OpenStack架构及维护管理实战指南

OpenStack概述

什么是OpenStack

OpenStack是一个开源的云计算平台，用于构建和管理私有云和混合云基础设施：

OpenStack特性:
  开源性质: Apache 2.0许可证
  模块化设计: 松耦合的服务组件
  厂商中立: 不依赖特定硬件或软件
  扩展性强: 支持大规模横向扩展
  API兼容: 提供RESTful API接口
  社区活跃: 全球开发者社区支持

OpenStack发行版本

# 查看OpenStack版本历史
OpenStack主要版本:
  Austin (2010.1)     - 首个版本
  Bexar (2011.1)      - 增加Swift对象存储
  Cactus (2011.2)     - 增加Glance镜像服务
  Diablo (2011.3)     - 增加Dashboard
  Essex (2012.1)      - 企业级功能增强
  Folsom (2012.2)     - 网络服务重构
  Grizzly (2013.1)    - 增加Ceilometer
  Havana (2013.2)     - 增加Heat编排
  Icehouse (2014.1)   - 长期支持版本
  Juno (2014.2)       - 大数据集成
  Kilo (2015.1)       - 容器支持
  Liberty (2015.2)    - 微服务架构
  Mitaka (2016.1)     - 企业功能增强
  Newton (2016.2)     - 性能优化
  Ocata (2017.1)      - 容器集成
  Pike (2017.2)       - 边缘计算
  Queens (2018.1)     - 裸机服务增强
  Rocky (2018.2)      - 多区域支持
  Stein (2019.1)      - 5G网络功能
  Train (2019.2)      - 边缘计算增强
  Ussuri (2020.1)     - Python 3支持
  Victoria (2020.2)   - 安全增强
  Wallaby (2021.1)    - 云原生支持
  Xena (2021.2)       - 混合云功能
  Yoga (2022.1)       - 可观测性增强
  Zed (2022.2)        - 最新稳定版本

核心组件架构

OpenStack核心服务

{
  "计算服务": {
    "Nova": "计算资源管理",
    "描述": "虚拟机生命周期管理",
    "端口": "8774"
  },
  "网络服务": {
    "Neutron": "网络即服务",
    "描述": "软件定义网络",
    "端口": "9696"
  },
  "存储服务": {
    "Cinder": "块存储服务",
    "Swift": "对象存储服务",
    "描述": "持久化存储解决方案",
    "端口": "8776/8080"
  },
  "镜像服务": {
    "Glance": "镜像管理服务",
    "描述": "虚拟机镜像存储和检索",
    "端口": "9292"
  },
  "身份服务": {
    "Keystone": "身份认证服务",
    "描述": "统一认证和授权",
    "端口": "5000"
  },
  "Web界面": {
    "Horizon": "Web管理界面",
    "描述": "基于Django的管理控制台",
    "端口": "80/443"
  }
}

OpenStack架构设计

逻辑架构

三层架构模型

OpenStack架构层次:
  控制层(Control Plane):
    - 组件: Keystone, Glance, Nova API, Neutron Server
    - 功能: API服务、认证授权、资源调度
    - 部署: 控制节点集群

  计算层(Compute Plane):
    - 组件: Nova Compute, Neutron Agent
    - 功能: 虚拟机运行、网络代理
    - 部署: 计算节点

  存储层(Storage Plane):
    - 组件: Cinder Volume, Swift Storage
    - 功能: 块存储、对象存储
    - 部署: 存储节点

物理架构设计

# 典型的OpenStack物理架构
生产环境节点规划:
  控制节点 (3台):
    - CPU: 16核+
    - 内存: 64GB+
    - 存储: SSD 500GB+
    - 网络: 双10G网卡
    - 作用: API服务、数据库、消息队列

  计算节点 (N台):
    - CPU: 32核+
    - 内存: 128GB+
    - 存储: SSD 200GB (系统) + 本地存储
    - 网络: 双10G网卡
    - 作用: 运行虚拟机

  存储节点 (3台+):
    - CPU: 8核+
    - 内存: 32GB+
    - 存储: 多块大容量硬盘
    - 网络: 双10G网卡
    - 作用: 提供块存储和对象存储

  网络节点 (2台):
    - CPU: 8核+
    - 内存: 16GB+
    - 存储: SSD 200GB
    - 网络: 多张网卡
    - 作用: 网络服务、路由、负载均衡

网络架构设计

网络平面规划

# OpenStack网络平面设计
网络架构:
  管理网络 (Management):
    - VLAN: 100
    - 网段: 10.0.100.0/24
    - 用途: 组件间API通信

  隧道网络 (Tunnel):
    - VLAN: 200
    - 网段: 10.0.200.0/24
    - 用途: 租户网络隧道

  存储网络 (Storage):
    - VLAN: 300
    - 网段: 10.0.300.0/24
    - 用途: 存储流量隔离

  外部网络 (External):
    - VLAN: 400
    - 网段: 192.168.1.0/24
    - 用途: 外部网络访问

  PXE网络 (Provisioning):
    - VLAN: 500
    - 网段: 10.0.500.0/24
    - 用途: 自动化部署

OpenStack安装部署

环境准备

系统要求检查

#!/bin/bash
# OpenStack环境检查脚本

echo "=== OpenStack环境检查 ==="

# 检查操作系统
echo "操作系统信息:"
cat /etc/os-release

# 检查硬件资源
echo -e "\n硬件资源:"
echo "CPU核心数: $(nproc)"
echo "内存大小: $(free -h | grep Mem | awk '{print $2}')"
echo "磁盘空间:"
df -h | grep -v tmpfs

# 检查网络配置
echo -e "\n网络配置:"
ip addr show | grep -E "(inet|link/ether)"

# 检查虚拟化支持
echo -e "\n虚拟化支持:"
if grep -q vmx /proc/cpuinfo; then
    echo "Intel VT-x: 支持"
elif grep -q svm /proc/cpuinfo; then
    echo "AMD-V: 支持"
else
    echo "虚拟化扩展: 不支持"
fi

# 检查KVM模块
echo -e "\nKVM模块:"
lsmod | grep kvm || echo "KVM模块未加载"

# 检查网络连通性
echo -e "\n网络连通性:"
ping -c 3 8.8.8.8 && echo "外网连接: 正常" || echo "外网连接: 异常"

基础环境配置

#!/bin/bash
# OpenStack基础环境配置

# 设置主机名和hosts
hostnamectl set-hostname controller
cat >> /etc/hosts << EOF
10.0.100.11 controller
10.0.100.21 compute1
10.0.100.22 compute2
10.0.100.31 storage1
EOF

