OpenStack Zed : Magnum 設定 (Network ノード)2022/11/11 |
|
OpenStack Container Infrastructure Management Service（Magnum）をインストールします。
当例では以下のような環境を例に Network ノードに Magnum サービス一式をインストールします。
------------+-----------------------------+-----------------------------+------------
| | |
eth0|10.0.0.30 eth0|10.0.0.50 eth0|10.0.0.51
+-----------+-----------+ +-----------+-----------+ +-----------+-----------+
| [ dlp.srv.world ] | | [ network.srv.world ] | | [ node01.srv.world ] |
| (Control Node) | | (Network Node) | | (Compute Node) |
| | | | | |
| MariaDB RabbitMQ | | Open vSwitch | | Libvirt |
| Memcached Nginx | | Neutron Server | | Nova Compute |
| Keystone httpd | | OVN-Northd | | Open vSwitch |
| Glance Nova API | | Nginx iSCSI Target | | OVN Metadata Agent |
| Cinder API | | Cinder Volume | | OVN-Controller |
| Barbican API | | Heat API/Engine | | |
| | | Magnum Services | | |
+-----------------------+ +-----------------------+ +-----------------------+
|
| [1] | Network ノードで Magnum サービス をインストールします。 |
|
[root@network ~]# dnf --enablerepo=centos-openstack-zed,epel,crb -y install openstack-magnum-api openstack-magnum-conductor python3-magnumclient
|
| [2] | Magnum の設定です。 |
|
[root@network ~]# mv /etc/magnum/magnum.conf /etc/magnum/magnum.conf.org
[root@network ~]#
vi /etc/magnum/magnum.conf # 新規作成 [DEFAULT] state_path = /var/lib/magnum log_dir = /var/log/magnum # RabbitMQ 接続情報 transport_url = rabbit://openstack:password@dlp.srv.world [api] host = 127.0.0.1 port = 9511 enabled_ssl = false [database] # MariaDB 接続情報 connection = mysql+pymysql://magnum:password@dlp.srv.world/magnum [certificates] cert_manager_type = barbican [cinder] default_docker_volume_type = lvm-magnum [cinder_client] region_name = RegionOne [magnum_client] region_name = RegionOne # Keystone 認証情報 [keystone_authtoken] www_authenticate_uri = https://dlp.srv.world:5000 auth_url = https://dlp.srv.world:5000 memcached_servers = dlp.srv.world:11211 auth_type = password auth_version = v3 project_domain_name = default user_domain_name = default project_name = service username = magnum password = servicepassword admin_user = magnum admin_password = servicepassword admin_tenant_name = service [oslo_policy] enforce_scope = false enforce_new_defaults = false policy_file = /etc/magnum/policy.json [oslo_messaging_notifications] driver = messagingv2 [trust] trustee_domain_name = magnum trustee_domain_admin_name = magnum_domain_admin trustee_domain_admin_password = servicepassword trustee_keystone_interface = public
[root@network ~]#
vi /etc/magnum/policy.json # 新規作成
{
"context_is_admin": "role:admin",
"admin_or_owner": "is_admin:True or project_id:%(project_id)s",
"admin_api": "rule:context_is_admin",
"admin_or_user": "is_admin:True or user_id:%(user_id)s",
"cluster_user": "user_id:%(trustee_user_id)s",
"deny_cluster_user": "not domain_id:%(trustee_domain_id)s",
"bay:create": "rule:deny_cluster_user",
"bay:delete": "rule:deny_cluster_user",
"bay:detail": "rule:deny_cluster_user",
"bay:get": "rule:deny_cluster_user",
"bay:get_all": "rule:deny_cluster_user",
"bay:update": "rule:deny_cluster_user",
"baymodel:create": "rule:deny_cluster_user",
"baymodel:delete": "rule:deny_cluster_user",
"baymodel:detail": "rule:deny_cluster_user",
"baymodel:get": "rule:deny_cluster_user",
"baymodel:get_all": "rule:deny_cluster_user",
"baymodel:update": "rule:deny_cluster_user",
"baymodel:publish": "rule:admin_api",
"certificate:create": "rule:admin_or_user or rule:cluster_user",
"certificate:get": "rule:admin_or_user or rule:cluster_user",
"certificate:rotate_ca": "rule:admin_or_owner",
"cluster:create": "rule:deny_cluster_user",
"cluster:delete": "rule:deny_cluster_user",
"cluster:delete_all_projects": "rule:admin_api",
"cluster:detail": "rule:deny_cluster_user",
"cluster:detail_all_projects": "rule:admin_api",
"cluster:get": "rule:deny_cluster_user",
"cluster:get_one_all_projects": "rule:admin_api",
"cluster:get_all": "rule:deny_cluster_user",
"cluster:get_all_all_projects": "rule:admin_api",
"cluster:update": "rule:deny_cluster_user",
