4.0-x86_64-disk.img \
8
  --disk-format qcow2 --container-format bare --public
9
openstack image list

3.9 Nova 计算服务#

Controller 节点：

1
# 创建服务、用户、端点
2
openstack service create --name nova --description "OpenStack Compute" compute
3
openstack user create --domain default --password 密码 nova
4
openstack role add --project service --user nova admin
5
openstack endpoint create --region RegionOne compute public http://controller:8774/v2.1
6
openstack endpoint create --region RegionOne compute internal http://controller:8774/v2.1
7
openstack endpoint create --region RegionOne compute admin http://controller:8774/v2.1
8

9
# Placement
10
openstack service create --name placement --description "Placement API" placement
11
openstack user create --domain default --password 密码 placement
12
openstack role add --project service --user placement admin
13
openstack endpoint create --region RegionOne placement public http://controller:8778
14
openstack endpoint create --region RegionOne placement internal http://controller:8778
15
openstack endpoint create --region RegionOne placement admin http://controller:8778
16

17
yum install openstack-nova-api openstack-nova-conductor \
18
  openstack-nova-console openstack-nova-novncproxy \
19
  openstack-nova-scheduler openstack-nova-placement-api -y

配置 /etc/nova/nova.conf（数据库、RabbitMQ、Keystone、VNC、Glance、Placement）。

1
# 初始化数据库
2
su -s /bin/sh -c "nova-manage api_db sync" nova
3
su -s /bin/sh -c "nova-manage cell_v2 map_cell0" nova
4
su -s /bin/sh -c "nova-manage cell_v2 create_cell --name=cell1 --verbose" nova
5
su -s /bin/sh -c "nova-manage db sync" nova
6

7
# 配置 Placement httpd
8
vi /etc/httpd/conf.d/00-nova-placement-api.conf  # 添加 Listen 8778 虚拟主机
9
systemctl restart httpd
10

11
systemctl enable openstack-nova-api openstack-nova-scheduler \
12
  openstack-nova-conductor openstack-nova-novncproxy
13
systemctl start openstack-nova-api openstack-nova-scheduler \
14
  openstack-nova-conductor openstack-nova-novncproxy

Compute 节点：

1
yum install openstack-nova-compute -y
2
# 配置 /etc/nova/nova.conf（类似 Controller，但 my_ip 为本机 IP）
3
systemctl enable libvirtd openstack-nova-compute
4
systemctl start libvirtd openstack-nova-compute
5
su -s /bin/sh -c "nova-manage cell_v2 discover_hosts --verbose" nova
6
openstack compute service list

3.10 Neutron 网络服务（Open vSwitch）#

Controller 节点：

1
openstack service create --name neutron --description "OpenStack Networking" network
2
openstack user create --domain default --password 密码 neutron
3
openstack role add --project service --user neutron admin
4
openstack endpoint create --region RegionOne network public http://controller:9696
5
openstack endpoint create --region RegionOne network internal http://controller:9696
6
openstack endpoint create --region RegionOne network admin http://controller:9696
7

8
yum install openstack-neutron openstack-neutron-ml2 openstack-neutron-openvswitch -y

配置文件：

/etc/neutron/neutron.conf — 核心配置
/etc/neutron/plugins/ml2/ml2_conf.ini — ML2 插件（flat,vlan,vxlan）
/etc/neutron/plugins/ml2/openvswitch_agent.ini — OvS Agent
/etc/neutron/l3_agent.ini — L3 Agent
/etc/neutron/dhcp_agent.ini — DHCP Agent
/etc/neutron/metadata_agent.ini — Metadata Agent

1
# Open vSwitch
2
systemctl enable openvswitch && systemctl start openvswitch
3
ovs-vsctl add-br br-provider
4
ovs-vsctl add-port br-provider ens224
5

6
# 初始化数据库
7
su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
8
  --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
9

