创建 OpenStack云主机（十五）

创建过程

创建虚拟网络
创建m1.nano规格的主机（相等于定义虚拟机的硬件配置）
生成一个密钥对（openstack的原理是不使用密码连接，而是使用密钥对进行连接）
增加安全组规则（用iptables做的安全组）
启动一个实例（启动虚拟机有三种类型：1.命令CLI 2.api 3.Dashboard）实际上Dashboard也是通过api进行操作
虚拟网络分为提供者网络和私有网络，提供者网络就是跟主机在同一个网络里，私有网络自定义路由器等，跟主机不在一个网络

一.)创建网络

1.1.节点操作，创建网络

[root@controller ~]# source admin-openrc 

[root@controller ~]# neutron net-create --shared --provider:physical_network provider --provider:network_type flat public-net

Created a new network:

+---------------------------+--------------------------------------+

| Field | Value |

+---------------------------+--------------------------------------+

| admin_state_up | True |

| availability_zone_hints | |

| availability_zones | |

| created_at | 2018-04-13T12:03:41Z |

| description | |

| id | c7e2a252-775d-48e1-a748-11089994f455 |

| ipv4_address_scope | |

| ipv6_address_scope | |

| mtu | 1500 |

| name | public-net |

| port_security_enabled | True |

| project_id | 24a37179b1844e8897e77a0c44cc8d25 |

| provider:network_type | flat |

| provider:physical_network | provider |

| provider:segmentation_id | |

| revision_number | 3 |

| router:external | False |

| shared | True |

| status | ACTIVE |

| subnets | |

| tags | |

| tenant_id | 24a37179b1844e8897e77a0c44cc8d25 |

| updated_at | 2018-04-13T12:03:41Z |

+---------------------------+--------------------------------------+

上图中tenant_id 等于 project_id，查看项目列表如下图

[root@controller ~]# openstack project list

+----------------------------------+---------+

| ID | Name |

+----------------------------------+---------+

| 24a37179b1844e8897e77a0c44cc8d25 | admin |

| a1c365af1dcb4811a96d10381d3b5606 | service |

| dece6a569ea74a43a50119d04edec8c8 | demo |

+----------------------------------+---------

1.2 检查是否创建成功

[root@controller ~]# neutron net-list

+--------------------------------------+------------+---------+

| id | name | subnets |

+--------------------------------------+------------+---------+

| c7e2a252-775d-48e1-a748-11089994f455 | public-net | |

+--------------------------------------+------------+---------+

1.3 创建子网

[root@controller ~]# neutron subnet-create --name public-subnet \

> --allocation-pool start=10.0.0.100,end=10.0.0.200 \

> --dns-nameserver 233.5.5.5 --gateway 10.0.0.2 \

> public-net 10.0.0.0/24

Created a new subnet:

+-------------------+----------------------------------------------+

| Field             | Value                                        |

+-------------------+----------------------------------------------+

| allocation_pools  | {"start": "10.0.0.100", "end": "10.0.0.200"} |

| cidr              | 10.0.0.0/24                                  |

| created_at        | 2018-04-13T12:08:37Z                         |

| description       |                                              |

| dns_nameservers   | 233.5.5.5                                    |

| enable_dhcp       | True                                         |

| gateway_ip        | 10.0.0.2                                     |

| host_routes       |                                              |

| id                | 4c5d0667-f711-4eb1-a750-0ae4143976b9         |

| ip_version        | 4                                            |

| ipv6_address_mode |                                              |

| ipv6_ra_mode      |                                              |

| name              | public-subnet                                |

| network_id        | c7e2a252-775d-48e1-a748-11089994f455         |

| project_id        | 24a37179b1844e8897e77a0c44cc8d25             |

| revision_number   | 2                                            |

| service_types     |                                              |

| subnetpool_id     |                                              |

| tenant_id         | 24a37179b1844e8897e77a0c44cc8d25             |

| updated_at        | 2018-04-13T12:08:37Z                         |

+-------------------+----------------------------------------------+

　参数说明

neutron subnet-create 子网创建

--name （名称）

--allocation—pool 分配地址池

start=开始IP地址

end=结束IP地址

dns-nameserver DNS地址，233.5..5是阿里公共DNS地址

--gateway 网关

public-net 提供者的网络名称（要跟上面创建网络的名称对应起来）

1.4 检查是否关联成功

[root@controller ~]# neutron net-list

+--------------------------------------+------------+--------------------------------------------------+

| id | name | subnets |

+--------------------------------------+------------+--------------------------------------------------+

| c7e2a252-775d-48e1-a748-11089994f455 | public-net | 4c5d0667-f711-4eb1-a750-0ae4143976b9 10.0.0.0/24 |

