CentOS Stream 9
Sponsored Link

OpenStack Dalmatian : Configure Nova #22024/10/09
 

Install OpenStack Compute Service (Nova).

This example is based on the environment like follows. 

        eth0|10.0.0.30 
+-----------+-----------+
|   [ dlp.srv.world ]   |
|     (Control Node)    |
|                       |
|  MariaDB    RabbitMQ  |
|  Memcached  Nginx     |
|  Keystone   httpd     |
|  Glance     Nova API  |
+-----------------------+
[1] Install Nova services.
# install from Dalmatian, EPEL, CRB

[root@dlp ~(keystone)]#
dnf --enablerepo=centos-openstack-dalmatian,epel,crb -y install openstack-nova openstack-placement-api
[2] Configure Nova.
[root@dlp ~(keystone)]#
mv /etc/nova/nova.conf /etc/nova/nova.conf.org

[root@dlp ~(keystone)]#
vi /etc/nova/nova.conf
# create new

[DEFAULT]
osapi_compute_listen = 127.0.0.1
osapi_compute_listen_port = 8774
metadata_listen = 127.0.0.1
metadata_listen_port = 8775
state_path = /var/lib/nova
enabled_apis = osapi_compute,metadata
log_dir = /var/log/nova
# RabbitMQ connection info
transport_url = rabbit://openstack:password@dlp.srv.world

[api]
auth_strategy = keystone

[vnc]
enabled = True
novncproxy_host = 127.0.0.1
novncproxy_port = 6080
novncproxy_base_url = https://dlp.srv.world:6080/vnc_auto.html

# Glance connection info
[glance]
api_servers = https://dlp.srv.world:9292

[oslo_concurrency]
lock_path = $state_path/tmp

# MariaDB connection info
[api_database]
connection = mysql+pymysql://nova:password@dlp.srv.world/nova_api

[database]
connection = mysql+pymysql://nova:password@dlp.srv.world/nova

# Keystone auth info
[keystone_authtoken]
www_authenticate_uri = https://dlp.srv.world:5000
auth_url = https://dlp.srv.world:5000
memcached_servers = dlp.srv.world:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = nova
password = servicepassword
# if using self-signed certs on httpd Keystone, turn to [true]
insecure = false

[placement]
auth_url = https://dlp.srv.world:5000
os_region_name = RegionOne
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = placement
password = servicepassword
# if using self-signed certs on httpd Keystone, turn to [true]
insecure = false

[wsgi]
api_paste_config = /etc/nova/api-paste.ini

[oslo_policy]
enforce_new_defaults = true
[root@dlp ~(keystone)]#
chmod 640 /etc/nova/nova.conf

[root@dlp ~(keystone)]#
chgrp nova /etc/nova/nova.conf
[root@dlp ~(keystone)]#
mv /etc/placement/placement.conf /etc/placement/placement.conf.org

[root@dlp ~(keystone)]#
vi /etc/placement/placement.conf
# create new

[DEFAULT]
debug = false

[api]
auth_strategy = keystone

[keystone_authtoken]
www_authenticate_uri = https://dlp.srv.world:5000
auth_url = https://dlp.srv.world:5000
memcached_servers = dlp.srv.world:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = placement
password = servicepassword
# if using self-signed certs on httpd Keystone, turn to [true]
insecure = false

[placement_database]
connection = mysql+pymysql://placement:password@dlp.srv.world/placement
[root@dlp ~(keystone)]#
chmod 640 /etc/placement/placement.conf

[root@dlp ~(keystone)]#
chgrp placement /etc/placement/placement.conf
[root@dlp ~(keystone)]#
vi /etc/httpd/conf.d/00-placement-api.conf 
# line 1 : change
Listen 127.0.0.1:8778

# line 15 : add
  <Directory /usr/bin>
    Require all granted
  </Directory>
</VirtualHost>
[3] If SELinux is enabled, change policy.
[root@dlp ~(keystone)]#
dnf --enablerepo=centos-openstack-dalmatian -y install openstack-selinux

[root@dlp ~(keystone)]#
semanage port -a -t http_port_t -p tcp 8778

[root@dlp ~(keystone)]#
vi novaapi.te
# create new

module novaapi 1.0;

require {
        type rpm_exec_t;
        type hostname_exec_t;
        type nova_t;
        type nova_var_lib_t;
        type iscsid_exec_t;
        type pasta_exec_t;
        type passt_exec_t;
        type lsmd_t;
        type virtlogd_t;
        type geneve_port_t;
        type mysqld_t;
        type mysqld_exec_t;
        type mysqld_safe_exec_t;
        type gpg_exec_t;
        type crontab_exec_t;
        type consolehelper_exec_t;
        type keepalived_exec_t;
        type sysctl_net_t;
        type container_runtime_exec_t;
        class dir { add_name remove_name search write };
        class file { append create getattr open read unlink };
        class lnk_file { read getattr };
        class capability dac_override;
}