10
# 启动服务
11
systemctl restart openstack-nova-api
12
systemctl enable neutron-server neutron-openvswitch-agent \
13
  neutron-dhcp-agent neutron-metadata-agent neutron-l3-agent
14
systemctl start neutron-server neutron-openvswitch-agent \
15
  neutron-dhcp-agent neutron-metadata-agent neutron-l3-agent

Compute 节点：

1
yum install openstack-neutron-openvswitch ipset -y
2
# 配置 /etc/neutron/neutron.conf 和 openvswitch_agent.ini
3
systemctl enable openvswitch && systemctl start openvswitch
4
systemctl restart openstack-nova-compute
5
systemctl enable neutron-openvswitch-agent && systemctl start neutron-openvswitch-agent
6
openstack network agent list

3.11 Horizon Dashboard（Controller）#

1
yum install openstack-dashboard -y
2
vi /etc/openstack-dashboard/local_settings

关键配置：

1
OPENSTACK_HOST = "controller"
2
ALLOWED_HOSTS = ['*']
3
SESSION_ENGINE = 'django.contrib.sessions.backends.cache'
4
CACHES = {'default': {'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache', 'LOCATION': 'controller:11211'}}
5
OPENSTACK_KEYSTONE_URL = "http://%s:5000/v3" % OPENSTACK_HOST
6
OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True
7
OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = 'Default'
8
OPENSTACK_KEYSTONE_DEFAULT_ROLE = "user"

1
systemctl restart httpd memcached
2
# 访问 http://controller/dashboard

4. OpenStack Train 版手动搭建#

参考：https://blog.csdn.net/m0_37239002/article/details/131824107

Train 版与 Rocky 版搭建流程基本一致，以下仅列出差异部分。

4.1 YUM 源差异#

1
yum install centos-release-openstack-train -y
2
yum upgrade -y
3
yum install python-openstackclient -y
4
yum install openstack-selinux -y

4.2 Keystone 差异#

Train 版需手动创建 wsgi-keystone.conf 完整虚拟主机配置：

1
vi /etc/httpd/conf.d/wsgi-keystone.conf

1
Listen 5000
2
<VirtualHost *:5000>
3
    WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
4
    WSGIProcessGroup keystone-public
5
    WSGIScriptAlias / /usr/bin/keystone-wsgi-public
6
    WSGIApplicationGroup %{GLOBAL}
7
    WSGIPassAuthorization On
8
    ErrorLogFormat "%{cu}t %M"
9
    ErrorLog /var/log/httpd/keystone-error.log
10
    CustomLog /var/log/httpd/keystone-access.log combined
11

12
    <Directory /usr/bin>
13
        Require all granted
14
    </Directory>
15
</VirtualHost>

4.3 Glance 差异#

Train 版需额外配置 glance-registry.conf：

1
vi /etc/glance/glance-registry.conf

1
[database]
2
connection = mysql+pymysql://glance:密码@controller/glance
3

4
[keystone_authtoken]
5
www_authenticate_uri = http://controller:5000
6
auth_url = http://controller:5000
7
memcached_servers = controller:11211
8
auth_type = password
9
project_domain_name = Default
10
user_domain_name = Default
11
project_name = service
12
username = glance
13
password = 密码
14

15
[paste_deploy]
16
flavor = keystone

1
su -s /bin/sh -c "glance-manage db_sync" glance
2
systemctl enable openstack-glance-api openstack-glance-registry
3
systemctl start openstack-glance-api openstack-glance-registry

4.4 Nova 差异#

Train 版 Placement 使用独立数据库：

1
# 创建 Placement 数据库
2
mysql -uroot -p密码 -e "CREATE DATABASE placement;"
3
mysql -uroot -p密码 -e "GRANT ALL PRIVILEGES ON placement.* TO 'placement'@'localhost' IDENTIFIED BY '密码';"
4
mysql -uroot -p密码 -e "GRANT ALL PRIVILEGES ON placement.* TO 'placement'@'%' IDENTIFIED BY '密码';"