# 配置NTP时间同步
yum install -y chrony
systemctl enable chronyd
systemctl start chronyd

# 配置OpenStack软件源
yum install -y centos-release-openstack-zed
yum update -y

# 安装Python和OpenStack客户端
yum install -y python3-openstackclient
yum install -y openstack-selinux

# 配置防火墙
systemctl disable firewalld
systemctl stop firewalld
systemctl disable NetworkManager
systemctl stop NetworkManager
systemctl enable network
systemctl start network

# 禁用SELinux
setenforce 0
sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

数据库和消息队列部署

MariaDB数据库配置

#!/bin/bash
# MariaDB数据库部署配置

# 安装MariaDB
yum install -y mariadb mariadb-server python3-PyMySQL

# 配置MariaDB
cat > /etc/my.cnf.d/openstack.cnf << EOF
[mysqld]
bind-address = 10.0.100.11
default-storage-engine = innodb
innodb_file_per_table = on
max_connections = 4096
collation-server = utf8_general_ci
character-set-server = utf8
EOF

# 启动并启用MariaDB
systemctl enable mariadb.service
systemctl start mariadb.service

# 安全配置
mysql_secure_installation

# 创建数据库
mysql -u root -p << EOF
CREATE DATABASE keystone;
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'KEYSTONE_DBPASS';
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'KEYSTONE_DBPASS';

CREATE DATABASE glance;
GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost' IDENTIFIED BY 'GLANCE_DBPASS';
GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%' IDENTIFIED BY 'GLANCE_DBPASS';

CREATE DATABASE nova_api;
CREATE DATABASE nova;
CREATE DATABASE nova_cell0;
GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'localhost' IDENTIFIED BY 'NOVA_DBPASS';
GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'%' IDENTIFIED BY 'NOVA_DBPASS';
GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'localhost' IDENTIFIED BY 'NOVA_DBPASS';
GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' IDENTIFIED BY 'NOVA_DBPASS';
GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'localhost' IDENTIFIED BY 'NOVA_DBPASS';
GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'%' IDENTIFIED BY 'NOVA_DBPASS';

CREATE DATABASE neutron;
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'NEUTRON_DBPASS';
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'NEUTRON_DBPASS';

CREATE DATABASE cinder;
GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'localhost' IDENTIFIED BY 'CINDER_DBPASS';
GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'%' IDENTIFIED BY 'CINDER_DBPASS';

FLUSH PRIVILEGES;
EOF

RabbitMQ消息队列配置

#!/bin/bash
# RabbitMQ消息队列部署

# 安装RabbitMQ
yum install -y rabbitmq-server

# 启动并启用RabbitMQ
systemctl enable rabbitmq-server.service
systemctl start rabbitmq-server.service

# 添加openstack用户
rabbitmqctl add_user openstack RABBIT_PASS
rabbitmqctl set_permissions openstack ".*" ".*" ".*"

# 启用管理插件
rabbitmq-plugins enable rabbitmq_management

# 查看状态
rabbitmqctl status

Keystone身份服务部署

Keystone安装配置

#!/bin/bash
# Keystone身份服务部署

# 安装Keystone
yum install -y openstack-keystone httpd python3-mod_wsgi

# 配置Keystone
cp /etc/keystone/keystone.conf /etc/keystone/keystone.conf.bak

cat > /etc/keystone/keystone.conf << EOF
[DEFAULT]
transport_url = rabbit://openstack:RABBIT_PASS@controller:5672/

[database]
connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone

[token]
provider = fernet
EOF

# 初始化数据库
su -s /bin/sh -c "keystone-manage db_sync" keystone

# 初始化Fernet密钥
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

# Bootstrap身份服务
keystone-manage bootstrap --bootstrap-password ADMIN_PASS \
  --bootstrap-admin-url http://controller:5000/v3/ \
  --bootstrap-internal-url http://controller:5000/v3/ \
  --bootstrap-public-url http://controller:5000/v3/ \
  --bootstrap-region-id RegionOne

# 配置Apache HTTP服务器
echo "ServerName controller" >> /etc/httpd/conf/httpd.conf

# 创建软链接
ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

# 启动HTTP服务
systemctl enable httpd.service
systemctl start httpd.service

# 设置环境变量
cat > /root/admin-openrc << EOF
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=ADMIN_PASS
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
EOF

# 加载环境变量
source /root/admin-openrc

# 创建域、项目、用户和角色
openstack domain create --description "An Example Domain" example
openstack project create --domain default --description "Service Project" service
openstack project create --domain default --description "Demo Project" myproject
openstack user create --domain default --password DEMO_PASS myuser
openstack role create myrole
openstack role add --project myproject --user myuser myrole

Glance镜像服务部署

Glance安装配置

#!/bin/bash
# Glance镜像服务部署

# 创建Glance用户和服务
source /root/admin-openrc
openstack user create --domain default --password GLANCE_PASS glance
openstack role add --project service --user glance admin
openstack service create --name glance --description "OpenStack Image" image
openstack endpoint create --region RegionOne image public http://controller:9292
openstack endpoint create --region RegionOne image internal http://controller:9292
openstack endpoint create --region RegionOne image admin http://controller:9292

# 安装Glance
yum install -y openstack-glance

# 配置Glance API
cp /etc/glance/glance-api.conf /etc/glance/glance-api.conf.bak

cat > /etc/glance/glance-api.conf << EOF
[DEFAULT]
bind_host = 0.0.0.0
bind_port = 9292

[database]
connection = mysql+pymysql://glance:GLANCE_DBPASS@controller/glance

[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = glance
password = GLANCE_PASS

[paste_deploy]
flavor = keystone

[glance_store]
stores = file,http
default_store = file
filesystem_store_datadir = /var/lib/glance/images/
EOF

