은솔이의 공부방

📘 Day 51 (2025.08.25.MON) - OpenStack 설치(2)

작업 경로: /root

OpenStack의 주요 컴포넌트:

Keystone: 계정 관리 (사용자 추가)
Glance: 이미지 관리 서비스 (서버 이미지)
Nova: Compute 서비스 (VPC = Compute)

🔑 Keystone 설치 및 설정

        CREATE DATABASE keystone;

        GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY '123456';

        GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY '123456';

        FLUSH PRIVILEGES;

        EXIT;

        sudo apt install keystone apache2 libapache2-mod-wsgi-py3 -y

        sudo nano /etc/keystone/keystone.conf

[database], [token] 설정:

        [database]

        connection = mysql+pymysql://keystone:123456@controller/keystone

        [token]

        provider = fernet

        sudo su -s /bin/sh -c "keystone-manage db_sync" keystone

        sudo keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

        sudo keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

Bootstrap:

        sudo keystone-manage bootstrap --bootstrap-password adminpassword \

        --bootstrap-admin-url http://controller:5000/v3/ \

        --bootstrap-internal-url http://controller:5000/v3/ \

        --bootstrap-public-url http://controller:5000/v3/ \

        --bootstrap-region-id RegionOne

Apache 설정 및 환경 변수 파일:

        sudo nano /etc/apache2/apache2.conf

        ServerName controller

        sudo systemctl restart apache2

        sudo systemctl enable apache2

        nano ~/admin-openrc

        export OS_USERNAME=admin

        export OS_PASSWORD=adminpassword

        export OS_PROJECT_NAME=admin

        export OS_USER_DOMAIN_NAME=Default

        export OS_PROJECT_DOMAIN_NAME=Default

        export OS_AUTH_URL=http://controller:5000/v3

        export OS_IDENTITY_API_VERSION=3

        export PS1='\u@\h \W(keystone)\$ '

        source ~/admin-openrc(keystone 빠져나가기: export PS1='\u@\h \W\$ ')

        openstack project create --domain default --description "Service Project" service

        openstack project create --domain default --description "Demo Project" demo

        openstack user create --domain default --password 123456 demo

        openstack role create user

        openstack role add --project demo --user demo user

		cp admin-openrc demo-openrc

		openstack token issue

🖼️ Glance (이미지 서비스)

        CREATE DATABASE glance;

        GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost' IDENTIFIED BY '123456';

        GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%' IDENTIFIED BY '123456';

        FLUSH PRIVILEGES;

		EXIT;

        openstack user create --domain default --password 123456 glance

        openstack role add --project service --user glance admin

        openstack service create --name glance --description "OpenStack Image" image

엔드포인트 등록:

        openstack endpoint create --region RegionOne image public http://controller:9292

        openstack endpoint create --region RegionOne image internal http://controller:9292

        openstack endpoint create --region RegionOne image admin http://controller:9292

Glance 패키지 설치:

sudo apt install glance -y

각 섹션별 내용 추가:

nano /etc/glance/glance-api.conf

[database]

#connection = sqlite:////var/lib/glance/glance.sqlite

#backend = sqlalchemy

connection = mysql+pymysql://glance:123456@controller/glance

[keystone_authtoken]

www_authenticate_uri = http://controller:5000

auth_url = http://controller:5000

memcached_servers = controller:11211

auth_type = password

project_domain_name = Default

user_domain_name = Default

project_name = service

username = glance

password = 123456

[paste_deploy]

flavor = keystone

[glance_store]

stores = file,http

default_store = file

filesystem_store_datadir = /var/lib/glance/images/

Glance DB 동기화:

sudo su -s /bin/sh -c "glance-manage db_sync" glance

sudo systemctl restart glance-api

sudo systemctl enable glance-api

source ~/admin-openrc

Glance 설정 후 테스트 이미지 업로드:

        wget http://download.cirros-cloud.net/0.6.2/cirros-0.6.2-x86_64-disk.img

        openstack image create "cirros" \

        --file cirros-0.6.2-x86_64-disk.img \

        --disk-format qcow2 --container-format bare \

        --public

이미지 업로드 확인:

openstack image list

Status=active 확인 시 Glance 정상 동작.

세부 정보 확인:

openstack image show cirros

💻 Nova (Compute 서비스)

Nova 및 Placement DB 생성 후 사용자 등록, 엔드포인트 등록, nova.conf 설정, DB 동기화 및 서비스 재시작 진행.