1
# 初始化 Placement 数据库
2
su -s /bin/sh -c "placement-manage db_sync" placement

4.5 其他组件#

其余组件（Neutron、Horizon、Cinder、Swift）配置与 Rocky 版基本一致，替换版本号即可。

5. OpenStack 基础命令速查#

5.1 Keystone 身份管理#

1
# 域
2
openstack domain create mydomain
3

4
# 项目
5
openstack project create --domain mydomain myproject
6
openstack project list
7

8
# 用户
9
openstack user create --domain mydomain --password 123 --email myuser@lab.example.com myuser
10
openstack user list
11

12
# 组
13
openstack group create --domain mydomain mygroup
14
openstack group add user mygroup myuser
15

16
# 角色
17
openstack role add --project myproject --user myuser member
18
openstack role add --project myproject --user myuser admin
19

20
# Token
21
openstack token issue
22
openstack catalog list

5.2 Glance 镜像管理#

1
# 上传镜像
2
openstack image create --disk-format qcow2 --container-format bare \
3
  --file cirros-0.3.4-x86_64-disk.img cirros-test
4

5
# 设置启动要求
6
openstack image create --container-format bare --disk-format qcow2 \
7
  --min-disk 10 --min-ram 1024 --file cirros.img cirros
8

9
# 查看/删除
10
openstack image list
11
openstack image delete 镜像名

5.3 Nova 计算管理#

1
# 实例类型
2
openstack flavor create --id auto --vcpus 4 --ram 4096 --disk 30 m1.test
3
openstack flavor list
4

5
# 创建云主机
6
openstack server create --image cirros --flavor m1.test --network ext-net test
7
openstack server list

5.4 Neutron 网络管理#

1
# 外部网络
2
openstack network create --external ext-net
3

4
# 子网
5
openstack subnet create --ip-version 4 --gateway 10.10.10.1 \
6
  --allocation-pool start=10.10.10.10,end=10.10.10.100 \
7
  --network ext-net --subnet-range 10.10.10.0/24 ext-subnet
8

9
# VLAN 网络
10
openstack network create --provider-network-type vlan \
11
  --provider-physical-network provider --provider-segment 200 network-vlan

5.5 Swift 对象存储#

1
swift post file
2
swift upload file cirros-0.3.4-x86_64-disk.img
3
swift upload -S 10000000 examcontainer cirros.img  # 分段上传（每段 10M）

5.6 Cinder 块存储#

1
openstack volume type create lvm
2
cinder type-key lvm set volume_backend_name=LVM
3
cinder create --volume-type lvm --name lvm_test 1
4

5
# 扩容
6
pvcreate /dev/vdb5
7
vgextend cinder-volumes /dev/vdb5

5.7 Manila 共享存储#

1
manila type-create default_share_type false
2
manila create NFS 2 --name share01
3
manila access-allow share01 ip 172.129.20.0/24 --access-level rw

5.8 安全组#

1
openstack security group create --description "Custom security group" group_web
2
openstack security group rule create --ingress --ethertype IPv4 --protocol tcp --dst-port 80:80 group_web
3
openstack security group rule create --ingress --ethertype IPv4 --protocol tcp --dst-port 22:22 group_web
4
openstack security group rule create --ingress --protocol icmp group_web

5.9 Heat 编排#

1
heat_template_version: 2018-08-31
2
resources:
3
  nova_flavor:
4
    type: OS::Nova::Flavor
5
    properties:
6
      name: m2.flavor
7
      disk: 20
8
      is_public: True
9
      ram: 1024
10
      vcpus: 1
11
      flavorid: 1234

1
openstack stack create -t create_flavor.yaml test

5.10 REST API 调用#

1
# 获取 Token
2
curl -i -X POST http://controller:5000/v3/auth/tokens \
3
  -H "Content-type: application/json" \
4
  -d '{"auth": {"identity": {"methods":["password"],"password": {"user": {"domain": {"name": "default"},"name": "admin","password": "000000"}}},"scope": {"project": {"domain": {"name": "default"},"name": "admin"}}}}' \
5
  | grep X-Subject-Token
6