# 初始化数据库
su -s /bin/sh -c "glance-manage db_sync" glance

# 启动服务
systemctl enable openstack-glance-api.service
systemctl start openstack-glance-api.service

# 验证安装
source /root/admin-openrc
wget http://download.cirros-cloud.net/0.5.2/cirros-0.5.2-x86_64-disk.img

openstack image create "cirros" \
  --file cirros-0.5.2-x86_64-disk.img \
  --disk-format qcow2 --container-format bare \
  --public

openstack image list

Nova计算服务部署

Nova控制节点配置

#!/bin/bash
# Nova计算服务控制节点部署

# 创建Nova用户和服务
source /root/admin-openrc
openstack user create --domain default --password NOVA_PASS nova
openstack role add --project service --user nova admin
openstack service create --name nova --description "OpenStack Compute" compute
openstack endpoint create --region RegionOne compute public http://controller:8774/v2.1
openstack endpoint create --region RegionOne compute internal http://controller:8774/v2.1
openstack endpoint create --region RegionOne compute admin http://controller:8774/v2.1

# 安装Nova组件
yum install -y openstack-nova-api openstack-nova-conductor \
  openstack-nova-novncproxy openstack-nova-scheduler

# 配置Nova
cp /etc/nova/nova.conf /etc/nova/nova.conf.bak

cat > /etc/nova/nova.conf << EOF
[DEFAULT]
enabled_apis = osapi_compute,metadata
transport_url = rabbit://openstack:RABBIT_PASS@controller:5672/
my_ip = 10.0.100.11
use_neutron = true
firewall_driver = nova.virt.firewall.NoopFirewallDriver

[api_database]
connection = mysql+pymysql://nova:NOVA_DBPASS@controller/nova_api

[database]
connection = mysql+pymysql://nova:NOVA_DBPASS@controller/nova

[api]
auth_strategy = keystone

[keystone_authtoken]
www_authenticate_uri = http://controller:5000/
auth_url = http://controller:5000/
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = nova
password = NOVA_PASS

[vnc]
enabled = true
server_listen = \$my_ip
server_proxyclient_address = \$my_ip

[glance]
api_servers = http://controller:9292

[oslo_concurrency]
lock_path = /var/lib/nova/tmp

[placement]
region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://controller:5000/v3
username = placement
password = PLACEMENT_PASS
EOF

# 初始化数据库
su -s /bin/sh -c "nova-manage api_db sync" nova
su -s /bin/sh -c "nova-manage cell_v2 map_cell0" nova
su -s /bin/sh -c "nova-manage cell_v2 create_cell --name=cell1 --verbose" nova
su -s /bin/sh -c "nova-manage db sync" nova
su -s /bin/sh -c "nova-manage cell_v2 list_cells" nova

# 启动服务
systemctl enable \
  openstack-nova-api.service \
  openstack-nova-scheduler.service \
  openstack-nova-conductor.service \
  openstack-nova-novncproxy.service

systemctl start \
  openstack-nova-api.service \
  openstack-nova-scheduler.service \
  openstack-nova-conductor.service \
  openstack-nova-novncproxy.service

Nova计算节点配置

#!/bin/bash
# Nova计算节点部署

# 安装Nova计算组件
yum install -y openstack-nova-compute

# 配置Nova计算节点
cp /etc/nova/nova.conf /etc/nova/nova.conf.bak

cat > /etc/nova/nova.conf << EOF
[DEFAULT]
enabled_apis = osapi_compute,metadata
transport_url = rabbit://openstack:RABBIT_PASS@controller:5672/
my_ip = 10.0.100.21
use_neutron = true
firewall_driver = nova.virt.firewall.NoopFirewallDriver

[api]
auth_strategy = keystone

[keystone_authtoken]
www_authenticate_uri = http://controller:5000/
auth_url = http://controller:5000/
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = nova
password = NOVA_PASS

[vnc]
enabled = true
server_listen = 0.0.0.0
server_proxyclient_address = \$my_ip
novncproxy_base_url = http://controller:6080/vnc_auto.html

[glance]
api_servers = http://controller:9292

[oslo_concurrency]
lock_path = /var/lib/nova/tmp

[placement]
region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://controller:5000/v3
username = placement
password = PLACEMENT_PASS

[libvirt]
virt_type = kvm
EOF

# 启动服务
systemctl enable libvirtd.service openstack-nova-compute.service
systemctl start libvirtd.service openstack-nova-compute.service

# 在控制节点发现计算节点
# source /root/admin-openrc
# openstack compute service list --service nova-compute
# su -s /bin/sh -c "nova-manage cell_v2 discover_hosts --verbose" nova

网络服务Neutron部署

Neutron控制节点配置

#!/bin/bash
# Neutron网络服务控制节点部署

# 创建Neutron用户和服务
source /root/admin-openrc
openstack user create --domain default --password NEUTRON_PASS neutron
openstack role add --project service --user neutron admin
openstack service create --name neutron --description "OpenStack Networking" network
openstack endpoint create --region RegionOne network public http://controller:9696
openstack endpoint create --region RegionOne network internal http://controller:9696
openstack endpoint create --region RegionOne network admin http://controller:9696

# 安装Neutron组件
yum install -y openstack-neutron openstack-neutron-ml2 \
  openstack-neutron-linuxbridge ebtables

# 配置Neutron
cp /etc/neutron/neutron.conf /etc/neutron/neutron.conf.bak

cat > /etc/neutron/neutron.conf << EOF
[DEFAULT]
core_plugin = ml2
service_plugins = router
transport_url = rabbit://openstack:RABBIT_PASS@controller:5672/
auth_strategy = keystone
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true

[database]
connection = mysql+pymysql://neutron:NEUTRON_DBPASS@controller/neutron

[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = neutron
password = NEUTRON_PASS

[nova]
auth_url = http://controller:5000
auth_type = password
project_domain_name = Default
user_domain_name = Default
region_name = RegionOne
project_name = service
username = nova
password = NOVA_PASS

[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
EOF

# 配置ML2插件
cat > /etc/neutron/plugins/ml2/ml2_conf.ini << EOF
[ml2]
type_drivers = flat,vlan,vxlan
tenant_network_types = vxlan
mechanism_drivers = linuxbridge,l2population
extension_drivers = port_security

[ml2_type_flat]
flat_networks = provider

[ml2_type_vxlan]
vni_ranges = 1:1000

[securitygroup]
enable_ipset = true
EOF

# 配置Linux bridge代理
cat > /etc/neutron/plugins/ml2/linuxbridge_agent.ini << EOF
[linux_bridge]
physical_interface_mappings = provider:ens33