컨트롤러 노드에서 Nova용 DB 생성:

  CREATE DATABASE nova_api;

  CREATE DATABASE nova;

  CREATE DATABASE nova_cell0;

  GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'localhost' IDENTIFIED BY '123456';

  GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'%' IDENTIFIED BY '123456';

  GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'localhost' IDENTIFIED BY '123456';

  GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' IDENTIFIED BY '123456';

  GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'localhost' IDENTIFIED BY '123456';

  GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'%' IDENTIFIED BY '123456';

  FLUSH PRIVILEGES;

  EXIT;

Keystone에 Nova 사용자 등록 및 권한 부여:

  source ~/admin-openrc

  openstack user create --domain default --password 123456 nova

  openstack role add --project service --user nova admin

  openstack service create --name nova --description "OpenStack Compute" compute

Nova API 엔드포인트 생성:

  openstack endpoint create --region RegionOne compute public   http://controller:8774/v2.1

  openstack endpoint create --region RegionOne compute internal http://controller:8774/v2.1

  openstack endpoint create --region RegionOne compute admin    http://controller:8774/v2.1

컨트롤러 노드에서 Placement DB 생성:

  CREATE DATABASE placement;

  GRANT ALL PRIVILEGES ON placement.* TO 'placement'@'localhost' IDENTIFIED BY '123456';

  GRANT ALL PRIVILEGES ON placement.* TO 'placement'@'%' IDENTIFIED BY '123456';

  FLUSH PRIVILEGES;

  EXIT;

Placement 사용자 등록 및 서비스 생성:

  source ~/admin-openrc

  openstack user create --domain default --password 123456 placement

  openstack role add --project service --user placement admin

  openstack service create --name placement --description "Placement API" placement

Placement API 엔드포인트 생성:

  openstack endpoint create --region RegionOne placement public   http://controller:8778

  openstack endpoint create --region RegionOne placement internal http://controller:8778

  openstack endpoint create --region RegionOne placement admin    http://controller:8778

컨트롤러 노드에서 Nova & Placement 패키지 설치:

  sudo apt install nova-api nova-conductor nova-novncproxy nova-scheduler -y

  sudo apt install placement-api -y

Placement 설정 (/etc/placement/placement.conf):

  [placement_database]

  connection = mysql+pymysql://placement:123456@controller/placement

  [api]

  auth_strategy = keystone

  [keystone_authtoken]

  auth_url = http://controller:5000/v3

  memcached_servers = controller:11211

  auth_type = password

  project_domain_name = Default

  user_domain_name = Default

  project_name = service

  username = placement

  password = 123456

Placement DB 동기화 및 서비스 재시작:

  sudo su -s /bin/sh -c "placement-manage db sync" placement

  sudo systemctl restart apache2

Nova 설정 (/etc/nova/nova.conf):

  [DEFAULT]

  transport_url = rabbit://openstack:123456@controller

  my_ip = 0.0.0.0

  use_neutron = true

  firewall_driver = nova.virt.firewall.NoopFirewallDriver

  [api_database]

  connection = mysql+pymysql://nova:123456@controller/nova_api

  [database]

  connection = mysql+pymysql://nova:123456@controller/nova

  [api]

  auth_strategy = keystone

  [keystone_authtoken]

  www_authenticate_uri = http://controller:5000

  auth_url = http://controller:5000

  memcached_servers = controller:11211

  auth_type = password

  project_domain_name = Default

  user_domain_name = Default

  project_name = service

  username = nova

  password = 123456

  [vnc]

  enabled = true

  server_listen = $my_ip

  server_proxyclient_address = $my_ip

  [glance]

  api_servers = http://controller:9292

  [oslo_concurrency]

  lock_path = /var/lib/nova/tmp

  [placement]

  region_name = RegionOne

  project_domain_name = Default

  project_name = service

  auth_type = password

  user_domain_name = Default

  auth_url = http://controller:5000/v3

  username = placement

  password = 123456

        sudo su -s /bin/sh -c "nova-manage api_db sync" nova

        sudo su -s /bin/sh -c "nova-manage cell_v2 map_cell0" nova

        sudo su -s /bin/sh -c "nova-manage cell_v2 create_cell --name=cell1 --verbose" nova

        sudo su -s /bin/sh -c "nova-manage db sync" nova

등록 확인:

sudo su -s /bin/sh -c "nova-manage cell_v2 list_cells" nova

재시작:

sudo systemctl restart nova-api nova-scheduler nova-conductor nova-novncproxy
sudo systemctl enable nova-api nova-scheduler nova-conductor nova-novncproxy

📊 대시보드 (Horizon)

OpenStack Dashboard 설치 및 Memcached, Keystone URL, TimeZone 설정.