7
# 使用 Token 查询用户
8
curl http://controller:5000/v3/users?domain_id=default \
9
  -H "X-Auth-Token: <token>" | python -m json.tool | grep name

6. OpenStack 运维案例#

6.1 NFS 作为 Glance 存储后端#

1
# NFS 服务端
2
hostnamectl set-hostname nfs-server
3
mkdir /mnt/test
4
echo "/mnt/test 10.24.200.0/24(rw,no_root_squash,no_all_squash,sync)" >> /etc/exports
5
exportfs -r
6
systemctl start rpcbind nfs
7

8
# Controller 挂载
9
mount -t nfs NFS_IP:/mnt/test /var/lib/glance/images/
10
chown glance:glance /var/lib/glance/images/

6.2 Glance 对接 Cinder 存储#

1
# glance-api.conf
2
[DEFAULT]
3
show_multiple_locations = True
4
[glance_store]
5
stores = file,http,cinder
6

7
# cinder.conf
8
[DEFAULT]
9
glance_api_version = 2
10
allowed_direct_url_schemes = cinder
11
[lvm]
12
image_upload_use_internal_tenant = True
13

14
systemctl restart openstack-glance-* openstack-cinder-*
15
openstack volume create --bootable --image cirros --size 1 cirros-cinder
16
glance location-add <imageID> --url cinder://<volumeID>

6.3 RabbitMQ 服务优化#

1
# 系统级
2
echo "fs.file-max=10240" >> /etc/sysctl.conf && sysctl -p
3

4
# 用户级
5
echo "openstack soft nofile 10240" >> /etc/security/limits.conf
6
echo "openstack hard nofile 10240" >> /etc/security/limits.conf
7

8
# 进程级
9
vi /usr/lib/systemd/system/rabbitmq-server.service
10
# [Service] 下添加 LimitNOFILE=10240
11
systemctl daemon-reload && systemctl restart rabbitmq-server

6.4 镜像压缩与转换#

1
# 压缩 qcow2
2
qemu-img convert -c -O qcow2 source.qcow2 compressed.qcow2
3

4
# qcow2 转 raw
5
qemu-img convert -f qcow2 -O raw source.qcow2 output.raw

6.5 镜像权限共享#

1
# 共享镜像给租户
2
glance member-create <image_id> <project_id>
3
glance member-update <image_id> <project_id> accepted
4

5
# 切换用户验证
6
export OS_PROJECT_NAME=deyA
7
export OS_USERNAME=userA
8
export OS_PASSWORD=123456
9
glance image-list

6.6 对接堡垒机（JumpServer）#

1
# 部署 JumpServer
2
tar -zxvf jumpserver.tar.gz -C /opt/
3
# 配置 YUM 源、安装 Docker、加载镜像
4
docker-compose up -d
5

6
# Web 界面配置
7
# 1. 资产管理 → 管理用户（root/Abc@1234）
8
# 2. 系统用户（SSH/root）
9
# 3. 资产列表（添加 controller）
10
# 4. 权限管理 → 资产授权
11
# 5. Web 终端连接

6.7 系统调优#

句柄调优：

1
ulimit -n
2
echo "* soft nofile 65535" >> /etc/security/limits.conf
3
echo "* hard nofile 65535" >> /etc/security/limits.conf
4
logout
5
ulimit -n

I/O 调度优化：

1
echo mq-deadline > /sys/block/vda/queue/scheduler
2
cat /sys/block/vda/queue/scheduler
3
# [mq-deadline] kyber none

Nova 调度策略优化：

1
vi /etc/nova/nova.conf

1
vif_plugging_is_fatal=false

1
systemctl restart openstack-nova-*

7. 私有云竞赛真题精选#

7.1 数据库调优#

1
vi /etc/my.cnf
2
lower_case_table_names = 1
3
innodb_buffer_pool_size = 4G
4
innodb_log_buffer_size = 64M
5
innodb_log_file_size = 256M
6
innodb_log_files_in_group = 2

7.2 Memcached 调优#

1
vi /etc/sysconfig/memcached
2
MAXCONN="2048"
3
CACHESIZE="512"
4
hash_algorithm=md5