[vxlan]
enable_vxlan = true
local_ip = 10.0.100.11
l2_population = true

[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
EOF

# 配置L3代理
cat > /etc/neutron/l3_agent.ini << EOF
[DEFAULT]
interface_driver = linuxbridge
EOF

# 配置DHCP代理
cat > /etc/neutron/dhcp_agent.ini << EOF
[DEFAULT]
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true
EOF

# 初始化数据库
su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
  --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

# 重启Nova API服务
systemctl restart openstack-nova-api.service

# 启动Neutron服务
systemctl enable neutron-server.service \
  neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
  neutron-metadata-agent.service neutron-l3-agent.service

systemctl start neutron-server.service \
  neutron-linuxbridge-agent.service neutron-dhcp-agent.service \
  neutron-metadata-agent.service neutron-l3-agent.service

存储服务部署

Cinder块存储服务

#!/bin/bash
# Cinder块存储服务部署

# 创建Cinder用户和服务
source /root/admin-openrc
openstack user create --domain default --password CINDER_PASS cinder
openstack role add --project service --user cinder admin
openstack service create --name cinderv3 --description "OpenStack Block Storage" volumev3
openstack endpoint create --region RegionOne volumev3 public http://controller:8776/v3/%\(project_id\)s
openstack endpoint create --region RegionOne volumev3 internal http://controller:8776/v3/%\(project_id\)s
openstack endpoint create --region RegionOne volumev3 admin http://controller:8776/v3/%\(project_id\)s

# 安装Cinder组件
yum install -y openstack-cinder

# 配置Cinder
cp /etc/cinder/cinder.conf /etc/cinder/cinder.conf.bak

cat > /etc/cinder/cinder.conf << EOF
[DEFAULT]
transport_url = rabbit://openstack:RABBIT_PASS@controller:5672/
auth_strategy = keystone
my_ip = 10.0.100.11

[database]
connection = mysql+pymysql://cinder:CINDER_DBPASS@controller/cinder

[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = cinder
password = CINDER_PASS

[oslo_concurrency]
lock_path = /var/lib/cinder/tmp
EOF

# 初始化数据库
su -s /bin/sh -c "cinder-manage db sync" cinder

# 启动服务
systemctl enable openstack-cinder-api.service openstack-cinder-scheduler.service
systemctl start openstack-cinder-api.service openstack-cinder-scheduler.service

Swift对象存储服务

#!/bin/bash
# Swift对象存储服务部署

# 创建Swift用户和服务
source /root/admin-openrc
openstack user create --domain default --password SWIFT_PASS swift
openstack role add --project service --user swift admin
openstack service create --name swift --description "OpenStack Object Storage" object-store
openstack endpoint create --region RegionOne object-store public http://controller:8080/v1/AUTH_%\(project_id\)s
openstack endpoint create --region RegionOne object-store internal http://controller:8080/v1/AUTH_%\(project_id\)s
openstack endpoint create --region RegionOne object-store admin http://controller:8080/v1

# 安装Swift组件
yum install -y openstack-swift-proxy python3-swiftclient \
  python3-keystoneclient python3-keystonemiddleware

# 配置Swift代理服务
mkdir -p /etc/swift

cat > /etc/swift/proxy-server.conf << EOF
[DEFAULT]
bind_port = 8080
user = swift
swift_dir = /etc/swift

[pipeline:main]
pipeline = catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk ratelimit authtoken keystoneauth container-quotas account-quotas slo dlo versioned_writes proxy-logging proxy-server

[app:proxy-server]
use = egg:swift#proxy
account_autocreate = True

[filter:keystoneauth]
use = egg:swift#keystoneauth
operator_roles = admin,user

[filter:authtoken]
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_id = default
user_domain_id = default
project_name = service
username = swift
password = SWIFT_PASS
delay_auth_decision = True

[filter:cache]
use = egg:swift#memcache
memcache_servers = controller:11211
EOF

# 启动Swift代理服务
systemctl enable openstack-swift-proxy.service
systemctl start openstack-swift-proxy.service

Horizon Web界面部署

Dashboard安装配置

#!/bin/bash
# Horizon Web界面部署

# 安装Horizon
yum install -y openstack-dashboard

# 配置Horizon
cp /etc/openstack-dashboard/local_settings /etc/openstack-dashboard/local_settings.bak

cat > /etc/openstack-dashboard/local_settings << 'EOF'
import os
from django.utils.translation import gettext_lazy as _

DEBUG = False
TEMPLATE_DEBUG = DEBUG

# 应该设置为OpenStack控制器节点的IP
OPENSTACK_HOST = "controller"
OPENSTACK_KEYSTONE_URL = "http://%s:5000/v3" % OPENSTACK_HOST
OPENSTACK_KEYSTONE_DEFAULT_ROLE = "_member_"

# 禁用SSL证书检查
OPENSTACK_SSL_NO_VERIFY = True

# 启用Identity API v3
OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = "Default"
OPENSTACK_API_VERSIONS = {
    "identity": 3,
    "image": 2,
    "volume": 3,
}

# 启用多域支持
OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True

# 配置用户首选项
OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = "Default"

# 时区设置
TIME_ZONE = "Asia/Shanghai"

# Memcached配置
CACHES = {
    'default': {
        'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
        'LOCATION': 'controller:11211',
    }
}

# 会话引擎配置
SESSION_ENGINE = 'django.contrib.sessions.backends.cache'

# 安全设置
ALLOWED_HOSTS = ['*']
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
CSRF_COOKIE_SECURE = False
SESSION_COOKIE_SECURE = False

# Neutron配置
OPENSTACK_NEUTRON_NETWORK = {
    'enable_router': True,
    'enable_quotas': True,
    'enable_ipv6': True,
    'enable_distributed_router': False,
    'enable_ha_router': False,
    'enable_lb': True,
    'enable_firewall': True,
    'enable_vpn': True,
    'enable_fip_topology_check': True,
}
EOF

# 重启HTTP服务
systemctl restart httpd.service memcached.service

# 检查服务状态
systemctl status httpd.service
systemctl status memcached.service

echo "Horizon安装完成，访问 http://controller/dashboard"

