OpenStack Train 多节点生产级部署实战指南1. 环境规划与基础配置在开始部署OpenStack Train版本之前合理的环境规划至关重要。我们采用1控制节点2计算节点的架构这种配置既满足生产环境的高可用需求又保持适度的资源消耗。硬件建议配置控制节点16核CPU/32GB内存/200GB系统盘100GB数据盘计算节点根据虚拟机密度需求配置建议32核CPU/64GB内存/200GB系统盘网络拓扑设计------------------- ------------------- | 控制节点 | | 计算节点1 | | eth0:管理网络 |-----| eth0:管理网络 | | eth1:Provider网络 | | eth1:Provider网络 | ------------------- ------------------- ^ | v ------------------- | 计算节点2 | | eth0:管理网络 | | eth1:Provider网络 | -------------------关键提示生产环境中建议将管理网络与Provider网络物理隔离使用不同网卡和交换机基础服务配置步骤所有节点配置静态IP并更新主机名# 控制节点 hostnamectl set-hostname controller # 计算节点1 hostnamectl set-hostname compute1 # 计算节点2 hostnamectl set-hostname compute2统一配置/etc/hosts解析10.0.19.133 controller 10.0.19.134 compute1 10.0.19.135 compute2关闭防火墙和SELinuxsystemctl stop firewalld systemctl disable firewalld setenforce 0 sed -i s/SELINUXenforcing/SELINUXdisabled/g /etc/selinux/config2. 核心服务部署与优化2.1 时间同步服务配置多节点环境中时间同步至关重要我们采用chrony实现纳秒级时间同步控制节点配置yum install -y chrony cat /etc/chrony.conf EOF server ntp.aliyun.com iburst allow 10.0.19.0/24 local stratum 10 EOF systemctl enable --now chronyd计算节点配置yum install -y chrony cat /etc/chrony.conf EOF server controller iburst EOF systemctl enable --now chronyd验证时间同步状态# 在所有节点执行 chronyc sources -v chronyc tracking2.2 数据库与消息队列MariaDB集群配置yum install -y mariadb-server mariadb-backup cat /etc/my.cnf.d/openstack.cnf EOF [mysqld] bind-address 10.0.19.133 default-storage-engine innodb innodb_file_per_table on max_connections 4096 collation-server utf8_general_ci character-set-server utf8 EOF systemctl enable --now mariadb安全加固mysql_secure_installationRabbitMQ消息队列yum install -y rabbitmq-server systemctl enable --now rabbitmq-server rabbitmqctl add_user openstack openstack rabbitmqctl set_permissions openstack .* .* .* rabbitmq-plugins enable rabbitmq_management2.3 Memcached与Etcd# Memcached yum install -y memcached python-memcached sed -i s/OPTIONS-l 127.0.0.1,::1/OPTIONS-l 127.0.0.1,::1,controller/g /etc/sysconfig/memcached systemctl enable --now memcached # Etcd yum install -y etcd cat /etc/etcd/etcd.conf EOF [Member] ETCD_DATA_DIR/var/lib/etcd/default.etcd ETCD_LISTEN_PEER_URLShttp://10.0.19.133:2380 ETCD_LISTEN_CLIENT_URLShttp://10.0.19.133:2379 ETCD_NAMEcontroller [Clustering] ETCD_INITIAL_ADVERTISE_PEER_URLShttp://10.0.19.133:2380 ETCD_ADVERTISE_CLIENT_URLShttp://10.0.19.133:2379 ETCD_INITIAL_CLUSTERcontrollerhttp://10.0.19.133:2380 ETCD_INITIAL_CLUSTER_TOKENetcd-cluster-01 ETCD_INITIAL_CLUSTER_STATEnew EOF systemctl enable --now etcd3. 认证服务(Keystone)部署Keystone作为OpenStack的认证核心需要特别注意安全配置# 创建数据库 mysql -uroot -p -e CREATE DATABASE keystone; mysql -uroot -p -e GRANT ALL PRIVILEGES ON keystone.* TO keystonelocalhost IDENTIFIED BY Mss123456; mysql -uroot -p -e GRANT ALL PRIVILEGES ON keystone.* TO keystone% IDENTIFIED BY Mss123456; # 安装服务 yum install -y openstack-keystone httpd mod_wsgi配置/etc/keystone/keystone.conf关键参数[database] connection mysqlpymysql://keystone:Mss123456controller/keystone [token] provider fernet初始化数据库和密钥su -s /bin/sh -c keystone-manage db_sync keystone keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone keystone-manage credential_setup --keystone-user keystone --keystone-group keystone引导认证服务keystone-manage bootstrap --bootstrap-password Mss123456 \ --bootstrap-admin-url http://controller:5000/v3/ \ --bootstrap-internal-url http://controller:5000/v3/ \ --bootstrap-public-url http://controller:5000/v3/ \ --bootstrap-region-id RegionOne配置Apache服务echo ServerName controller /etc/httpd/conf/httpd.conf ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/ systemctl enable --now httpd4. 计算服务(Nova)部署4.1 控制节点配置创建Nova数据库和用户mysql -uroot -p -e CREATE DATABASE nova_api; mysql -uroot -p -e CREATE DATABASE nova; mysql -uroot -p -e CREATE DATABASE nova_cell0; mysql -uroot -p -e GRANT ALL PRIVILEGES ON nova_api.* TO novalocalhost IDENTIFIED BY Mss123456; mysql -uroot -p -e GRANT ALL PRIVILEGES ON nova.