+--------------------------------------+------------+--------------------------------------------------+

[root@controller ~]#

[root@controller ~]# neutron subnet-list

+--------------------------------------+---------------+-------------+----------------------------------------------+

| id | name | cidr | allocation_pools |

+--------------------------------------+---------------+-------------+----------------------------------------------+

| 4c5d0667-f711-4eb1-a750-0ae4143976b9 | public-subnet | 10.0.0.0/24 | {"start": "10.0.0.100", "end": "10.0.0.200"} |

+--------------------------------------+---------------+-------------+----------------------------------------------+

1.5 创建m1.nano规格的主机（自定义云主机规格）

默认的最小规格的主机需要512 MB内存。我们推荐创建只需要64 MB的m1.nano规格的主机。若单纯为了测试的目的，请使用m1.nano规格的主机来加载CirrOS镜像。

[root@controller ~]# openstack flavor create --id 0 --vcpus 1 --ram 64 --disk 1 m1.nano

+----------------------------+---------+

| Field | Value |

+----------------------------+---------+

| OS-FLV-DISABLED:disabled | False |

| OS-FLV-EXT-DATA:ephemeral | 0 |

| disk | 1 |

| id | 0 |

| name | m1.nano |

| os-flavor-access:is_public | True |

| properties | |

| ram | 64 |

| rxtx_factor | 1.0 |

| swap | |

| vcpus | 1 |

+----------------------------+---------+

参数说明：

openstack flavor create 创建主机

--id 主机ID

--vcpus cpu数量

--ram 64（默认是MB，可以写成G）

--disk 磁盘（默认单位是G）

1.6 查看创建结果

[root@controller ~]# openstack flavor list

+----+---------+-----+------+-----------+-------+-----------+

| ID | Name | RAM | Disk | Ephemeral | VCPUs | Is Public |

+----+---------+-----+------+-----------+-------+-----------+

| 0 | m1.nano | 64 | 1 | 0 | 1 | True |

+----+---------+-----+------+-----------+-------+-----------+

1.7 生成秘钥

大部分云镜像支持公共密钥认证而不是传统的密码认证。在启动实例前，必须添加一个公共密钥到计算服务。

[root@controller ~]# source admin-openrc

[root@controller ~]# ssh-keygen -q -N ""

Enter file in which to save the key (/root/.ssh/id_rsa):

1.8 将密钥放在openstack上

[root@controller ~]# openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey

+-------------+-------------------------------------------------+

| Field | Value |

+-------------+-------------------------------------------------+

| fingerprint | e7:bb:a1:e5:a1:ef:1a:e7:ea:59:b2:67:cb:4c:5f:85 |

| name | mykey |

| user_id | ff64ec1a3fa7461d890b9757401d475d |

+-------------+-------------------------------------------------+

1.9 验证公钥的添加

[root@controller ~]# openstack keypair list

+-------+-------------------------------------------------+

| Name | Fingerprint |

+-------+-------------------------------------------------+

| mykey | e7:bb:a1:e5:a1:ef:1a:e7:ea:59:b2:67:cb:4c:5f:85 |

+-------+-------------------------------------------------+

1.10 增加安全组规则
允许 ICMP (ping)

默认情况下， default安全组适用于所有实例并且包括拒绝远程访问实例的防火墙规则。对诸如CirrOS这样的Linux镜像，我们推荐至少允许ICMP (ping) 和安全shell(SSH)规则。