7.3 Keystone 用户创建#

1
source /etc/keystone/admin-openrc.sh
2
openstack domain create 21Demo
3
openstack project create --domain 21Demo Engineering
4
openstack project create --domain 21Demo Production
5
openstack group create --domain 21Demo Devops
6
openstack user create --domain 21Demo --password 000000 --email Robert@lab.example.com Robert
7
openstack group add user Devops Robert
8
openstack role add --project Engineering --user Robert member
9
openstack role add --project Engineering --user Robert admin

7.4 Python 自动化脚本#

使用 requests 库调用 OpenStack REST API 创建镜像和用户：

1
import requests, json
2

3
# 获取 Token
4
url = f"http://{controller_ip}:5000/v3/auth/tokens"
5
body = {"auth": {"identity": {"methods": ["password"], "password": {"user": {"domain": {"name": "Default"}, "name": "admin", "password": "000000"}}}, "scope": {"project": {"domain": {"name": "Default"}, "name": "admin"}}}}
6
Token = requests.post(url, data=json.dumps(body), headers={"Content-Type": "application/json"}).headers['X-Subject-Token']
7

8
# 创建镜像
9
headers = {"X-Auth-Token": Token}
10
requests.post(f"http://{controller_ip}:9292/v2/images", data=json.dumps({"container_format": "bare", "disk_format": "qcow2", "name": "cirros001"}), headers=headers)
11

12
# 上传镜像文件
13
headers['Content-Type'] = "application/octet-stream"
14
requests.put(f"http://{controller_ip}:9292/v2/images/{image_id}/file", data=open("cirros.img", "rb").read(), headers=headers)

7.5 Heat 编排模板#

1
heat_template_version: 2018-08-31
2
resources:
3
  nova_flavor:
4
    type: OS::Nova::Flavor
5
    properties:
6
      name: m2.flavor
7
      disk: 20
8
      is_public: True
9
      ram: 1024
10
      vcpus: 1
11
      flavorid: 1234

8. Ceph 集群存储#

8.1 环境准备#

1
# 三节点：ceph-node1, ceph-node2, ceph-node3
2
hostnamectl set-hostname ceph-node1
3
fdisk /dev/vdb

1
172.128.11.15  ceph-node1
2
172.128.11.26  ceph-node2
3
172.128.11.64  ceph-node3

8.2 安装 Ceph#

1
tar -zxvf ceph-14.2.22.tar.gz -C /opt
2
mv /etc/yum.repos.d/* /media/
3

4
cat > /etc/yum.repos.d/ceph.repo << EOF
5
[ceph]
6
name=ceph
7
baseurl=file:///opt/ceph
8
gpgcheck=0
9
enabled=1
10
EOF
11

12
yum install ceph-deploy -y
13
mkdir /etc/ceph && cd /etc/ceph

8.3 初始化集群#

1
ceph-deploy new ceph-node1
2
ceph-deploy install ceph-node1 ceph-node2 ceph-node3 --no-adjust-repos
3
ceph -v
4
ceph-deploy mon create-initial
5

6
# 创建 OSD
7
ceph-deploy osd create --data /dev/vdb1 ceph-node1
8
ceph-deploy osd create --data /dev/vdb1 ceph-node2
9
ceph-deploy osd create --data /dev/vdb1 ceph-node3
10

11
# 创建 Manager
12
ceph-deploy mgr create ceph-node1 ceph-node2 ceph-node3
13

14
ceph -s
15
ceph config set mon auth_allow_insecure_global_id_reclaim false
16
ceph-deploy admin ceph-node{1,2,3}
17
chmod +r /etc/ceph/ceph.client.admin.keyring

