<1,keystone安装配置>

1,yum -y install openstack-keystone python-keystoneclient;

2,配置实用mysql存储keytone componts 配置信息

/etc/keystone/keystone.conf

connection = mysql://ruiy:321@byruiy.cc/keystone

创建数据库用户赋予合适权限;

3,Define an authorization token to use as a shared secret between the identity service and other OpenStack service
ADMIN_TOKEN=$(openssl rand -hex 10)
admin_token = $ADMIN_TOKEN

export OS_SERVICE_TOKEN=14034bb8102de15503dc
export OS_SERVICE_ENDPOINT=http://byruiy.cc:35357/v2.0

4,Keystone usees PKI tokens,Create the signing keys and certificates and restrict access to the generated data:

keystone-manage pki_setup --keystone-user keystone --keystone-group keystone

chown -R keystone:keystone /etc/keystone/ssl
chmod -R o-rwx /etc/keystone/ssl

5,OpenStack清理expired tokens

 6,Define users,tenants,roles

创建administrative用户

创建用户,角色,租户

keystone user-create --name=admin --pass=admin --email=rui.qin@egrandis.com
keystone role-create --name=admin
keystone tenant-create --name=admin --description="Admin Tenant"

链接用户角色租户

创建normal普通用户

daily non-administrative interaction with the OpenStack cloud,skip the tenant role creation step when creating there users;

当前角色有admin(super-user)和_member_(normal-user)

7,Create a service tenant:
OpenStack service also require a username,tenant,and role to access other OpenStack services.

Ruiy tips

基于2中环境变量交互访问OpenStack services components

(1,用户,租户,Auth-URL,无此API called)

export OS_USERNAME=admin
export OS_PASSWORD=321
export OS_TENANT_NAME=admin_project
export OS_AUTH_URL=http://5.10.124.181:5000/v2.0

(2,admin_token,OS_SERVICE_ENDPOINT)

export OS_SERVICE_TOKEN=14034bb8102de15503dc
export OS_SERVICE_ENDPOINT=http://byruiy.cc:35357/v2.0

或是指定OpenStack components --options

8,Define services and API endpoints

keystone service-create     Describes the service;
keystone endpoint-create  Associates API endpoints with the service;

register the identity service itself:

8.1,service-create

8.2,endpoint-create

Specify an OpenStack core components service API endpoint for identity service by using every keystone service-create returned service_ID

8.2.1,截取keystone service-id字段

8.2.2,基于OpenStack service components keystone service-id创建keystone的API endpoint

8.2.3,verify identityService installed and configured correctly

clear unset OS_SERVICE_TOKEN and OS_SERVICE_ENDPOINT environment variables

8.2.4,use regular user name-based authentication(基于此时还没使用tenant)
request a authentication token by using the admin user and the password

in response,you receive a token paired with your user ID

verifyes identity service kis running on the expected endpoint and that your user account is established with the expected credenitals

当你看到上面的截图时,你一定惊呆了!要是惊呆了,那你就傻了,上面仅仅是使用上面创建的用户基于密码,而没使用tenant,看到没

分别总结基于环境变量访问以定义的API endpoint

基于OpenStack core components python-OpenStackcorecomponentsClients --options访问API endpoint

keystone --os-username= --os-password= --os-auth-url= token-get

 8.2.5,基于tenant 获取token-get for specify tenant

request authorization on tenant

 In response,you receive a token that includes the ID of the tenant that you specified.Verifies that your user account has an explicitly defined role on the specified tenant and the tenant exists expected;

测试不使用--os-username= --os-password= --os-tenant-name= --os-auth-url= 而是使用此命令选项的环境变量

或是--os-service-token= --os-service-endpoint=

<二,安装配置OpenStackClient客户端>

OpenStack Client客户端是干啥的?是用来执行CLI called OpenStack core components Services API;

Ruiy Tips:Internally,each OpenStack core components Service client CLI runs cURL commands that embed API requests;

