首先登录controller1创建keystone数据库,并赋于远程和本地访问的权限。
mysql -u root -p
CREATE DATABASE keystone;
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'venic8888';
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'venic8888';
flush PRIVILEGES;
2台controller服务器(kxcontrolelr1 kxcontroller2) 安装其它无状态服务的组件,
yum install openstack-keystone httpd mod_wsgi memcached python-memcached -y
先开启memcache
systemctl enable memcached.service
systemctl start memcached.service
controller1上
vi /etc/keystone/keystone.conf
[DEFAULT]
admin_token = venicchina
verbose = True
[database]
connection = mysql://keystone:venic8888@controller/keystone
[memcache]
servers = controller1:11211
[token]
provider = uuid
driver = memcache
expiration = 86400
caching = true
cache_time = 86400
[revoke]
driver = sql
expiration_buffer = 86400
caching = true
cache_time = 86400
[catalog]
driver = keystone.catalog.backends.sql.Catalog
[identity]
driver = keystone.identity.backends.sql.Identity
controller2上
vi /etc/keystone/keystone.conf
[DEFAULT]
admin_token = venicchina
verbose = True
[database]
connection = mysql://keystone:venic8888@controller/keystone
[memcache]
servers = controller2:11211
[token]
provider = uuid
driver = memcache
expiration = 86400
caching = true
cache_time = 86400
[revoke]
driver = sql
expiration_buffer = 86400
caching = true
cache_time = 86400
[catalog]
driver = keystone.catalog.backends.sql.Catalog
[identity]
driver = keystone.identity.backends.sql.Identity
以上的每个配置中两组黄色底86400的是给token定义失效时间,默认30分钟或1小时,因为有时迁移一些很大的实例时,迁移大200G的时候,时间会超过,到时会有token报错,到时实例就废掉了。加大时长是必须,这里我定义1天超时
在其中一台kxcontroller1同步数据库,生成表单
su -s /bin/sh -c "keystone-manage db_sync" keystone
---------------------------------------
修改httpd配置
controller1上
vi /etc/httpd/conf/httpd.conf
ServerName controller1
改
Listen 80 这一条为以下行:
Listen 10.40.42.1:80#与VIP监听的IP不同
controller2上
vi /etc/httpd/conf/httpd.conf
ServerName controller2
改
Listen 80 这一条为以下行:
Listen 10.40.42.2:80#与VIP监听的IP不同
------------------------------------------
controller1上
vi /etc/httpd/conf.d/wsgi-keystone.conf
Listen 10.40.42.1:5000
Listen 10.40.42.1:35357
<VirtualHost *:5000>
WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-public
WSGIScriptAlias / /usr/bin/keystone-wsgi-public
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
<IfVersion >= 2.4>
ErrorLogFormat "%{cu}t %M"
</IfVersion>
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
Allow from all
</IfVersion>
</Directory>
</VirtualHost>
<VirtualHost *:35357>
WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-admin
WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
<IfVersion >= 2.4>
ErrorLogFormat "%{cu}t %M"
</IfVersion>
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
Allow from all
</IfVersion>
</Directory>
</VirtualHost>
controller2上
vi /etc/httpd/conf.d/wsgi-keystone.conf
Listen 10.40.42.2:5000
Listen 10.40.42.2:35357
<VirtualHost *:5000>
WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-public
WSGIScriptAlias / /usr/bin/keystone-wsgi-public
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
<IfVersion >= 2.4>
ErrorLogFormat "%{cu}t %M"
</IfVersion>
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
Allow from all
</IfVersion>
</Directory>
</VirtualHost>
<VirtualHost *:35357>
WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-admin
WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
<IfVersion >= 2.4>
ErrorLogFormat "%{cu}t %M"
</IfVersion>
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
Allow from all
</IfVersion>
</Directory>
</VirtualHost>
2台controller服务启动,加入开机自启
# systemctl enable httpd.service
# systemctl start httpd.service
验证:在haproxy的页面http://10.40.42.10:8888/stats上查看80 5000 35357端口状态转发是否成功
- openstack私有云布署实践【12.2 网络Neutron-controller节点配置(办公网环境)】
网络这一块推荐使用的是 Neutron--LinuxBirdge的Ha高可用,此高可用方案对Public作用不是很大,Public只用到DHCP,而Private则会用到L3 Agent,则此方案是有 ...
- openstack私有云布署实践【12.1 网络Neutron-controller节点配置(科兴环境)】
网络这一块推荐使用的是 Neutron--LinuxBirdge的Ha高可用,此高可用方案对Public作用不是很大,Public只用到DHCP,而Private则会用到L3 Agent,则此方案是有 ...
