OpenStack API部分高可用配置（一）

一、概况与原理

 SHAPE  \* MERGEFORMAT

1）所需要的配置组件有：pacemaker+corosync+HAProxy

2）主要原理：HAProxy作为负载均衡器，将对openstack api服务的请求分发到两个镜像的控制节点上，由于openstack api服务是无状态的服务，所以不存在数据同步的问题。具体为在pacemaker中配置一个VIP，HAProxy负责监听这个VIP，将对这个VIP的请求分发到两台控制节点上，同时HAProxy本身作为pacemaker的资源实现高可用性。另外，需在openstack中修改API服务的endpoint为VIP，同时对于服务的调用地址改为VIP。

3) 目前只配置了keystone部分，其他部分情况类似。

二、pacemaker+corosync+crmsh安装

一、前提条件

node1：

(1)各节点之间主机名互相解析

uname -n

>node1.test.com

vim /etc/hosts

>127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4

>::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

>192.168.18.201  node1.test.com  node1

>192.168.18.202  node2.test.com  node2

ping node1

ping node2

(2).各节点之间时间同步

ntpdate 210.72.145.44

(3).各节点之间ssh互信

ssh-keygen  -t rsa -f ~/.ssh/id_rsa  -P ''

ssh-copy-id -i .ssh/id_rsa.pub root@node2.test.com

node2:

(1).各节点之间主机名互相解析

uname -n

>node2.test.com

vim /etc/hosts

>127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4

>::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

>192.168.18.201  node1.test.com  node1

>192.168.18.202  node2.test.com  node2

ping node1

ping node2

(2).各节点之间时间同步

ntpdate 210.72.145.44

(3).各节点之间ssh互信

ssh-keygen  -t rsa -f ~/.ssh/id_rsa  -P ''

ssh-copy-id -i .ssh/id_rsa.pub root@node1.test.com

配置yum源(EPEL源)

node1:

wget http://download.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm

rpm -ivh epel-release-5-4.noarch.rpm

rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5

yum list

node2:

wget http://download.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm

rpm -ivh epel-release-5-4.noarch.rpm

rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5

yum list

关闭防火墙与SELinux

node1:

service iptables stop

vim /etc/selinux/config

># This file controls the state of SELinux on the system.

># SELINUX= can take one of these three values:

>#       enforcing - SELinux security policy is enforced.

>#       permissive - SELinux prints warnings instead of enforcing.

>#       disabled - SELinux is fully disabled.

>SELINUX=disabled

># SELINUXTYPE= type of policy in use. Possible values are:

>#       targeted - Only targeted network daemons are protected.

>#       strict - Full SELinux protection.

>SELINUXTYPE=targeted

node2:

service iptables stop

vim /etc/selinux/config

>SELINUX=disabled

>SELINUXTYPE=targeted

二、安装pacemaker+corosync+crmsh

node1+node2:

安装pacemaker+corosync

yum install -y corosync*

yum install -y pacemaker*

安装crmsh

1）crmsh官方网站

https://savannah.nongnu.org/forum/forum.php?forum_id=7672

2）crmsh下载地址

http://download.opensuse.org/repositories/network:/ha-clustering:/Stable/

3）安装crmsh【如果缺少依赖包再安装依赖包】

rpm -ivh crmsh-1.2.6-0.rc2.2.1.x86_64.rpm

4）验证配置：

crm

三、Corosync 详细配置

node1:

修改配置文件

vim  /etc/corosync/corosync.conf

>>>

totem {

version: 2

# Time (in ms) to wait for a token  1

token: 10000

# How many token retransmits before forming a new

# configuration

token_retransmits_before_loss_const: 10

# Turn off the virtual synchrony filter

vsftype: none

# Enable encryption  2

secauth: on

# How many threads to use for encryption/decryption

threads: 0

# This specifies the redundant ring protocol, which may be

# none, active, or passive.  3

rrp_mode: active

# The following is a two-ring multicast configuration.  4

interface {

ringnumber: 1

bindnetaddr: 10.0.42.0#心跳线网段

mcastaddr: 239.255.42.2

mcastport: 5405

}

}

amf {

mode: disabled

}

service {

# Load the Pacemaker Cluster Resource Manager  5

ver:       1

name:      pacemaker

}

aisexec {

user:   root

group:  root

}

logging {

fileline: off

to_stderr: yes

to_logfile: yes

to_syslog: yes

logfile: /var/log/cluster/corosync.log #日志位置

syslog_facility: daemon

debug: off

timestamp: on

logger_subsys {

subsys: AMF

debug: off

tags: enter|leave|trace1|trace2|trace3|trace4|trace6

}

}

>>>

生成密钥文件

注：corosync生成key文件会默认调用/dev/random随机数设备，一旦系统中断的IRQS的随机数不够用，将会产生大量的等待时间，因此，为了节约时间，我们在生成key之前讲random替换成urandom，以便节约时间。

mv /dev/{random,random.bak}

ln -s /dev/urandom /dev/random

corosync-keygen

查看生成的key文件

ll

>总用量 24

>-r-------- 1 root root  128 8月  13 14:16 authkey

>-rw-r--r-- 1 root root  521 8月  13 11:11 corosync.conf

>-rw-r--r-- 1 root root  445 5月  15 05:09 corosync.conf.example

>-rw-r--r-- 1 root root 1084 5月  15 05:09 corosync.conf.example.udpu

>drwxr-xr-x 2 root root 4096 5月  15 05:09 service.d

>drwxr-xr-x 2 root root 4096 5月  15 05:09 uidgid.d

将key文件authkey与配置文件corosync.conf复制到node2上

scp -p authkey corosync.conf node2:/etc/corosync/

检查配置

node1+node2:

corosync-cfgtool -s

启动corosync

node1+node2:

service corosync start

四、pacemaker详细配置

启动pacemaker

node1+node2:

service pacemaker start

node1 or node2:

配置集群基本属性

crm configure

>property no-quorum-policy="ignore" \ 

>  pe-warn-series-max="1000" \        

>  pe-input-series-max="1000" \

>  pe-error-series-max="1000" \

>  cluster-recheck-interval="5min"    

【具体资源的配置另当别论】