* TO novalocalhost IDENTIFIED BY Mss123456; mysql -uroot -p -e GRANT ALL PRIVILEGES ON nova_cell0.* TO novalocalhost IDENTIFIED BY Mss123456;安装服务组件yum install -y openstack-nova-api openstack-nova-conductor \ openstack-nova-novncproxy openstack-nova-scheduler关键配置/etc/nova/nova.conf[api_database] connection mysqlpymysql://nova:Mss123456controller/nova_api [database] connection mysqlpymysql://nova:Mss123456controller/nova [DEFAULT] transport_url rabbit://openstack:openstackcontroller [api] auth_strategy keystone [keystone_authtoken] www_authenticate_uri http://controller:5000/ auth_url http://controller:5000/ memcached_servers controller:11211 auth_type password project_domain_name Default user_domain_name Default project_name service username nova password Mss123456 [placement] region_name RegionOne auth_url http://controller:5000/v3 auth_type password project_domain_name Default user_domain_name Default project_name service username placement password Mss1234564.2 计算节点配置安装基础组件yum install -y openstack-nova-compute配置/etc/nova/nova.conf[DEFAULT] transport_url rabbit://openstack:openstackcontroller [compute] [keystone_authtoken] www_authenticate_uri http://controller:5000/ auth_url http://controller:5000/ memcached_servers controller:11211 auth_type password project_domain_name Default user_domain_name Default project_name service username nova password Mss123456 [vnc] enabled true server_listen 0.0.0.0 server_proxyclient_address $my_ip novncproxy_base_url http://controller:6080/vnc_auto.html检查虚拟化支持egrep -c (vmx|svm) /proc/cpuinfo # 返回0则需要配置 echo [libvirt] virt_type qemu /etc/nova/nova.conf启动服务systemctl enable --now libvirtd openstack-nova-compute5. 网络服务(Neutron)部署5.1 控制节点配置创建数据库mysql -uroot -p -e CREATE DATABASE neutron; mysql -uroot -p -e GRANT ALL PRIVILEGES ON neutron.* TO neutronlocalhost IDENTIFIED BY Mss123456; mysql -uroot -p -e GRANT ALL PRIVILEGES ON neutron.* TO neutron% IDENTIFIED BY Mss123456;安装组件yum install -y openstack-neutron openstack-neutron-ml2 \ openstack-neutron-linuxbridge ebtables配置/etc/neutron/neutron.conf[DEFAULT] core_plugin ml2 service_plugins router allow_overlapping_ips true transport_url rabbit://openstack:openstackcontroller auth_strategy keystone [keystone_authtoken] www_authenticate_uri http://controller:5000 auth_url http://controller:5000 memcached_servers controller:11211 auth_type password project_domain_name default user_domain_name default project_name service username neutron password Mss123456配置ML2插件/etc/neutron/plugins/ml2/ml2_conf.ini[ml2] type_drivers flat,vlan,vxlan tenant_network_types vxlan mechanism_drivers linuxbridge,l2population extension_drivers port_security [ml2_type_flat] flat_networks provider [ml2_type_vxlan] vni_ranges 1:1000 [securitygroup] enable_ipset true6. 部署验证与排错6.1 服务健康检查创建检查脚本/root/check_openstack.sh#!/bin/bash services( nova-api nova-scheduler nova-conductor nova-compute neutron-server neutron-linuxbridge-agent neutron-dhcp-agent neutron-metadata-agent keystone glance-api ) for service in ${services[]}; do status$(systemctl is-active $service) if [ $status ! active ]; then echo [ERROR] $service is $status journalctl -u $service -n 30 --no-pager else echo [OK] $service is running fi done # 检查端点 openstack endpoint list6.2 常见问题解决问题1计算节点无法注册# 在控制节点执行 nova-manage cell_v2 discover_hosts --verbose问题2网络服务异常# 检查OVS状态 ovs-vsctl show # 检查网络命名空间 ip netns list问题3镜像上传失败# 检查存储权限 chown glance:glance /var/lib/glance/images/ # 检查Quota设置 openstack quota show7. 生产环境优化建议数据库优化配置MariaDB Galera集群调整innodb_buffer_pool_size为物理内存的70%消息队列优化rabbitmqctl set_policy HA-all ^ {ha-mode:all}网络性能优化启用巨帧(Jumbo Frame)配置SR-IOV或DPDK加速监控方案使用PrometheusGranfana监控集群配置告警规则关键指标- alert: HighCPUUsage expr: 100 - (avg by(instance)(irate(node_cpu_seconds_total{modeidle}[5m])) * 100) 80 for: 10m通过以上步骤我们完成了OpenStack Train版本的三节点生产级部署。实际运维中建议定期执行备份操作并建立完善的监控告警体系。