监控和故障排除

系统监控脚本

#!/usr/bin/env python3
# OpenStack集群监控脚本

import os
import subprocess
import json
import psutil
from datetime import datetime

def check_openstack_services():
    """检查OpenStack服务状态"""

    services = [
        'openstack-keystone',
        'openstack-glance-api',
        'openstack-nova-api',
        'openstack-nova-scheduler',
        'openstack-nova-conductor',
        'openstack-neutron-server',
        'openstack-cinder-api',
        'openstack-cinder-scheduler',
        'httpd',
        'mariadb',
        'rabbitmq-server',
        'memcached'
    ]

    print("=== OpenStack服务状态检查 ===")

    for service in services:
        try:
            result = subprocess.run(['systemctl', 'is-active', service],
                                  capture_output=True, text=True)
            status = result.stdout.strip()
            print(f"{service}: {status}")
        except Exception as e:
            print(f"{service}: 检查失败 - {e}")

def check_system_resources():
    """检查系统资源使用情况"""

    print("\n=== 系统资源使用情况 ===")

    # CPU使用率
    cpu_percent = psutil.cpu_percent(interval=1)
    print(f"CPU使用率: {cpu_percent}%")

    # 内存使用率
    memory = psutil.virtual_memory()
    print(f"内存使用率: {memory.percent}% ({memory.used//1024//1024}MB/{memory.total//1024//1024}MB)")

    # 磁盘使用率
    disk = psutil.disk_usage('/')
    print(f"磁盘使用率: {disk.percent}% ({disk.used//1024//1024//1024}GB/{disk.total//1024//1024//1024}GB)")

    # 网络统计
    network = psutil.net_io_counters()
    print(f"网络接收: {network.bytes_recv//1024//1024}MB")
    print(f"网络发送: {network.bytes_sent//1024//1024}MB")

def check_openstack_endpoints():
    """检查OpenStack端点连通性"""

    print("\n=== OpenStack端点检查 ===")

    endpoints = {
        'keystone': 'http://controller:5000',
        'glance': 'http://controller:9292',
        'nova': 'http://controller:8774',
        'neutron': 'http://controller:9696',
        'cinder': 'http://controller:8776',
        'horizon': 'http://controller/dashboard'
    }

    for service, url in endpoints.items():
        try:
            result = subprocess.run(['curl', '-s', '-o', '/dev/null', '-w', '%{http_code}', url],
                                  capture_output=True, text=True, timeout=10)
            status_code = result.stdout.strip()
            if status_code in ['200', '300', '301', '302']:
                print(f"{service}: 正常 (HTTP {status_code})")
            else:
                print(f"{service}: 异常 (HTTP {status_code})")
        except Exception as e:
            print(f"{service}: 连接失败 - {e}")

def check_database_connections():
    """检查数据库连接"""

    print("\n=== 数据库连接检查 ===")

    databases = ['keystone', 'glance', 'nova', 'nova_api', 'neutron', 'cinder']

    for db in databases:
        try:
            cmd = f"mysql -h controller -u {db} -p{db.upper()}_DBPASS -e 'SELECT 1;' {db}"
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
            if result.returncode == 0:
                print(f"{db}: 连接正常")
            else:
                print(f"{db}: 连接失败")
        except Exception as e:
            print(f"{db}: 检查失败 - {e}")

def generate_status_report():
    """生成状态报告"""

    timestamp = datetime.now().strftime('%Y-%m-%d %H:%M:%S')

    print(f"\n=== OpenStack集群状态报告 ({timestamp}) ===")

    check_openstack_services()
    check_system_resources()
    check_openstack_endpoints()
    check_database_connections()

if __name__ == "__main__":
    generate_status_report()

日志分析工具

#!/bin/bash
# OpenStack日志分析脚本

LOG_DIR="/var/log"
TEMP_DIR="/tmp/openstack_logs"
DATE=$(date +%Y%m%d)

echo "=== OpenStack日志分析工具 ==="

# 创建临时目录
mkdir -p $TEMP_DIR

# 分析各服务日志
analyze_service_logs() {
    local service=$1
    local log_file="$LOG_DIR/$service/$service.log"

    echo "分析 $service 服务日志..."

    if [ -f "$log_file" ]; then
        # 统计错误数量
        error_count=$(grep -c "ERROR" "$log_file")
        warning_count=$(grep -c "WARNING" "$log_file")

        echo "$service - 错误: $error_count, 警告: $warning_count"

        # 提取最近的错误
        grep "ERROR" "$log_file" | tail -5 > "$TEMP_DIR/${service}_errors.log"

        # 分析常见错误模式
        grep "ERROR" "$log_file" | awk '{print $5}' | sort | uniq -c | sort -nr | head -5 > "$TEMP_DIR/${service}_error_patterns.log"
    else
        echo "$service 日志文件不存在: $log_file"
    fi
}

# 分析主要服务日志
services=("keystone" "glance" "nova" "neutron" "cinder")

for service in "${services[@]}"; do
    analyze_service_logs $service
done

# 分析Apache日志
echo "分析Apache访问日志..."
if [ -f "/var/log/httpd/access_log" ]; then
    # 统计访问最多的IP
    awk '{print $1}' /var/log/httpd/access_log | sort | uniq -c | sort -nr | head -10 > "$TEMP_DIR/top_ips.log"

    # 统计HTTP状态码
    awk '{print $9}' /var/log/httpd/access_log | sort | uniq -c | sort -nr > "$TEMP_DIR/http_status_codes.log"
fi

# 分析系统日志
echo "分析系统日志..."
if [ -f "/var/log/messages" ]; then
    grep "$(date +%b\ %d)" /var/log/messages | grep -E "(ERROR|WARN|FAIL)" > "$TEMP_DIR/system_errors.log"
fi

# 生成总结报告
echo "生成日志分析报告..."
cat > "$TEMP_DIR/log_analysis_report_$DATE.txt" << EOF
OpenStack日志分析报告
生成时间: $(date)

=== 服务错误统计 ===
EOF

for service in "${services[@]}"; do
    if [ -f "$TEMP_DIR/${service}_errors.log" ]; then
        echo "=== $service 最近错误 ===" >> "$TEMP_DIR/log_analysis_report_$DATE.txt"
        cat "$TEMP_DIR/${service}_errors.log" >> "$TEMP_DIR/log_analysis_report_$DATE.txt"
        echo "" >> "$TEMP_DIR/log_analysis_report_$DATE.txt"
    fi
done

echo "日志分析完成，报告保存在: $TEMP_DIR/log_analysis_report_$DATE.txt"

维护管理操作

集群维护脚本

#!/bin/bash
# OpenStack集群维护脚本

BACKUP_DIR="/backup/openstack"
DATE=$(date +%Y%m%d_%H%M%S)

echo "=== OpenStack集群维护工具 ==="