#============= nova_t ==============
allow nova_t mysqld_exec_t:file getattr;
allow nova_t mysqld_safe_exec_t:file getattr;
allow nova_t gpg_exec_t:file getattr;
allow nova_t hostname_exec_t:file getattr;
allow nova_t rpm_exec_t:file getattr;
allow nova_t consolehelper_exec_t:file getattr;
allow nova_t crontab_exec_t:file getattr;
allow nova_t keepalived_exec_t:file getattr;
allow nova_t passt_exec_t:file getattr;
allow nova_t pasta_exec_t:lnk_file read;
allow nova_t container_runtime_exec_t:file getattr;
allow nova_t iscsid_exec_t:file { getattr open read };

#============= virtlogd_t ==============
allow virtlogd_t nova_var_lib_t:dir { add_name remove_name search write };
allow virtlogd_t nova_var_lib_t:file { append create getattr open unlink };
allow virtlogd_t self:capability dac_override;

#============= mysqld_t ==============
allow mysqld_t sysctl_net_t:dir search;
allow mysqld_t sysctl_net_t:file { getattr open read };

#============= lsmd_t ==============
allow lsmd_t pasta_exec_t:lnk_file getattr;
[root@dlp ~(keystone)]#
checkmodule -m -M -o novaapi.mod novaapi.te

[root@dlp ~(keystone)]#
semodule_package --outfile novaapi.pp --module novaapi.mod

[root@dlp ~(keystone)]#
semodule -i novaapi.pp

[4] If Firewalld is running, allow ports for services.
[root@dlp ~(keystone)]#
firewall-cmd --add-port={6080/tcp,6081/tcp,6082/tcp,8774/tcp,8775/tcp,8778/tcp}

success
[root@dlp ~(keystone)]#
firewall-cmd --runtime-to-permanent

success
[5] Configure Nginx for proxy settings.
[root@dlp ~(keystone)]#
vi /etc/nginx/nginx.conf
# add into the [stream] section

stream {
    upstream glance-api {
        server 127.0.0.1:9292;
    }
    server {
        listen 10.0.0.30:9292 ssl;
        proxy_pass glance-api;
    }
    upstream nova-api {
        server 127.0.0.1:8774;
    }
    server {
        listen 10.0.0.30:8774 ssl;
        proxy_pass nova-api;
    }
    upstream nova-metadata-api {
        server 127.0.0.1:8775;
    }
    server {
        listen 10.0.0.30:8775 ssl;
        proxy_pass nova-metadata-api;
    }
    upstream placement-api {
        server 127.0.0.1:8778;
    }
    server {
        listen 10.0.0.30:8778 ssl;
        proxy_pass placement-api;
    }
    upstream novncproxy {
        server 127.0.0.1:6080;
    }
    server {
        listen 10.0.0.30:6080 ssl;
        proxy_pass novncproxy;
    }
    ssl_certificate "/etc/letsencrypt/live/dlp.srv.world/fullchain.pem";
    ssl_certificate_key "/etc/letsencrypt/live/dlp.srv.world/privkey.pem";
}
[6] Add Data into Database and start Nova services.
[root@dlp ~(keystone)]#
su -s /bin/bash placement -c "placement-manage db sync"
[root@dlp ~(keystone)]#
su -s /bin/bash nova -c "nova-manage api_db sync"
[root@dlp ~(keystone)]#
su -s /bin/bash nova -c "nova-manage cell_v2 map_cell0"
[root@dlp ~(keystone)]#
su -s /bin/bash nova -c "nova-manage db sync"
[root@dlp ~(keystone)]#
su -s /bin/bash nova -c "nova-manage cell_v2 create_cell --name cell1"
[root@dlp ~(keystone)]#
systemctl restart httpd nginx

[root@dlp ~(keystone)]#
systemctl enable --now openstack-nova-api openstack-nova-conductor openstack-nova-scheduler openstack-nova-novncproxy

[root@dlp ~(keystone)]#
chown placement:placement /var/log/placement/placement-api.log

# show status

[root@dlp ~(keystone)]#
openstack compute service list 

+--------------------------------------+----------------+---------------+----------+---------+-------+----------------------------+
| ID                                   | Binary         | Host          | Zone     | Status  | State | Updated At                 |
+--------------------------------------+----------------+---------------+----------+---------+-------+----------------------------+
| de300d77-76e6-47c1-9015-ccffdfb1925c | nova-scheduler | dlp.srv.world | internal | enabled | up    | 2024-10-09T07:38:57.000000 |
| e3f6d0c7-d55e-40c7-a466-5d52502a8c5f | nova-conductor | dlp.srv.world | internal | enabled | up    | 2024-10-09T07:38:57.000000 |
+--------------------------------------+----------------+---------------+----------+---------+-------+----------------------------+
Matched Content