[root@controller ~]# openstack security group rule create --proto icmp default

+-------------------+--------------------------------------+

| Field | Value |

+-------------------+--------------------------------------+

| created_at | 2018-04-13T12:16:28Z |

| description | |

| direction | ingress |

| ethertype | IPv4 |

| headers | |

| id | f45624e2-bd78-4131-82c6-c09ccdfbe317 |

| port_range_max | None |

| port_range_min | None |

| project_id | 24a37179b1844e8897e77a0c44cc8d25 |

| project_id | 24a37179b1844e8897e77a0c44cc8d25 |

| protocol | icmp |

| remote_group_id | None |

| remote_ip_prefix | 0.0.0.0/0 |

| revision_number | 1 |

| security_group_id | b40c315f-9625-4877-a9f4-3b52b1f750d1 |

| updated_at | 2018-04-13T12:16:28Z |

+-------------------+--------------------------------------+

允许安全 shell (SSH) 的访问

openstack security group rule create --proto tcp --dst-port 22 default

1.11 查看网络的ID

[root@controller ~]# openstack network list

+--------------------------------------+------------+--------------------------------------+

| ID | Name | Subnets |

+--------------------------------------+------------+--------------------------------------+

| c7e2a252-775d-48e1-a748-11089994f455 | public-net | 4c5d0667-f711-4eb1-a750-0ae4143976b9 |

+--------------------------------------+------------+--------------------------------------+

1.12 创建一个实例

[root@controller ~]# openstack server create --flavor m1.nano --image cirros \

> --nic net-id=c7e2a252-775d-48e1-a748-11089994f455 --security-group default \

> --key-name mykey xuli-instance

+--------------------------------------+-----------------------------------------------+

| Field | Value |

+--------------------------------------+-----------------------------------------------+

| OS-DCF:diskConfig | MANUAL |

| OS-EXT-AZ:availability_zone | |

| OS-EXT-SRV-ATTR:host | None |

| OS-EXT-SRV-ATTR:hypervisor_hostname | None |

| OS-EXT-SRV-ATTR:instance_name | |

| OS-EXT-STS:power_state | NOSTATE |

| OS-EXT-STS:task_state | scheduling |

| OS-EXT-STS:vm_state | building |

| OS-SRV-USG:launched_at | None |

| OS-SRV-USG:terminated_at | None |

| accessIPv4 | |

| accessIPv6 | |

| addresses | |

| adminPass | rYP39r4N8th6 |

| config_drive | |

| created | 2018-04-13T12:19:11Z |

| flavor | m1.nano (0) |

| hostId | |

| id | d403e69a-adfc-41b6-937d-75156c080ce0 |

| image | cirros (c952e002-680e-45e1-9337-08d2c3a9abe6) |

| key_name | mykey |

| name | xuli-instance |

| os-extended-volumes:volumes_attached | [] |

| progress | 0 |

| project_id | 24a37179b1844e8897e77a0c44cc8d25 |

| properties | |

| security_groups | [{u'name': u'default'}] |

| status | BUILD |

| updated | 2018-04-13T12:19:12Z |

| user_id | ff64ec1a3fa7461d890b9757401d475d |

+--------------------------------------+-----------------------------------------------+

1.14 查看虚拟机　

[root@controller ~]# openstack server list

+--------------------------------------+------+---------+-----------------------+------------+

| ID | Name | Status | Networks | Image Name |

+--------------------------------------+------+---------+-----------------------+------------+

| b47c5250-20d7-4a05-a555-e59714a08959 | GGG | SHUTOFF | public-net=10.0.0.111 | |

| 1df453d3-c393-4277-8221-f73a1dc69709 | RRR | SHUTOFF | public-net=10.0.0.107 | |

| 3da5bba5-beae-435c-a9b6-cc774951e678 | QQQ | SHUTOFF | public-net=10.0.0.110 | |

+--------------------------------------+------+---------+-----------------------+------------+

1.15 查看虚拟机的URL地址

[root@controller ~]# openstack console url show GGG

+-------+---------------------------------------------------------------------------------+

| Field | Value |

+-------+---------------------------------------------------------------------------------+

| type | novnc |

| url | http://10.0.0.101:6080/vnc_auto.html?token=433f2e28-b480-4d35-96b2-5ac068f699e3 |

+-------+---------------------------------------------------------------------------------+

可以复制上面URL地址，在浏览器访问

1.16 异常排查

如果无法创建虚拟机，我们需要查看控制节点和计算节点所有服务的日志，同时也要查看iptables、selinux、时间同步等

grep 'ERROR' /var/log/nova/*

grep 'ERROR' /var/log/neutron/*

grep 'ERROR' /var/log/glance/*

grep 'ERROR' /var/log/keystone/*

检查

source admin-openstack.sh

nova service-list

neutron agent-list

nova image-list