--no-adjust-repos 参数防止系统自动安装 epel-release 源，此处全使用本地安装。

8.4 Ceph 运维命令#

1
ceph status                          # 检查安装状态
2
ceph w                               # 观察健康状况
3
ceph quorum_status --format json-pretty  # 检查 Monitor 仲裁状态
4
ceph mon dump                        # 导出 Monitor 信息
5
ceph df                              # 检查使用状态
6
ceph mon stat                        # Monitor 状态
7
ceph osd stat                        # OSD 状态
8
ceph pg stat                          # PG 状态
9
ceph pg dump                          # 列表 PG
10
ceph osd lspools                      # 列表存储池
11
ceph osd tree                         # 检查 OSD 的 CRUSH
12
ceph auth list                        # 列表认证密钥

9. Redis 集群部署与优化#

9.1 一主二从部署#

三节点准备：

1
# redis1, redis2, redis3
2
hostnamectl set-hostname redis1
3

4
curl -O http://mirrors.douxuedu.com/competition/redis-3.2.12.tar.gz
5
tar -xf redis-3.2.12.tar.gz -C /opt/
6
mv /etc/yum.repos.d/* /media/
7

8
cat > /etc/yum.repos.d/redis.repo << EOF
9
[redis]
10
name=redis
11
baseurl=file:///opt/redis
12
gpgcheck=0
13
enabled=1
14
EOF
15

16
yum clean all && yum repolist
17
yum install -y redis
18
systemctl start redis && systemctl enable redis

redis1（主节点）配置：

1
vi /etc/redis.conf

1
# bind 127.0.0.1
2
protected-mode no
3
daemonize yes
4
requirepass "123456"
5
masterauth "123456"
6
appendonly yes

redis2/redis3（从节点）配置：

1
# bind 127.0.0.1
2
protected-mode no
3
daemonize yes
4
requirepass "123456"
5
slaveof 主redis库ip 6379
6
masterauth "123456"
7
appendonly yes

验证集群状态：

1
redis-cli -h 192.168.200.21 -p 6379 -a 123456 info replication
2
redis-cli -h 192.168.200.22 -p 6379 -a 123456 info replication
3
redis-cli -h 192.168.200.23 -p 6379 -a 123456 info replication

9.2 哨兵模式配置#

1
vi /etc/redis-sentinel.conf

1
protected-mode no
2
sentinel monitor mymaster 主redis库ip 6379 2
3
sentinel down-after-milliseconds mymaster 5000
4
sentinel failover-timeout mymaster 15000
5
sentinel parallel-syncs mymaster 2
6
sentinel auth-pass mymaster 123456

1
systemctl restart redis-sentinel
2
systemctl enable redis-sentinel

查看哨兵信息：

1
redis-cli -h 192.168.200.21 -p 26379 INFO Sentinel
2
redis-cli -h 192.168.200.22 -p 26379 INFO Sentinel
3
redis-cli -h 192.168.200.23 -p 26379 INFO Sentinel

9.3 哨兵模式验证#

1
# 停止主节点
2
systemctl stop redis
3

4
# 在从节点查看，应自动切换为主节点
5
redis-cli -h 192.168.200.22 -p 6379 -a 123456 info replication
6
redis-cli -h 192.168.200.23 -p 6379 -a 123456 info replication
7

8
# 恢复后变为从节点
9
systemctl restart redis
10
systemctl restart redis-sentinel
11
redis-cli -h 192.168.200.21 -p 6379 -a 123456 info replication

10. 私有云组件速查表#

组件	说明
MySQL/MariaDB	关系型数据库，存储和管理数据
RabbitMQ	消息队列，异步消息处理和分布式通信
Memcached	内存缓存，提高性能、减轻数据库压力
Etcd	键值存储，共享配置和服务发现
Keystone	认证服务，身份验证和授权
Glance	镜像服务，管理虚拟机镜像
Nova	计算服务，管理虚拟机生命周期
Neutron	网络服务，虚拟网络管理
Horizon	Dashboard，Web 管理界面
Cinder	块存储，持久化存储
Swift	对象存储，非结构化数据存储
Heat	编排服务，自动化部署
Placement	资源追踪，主机资源管理
Ceph	分布式存储，提供块/文件/对象存储
Redis	内存数据库/缓存，支持主从复制和哨兵模式