- openstack私有云布署实践【0 前言】
管理控制层面示图: 其实在修改这个布署文档是,我发现当时生产中的布署已经严重偏离了openstack高可用的指导思想.我们自己实践的高可用其实是适应自己的架构而做的调整,因为我们现实手头上中没有比较符 ...
- openstack私有云布署实践【15 创建租户网络+实例】
这里以办公网测试环境为例, (一)创建租户demo的网络 使用admin用户 source admin-openrc.sh 创建public公网 neutron net-create 1040 ...
- openstack私有云布署实践【9.3 主从controller单向同步glance-image目录】
采用Rysnc单向同步,而不用双方实时同步,原因是在历史的运行过程中,我们发现,有些镜像包太大,当在主用的glance将镜像保存时,并不是一时半会就把镜像保存好,当主用在保存时,备用节点又在实时同步那 ...
- openstack私有云布署实践【14.2 登录页dashboard-controller(办公网环境)】
这一小节基本配置相同,但留意以下紫色部份的配置,当初为了管理方便,我们让办公网openstack的dashboard的登录桥接了科兴的dashboard,由此统一dashboard界面的登录地址 ...
- openstack私有云布署实践【2 安装前的服务器基本环境准备】
服务器物理机都安装centos7.2 1511版本 , 此次采用的分区方式全是自动XFS格式LVM,在装系统时就将所有本地raid5硬盘都加入LVM全用了.默认/home目录有着最大的硬盘空间 并且我 ...
- openstack私有云布署实践【1 网络拓扑说明】
图1说明:办公网的openstack使用2台交换机,10.40.40.2是24口 10.40.40.6是48口,管理网段接10.40.40.2VLAN1002 虚拟机的public网段接 ...
- openstack私有云布署实践【16.3 Windows Server2008 R2 只有C盘分区镜像制作】
之所以要只有C盘分区镜像,是因为在创建VM或者调整云主机的硬盘大小时,它能自动扩容.无需人工介入 参考http://www.iyunv.com/thread-45149-1-1.html的灵感 ...
- openstack私有云布署实践【11.3 计算nova - compute节点-nova用户免密登录(用于云主机冷迁移+扩展云主机大小)】
云主机迁移+扩展云主机大小 ,官方说它依赖nova用户之间的免密登录.确保每个resion区域的compute节点服务器他们可以相互SSH免密 compute1-7 他们相互SSH免密 k ...
随机推荐
- 使用highcharts显示mongodb中的数据
1.mongodb数据表相关 # 显示数据库 show dbs # 数据库 use ceshi # 显示表 show tables # 创建集合 db.createCollection('infoB' ...
- 《如何阅读一本书》(How to Read a Book)
值得一读的书,有深入浅出,也有并不能完全读懂的部分,以下是第11章对之前内容的总结整理. 阅读的层次 1. 基础阅读 2. 检视阅读 3. 分析阅读 4. 主题阅读 分析阅读 第一阶段:这本书在谈些什 ...
- java基础练习 4
import java.util.Scanner; public class Forth { public static void main(String[] args){ /*请输入星期几的第一个字 ...
- Matlab最新的官方文档中文翻译
文章翻译的是Matlab最新的官方文档R2016b,可能后续如果我还有时间会继续翻译,希望能够帮到大家,翻译的不好请大家不要吐槽. Matlab官方文档地址:http://cn.mathworks.c ...
- USACO 3.4 Electric Fence
Electric FenceDon Piele In this problem, `lattice points' in the plane are points with integer coord ...
- 本地存储 cookie,session,localstorage( 一)基本概念及原生API
http://www.w3school.com.cn/html5/html_5_webstorage.asp http://adamed.iteye.com/blog/1698740 localSto ...
- linux之LVS简介(转自南非的蚂蚁)
一. LVS简介LVS是Linux Virtual Server的简称,也就是Linux虚拟服务器, 是一个由章文嵩博士发起的自由软件项目,它的官方站点是www.linuxvirtualserver. ...
- Rails 执行 rails server 报错 Could not find a JavaScript runtime
gem install 'execj' gem install 'therubyrace' Ubuntu install Node.js(ubuntu) sudo apt-get install no ...
- zabbix 布署实践【1 server安装】
通过openstack环境,开通了2台只有根分区的虚拟机, 目的是为了监控公司所有的物理机,网络设备,虚拟机,总计300个台以上,推荐配置,zabbix官方文档是有给出指引的 环境:CentO ...
- sass 安装和使用
1,安装ruby :检查本地是否安装ruby: #ruby -v 2,安装sass: #gem install sass 3,检查是否安装成功:#sass -v 4,.scss文件不能直接被浏览器解析 ...