OpenStack APIs are RESTful APIs that use the HTTP protocol,including methods,URIs,media types,and response codes;
URI,URL区别见
http://baike.baidu.com/view/160675.htm?fr=aladdin
Each Openstack service has its own command-line client;

Openstack services   and    clients:

Block Storage　　  cinder     python-cinderclient   create and manage volumes
Compute  　　       nova      python-novaclient     create and manage images,instances,and flavors

Database service   trove      python-troveclient     create and manage databases

image service        glance     python-glanceclient   create and manage images

identity   　　　　  keystone python-keystoneclient create and manage users,tenants,roles,endpoints,and credentials

Networking   　　  neutron   python-neutronclient   configure network for guest servers

Object Storage     swift        python-swiftclient       gather statistics,list items,update metadata,and upload,download,and delete files stored by the object storage service,gain access to an object storage installation for ad hoc processing

orchestration       heat        python-heatclient       launch stacks from templates,view details of running stacks including events and resources,and update and delete stacks

telemetry            ceilometer  python-ceilometerclient    create and collect measurements across openstack

prerequisite softwares for openstack core components services clients

setuptools是 Python Enterprise Application Kit（PEAK）的一个副项目，它 是一组Python的 distutilsde工具的增强工具

pip(python package index) CLC

easy_install pip
    from setuptools package

pip install python-PROJECTclient (latest version)

pip enables you to update or remove a packages

upgrade or remove clients
pip install --upgrade python-PROJECTclient
pip uninstall python-PROJECTclient

<三,安装配置image 镜像服务>

OpenStack VMIs image service overview

 

 snapshots for back up and as templates to launch new servers

can store registered
images in Object Storage or in other locations or simple fileSystem

verify image service Succ installed

下载测试镜像

http://cdn.download.cirros-cloud.net/0.3.2/cirros-0.3.2-x86_64-disk.img

upload registry img to image service;

online regtry img resources

Ruiy Tips,OpenStack Services Core components image Service(glance)项目下的组件

glance-api
glance-registry

<四,安装配置compute service Inc Compute control service and compute Nodes>

1,compute control service

Ruiy Rips:

every OpenStack core Componets Service 都需要创建一个keystone user,为其指定service tenant,admin role

注册此组件服务,并关联足迹API endpoints

Ubuntu OpenStack compute control service 服务控制

测试compute controll service -->nova 配置Ok!

基于CLIlaunch virtual machine 前提是获取相关image-id,flavor-id

2,compute Nodes

 无网络实例化VMI,always spawning

<五,add a Network services (Nrutron,legacy networking)>

关于云计算安全组(security group)概念:
安全组概念属于云网络范畴,Security groups enable adminstrators to defined firewall rules in groups,a VM can blong to one or more security group,and Networking applies the rules in those security groups to block or unblock,port ranges,or traffic types for that VM

Ruiy Tips:一般命令行的参数Arguments及options选项区别

Arguments(通常no --)

Options(通常加--)

调节内核参数,启用内核网络(kernel networking)功能

dmks(动态内核模块支持(Dynamic Kernel Module Support))

generic routing encapsulation(通用路由封装)

Generic Receive Offload (GRO)

Tunneling protocols such as generic routing encapsulation (GRE) include additional
packet headers that increase overhead and decrease space available for the payload or
user data

many network devices lack support for jumbo frames (Mellanox)

基于单网卡(eg,eth0)配置多ip

ifconfig eth0:1 192.168.1.159 netmask 255.255.255.0;

create a router and attach your tenant and external networks to it;

在配置OpenStack网络后启动虚机必须指定网络

基于nova boot --image --flavor --nic net-id= --security-group --key-name New-Instance-You-want-like-to-name初始化创建OpenStack虚机实例VMI VMs;

获取与本机ESTABLISH的外网ip

OpenStack基于CLI删除VMI,VMs;