# 备份数据库
backup_databases() {
    echo "开始备份数据库..."

    mkdir -p "$BACKUP_DIR/mysql/$DATE"

    databases=("keystone" "glance" "nova" "nova_api" "nova_cell0" "neutron" "cinder")

    for db in "${databases[@]}"; do
        echo "备份数据库: $db"
        mysqldump -h controller -u root -p$MYSQL_ROOT_PASS $db > "$BACKUP_DIR/mysql/$DATE/${db}.sql"

        if [ $? -eq 0 ]; then
            echo "$db 备份成功"
        else
            echo "$db 备份失败"
        fi
    done

    # 压缩备份文件
    cd "$BACKUP_DIR/mysql"
    tar -czf "mysql_backup_$DATE.tar.gz" "$DATE"
    rm -rf "$DATE"

    echo "数据库备份完成: $BACKUP_DIR/mysql/mysql_backup_$DATE.tar.gz"
}

# 备份配置文件
backup_configs() {
    echo "开始备份配置文件..."

    mkdir -p "$BACKUP_DIR/configs/$DATE"

    config_dirs=(
        "/etc/keystone"
        "/etc/glance"
        "/etc/nova"
        "/etc/neutron"
        "/etc/cinder"
        "/etc/swift"
        "/etc/openstack-dashboard"
        "/etc/httpd"
        "/etc/my.cnf.d"
    )

    for dir in "${config_dirs[@]}"; do
        if [ -d "$dir" ]; then
            echo "备份配置目录: $dir"
            cp -r "$dir" "$BACKUP_DIR/configs/$DATE/"
        fi
    done

    # 压缩配置备份
    cd "$BACKUP_DIR/configs"
    tar -czf "configs_backup_$DATE.tar.gz" "$DATE"
    rm -rf "$DATE"

    echo "配置文件备份完成: $BACKUP_DIR/configs/configs_backup_$DATE.tar.gz"
}

# 清理旧日志
cleanup_logs() {
    echo "开始清理旧日志..."

    # 清理30天前的日志
    find /var/log -name "*.log" -mtime +30 -delete
    find /var/log -name "*.log.*" -mtime +30 -delete

    # 清理日志目录中的旧文件
    log_dirs=(
        "/var/log/keystone"
        "/var/log/glance"
        "/var/log/nova"
        "/var/log/neutron"
        "/var/log/cinder"
        "/var/log/httpd"
    )

    for dir in "${log_dirs[@]}"; do
        if [ -d "$dir" ]; then
            echo "清理日志目录: $dir"
            find "$dir" -type f -mtime +30 -delete
        fi
    done

    echo "日志清理完成"
}

# 更新系统包
update_system() {
    echo "开始更新系统包..."

    # 备份当前包列表
    rpm -qa > "$BACKUP_DIR/package_list_before_$DATE.txt"

    # 更新系统
    yum update -y

    # 保存更新后的包列表
    rpm -qa > "$BACKUP_DIR/package_list_after_$DATE.txt"

    echo "系统更新完成"
}

# 检查磁盘空间
check_disk_space() {
    echo "检查磁盘空间使用情况..."

    df -h | while read line; do
        usage=$(echo $line | awk '{print $5}' | sed 's/%//')
        partition=$(echo $line | awk '{print $6}')

        if [ "$usage" -gt 80 ] 2>/dev/null; then
            echo "警告: 分区 $partition 使用率达到 $usage%"
        fi
    done
}

# 重启服务
restart_services() {
    echo "重启OpenStack服务..."

    services=(
        "mariadb"
        "rabbitmq-server"
        "memcached"
        "httpd"
        "openstack-keystone"
        "openstack-glance-api"
        "openstack-nova-api"
        "openstack-nova-scheduler"
        "openstack-nova-conductor"
        "openstack-neutron-server"
        "openstack-cinder-api"
        "openstack-cinder-scheduler"
    )

    for service in "${services[@]}"; do
        echo "重启服务: $service"
        systemctl restart $service

        if [ $? -eq 0 ]; then
            echo "$service 重启成功"
        else
            echo "$service 重启失败"
        fi
    done
}

# 主菜单
show_menu() {
    echo ""
    echo "请选择维护操作:"
    echo "1. 备份数据库"
    echo "2. 备份配置文件"
    echo "3. 清理旧日志"
    echo "4. 更新系统包"
    echo "5. 检查磁盘空间"
    echo "6. 重启服务"
    echo "7. 执行全部维护操作"
    echo "0. 退出"
    echo ""
}

# 主程序
main() {
    while true; do
        show_menu
        read -p "请输入选项 [0-7]: " choice

        case $choice in
            1) backup_databases ;;
            2) backup_configs ;;
            3) cleanup_logs ;;
            4) update_system ;;
            5) check_disk_space ;;
            6) restart_services ;;
            7)
                backup_databases
                backup_configs
                cleanup_logs
                update_system
                check_disk_space
                ;;
            0) echo "退出维护工具"; exit 0 ;;
            *) echo "无效选项，请重新选择" ;;
        esac
    done
}

# 检查是否以root权限运行
if [ "$EUID" -ne 0 ]; then
    echo "请以root权限运行此脚本"
    exit 1
fi

# 创建备份目录
mkdir -p "$BACKUP_DIR"

# 运行主程序
main

性能优化脚本

#!/usr/bin/env python3
# OpenStack性能优化脚本

import subprocess
import os
import sys
import json
import configparser

class OpenStackOptimizer:
    def __init__(self):
        self.config_files = {
            'nova': '/etc/nova/nova.conf',
            'neutron': '/etc/neutron/neutron.conf',
            'keystone': '/etc/keystone/keystone.conf',
            'glance': '/etc/glance/glance-api.conf',
            'cinder': '/etc/cinder/cinder.conf'
        }

    def optimize_mysql(self):
        """优化MySQL配置"""
        print("优化MySQL配置...")

        mysql_config = """
[mysqld]
# 基本设置
bind-address = 10.0.100.11
default-storage-engine = innodb
innodb_file_per_table = on
max_connections = 4096
collation-server = utf8_general_ci
character-set-server = utf8

# 性能优化
innodb_buffer_pool_size = 2G
innodb_buffer_pool_instances = 8
innodb_log_file_size = 256M
innodb_log_buffer_size = 64M
innodb_flush_log_at_trx_commit = 2
innodb_flush_method = O_DIRECT