패키지 설치:

apt -y install openstack-dashboard

local_settings.py 편집:

sudo nano /etc/openstack-dashboard/local_settings.py

# line 99 : change Memcache server

CACHES = {

    'default': {

        'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',

        'LOCATION': '192.168.0.198:11211',

    },

}

# line 113 : add

SESSION_ENGINE = "django.contrib.sessions.backends.cache"

# line 126 : set Openstack Host

# line 127 : comment out and add a line to specify URL of Keystone Host

OPENSTACK_HOST = "192.168.0.198"

#OPENSTACK_KEYSTONE_URL = "http://%s/identity/v3" % OPENSTACK_HOST

OPENSTACK_KEYSTONE_URL = "https://192.168.0.198:5000/v3"

# line 131 : set your timezone

TIME_ZONE = "Asia/Tokyo"

# add to the end

OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True

OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = 'Default'

# set [True] below if you are using self signed certificate

OPENSTACK_SSL_NO_VERIFY = False

ufw disable

systemctl restart apache2 nova-api

접속 주소: http://192.168.0.198/horizon

사용자: demo / 비밀번호: 123456 / 도메인: default

📡 메시지 큐 (RabbitMQ)

        sudo apt install rabbitmq-server -y

		#OpenStack 컴포넌트들이 메시지를 주고받을 전용 사용자(openstack) 생성

        sudo rabbitmqctl add_user openstack 123456

		#계정 권한 부여 (읽기/쓰기/관리)

        sudo rabbitmqctl set_permissions openstack ".*" ".*" ".*"

		#상태 확인

        sudo rabbitmqctl list_users

		#컨트롤러 노드에 설치

sudo apt install memcached python3-memcache -y

sudo nano /etc/memcached.conf

-l : 192.168.0.198, Memcached가 바인딩할 IP 주소 (컨트롤러 노드의 내부 IP 할당)

sudo systemctl restart memcached

sudo systemctl enable memcached

🌐 Neutron (네트워크 서비스)

DB 생성 → 사용자 등록 → 엔드포인트 생성 → 패키지 설치 및 설정 후 외부 네트워크/서브넷 생성.

Neutron 데이터베이스 생성:

mysql

CREATE DATABASE neutron;

GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY '123456';

GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY '123456';

FLUSH PRIVILEGES;

EXIT;

Keystone 서비스 사용자 생성 및 권한 부여:

source admin-openrc

openstack user create --domain default --password-prompt neutron

openstack role add --project service --user neutron admin

네트워크 서비스 등록 및 API 엔드포인트 생성:

openstack service create --name neutron --description "OpenStack Networking" network

openstack endpoint create --region RegionOne network public http://controller:9696

openstack endpoint create --region RegionOne network internal http://controller:9696

openstack endpoint create --region RegionOne network admin http://controller:9696

컨트롤러 노드에서 Neutron 패키지 설치:

sudo apt install neutron-server neutron-plugin-ml2 \

  neutron-linuxbridge-agent neutron-dhcp-agent \

  neutron-metadata-agent neutron-l3-agent -y

neutron.conf DB 연결 설정:

nano /etc/neutron/neutron.conf

[database]

connection = mysql+pymysql://neutron:123456@controller/neutron

DB 업그레이드 및 서비스 상태 확인:

mysql -u root -p

SHOW DATABASES;

SELECT User, Host FROM mysql.user;

su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \

  --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

systemctl restart neutron-server

systemctl status neutron-server

ss -lnpt | grep 9696

neutron.conf Keystone 인증 설정:

nano /etc/neutron/neutron.conf

[keystone_authtoken]

www_authenticate_uri = http://controller:5000

auth_url = http://controller:5000

memcached_servers = controller:11211

auth_type = password

project_domain_name = Default

user_domain_name = Default

project_name = service

username = neutron

password = 123456

외부 네트워크 생성:

openstack network create --external \

  --provider-network-type flat \

  --provider-physical-network physnet1 \

  provider

openstack subnet create \

  --network provider \

  --allocation-pool start=192.168.0.200,end=192.168.0.250 \

  --gateway 192.168.0.1 \

  --subnet-range 192.168.0.0/24 \

  provider_SUBNET

openstack network list --external

Floating IP 발급 및 ML2 설정:

nano /etc/neutron/plugins/ml2/ml2_conf.ini

[ml2_type_flat]

flat_networks = physnet1

nano /etc/neutron/neutron.conf

[DEFAULT]

core_plugin = ml2

service_plugins = router

systemctl restart neutron-server

openstack floating ip create provider

새로운 계정 추가:

openstack project create --domain default --description "st Project" stProject

openstack user create --domain default --project stProject --password 123456 master

openstack role list

openstack role add --project stProject --user master member

neutron 사용자의 프로젝트 권한 확인:

openstack role assignment list --user neutron --project service

# 아무 결과도 안 나온다면 아래 명령으로 권한 부여

openstack role add --project service --user neutron admin

ML2 메커니즘 드라이버 및 확장 설정:

nano /etc/neutron/plugins/ml2/ml2_conf.ini

[ml2]

mechanism_drivers = openvswitch,l2population

extension_drivers = port_security,qos

인스턴스에 Floating IP 연결:

openstack server add floating ip <인스턴스ID> <FLOATING_IP>