"cluster:update_health_status": "rule:admin_or_user or rule:cluster_user",
"cluster:update_all_projects": "rule:admin_api",
"cluster:resize": "rule:deny_cluster_user",
"cluster:upgrade": "rule:deny_cluster_user",
"cluster:upgrade_all_projects": "rule:admin_api",
"clustertemplate:create": "rule:deny_cluster_user",
"clustertemplate:delete": "rule:admin_or_owner",
"clustertemplate:delete_all_projects": "rule:admin_api",
"clustertemplate:detail_all_projects": "rule:admin_api",
"clustertemplate:detail": "rule:deny_cluster_user",
"clustertemplate:get": "rule:deny_cluster_user",
"clustertemplate:get_one_all_projects": "rule:admin_api",
"clustertemplate:get_all": "rule:deny_cluster_user",
"clustertemplate:get_all_all_projects": "rule:admin_api",
"clustertemplate:update": "rule:admin_or_owner",
"clustertemplate:update_all_projects": "rule:admin_api",
"clustertemplate:publish": "rule:admin_api",
"federation:create": "rule:deny_cluster_user",
"federation:delete": "rule:deny_cluster_user",
"federation:detail": "rule:deny_cluster_user",
"federation:get": "rule:deny_cluster_user",
"federation:get_all": "rule:deny_cluster_user",
"federation:update": "rule:deny_cluster_user",
"magnum-service:get_all": "rule:admin_api",
"quota:create": "rule:admin_api",
"quota:delete": "rule:admin_api",
"quota:get": "rule:admin_or_owner",
"quota:get_all": "rule:admin_api",
"quota:update": "rule:admin_api",
"stats:get_all": "rule:admin_or_owner",
"nodegroup:get": "rule:admin_or_owner",
"nodegroup:get_all": "rule:admin_or_owner",
"nodegroup:get_all_all_projects": "rule:admin_api",
"nodegroup:get_one_all_projects": "rule:admin_api",
"nodegroup:create": "rule:admin_or_owner",
"nodegroup:delete": "rule:admin_or_owner",
"nodegroup:update": "rule:admin_or_owner"
}
chmod 640 /etc/magnum/{magnum.conf,policy.json} [root@network ~]# chgrp magnum /etc/magnum/{magnum.conf,policy.json} [root@network ~]# mkdir /var/lib/magnum/tmp [root@network ~]# chown magnum /var/lib/magnum/tmp |
| [3] | Nginx にプロキシの設定をします。 |
|
[root@network ~]#
vi /etc/nginx/nginx.conf # [stream] セクション内に追記
stream {
upstream neutron-api {
server 127.0.0.1:9696;
}
server {
listen 10.0.0.50:9696 ssl;
proxy_pass neutron-api;
}
upstream magnum-api {
server 127.0.0.1:9511;
}
server {
listen 10.0.0.50:9511 ssl;
proxy_pass magnum-api;
}
ssl_certificate "/etc/letsencrypt/live/network.srv.world/fullchain.pem";
ssl_certificate_key "/etc/letsencrypt/live/network.srv.world/privkey.pem";
}
|
| [4] | データベースにデータを追加して Magnum サービスを起動します。 |
|
[root@network ~]# su -s /bin/bash magnum -c "magnum-db-manage upgrade" [root@network ~]# systemctl enable --now openstack-magnum-api openstack-magnum-conductor [root@network ~]# systemctl restart nginx |
| [5] | Firewalld を有効にしている場合は、サービスポートの許可が必要です。 |
|
[root@network ~]# firewall-cmd --add-port=9511/tcp success [root@network ~]# firewall-cmd --runtime-to-permanent success |
| [6] | Control ノードでステータスを確認します。[up] 状態であれば OK です。 また、[magnum.conf] で設定した Magnum 用の Cinder ボリュームタイプを作成しておきます。 |
|
[root@dlp ~(keystone)]#
[root@dlp ~(keystone)]# dnf --enablerepo=centos-openstack-zed,epel,crb -y install python3-magnumclient openstack coe service list +----+------+------------------+-------+----------+-----------------+---------------------------+---------------------------+ | id | host | binary | state | disabled | disabled_reason | created_at | updated_at | +----+------+------------------+-------+----------+-----------------+---------------------------+---------------------------+ | 1 | None | magnum-conductor | up | False | None | 2022-11-11T06:10:32+00:00 | 2022-11-11T06:14:33+00:00 | +----+------+------------------+-------+----------+-----------------+---------------------------+---------------------------+[root@dlp ~(keystone)]# openstack volume type create lvm-magnum --public +-------------+--------------------------------------+ | Field | Value | +-------------+--------------------------------------+ | description | None | | id | f014c406-11a4-46ff-a210-30403fff2b0b | | is_public | True | | name | lvm-magnum | +-------------+--------------------------------------+ |
| Sponsored Link |