# 查询缓存
query_cache_type = 1
query_cache_size = 128M
query_cache_limit = 4M

# 连接设置
thread_cache_size = 50
table_open_cache = 4096
tmp_table_size = 128M
max_heap_table_size = 128M

# 二进制日志
log-bin = mysql-bin
binlog_format = ROW
expire_logs_days = 7
        """

        with open('/etc/my.cnf.d/openstack_optimized.cnf', 'w') as f:
            f.write(mysql_config)

        print("MySQL配置优化完成")

    def optimize_rabbitmq(self):
        """优化RabbitMQ配置"""
        print("优化RabbitMQ配置...")

        rabbitmq_config = """
vm_memory_high_watermark.relative = 0.6
disk_free_limit.relative = 2.0
heartbeat = 60
frame_max = 131072
channel_max = 2047
tcp_listen_options.backlog = 128
tcp_listen_options.nodelay = true
tcp_listen_options.keepalive = true
collect_statistics_interval = 30000
        """

        with open('/etc/rabbitmq/rabbitmq.conf', 'w') as f:
            f.write(rabbitmq_config)

        print("RabbitMQ配置优化完成")

    def optimize_nova(self):
        """优化Nova配置"""
        print("优化Nova配置...")

        config = configparser.ConfigParser()
        config.read(self.config_files['nova'])

        # 添加性能优化配置
        if 'DEFAULT' not in config:
            config['DEFAULT'] = {}

        config['DEFAULT']['osapi_compute_workers'] = '8'
        config['DEFAULT']['metadata_workers'] = '8'
        config['DEFAULT']['cpu_allocation_ratio'] = '2.0'
        config['DEFAULT']['ram_allocation_ratio'] = '1.5'
        config['DEFAULT']['disk_allocation_ratio'] = '1.0'

        if 'conductor' not in config:
            config['conductor'] = {}
        config['conductor']['workers'] = '8'

        if 'scheduler' not in config:
            config['scheduler'] = {}
        config['scheduler']['workers'] = '8'

        with open(self.config_files['nova'], 'w') as f:
            config.write(f)

        print("Nova配置优化完成")

    def optimize_neutron(self):
        """优化Neutron配置"""
        print("优化Neutron配置...")

        config = configparser.ConfigParser()
        config.read(self.config_files['neutron'])

        if 'DEFAULT' not in config:
            config['DEFAULT'] = {}

        config['DEFAULT']['api_workers'] = '8'
        config['DEFAULT']['rpc_workers'] = '8'

        if 'agent' not in config:
            config['agent'] = {}
        config['agent']['report_interval'] = '60'

        with open(self.config_files['neutron'], 'w') as f:
            config.write(f)

        print("Neutron配置优化完成")

    def optimize_system(self):
        """优化系统参数"""
        print("优化系统参数...")

        sysctl_config = """
# 网络优化
net.core.rmem_default = 262144
net.core.rmem_max = 16777216
net.core.wmem_default = 262144
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 65536 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.core.netdev_max_backlog = 5000
net.ipv4.tcp_window_scaling = 1

# 文件系统优化
fs.file-max = 2097152
fs.nr_open = 1048576

# 虚拟内存优化
vm.swappiness = 10
vm.dirty_ratio = 15
vm.dirty_background_ratio = 5
        """

        with open('/etc/sysctl.d/99-openstack.conf', 'w') as f:
            f.write(sysctl_config)

        # 应用sysctl配置
        subprocess.run(['sysctl', '-p', '/etc/sysctl.d/99-openstack.conf'])

        print("系统参数优化完成")

    def restart_services(self):
        """重启相关服务"""
        print("重启相关服务以应用优化配置...")

        services = [
            'mariadb',
            'rabbitmq-server',
            'openstack-nova-api',
            'openstack-nova-scheduler',
            'openstack-nova-conductor',
            'openstack-neutron-server'
        ]

        for service in services:
            try:
                subprocess.run(['systemctl', 'restart', service], check=True)
                print(f"{service} 重启成功")
            except subprocess.CalledProcessError:
                print(f"{service} 重启失败")

    def run_optimization(self):
        """运行所有优化"""
        print("开始OpenStack性能优化...")

        self.optimize_mysql()
        self.optimize_rabbitmq()
        self.optimize_nova()
        self.optimize_neutron()
        self.optimize_system()

        print("\n优化配置完成，是否重启相关服务？(y/n)")
        response = input().lower()

        if response == 'y':
            self.restart_services()

        print("OpenStack性能优化完成!")

if __name__ == "__main__":
    if os.geteuid() != 0:
        print("请以root权限运行此脚本")
        sys.exit(1)

    optimizer = OpenStackOptimizer()
    optimizer.run_optimization()

自动化部署工具

Ansible自动化部署

# openstack-deploy.yml
---
- name: Deploy OpenStack cluster
  hosts: all
  become: yes

  vars:
    openstack_release: "zed"
    mysql_root_password: ""
    rabbit_password: ""
    admin_password: ""

  tasks:
    - name: Install base packages
      yum:
        name:
          - centos-release-openstack-zed
          - python3-openstackclient
          - openstack-selinux
        state: present

    - name: Disable firewall and NetworkManager
      systemd:
        name: ""
        state: stopped
        enabled: no
      loop:
        - firewalld
        - NetworkManager

    - name: Enable network service
      systemd:
        name: network
        state: started
        enabled: yes

    - name: Configure hosts file
      lineinfile:
        path: /etc/hosts
        line: ""
      loop:
        - "10.0.100.11 controller"
        - "10.0.100.21 compute1"
        - "10.0.100.22 compute2"

- name: Deploy controller node
  hosts: controller
  become: yes

  tasks:
    - name: Install MariaDB
      yum:
        name:
          - mariadb
          - mariadb-server
          - python3-PyMySQL
        state: present

    - name: Start MariaDB
      systemd:
        name: mariadb
        state: started
        enabled: yes

    - name: Install RabbitMQ
      yum:
        name: rabbitmq-server
        state: present

    - name: Start RabbitMQ
      systemd:
        name: rabbitmq-server
        state: started
        enabled: yes

    - name: Install Keystone
      yum:
        name:
          - openstack-keystone
          - httpd
          - python3-mod_wsgi
        state: present

    - name: Install Glance
      yum:
        name: openstack-glance
        state: present

    - name: Install Nova controller
      yum:
        name:
          - openstack-nova-api
          - openstack-nova-conductor
          - openstack-nova-novncproxy
          - openstack-nova-scheduler
        state: present

    - name: Install Neutron
      yum:
        name:
          - openstack-neutron
          - openstack-neutron-ml2
          - openstack-neutron-linuxbridge
          - ebtables
        state: present

- name: Deploy compute nodes
  hosts: compute
  become: yes

  tasks:
    - name: Install Nova compute
      yum:
        name: openstack-nova-compute
        state: present

    - name: Install Neutron agent
      yum:
        name:
          - openstack-neutron-linuxbridge
          - ebtables
          - ipset
        state: present

    - name: Start libvirtd
      systemd:
        name: libvirtd
        state: started
        enabled: yes

Heat编排模板

# openstack-stack.yaml
heat_template_version: 2018-08-31

description: OpenStack infrastructure template

parameters:
  key_name:
    type: string
    description: Name of keypair to assign to servers
    default: my-key

  image:
    type: string
    description: Name of image to use for servers
    default: cirros

  flavor:
    type: string
    description: Flavor to use for servers
    default: m1.small

  external_network:
    type: string
    description: Name of external network
    default: external

resources:
  # 创建私有网络
  private_network:
    type: OS::Neutron::Net
    properties:
      name: private-network

  # 创建私有子网
  private_subnet:
    type: OS::Neutron::Subnet
    properties:
      network_id: { get_resource: private_network }
      cidr: 192.168.100.0/24
      gateway_ip: 192.168.100.1
      dns_nameservers: [8.8.8.8, 8.8.4.4]

  # 创建路由器
  router:
    type: OS::Neutron::Router
    properties:
      external_gateway_info:
        network: { get_param: external_network }

  # 连接路由器和子网
  router_interface:
    type: OS::Neutron::RouterInterface
    properties:
      router_id: { get_resource: router }
      subnet_id: { get_resource: private_subnet }

  # 创建安全组
  security_group:
    type: OS::Neutron::SecurityGroup
    properties:
      description: Security group for web servers
      rules:
        - remote_ip_prefix: 0.0.0.0/0
          protocol: tcp
          port_range_min: 22
          port_range_max: 22
        - remote_ip_prefix: 0.0.0.0/0
          protocol: tcp
          port_range_min: 80
          port_range_max: 80
        - remote_ip_prefix: 0.0.0.0/0
          protocol: tcp
          port_range_min: 443
          port_range_max: 443

  # 创建Web服务器
  web_server:
    type: OS::Nova::Server
    properties:
      name: web-server
      image: { get_param: image }
      flavor: { get_param: flavor }
      key_name: { get_param: key_name }
      networks:
        - network: { get_resource: private_network }
      security_groups:
        - { get_resource: security_group }
      user_data:
        str_replace:
          template: |
            #!/bin/bash
            yum update -y
            yum install -y httpd
            systemctl start httpd
            systemctl enable httpd
            echo "<h1>Welcome to OpenStack</h1>" > /var/www/html/index.html
          params: {}

  # 创建浮动IP
  floating_ip:
    type: OS::Neutron::FloatingIP
    properties:
      floating_network: { get_param: external_network }

  # 关联浮动IP
  floating_ip_association:
    type: OS::Neutron::FloatingIPAssociation
    properties:
      floatingip_id: { get_resource: floating_ip }
      port_id: { get_attr: [web_server, addresses, { get_resource: private_network }, 0, port] }

outputs:
  server_private_ip:
    description: Private IP address of the web server
    value: { get_attr: [web_server, first_address] }

  server_public_ip:
    description: Public IP address of the web server
    value: { get_attr: [floating_ip, floating_ip_address] }

  website_url:
    description: URL of the website
    value:
      str_replace:
        template: http://host/
        params:
          host: { get_attr: [floating_ip, floating_ip_address] }

最佳实践和建议

安全最佳实践

OpenStack安全建议:
  网络安全:
    - 使用防火墙隔离管理网络
    - 启用TLS加密所有API通信
    - 实施网络分段和VLAN隔离
    - 定期更新安全组规则

  身份认证:
    - 启用多因子认证(MFA)
    - 使用强密码策略
    - 定期轮换密钥和证书
    - 实施最小权限原则

  数据保护:
    - 加密数据库和存储
    - 定期备份关键数据
    - 实施数据丢失防护(DLP)
    - 监控数据访问日志

  系统加固:
    - 定期安装安全补丁
    - 禁用不必要的服务
    - 使用SELinux或AppArmor
    - 实施入侵检测系统(IDS)

性能优化建议

性能优化策略:
  硬件优化:
    - 使用SSD存储提高I/O性能
    - 配置足够的内存避免交换
    - 使用高速网络连接
    - 启用CPU虚拟化扩展

  软件优化:
    - 调优数据库配置参数
    - 优化消息队列设置
    - 配置适当的工作进程数
    - 启用缓存机制

  网络优化:
    - 使用SR-IOV提高网络性能
    - 配置多队列网络接口
    - 优化MTU大小
    - 启用网络卸载功能

  存储优化:
    - 使用Ceph分布式存储
    - 配置存储池和放置组
    - 启用存储缓存
    - 优化存储网络

总结

OpenStack作为开源云计算平台，提供了构建私有云和混合云的完整解决方案。通过合理的架构设计、正确的部署配置和有效的运维管理，可以构建出稳定、高性能、安全的云计算环境。

关键要点

架构设计：
- 采用模块化设计，松耦合的服务架构
- 合理规划网络平面和节点角色
- 考虑高可用性和扩展性需求
部署实施：
- 遵循官方部署指南
- 使用自动化工具提高效率
- 进行充分的测试验证
运维管理：
- 建立完善的监控体系
- 定期进行维护和备份
- 实施性能优化措施
安全加固：
- 实施深度防御策略
- 加强身份认证和访问控制
- 定期进行安全评估
持续改进：
- 跟踪社区发展动态
- 参与开源社区贡献
- 不断优化和完善系统

掌握OpenStack的架构原理和运维技能，将帮助您构建和管理现代化的云计算基础设施，满足企业数字化转型的需求。

本文为OpenStack架构与维护管理指南，建议结合实际环境和最新官方文档进行实践。如有技术问题，欢迎交流讨论。